Calibration system and method of kernel module, electronic equipment and readable medium

Abstract

The invention relates to a kernel module verification system and method, electronic equipment and a readable medium. The system comprises a user mode management module and a kernel mode management module. The user mode management module is used for acquiring a secret key of the current equipment by utilizing a preset algorithm when the equipment is started for the first time; calculating a first hash value of each unloaded module, and mapping and storing each unloaded module and the first hash value to obtain a first hash mapping table; encrypting the first Hash mapping table by using the key to obtain a second Hash mapping table; the kernel mode management module is used for acquiring a second Hash mapping table when normal startup of the operating system is detected; decrypting the second Hash mapping table by using a preset algorithm to obtain a first Hash mapping table; verifying the target kernel module according to the first Hash mapping table; and when the verification result indicates that the target kernel module passes the verification, loading the target kernel module. The problem that it is difficult to simply and quickly perform security verification on the kernel module to be loaded is solved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a kernel module verification system, method, electronic device and readable medium. Background Art

[0002] After the operating system kernel module is loaded into the kernel, it has the highest system permissions and can directly access the entire kernel space. Once a hacker successfully implants a kernel module, the entire system will be completely exposed. In a typical Linux-like operating system, hackers may obtain administrator privileges through vulnerabilities, then load kernel modules, and then steal system resources or secrets.

[0003] In order to improve the security defense capability of terminal devices, the kernel signature verification mechanism that comes with the operating system is currently used, including: specifying a private key file when compiling the kernel, signing the kernel module during the compilation process or manually calling the signature command, and specifying a private key to sign a specific file, and then using the certificate to verify the kernel module when the kernel starts. However, the private key used by this method is kept by the system publisher, and usually multiple devices in a batch use the same private key, which brings challenges in the maintenance and security of the private key. For example, when a third-party device manufacturer wants to add a driver to the system, the system publisher's signature is required, or if the private key of the device in the same batch is compromised, the entire batch of devices will be affected. In other words, the current kernel signature verification mechanism is difficult to simply and quickly perform security verification on the loaded kernel module.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The present application provides a kernel module verification system, method, electronic device and readable medium to solve the above-mentioned technical problem of "difficulty in simply and quickly performing security verification on the kernel module to be loaded".

[0006] According to one aspect of an embodiment of the present application, the present application provides a kernel module verification system, including: a user state management module and a kernel state management module; the user state management module is used to obtain a key of the current device using a preset algorithm at the first startup; calculate a first hash value of each unloaded module, and map and store each unloaded module with the first hash value to obtain a first hash mapping table; encrypt the first hash mapping table using the key to obtain and store a second hash mapping table; the kernel state management module is used to obtain the second hash mapping table when it is detected that the operating system is started normally; decrypt the second hash mapping table using a preset algorithm to obtain the first hash mapping table; when a loading request of a target kernel module is received, the target kernel module is verified according to the first hash mapping table to obtain a verification result; when the verification result indicates that the target kernel module passes the verification, the target kernel module is loaded.

[0007] According to one aspect of an embodiment of the present application, the present application provides a kernel module verification method, which is applied to a user-state management module, including: at the first startup, using a preset algorithm to obtain a key of the current device; calculating a first hash value of each unloaded module, and mapping each unloaded module with the first hash value and storing it to obtain a first hash mapping table; encrypting the first hash mapping table using the key to obtain and store a second hash mapping table, so that the kernel-state management module uses the second hash mapping table for verification when loading the kernel module.

[0008] Optionally, obtaining the key of the current device using a preset algorithm includes: obtaining a unique identification code of the current device; calculating a second hash value of the unique identification code using a preset algorithm; and determining the second hash value as the key of the current device.

[0009] Optionally, after storing the second hash mapping table, the method further includes: upon receiving an update request from the user, verifying the update request; when the update request passes the verification, decrypting the second hash mapping table to obtain the first hash mapping table; extracting update instructions from the update request, updating the first hash mapping table according to the update instructions to obtain a third hash mapping table; encrypting the third hash mapping table using a key to obtain and store a new second hash mapping table, so that the kernel state management module uses the new second hash mapping table for verification when loading the kernel module.

[0010] Optionally, the update request is verified, including: extracting user management information from the update request and calculating a third hash value of the user management information; comparing the third hash value with a pre-stored user hash value, wherein the user hash value is obtained by hashing the user management information input by the user at the first startup; if the third hash value is the same as the user hash value, it is determined that the update request has passed the verification.

[0011] According to one aspect of an embodiment of the present application, the present application provides a kernel module verification method, which is applied to a kernel state management module, including: when it is detected that the operating system is started normally, obtaining a second hash mapping table, wherein the second hash mapping table is generated by the user state management module by calculating the first hash value of each unloaded module; decrypting the second hash mapping table using a preset algorithm to obtain a first hash mapping table; when a loading request of a target kernel module is received, verifying the target kernel module according to the first hash mapping table to obtain a verification result; when the verification result indicates that the target kernel module has passed the verification, loading the target kernel module.

[0012] Optionally, the second hash mapping table is decrypted using a preset algorithm to obtain the first hash mapping table, including: obtaining a unique identification code of the current device; calculating a second hash value of the unique identification code using a preset algorithm; using the second hash value as a key, and using the key to decrypt the second hash mapping table to obtain the first hash mapping table.

[0013] Optionally, the target kernel module is verified according to the first hash mapping table to obtain a verification result, including: obtaining a target hash value of the target kernel module; determining whether the target hash value exists in the first hash mapping table; if the target hash value exists in the first hash mapping table, taking the target kernel module passing the verification as the verification result; if the target hash value does not exist in the first hash mapping table, taking the target kernel module failing the verification as the verification result.

[0014] According to another aspect of an embodiment of the present application, the present application provides a kernel module verification device, which is applied to a user-state management module, including: a first acquisition unit, used to obtain a key of the current device using a preset algorithm at the first startup; a calculation unit, used to calculate a first hash value of each unloaded module, and map and store each unloaded module with the first hash value to obtain a first hash mapping table; an encryption unit, used to encrypt the first hash mapping table using the key, obtain and store a second hash mapping table, so that the kernel-state management module uses the second hash mapping table for verification when loading the kernel module.

[0015] According to another aspect of an embodiment of the present application, the present application provides a kernel module verification device, which is applied to a kernel state management module, including: a second acquisition unit, used to obtain a second hash mapping table when it is detected that the operating system is started normally, wherein the second hash mapping table is generated by the user state management module by calculating the first hash value of each unloaded module; a decryption unit, used to decrypt the second hash mapping table using a preset algorithm to obtain the first hash mapping table; a verification unit, used to verify the target kernel module according to the first hash mapping table when a loading request of the target kernel module is received to obtain a verification result; a loading unit, used to load the target kernel module when the verification result indicates that the target kernel module has passed the verification.

[0016] According to another aspect of an embodiment of the present application, the present application provides an electronic device, including a memory, a processor, a communication interface and a communication bus, wherein the memory stores a computer program that can be run on the processor, the memory and the processor communicate through the communication bus and the communication interface, and the steps of the above method are implemented when the processor executes the computer program.

[0017] According to another aspect of an embodiment of the present application, the present application also provides a computer-readable medium having a non-volatile program code executable by a processor, and the program code enables the processor to execute the above method.

[0018] The above technical solution provided by the embodiment of the present application has the following advantages compared with the related art:

[0019] The present application provides a kernel module verification system, including: a user state management module and a kernel state management module; the user state management module is used to obtain a key of the current device by using a preset algorithm at the first startup; calculate the first hash value of each unloaded module, and map and store each unloaded module with the first hash value to obtain a first hash mapping table; encrypt the first hash mapping table by using the key to obtain and store a second hash mapping table; the kernel state management module is used to obtain the second hash mapping table when it is detected that the operating system is started normally; decrypt the second hash mapping table by using a preset algorithm to obtain the first hash mapping table; when receiving a loading request of a target kernel module, verify the target kernel module according to the first hash mapping table to obtain a verification result; when the verification result indicates that the target kernel module passes the verification, load the target kernel module. First, the first hash value of the unloaded module is mapped and saved as a first hash mapping table through the user state module, and then the hash mapping table is encrypted and stored using a unique key. Then, the target hash value of the target kernel module to be loaded is calculated through the kernel state management module, and then the target hash value is compared with the hash mapping table to complete the verification of the target kernel module, thereby solving the problem of difficulty in simply and quickly performing security verification on the kernel module to be loaded. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0022] Figure 1 A schematic diagram of an optional kernel module verification system provided according to an embodiment of the present application;

[0023] Figure 2 A schematic diagram of checking an optional kernel module according to an embodiment of the present application;

[0024] Figure 3 A flowchart of an optional verification method for a kernel module applied to a user-mode management module provided according to an embodiment of the present application;

[0025] Figure 4 A flowchart of a kernel module verification method optionally applied to a kernel state management module according to an embodiment of the present application;

[0026] Figure 5 A block diagram of an optional verification device for a kernel module applied to a user-mode management module according to an embodiment of the present application;

[0027] Figure 6 A block diagram of an optional kernel module verification device applied to a kernel state management module according to an embodiment of the present application;

[0028] Figure 7 A schematic diagram of an optional electronic device structure provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0030] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present application and have no specific meaning. Therefore, "module" and "component" can be used interchangeably.

[0031] After the operating system kernel module is loaded into the kernel, it has the highest system permissions and can directly access the entire kernel space. Once a hacker successfully implants a kernel module, the entire system will be completely exposed. In a typical Linux-like operating system, hackers may obtain administrator privileges through vulnerabilities, then load kernel modules, and then steal system resources or secrets.

[0032] In order to improve the security defense capability of terminal devices, the kernel signature verification mechanism that comes with the operating system is currently used, including: specifying a private key file when compiling the kernel, signing the kernel module during the compilation process or manually calling the signature command, and specifying a private key to sign a specific file, and then using the certificate to verify the kernel module when the kernel starts. However, the private key used by this method is kept by the system publisher, and usually multiple devices in a batch use the same private key, which brings challenges in the maintenance and security of the private key. For example, when a third-party device manufacturer wants to add a driver to the system, the system publisher's signature is required, or if the private key of the device in the same batch is compromised, the entire batch of devices will be affected. In other words, the current kernel signature verification mechanism is difficult to simply and quickly perform security verification on the loaded kernel module.

[0033] In order to solve the problems mentioned in the background technology, according to one aspect of the embodiments of the present application, a kernel module verification system is provided, such as Figure 1 As shown, it includes: a user state management module 102 and a kernel state management module 104;

[0034] The user state management module 102 is used to obtain the key of the current device using a preset algorithm when starting for the first time; calculate the first hash value of each unloaded module, and map and store each unloaded module with the first hash value to obtain a first hash mapping table; encrypt the first hash mapping table using the key to obtain and store a second hash mapping table;

[0035] The kernel state management module 104 is used to obtain a second hash mapping table when it is detected that the operating system is started normally; decrypt the second hash mapping table using a preset algorithm to obtain a first hash mapping table; when a loading request of a target kernel module is received, verify the target kernel module according to the first hash mapping table to obtain a verification result; when the verification result indicates that the target kernel module has passed the verification, load the target kernel module.

[0036] The present application verifies the kernel module to be loaded through a user-state management module and a kernel-state management module. The user-state management module is a management program in user state, and the kernel-state management module is a management program in user state.

[0037] When the user state management module is started for the first time, the initialization process is executed to obtain the hash value of the user password of the current user and store it on the disk, then obtain the hash value corresponding to the unloaded module, and generate a first hash mapping table, and then use the key exclusive to the current device to encrypt the first hash mapping table to obtain a second hash mapping table, and store the second hash mapping table on the disk.

[0038] The key is obtained based on the UUID (Universally Unique Identifier) ​​of the current device, so the key of each device is unique and there is no risk of mass cracking.

[0039] The unloaded modules in this application are the modules that the operating system depends on.

[0040] After the user-state management module stores the second hash mapping table in the disk, if the operating system starts normally, the kernel-state management module will extract the second hash mapping table from the disk, decrypt the second hash mapping table using the key of the current device, and store the decrypted first hash mapping table in the memory. Before the kernel module needs to be loaded, the kernel module is verified using the first hash mapping table, and only the kernel module that passes the verification is loaded.

[0041] Figure 2 The verification schematic diagram of the kernel module provided by the present application is shown in the figure. The user uses the user state management program A (corresponding to the user state management module of the present application) to first obtain the hash value of the unloaded module, then calculate the password P (corresponding to the key of the present application), and finally use the password P to encrypt the hash value of the unloaded module to obtain a hash value table and store it on the disk, wherein the module name and the hash value of the module are stored correspondingly (including module M1, module M2, module M3, etc.). The kernel state management B (corresponding to the kernel state management module of the present application) is used to calculate the password P and use the password P to decrypt and obtain the hash value table (corresponding to the first hash mapping table of the present application) when the system starts. At this time, if the module M1 to be loaded appears, the hash value of the module M1 is calculated, and then it is determined whether the hash value of the module M1 exists in the decrypted hash value table. If it exists, the module M1 is allowed to be loaded. If not, the module M1 is refused to be loaded.

[0042] The embodiment provided by the present application calculates summary information (i.e., hash value) for the kernel modules that the system depends on during initialization, saves the summary information as an encrypted kernel module summary information table (i.e., the second hash mapping table), and restarts the system. When the system starts, the kernel decrypts and loads the summary information table, calculates the summary for the kernel module to be loaded, and compares it with the value in the summary information table. If the same summary exists, loading is allowed, otherwise loading is prohibited.

[0043] According to another aspect of the embodiment of the present application, the present application provides a kernel module verification method, which is applied to a user mode management module, such as Figure 3 As shown, including:

[0044] Step 301, when starting for the first time, obtain the key of the current device using a preset algorithm;

[0045] Step 303, calculating the first hash value of each unloaded module, and mapping and storing each unloaded module with the first hash value to obtain a first hash mapping table;

[0046] Step 305: encrypt the first hash mapping table using the key to obtain and store the second hash mapping table, so that the kernel state management module uses the second hash mapping table for verification when loading the kernel module.

[0047] A specific kernel startup parameter is set (eg, mo_check=0). Under this parameter, the first hash value mapping table for verifying the kernel module has not yet been generated, and the kernel state management module will disable the verification function.

[0048] When the user-state management module is started for the first time, it enters the initialization process. The user enters the management password, and the user-state management module stores the hash value of the management password to the disk. The hash value of the management password is used to subsequently verify the user's identity. The identity authentication steps are explained below.

[0049] The preset algorithm is an algorithm for hash calculation. The present application obtains the unique key of the current device through hash calculation, and then uses the unique key to encrypt the first hash mapping table including the first hash values ​​of each unloaded module, and stores the encrypted second hash mapping table to the disk, so that the kernel state management module can call the second hash mapping table to verify the target kernel module to be loaded.

[0050] The encryption algorithm provided in the embodiment of the present application can be symmetric encryption, or it can be asymmetric encryption implemented with the assistance of hardware. The key is calculated using a preset algorithm, and the user does not need to worry about key storage or key maintenance.

[0051] As an optional embodiment, obtaining the key of the current device using a preset algorithm includes: obtaining a unique identification code of the current device; calculating a second hash value of the unique identification code using a preset algorithm; and determining the second hash value as the key of the current device.

[0052] A system command or an API (Application Programming Interface) may be used to obtain the unique identification code of the current device, and the unique identification codes of different devices are different.

[0053] The preset algorithm may be a SHA-256 hash algorithm.

[0054] For example, the SHA-256 hash algorithm is used to perform hash calculation on the unique identification code of the current device to obtain a 256-bit hash value, and the hash value is used as the key of the current device.

[0055] Since the key is obtained based on the unique identification code of the current device, the key of each device is unique, and its corresponding hash value is also unique, so there is no risk of batch cracking.

[0056] As an optional embodiment, after storing the second hash mapping table, the method also includes: upon receiving an update request from a user, verifying the update request; when the update request passes the verification, decrypting the second hash mapping table to obtain the first hash mapping table; extracting an update instruction from the update request, updating the first hash mapping table according to the update instruction to obtain a third hash mapping table; encrypting the third hash mapping table using a key to obtain and store a new second hash mapping table, so that the kernel state management module uses the new second hash mapping table for verification when loading the kernel module.

[0057] After the second hash mapping table is generated and stored for the first time, the user may also modify and update the second hash mapping table through the user state management module.

[0058] Receiving the user's update request actually means detecting that the user has started the login user state management module again. At this time, the update request needs to be verified, that is, the identity of the current user is verified. Only after the user identity is verified, the second hash mapping table is allowed to be updated.

[0059] Extract the update instruction from the update request and obtain the content of the update instruction, such as the hash value of which module is to be modified or the hash value of which module is to be added / deleted.

[0060] It is necessary to first extract the second hash mapping table from the disk and decrypt the second hash mapping table to obtain the first hash mapping table, store the first hash mapping table into the memory, and then update the first hash mapping table according to the content of the update instruction.

[0061] After the first hash mapping table is updated, the updated hash mapping table is encrypted using the key to obtain a new second hash mapping table, and the new second hash mapping table is used to replace the original second hash mapping table on the disk to complete the update of the mapping table. In this way, the kernel state management module can use the new second hash mapping table for verification when loading the kernel module.

[0062] By updating the second hash mapping table, the timeliness of the verification basis can be guaranteed.

[0063] As an optional embodiment, verifying the update request includes: extracting user management information from the update request and calculating a third hash value of the user management information; comparing the third hash value with a pre-stored user hash value, wherein the user hash value is obtained by hashing the user management information input by the user at the first startup; if the third hash value is the same as the user hash value, it is determined that the update request has passed the verification.

[0064] The user management information is the management password entered by the user. When the user starts to log in to the user state management module for the first time, the management password entered by the user will be obtained, and the user hash value of the management password will be calculated and stored in the disk.

[0065] When the user wants to update the second hash value mapping table, the update request needs to be verified to verify the user's identity. The user management information entered by the user this time is obtained, and the third hash value of the user management information is calculated, and then the third hash value is compared with the user hash value stored on the disk. If the third hash value is the same as the user hash value, it means that the user management information entered this time is the management password entered for the first time. At this time, the identity authentication is successful, and the user's modification of the second hash mapping table can be accepted.

[0066] Performing security verification on the user identity before updating the second hash mapping table can further improve the security of system operation.

[0067] The present application uses a verification method for a kernel module applied to a user-mode management module, including: at the first startup, using a preset algorithm to obtain a key of the current device; calculating the first hash value of each unloaded module, and mapping and storing each unloaded module with the first hash value to obtain a first hash mapping table; encrypting the first hash mapping table with a key to obtain and store a second hash mapping table, so that the kernel-mode management module uses the second hash mapping table for verification when loading the kernel module. By first mapping the first hash value of the unloaded module to save it as the first hash mapping table, and then encrypting and storing the hash mapping table with a unique key, the kernel-mode management module can directly use the hash mapping table to verify the kernel module before loading the kernel module, solving the problem of difficulty in simply and quickly performing security verification on the kernel module to be loaded.

[0068] According to another aspect of the embodiment of the present application, the present application provides a kernel module verification method, which is applied to the kernel state management module, such as Figure 4 As shown, including:

[0069] Step 401, when it is detected that the operating system is started normally, a second hash mapping table is obtained, wherein the second hash mapping table is generated by the user state management module by calculating the first hash value of each unloaded module;

[0070] Step 403: decrypt the second hash mapping table using a preset algorithm to obtain a first hash mapping table;

[0071] Step 405, upon receiving a loading request of a target kernel module, verifying the target kernel module according to the first hash mapping table to obtain a verification result;

[0072] Step 407: When the verification result indicates that the target kernel module passes the verification, the target kernel module is loaded.

[0073] After the user state management module writes the second hash mapping table to the disk, a specific kernel startup parameter (eg, mo_check=1) is set. During the normal startup of the operating system, if the kernel state management module detects mo_check=1, the verification function is started to obtain the second hash mapping table.

[0074] When receiving the loading request of the target kernel module, the target kernel module implants a custom interface in the system kernel module loading function. At this time, it is necessary to find a hash value that is the same as the target hash value of the target kernel module in the first hash mapping table. If it can be found, it means that the target kernel module has passed the verification and is allowed to be loaded. Otherwise, the loading is rejected, the module loading function is exited, and a failure result is returned.

[0075] As an optional embodiment, the second hash mapping table is decrypted using a preset algorithm to obtain the first hash mapping table, including: obtaining a unique identification code of the current device; calculating a second hash value of the unique identification code using a preset algorithm; using the second hash value as a key, and using the key to decrypt the second hash mapping table to obtain the first hash mapping table.

[0076] Decrypting the second hash mapping table by using a preset algorithm to obtain the first hash mapping table includes: obtaining a key by using the preset algorithm, and then decrypting the second hash mapping table by using the key to obtain the first hash mapping table.

[0077] Obtaining a key using a preset algorithm includes: obtaining a unique identification code of the current device; calculating a second hash value of the unique identification code of the current device using a preset algorithm (eg, SHA-256 algorithm); and determining the second hash value as the key.

[0078] It should be noted that, no matter it is a user-mode management module or a kernel-mode management module, the manner of decrypting the second hash mapping table to obtain the first hash mapping table is the same.

[0079] The user-state management module and the kernel-state management module can use the same algorithm to obtain the key, and the user does not need to participate in key calculation or key storage.

[0080] As an optional embodiment, the target kernel module is verified according to the first hash mapping table to obtain a verification result, including: obtaining a target hash value of the target kernel module; determining whether the target hash value exists in the first hash mapping table; if the target hash value exists in the first hash mapping table, then taking the target kernel module passing the verification as the verification result; if the target hash value does not exist in the first hash mapping table, then taking the target kernel module failing the verification as the verification result.

[0081] The target hash value of the target kernel module is obtained by hash calculation, and then the target hash value is searched in the first hash mapping table. If the target hash value exists, it means that the target kernel module is a trustworthy module and is allowed to be loaded. Otherwise, the loading is refused.

[0082] The kernel module verification method provided by this application is simple and easy, and the key of each device is different and unique, without the risk of maintenance difficulties and batch leakage.

[0083] The present application adopts a kernel module verification method applied to a kernel state management module, including: when detecting that the operating system is started normally, obtaining a second hash mapping table, wherein the second hash mapping table is generated by the user state management module by calculating the first hash value of each unloaded module; decrypting the second hash mapping table using a preset algorithm to obtain the first hash mapping table; when receiving a loading request of a target kernel module, verifying the target kernel module according to the first hash mapping table to obtain a verification result; when the verification result indicates that the target kernel module passes the verification, loading the target kernel module. By comparing the hash value of the target kernel module to be loaded with the hash value in the pre-stored second hash mapping table, the verification result of the target kernel module is obtained, which solves the problem that it is difficult to simply and quickly perform security verification on the kernel module to be loaded.

[0084] According to another aspect of the embodiment of the present application, the present application provides a kernel module verification device, which is applied to a user mode management module, such as Figure 5 As shown, including:

[0085] A first acquisition unit 502 is used to acquire a key of the current device using a preset algorithm when starting for the first time;

[0086] The calculation unit 504 is used to calculate the first hash value of each unloaded module, and map and store each unloaded module with the first hash value to obtain a first hash mapping table;

[0087] The encryption unit 506 is used to encrypt the first hash mapping table using the key to obtain and store the second hash mapping table, so that the kernel state management module uses the second hash mapping table for verification when loading the kernel module.

[0088] It should be noted that the first acquisition unit 502 in this embodiment can be used to execute step 301 in the embodiment of the present application, the calculation unit 504 in this embodiment can be used to execute step 303 in the embodiment of the present application, and the encryption unit 506 in this embodiment can be used to execute step 305 in the embodiment of the present application.

[0089] Optionally, the first acquisition unit 502 is further configured to acquire a unique identification code of the current device; calculate a second hash value of the unique identification code using a preset algorithm; and determine the second hash value as a key of the current device.

[0090] Optionally, the device also includes an update unit, which is used to verify the update request after storing the second hash mapping table and when receiving the update request from the user; when the update request passes the verification, decrypt the second hash mapping table to obtain the first hash mapping table; extract the update instruction from the update request, update the first hash mapping table according to the update instruction, and obtain the third hash mapping table; encrypt the third hash mapping table with a key to obtain and store a new second hash mapping table, so that the kernel state management module uses the new second hash mapping table for verification when loading the kernel module.

[0091] Optionally, the update unit is also used to extract user management information from the update request and calculate a third hash value of the user management information; compare the third hash value with a pre-stored user hash value, wherein the user hash value is obtained by hashing the user management information input by the user at the first startup; if the third hash value is the same as the user hash value, it is determined that the update request has passed the verification.

[0092] According to another aspect of the embodiment of the present application, the present application provides a kernel module verification device, which is applied to a kernel state management module, such as Figure 6 As shown, including:

[0093] A second acquisition unit 602 is used to acquire a second hash mapping table when it is detected that the operating system is started normally, wherein the second hash mapping table is generated by the user state management module by calculating the first hash value of each unloaded module;

[0094] A decryption unit 604, configured to decrypt the second hash mapping table using a preset algorithm to obtain a first hash mapping table;

[0095] The verification unit 606 is used to verify the target kernel module according to the first hash mapping table when receiving the loading request of the target kernel module to obtain a verification result;

[0096] The loading unit 608 is used to load the target kernel module when the verification result indicates that the target kernel module passes the verification.

[0097] It should be noted that the second acquisition unit 602 in this embodiment can be used to execute step 401 in the embodiment of the present application, the decryption unit 604 in this embodiment can be used to execute step 403 in the embodiment of the present application, the verification unit 606 in this embodiment can be used to execute step 405 in the embodiment of the present application, and the loading unit 608 in this embodiment can be used to execute step 407 in the embodiment of the present application.

[0098] Optionally, the decryption unit 604 is further configured to obtain a unique identification code of the current device; calculate a second hash value of the unique identification code using a preset algorithm; use the second hash value as a key, and use the key to decrypt the second hash mapping table to obtain the first hash mapping table.

[0099] Optionally, the verification unit 606 is also used to obtain a target hash value of the target kernel module; determine whether the target hash value exists in the first hash mapping table; if the target hash value exists in the first hash mapping table, the target kernel module passes the verification as a verification result; if the target hash value does not exist in the first hash mapping table, the target kernel module fails the verification as a verification result.

[0100] It should be noted here that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments.

[0101] According to another aspect of the embodiments of the present application, the present application provides an electronic device, such as Figure 7 As shown, it includes a memory 701, a processor 703, a communication interface 705 and a communication bus 707. The memory 701 stores a computer program that can be run on the processor 703. The memory 701 and the processor 703 communicate through the communication interface 705 and the communication bus 707. When the processor 703 executes the computer program, the steps of the above method are implemented.

[0102] The memory and processor in the above electronic device communicate via a communication bus and a communication interface. The communication bus may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus may be divided into an address bus, a data bus, a control bus, etc.

[0103] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0104] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0105] According to another aspect of the embodiments of the present application, a computer-readable medium having a non-volatile program code executable by a processor is provided.

[0106] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0107] When the embodiments of the present application are specifically implemented, reference may be made to the above-mentioned embodiments, which have corresponding technical effects.

[0108] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0109] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0110] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0111] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0112] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0113] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0114] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0115] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk. It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, article or device. Without more constraints, an element defined by the phrase "comprising a..." does not exclude the existence of other identical elements in the process, method, article or apparatus comprising the element.

[0116] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A kernel module verification system, characterized in that: include: User state management module and kernel state management module; The user state management module is used to obtain the key of the current device using a preset algorithm when starting for the first time; Calculate a first hash value of each unloaded module, and map and store each of the unloaded modules with the first hash value to obtain a first hash mapping table; Encrypting the first hash mapping table using the key to obtain and store a second hash mapping table; The kernel state management module is used to obtain the second hash mapping table when it is detected that the operating system is started normally; Decrypting the second hash mapping table using the preset algorithm to obtain the first hash mapping table; When a loading request of a target kernel module is received, the target kernel module is verified according to the first hash mapping table to obtain a verification result; when the verification result indicates that the target kernel module passes the verification, the target kernel module is loaded.

2. A kernel module verification method, characterized in that: Applied to the user state management module, the method includes: At the first startup, the key of the current device is obtained using a preset algorithm; Calculate a first hash value of each unloaded module, and map and store each of the unloaded modules with the first hash value to obtain a first hash mapping table; The first hash mapping table is encrypted using the key to obtain and store a second hash mapping table, so that the kernel state management module uses the second hash mapping table for verification when loading the kernel module.

3. The method according to claim 2, characterized in that The method of obtaining the key of the current device by using a preset algorithm includes: Obtaining a unique identification code of the current device; Calculating a second hash value of the unique identification code using the preset algorithm; The second hash value is determined as the key of the current device.

4. The method according to claim 2, characterized in that: After storing the second hash mapping table, the method further includes: Upon receiving an update request from a user, verifying the update request; In a case where the update request passes the verification, decrypting the second hash mapping table to obtain the first hash mapping table; Extracting an update instruction from the update request, and updating the first hash mapping table according to the update instruction to obtain a third hash mapping table; The third hash mapping table is encrypted using the key to obtain and store a new second hash mapping table, so that the kernel state management module uses the new second hash mapping table for verification when loading the kernel module.

5. The method according to claim 4, characterized in that The verifying the update request includes: Extracting user management information from the update request, and calculating a third hash value of the user management information; Compare the third hash value with a pre-stored user hash value, wherein the user hash value is obtained by performing a hash calculation on user management information input by the user when the user is first started; If the third hash value is the same as the user hash value, it is determined that the update request passes the verification.

6. A kernel module verification method, characterized in that: Applied to the kernel mode management module, the method includes: When it is detected that the operating system is started normally, a second hash mapping table is obtained, wherein the second hash mapping table is generated by the user state management module by calculating the first hash value of each unloaded module; Decrypting the second hash mapping table using a preset algorithm to obtain a first hash mapping table; When receiving a loading request of a target kernel module, verifying the target kernel module according to the first hash mapping table to obtain a verification result; When the verification result indicates that the target kernel module passes the verification, the target kernel module is loaded.

7. The method according to claim 6, characterized in that The decrypting the second hash mapping table by using a preset algorithm to obtain a first hash mapping table includes: Get the unique identification code of the current device; Calculating a second hash value of the unique identification code using the preset algorithm; The second hash value is used as a key, and the second hash mapping table is decrypted using the key to obtain the first hash mapping table.

8. The method according to claim 6, characterized in that The verifying the target kernel module according to the first hash mapping table to obtain a verification result includes: Obtaining a target hash value of the target kernel module; Determine whether the target hash value exists in the first hash mapping table; If the target hash value exists in the first hash mapping table, the target kernel module passes the verification as the verification result; if the target hash value does not exist in the first hash mapping table, the target kernel module fails the verification as the verification result.

9. An electronic device, comprising a memory, a processor, a communication interface and a communication bus, wherein the memory stores a computer program that can be run on the processor, and the memory and the processor communicate through the communication bus and the communication interface, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 2 to 5 or 6 to 8 are implemented.

10. A computer readable medium having a non-volatile program code executable by a processor, characterized in that: The program code enables the processor to execute the method of any one of claims 2 to 5 or 6 to 8.

Images