Linux process code segment measurement enhancement method based on dual-system architecture

Abstract

The invention discloses a Linux process code segment measurement enhancement method based on a dual-system architecture. The method comprises the following steps: S1, collecting a process reference value; and S2, adding a kernel key data monitoring mechanism. And S3, measuring the process in real time. Based on a trusted execution environment, a prototype system for measuring the process in real time when the Linux operating system runs is realized on the basis of trusted startup, and the prototype system provides a mechanism for immediately initiating real-time measurement when kernel key data operation is abnormal while periodically measuring a process code segment. Kernel key data comprises a system call table, an interrupt descriptor table and SELinux enabling and configuration information, and the scheme solves a certain TOCTTOU problem and enhances the security of the Linux system. According to the method, real-time measurement on the processes related to kernel key data operation during operation of the computing component operating system is completed, the safety of the system is enhanced in the operation process of the operating system, the credibility of a computing platform is guaranteed, and the method conforms to the active immune credible idea.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a Linux process code segment measurement enhancement method based on a dual-architecture. Background Art

[0002] Trusted computing is a comprehensive information security technology based on cryptography and with trusted chips as the source of trust to enhance the trustworthiness of computer systems. Its main idea is to establish a trusted root in the computing system, starting from the trusted root to the hardware platform, to the operating system, and then to the application, with each level being measured, authenticated, and trusted, and this trust is extended to the entire computer system, and management and control measures are taken to ensure the integrity of computing resources and the predictability of behavior, thereby improving the trustworthiness of the computing system.

[0003] In view of the defects of the international TCG trusted computing theory, my country summarized the relevant theories of information security technology and proposed the Trusted 3.0 theory, namely active immune trusted computing. Active immune trusted computing is a new computing model that performs security protection while performing operations. It adopts a dual system architecture of parallel computing and protection, performs security protection while performing calculations, so that the calculation results are always in line with expectations, and the entire calculation process is measurable and controllable without interference.

[0004] Active immune trusted computing establishes a dual architecture, including computing components and protection components. The original computing component function flow remains unchanged, and a logically independent protection component is established in parallel, which can actively implement trusted monitoring of computing components and realize trusted protection of the computing components throughout their life cycle. The protection component uses the TPCM connected to the computing component as the trusted root, starts before the computing component, actively measures and controls the computing component, and becomes the source of system trust. Secondly, a trusted software base is built, which takes over the trusted management mechanism and implements active monitoring under the control of security policy rules; it schedules and manages trusted hardware resources such as TPCM, and coordinates active measurement and control. As a trusted root, TPCM has active measurement functions, and integrates the trusted measurement root RTM, trusted storage root RTS, and trusted reporting root RTR in TPCM, which improves security.

[0005] Measurement is a trust quantification method that verifies the integrity of the measured object based on a benchmark value or evaluates the degree of fit between the entity behavior and the expected description. Dynamic measurement of processes is a technology that protects the integrity of processes during the operation of the operating system. It can prevent processes from being illegally tampered with or destroyed by malware, thereby improving the credibility and security of the operating system. The existing technology has some shortcomings in the dynamic measurement method of processes during the operation of the operating system. For periodic dynamic measurement, if the process measurement period is longer than the time when the process is attacked and the file system is destroyed, this measurement method may not be able to effectively defend against malicious processes attacking the Linux file system. Therefore, there is a need for a real-time measurement method for processes accessing the Linux file system that can alleviate the TOCTTOU problem.

[0006] The patent name of CN 114168934A is "A dynamic measurement method for kernel-level processes of LINUX", which is characterized in that a measurement file is imported into the kernel state of LINUX, and the measurement file includes a preset executable ELF file; when executing a program and obtaining the first code of the executable ELF file of the program, the first preset code is obtained at the same time, and if the first code is inconsistent with the first preset code, an alarm log is generated; when running the program and verifying the correctness of the bprm file of the program, the second code read from the executable ELF file is compared with the second preset code, and if they are inconsistent, an alarm log is generated; after the program calls the __schedule() function, the third code included in the process pointed to by the current macro is compared with the third preset code, and if they are inconsistent, an alarm log is generated. This method is aimed at the LINUX operating system and ensures that the executable ELF file is not tampered with during the entire execution process. However, this method does not adopt a dual system architecture, cannot guarantee the security of the trusted benchmark library, and does not conform to the active measurement concept of Trusted Computing 3.0.

[0007] The patent name of CN 113221117A is "A dynamic measurement method for a trusted computing platform based on a dual architecture", which is characterized in that a dynamic measurement method for a trusted computing platform based on a dual architecture is provided, and a secondary dynamic measurement engine is implemented in the kernel of the computing subsystem. The measurement engine measures the process code segment and the read-only data segment, and the measurement result is handed over to the measurement engine of the protection subsystem for measurement verification. The method intercepts the exec_binprm and copy_process hook subfunctions in the kernel of the computing subsystem, calculates the HASH value and hands it over to the reference value module of the protection subsystem and calculates the reference value. The process dynamic measurement engine of the computing subsystem traverses the process by scanning the kernel process linked list, and measures all processes one by one. The dynamic measurement method for a trusted computing platform based on a dual architecture provided by the method can reduce the allocation of large blocks of continuous physical memory and improve overall performance and stability. However, the method of measuring the process by periodically scanning the kernel process linked list, if the scanning period is longer than the time when the process is attacked and the file system is damaged, this measurement method may not be able to effectively defend against the attack.

[0008] The patent name of CN 117313143A is "DCS host computer key file protection method, system, equipment and storage medium", which is characterized by monitoring the file calling process through the Hook function and passing the file parameters of the file to be called; judging whether the file to be called is in the host computer's trusted file list through the file parameters, if it is not in the trusted file list, the call is successful; otherwise, judging whether the opening mode of the file to be called is read-only; if it is read-only, the call is successful; when opened in read-only mode, judging whether the trusted flag of the file to be called is the first set value; if it is not the first set value, the call is successful; otherwise, clearing the flag of the file to be called, calculating the trusted value of the file to be called and judging whether the calling file is credible; when the calling file is credible, the call is successful; otherwise, recovering the file corresponding to the calling file from the redundant server, and the call fails. However, this method only measures the file itself, and does not measure the trustworthiness of the process accessing the file, and cannot prevent malicious processes from destroying the file. Summary of the invention

[0009] The invention is based on a trusted execution environment and proposes a Linux system security enhancement method based on a dual architecture. On the basis of trusted startup, a prototype system for real-time measurement of processes when the Linux operating system is running is implemented. While periodically measuring process code segments, the prototype system provides a mechanism for immediately initiating real-time measurement when an abnormality occurs in the kernel key data operation. The kernel key data includes: system call table, interrupt descriptor table, SELinux enablement and configuration information. The solution solves certain TOCTTOU problems and enhances the security of the Linux system.

[0010] The purpose of the present invention is to complete the real-time measurement of kernel key data operation-related processes when the computing component operating system is running, on the basis of the device completing trusted startup and on the basis that the security protection component does not affect the computing component, to enhance the security of the system during the operation of the operating system, to ensure the credibility of the computing platform, and to comply with the active immune credibility concept.

[0011] The technical solution adopted by the present invention is a Linux process code segment measurement enhancement method based on a dual system, which mainly includes three steps:

[0012] S1: Process benchmark value collection. By deploying the LSM hook function in the Linux system of the computing component, obtaining the ELF file information in the Linux system, parsing the ELF header file to obtain the .text segment start address and size, the trusted benchmark value of the process is calculated and stored in the protection component.

[0013] S2: Add kernel key data monitoring mechanism. First, obtain the virtual address of the kernel key data stored in the Linux system; the kernel key data includes: system call table, interrupt descriptor table, SELinux enablement and configuration information. Monitor whether there is permission anomaly on the page where the virtual address of the kernel key data is located. If a write operation is performed on a read-only page, immediately start process measurement to check whether the process in the current Linux system has been modified.

[0014] S3: Real-time process measurement. When the Linux system initiates a process measurement request, it collects information through the task_struct structure pointer of the process, calculates the hash value as the measurement value, and sends it to the protection component to perform real-time trusted measurement on the process. The protection component returns the measurement result, and the computing component operating system determines whether to stop the process based on the measurement result. Real-time measurement includes two situations. One is that if there is an abnormality in the kernel key data operation, the process is measured; the other is to periodically measure all processes in the process tree.

[0015] Furthermore, based on the Trusted 3.0 technical solution, a dual-architecture deployment experimental environment is adopted, the computing component environment is the Linux system, and the protection component deploys TPCM, which has certain versatility and effectiveness.

[0016] Furthermore, after the Linux system completes the trusted boot, the Linux system will use the data isolation and protection mechanism of the hardware platform to establish a secure shared memory area between the computing component and the protection component for secure data communication between the two parties.

[0017] Furthermore, on the computing component, a metric agent is deployed on the Linux operating system, which includes the following core components:

[0018] Benchmark value collection module: This module registers the hook function bprm_check_security() to the kernel's exec() system call to obtain the benchmark value information of its code segment before the process is executed to ensure that its integrity is not damaged.

[0019] Kernel key data monitoring module: This module first obtains the location of the kernel key data in the system as the detection address, and then uses the Kprobe probe to intercept the do_page_fault function to detect page permission changes. The specific implementation is to use kprobes to dynamically insert hooks into the do_page_fault function, capture relevant information when a page fault occurs, and detect whether there is an abnormal operation at the detection address, such as writing to a read-only page. Trigger process metrics when an abnormal situation occurs.

[0020] Process metric collection module: responsible for obtaining the memory page address corresponding to the application process code segment through the process's mm_struct structure, collecting the real-time metric value of the process code segment in the memory by paging, and sending it to the protection component benchmark library.

[0021] In the protection component, a trusted benchmark library is deployed to store the benchmark values ​​of process code segments and provide a basis for measurement decisions through measurement value matching results.

[0022] Furthermore, the process of collecting process benchmark values ​​is as follows:

[0023] First, the bprm structure corresponding to the common application is hooked through the LSM hook function bprm_check_security() to obtain the file pointer, and the ELF header table is parsed to read the .text segment start address and .text segment size stored therein, thereby determining the start address and end address. Then the .text segment content is read page by page in units of 4KB, and the summary value is calculated through the SM3 hash algorithm to generate a corresponding summary value for each 4KB page, and the generated multiple summary values ​​are used as the reference value. The communication module forwards the calculated reference value to the protection component and stores it in the trusted reference library.

[0024] Furthermore, the kernel key data monitoring module establishment process is as follows:

[0025] First, in order to monitor kernel key data, the address where the kernel key data is stored in the system is obtained. The address is found by parsing the kernel symbol table. If the symbol is not exported, the address to be monitored is obtained by parsing kallsyms. The do_page_fault function is intercepted to detect page permission changes, and the Linux kernel's kprobes mechanism is used to dynamically insert a hook before do_page_fault is executed. do_page_fault is the core function for handling page faults. It is triggered when a process attempts to access an invalid or permission-mismatched virtual address. Kprobes allows the capture and analysis of page faults before the function is executed. When a page fault occurs, do_page_fault saves the virtual address that triggers the error in the CR2 register, and the hook obtains the address by reading CR2. The hook code further checks whether the address is the address to be monitored. If it is the address to be monitored, the hook will parse the page table entry PTE of the virtual address and determine whether the page has the correct access rights based on the information in the page table.

[0026] Furthermore, the real-time measurement process of the process is as follows.

[0027] When the hook function is triggered, the permission change of the monitored address is detected, and the page fault caused by the permission change or mismatch is detected. In this case, it means that the Linux system may be abnormal, and the Linux system will immediately measure all processes.

[0028] Specifically, the Linux system traverses all processes in the process tree, obtains the corresponding task_struct, and reads the mm_struct structure in the task_struct structure to read the virtual address range of the code segment when the process is running. Then obtain the physical address corresponding to the virtual address: the page table entry of each page records the mapping relationship between the virtual page and the physical page frame of the application process, reads the data item of the page table entry corresponding to the virtual page, and obtains the physical page corresponding to the virtual page by calculation. The physical page is mapped to the kernel vmalloc area through the kmap() function, and the kernel performs SM3 operation on the data in the page, and then measures the next virtual page data according to the process page table in the same process until all virtual pages of the process are processed. After processing, the communication module sends the measurement value to the trusted benchmark library of the protection component for measurement and returns the measurement result. If the measurement fails, the process has been tampered with and the process is stopped immediately.

[0029] Compared with existing technologies, purely relying on periodic dynamic measurement mechanisms has certain security risks. If the process measurement cycle is too long, for example, longer than the time required for an attacker to invade and damage the file system, then the attack behavior may occur between two measurements, thus causing the system security line to fail.

[0030] In order to make up for this deficiency, the present invention introduces a real-time monitoring mechanism based on page read and write permission access control on the basis of periodic process measurement. Specifically, the system will closely monitor the read and write permission changes of the pages where the kernel's key operation data is stored. When changes occur, the system may be attacked, and a process measurement is immediately started.

[0031] The system will parse kallsyms to obtain the kernel's key operation data addresses, including the system call table, interrupt descriptor table, SELinux enablement and configuration information, as the addresses to be monitored. And by registering the Kprobe probe, the do_page_fault function is intercepted. When a problem with the page read and write permissions is detected, the system will immediately start the process measurement module to perform emergency measurement and judgment on the suspicious process. If the judgment result shows that the measurement fails, it indicates that the process behavior has a security risk. The system will immediately terminate the process to prevent the potential threat from further expanding.

[0032] The present invention provides a new process dynamic measurement trigger mechanism, which avoids the TOCTTOU problem that may exist in static measurement and dynamic measurement, and enhances the security of the Linux system. In the present invention, the trusted benchmark library is stored in the protection component, and the measurement value verification function is completed by the protection component, which conforms to the basic idea of ​​active measurement of trusted computing 3.0. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is an architecture diagram of the Linux process code segment measurement enhancement method based on dual architecture.

[0034] Figure 2 The flowchart of the Linux process code segment measurement enhancement method based on dual architecture. DETAILED DESCRIPTION

[0035] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0036] Figure 1 This is an architecture diagram of the Linux process code segment measurement enhancement method based on dual architecture.

[0037] Figure 2 The flowchart of the Linux process code segment measurement enhancement method based on dual architecture.

[0038] The purpose of the present invention is to complete the real-time measurement of kernel key data operation-related processes when the computing component operating system is running, on the basis of the device completing trusted startup and on the basis that the security protection component does not affect the computing component, to enhance the security of the system during the operation of the operating system, to ensure the credibility of the computing platform, and to comply with the active immune credibility concept.

[0039] The solution of the present invention is a Linux process code segment measurement enhancement method based on a dual system, and the solution mainly includes three parts:

[0040] Part 1: Process benchmark value collection. By deploying the LSM hook function in the Linux system of the computing component, obtaining the ELF file information in the Linux system, parsing the ELF header file to obtain the starting address and size of the .text segment, the trusted benchmark value of the process is calculated and stored in the protection component.

[0041] Part 2: Adding kernel key data monitoring mechanism. First, obtain the virtual address of the kernel key data stored in the system. The kernel key data includes: system call table, interrupt descriptor table, SELinux enablement and configuration information, etc. Monitor whether there is permission anomaly on the page where the virtual address of the key data is located. If a write operation is performed on a read-only page, immediately start process measurement to check whether the process in the current system has been modified.

[0042] Part 3: Real-time process measurement. When the system initiates a process measurement request, it collects information through the task_struct structure pointer of the process, calculates the hash value as the measurement value, and sends it to the protection component to perform real-time trusted measurement on the process. The protection component returns the measurement result, and the computing component operating system determines whether to stop the process based on the measurement result. Real-time measurement mainly includes two situations. One is that if there is an abnormality in the kernel key data operation, the process is measured; the other is to periodically measure all processes in the process tree.

[0043] The present invention is based on the Trusted 3.0 technical solution, adopts a dual-architecture deployment experimental environment, the computing component environment is a Linux operating system, and the protection component deploys TPCM, which has certain versatility and effectiveness. The specific implementation includes the following process.

[0044] Process 1: Initialization phase.

[0045] After the operating system completes trusted boot, the system will use the data isolation and protection mechanism of the hardware platform to establish a secure shared memory area between the computing component and the protection component for secure data communication between the two parties.

[0046] On the computing component, a measurement agent is deployed in the Linux operating system kernel layer. The agent contains the following core components:

[0047] (1) Baseline value acquisition module: This module registers the hook function bprm_check_security() to the kernel's exec() system call to obtain the baseline value information of its code segment before the process is executed to ensure that its integrity is not damaged.

[0048] (2) Kernel key data monitoring module: This module first obtains the location where the kernel key data is stored in the system as the detection address, and then uses the Kprobe probe to intercept the do_page_fault function to detect page permission changes. The specific implementation is to use kprobes to dynamically insert hooks into the do_page_fault function, capture relevant information when a page fault occurs, and detect whether there is an abnormal operation at the detection address, such as writing to a read-only page. When an abnormal situation occurs, process measurement is triggered.

[0049] (3) Process metric collection module: responsible for obtaining the memory page address corresponding to the application process code segment through the process's mm_struct structure, collecting the real-time metric value of the process code segment in the memory by paging, and sending it to the protection component benchmark library.

[0050] In the protection component, a trusted benchmark library is deployed to store the benchmark values ​​of process code segments and provide a basis for measurement decisions through measurement value matching results.

[0051] Process 2: Process baseline collection.

[0052] First, the bprm structure corresponding to the common application is hooked through the LSM hook function bprm_check_security() to obtain the file pointer, and the ELF header table is parsed to read the .text segment start address and .text segment size stored therein, thereby determining the start address and end address. Then the .text segment content is read page by page in units of 4KB, and the summary value is calculated through the SM3 hash algorithm to generate a corresponding summary value for each 4KB page, and the generated multiple summary values ​​are used as the reference value. The communication module forwards the calculated reference value to the protection component and stores it in the trusted reference library.

[0053] Process 3: Establishment of kernel key data monitoring module.

[0054] First, in order to monitor kernel key data, it is necessary to obtain the address where the kernel key data is stored in the system. The address can be found by parsing the kernel symbol table. If the symbol is not exported, the address to be monitored can be obtained by parsing kallsyms. By intercepting the do_page_fault function to detect page permission changes, the Linux kernel's kprobes mechanism is used to dynamically insert a hook before do_page_fault is executed. do_page_fault is the core function for handling page faults. This function is triggered when a process attempts to access an invalid or permission-mismatched virtual address. kprobes allows us to capture and analyze the occurrence of page faults before the function is executed. When a page fault occurs, do_page_fault saves the virtual address that triggers the error in the CR2 register, and the hook obtains the address by reading CR2. The hook code can further check whether the address is the address to be monitored. If it is the address to be monitored, the hook will parse the page table entry (PTE) of the virtual address and determine whether the page has the correct access rights based on the information in the page table, such as whether it is read-only, whether it allows writing, and whether it is executable. In this way, we can monitor the permission changes of the monitored address in real time and detect page errors caused by permission changes or mismatches, such as writing to read-only pages, accessing non-executable pages, etc.

[0055] Process 4: Real-time measurement of processes.

[0056] When the hook function is triggered, the permission change of the monitored address is detected, and the page fault caused by the permission change or mismatch is detected. In this case, it means that the system may be abnormal, and the system will immediately measure all processes in the system.

[0057] Specifically, the system traverses all processes in the process tree, obtains the corresponding task_struct, and reads the mm_struct structure in the task_struct structure to read the virtual address range of the code segment when the process is running. Then obtain the physical address corresponding to the virtual address: the page table entry of each page records the mapping relationship between the virtual page and the physical page frame of the application process, reads the data item of the page table entry corresponding to the virtual page, and obtains the physical page corresponding to the virtual page by calculation. The physical page is mapped to the kernel vmalloc area through the kmap() function, and the kernel performs SM3 operation on the data in the page, and then measures the next virtual page data according to the same process according to the process page table until all virtual pages of the process are processed. After the processing is completed, the communication module sends the measurement value to the trusted benchmark library of the protection component for measurement and returns the measurement result. If the measurement fails, the process has been tampered with and the process is stopped immediately.

[0058] Relying purely on periodic dynamic measurement mechanisms has certain security risks. If the process measurement cycle is too long, for example, longer than the time it takes for an attacker to invade and damage the file system, then the attack may occur between two measurements, thus causing the system security line to fail.

[0059] In order to make up for this deficiency, the present invention introduces a real-time monitoring mechanism based on page read and write permission access control on the basis of periodic process measurement. Specifically, the system will closely monitor the read and write permission changes of the pages where the kernel's key operation data is stored. When changes occur, the system may be attacked, and a process measurement is immediately started.

[0060] The system will parse kallsyms to obtain the kernel's key operation data addresses, including the system call table, interrupt descriptor table, SELinux enablement and configuration information, as the addresses to be monitored. And by registering the Kprobe probe, the do_page_fault function is intercepted. When a problem with the page read and write permissions is detected, the system will immediately start the process measurement module to perform emergency measurement and judgment on the suspicious process. If the judgment result shows that the measurement fails, it indicates that the process behavior has a security risk. The system will immediately terminate the process to prevent the potential threat from further expanding.

[0061] The present invention provides a new process dynamic measurement trigger mechanism, which avoids the TOCTTOU problem that may exist in static measurement and dynamic measurement, and enhances the security of the Linux system. In the present invention, the trusted benchmark library is stored in the protection component, and the measurement value verification function is completed by the protection component, which conforms to the basic idea of ​​active measurement of trusted computing 3.0.

Claims

1. A Linux process code segment measurement enhancement method based on dual architecture, characterized in that: There are three steps involved: S1: Process benchmark value collection; By deploying the LSM hook function in the Linux system of the computing component, obtaining the ELF file information in the Linux system, parsing the ELF header file to obtain the starting address and size of the .text segment, the trusted reference value of the process is calculated and stored in the protection component; S2: Adding a kernel key data monitoring mechanism; first, obtaining the virtual address of the kernel key data stored in the Linux system; the kernel key data includes: system call table, interrupt descriptor table, SELinux enablement and configuration information; monitoring and operating whether the page where the virtual address of the kernel key data is located has permission anomalies; S3: Real-time measurement of processes; when the Linux system initiates a process measurement request, it collects information through the task_struct structure pointer of the process, calculates the hash value as the measurement value, and sends it to the protection component to perform real-time trusted measurement on the process. The protection component returns the measurement result, and the computing component operating system determines whether to stop the process based on the measurement result; real-time measurement includes two situations. One is that when an abnormality occurs in the kernel key data operation, the process is measured; the other is to periodically measure all processes in the process tree.

2. According to the dual-architecture Linux process code segment measurement enhancement method according to claim 1, it is characterized in that: Based on the Trusted 3.0 technology solution, a dual-architecture system is used to deploy the experimental environment. The computing component environment is the Linux system, and the protection component deploys TPCM.

3. The method for enhancing Linux process code segment measurement based on dual architecture according to claim 2, characterized in that: After the Linux system completes trusted boot, it will use the data isolation and protection mechanism of the hardware platform to establish a secure shared memory area between the computing component and the protection component for secure data communication between the two parties.

4. The method for enhancing Linux process code segment measurement based on dual architecture according to claim 3, characterized in that: On the computing component, a metric agent is deployed on the Linux operating system. The metric agent contains the following core components: Benchmark value collection module: This module registers the hook function bprm_check_security() to the kernel's exec() system call to obtain the benchmark value information of its code segment before the process is executed to ensure that its integrity is not damaged; Kernel key data monitoring module: This module first obtains the location where the kernel key data is stored in the system as the detection address, and then uses the Kprobe probe to intercept the do_page_fault function to detect page permission changes. The specific implementation is to use kprobes to dynamically insert hooks into the do_page_fault function, capture relevant information when a page fault occurs, and detect whether there is an abnormal operation at the detection address, such as writing to a read-only page; trigger process measurement when an abnormal situation occurs; Process metric value collection module: responsible for obtaining the memory page address corresponding to the application process code segment through the process's mm_struct structure, collecting the real-time metric value of the process code segment in the memory by paging, and sending it to the protection component benchmark library; In the protection component, a trusted benchmark library is deployed to store the benchmark values ​​of process code segments and provide a basis for measurement decisions through measurement value matching results.

5. The method for enhancing Linux process code segment measurement based on dual architecture according to claim 1, characterized in that: The process of collecting process benchmark values ​​is as follows: First, the bprm structure corresponding to the common application is hooked through the LSM hook function bprm_check_security() to obtain the file pointer, and the ELF header table is parsed to read the .text segment start address and .text segment size stored therein, so as to determine the start address and end address; then the .text segment content is read page by page in units of 4KB, and the summary value is calculated through the SM3 hash algorithm to generate a corresponding summary value for each 4KB page, and the generated multiple summary values ​​are used as the benchmark value; The communication module forwards the calculated reference value to the protection component and stores it in the trusted reference library.

6. The method for enhancing Linux process code segment measurement based on dual architecture according to claim 1, characterized in that: The process of establishing the kernel key data monitoring module is as follows: First, in order to monitor kernel key data, the address where the kernel key data is stored in the system is obtained. The address is found by parsing the kernel symbol table. If the symbol is not exported, the address to be monitored is obtained by parsing kallsyms; the do_page_fault function is intercepted to detect page permission changes, and the Linux kernel's kprobes mechanism is used to dynamically insert hooks before do_page_fault is executed; do_page_fault is the core function for handling page faults, and is triggered when a process attempts to access an invalid or permission-mismatched virtual address; kprobes allows the capture and analysis of page faults before the function is executed; when a page fault occurs, do_page_fault saves the virtual address that triggers the error in the CR2 register, and the hook obtains the address by reading CR2; the hook code further checks whether the address is the address to be monitored; if it is the address to be monitored, the hook parses the page table entry PTE of the virtual address and determines whether the page has the correct access rights based on the information in the page table.

7. The method for enhancing Linux process code segment measurement based on dual architecture according to claim 1, characterized in that: The real-time measurement process of the process is as follows; When the hook function is triggered, the permission change of the monitored address is detected, and the page fault caused by the permission change or mismatch is detected; in this case, it means that the Linux system may be abnormal, and the Linux system will immediately measure all processes; Specifically, the Linux system traverses all processes in the process tree, obtains the corresponding task_struct, and reads the virtual address range of the code segment when the process is running by reading the mm_struct structure in the task_struct structure; then obtains the physical address corresponding to the virtual address: the page table entry of each page records the mapping relationship between the virtual page and the physical page frame of the application process, reads the data item of the page table entry corresponding to the virtual page, and obtains the physical page corresponding to the virtual page by calculation; the physical page is mapped to the kernel vmalloc area through the kmap() function, and the kernel performs SM3 operation on the data in the page, and then measures the next virtual page data according to the process page table according to the same process until all virtual pages of the process are processed. After processing, the communication module sends the measurement value to the trusted benchmark library of the protection component for measurement and returns the measurement result. If the measurement fails, the process has been tampered with and the process is stopped immediately.

Images