Program processing device, program processing method, and program processing program

Abstract

A program processing device (100) is provided with an address mask table generation unit (120), a countermeasure application unit (130), and an execution unit (140). An address mask table generation unit (120) generates an address mask table (155) on the basis of setting data (158). A countermeasure application unit (130) assigns a call wrapper to a program, specifies a migration process for performing context switching from the program, and replaces the migration process with a process for specifying a physical address at which the call wrapper is expanded and skipping. The execution unit (140) refers to the address mask table (155) during execution of the program to which the countermeasures have been applied, and performs logical address allocation while securing the memory. The execution unit (140) uses a jump address obtained by demasking the jump address obtained by referring to the address mask table (155) in accordance with the set separation setting instead of directly obtaining the jump address during the migration process.

Description

Technical Field

[0001] The present disclosure relates to a program processing device, a program processing method, and a program processing program. Background Art

[0002] TEE is a secure execution environment that uses the processor's memory protection mechanism to control access between applications. TEE is the abbreviation of Trusted Execution Environment. For example, by executing security-critical applications on TEE, even if a vulnerability is found in a library or application, the impact of the vulnerability can be prevented from spreading to security-critical applications.

[0003] TEE is a mechanism to prevent software attacks. On the other hand, for TEE environments in devices that can be physically accessed, such as embedded devices, the risk of physical attacks called fault attacks has been pointed out. Fault attacks are attacks that actively act on the processor to cause command skipping or data errors, thereby causing temporary calculation or data errors. In non-patent document 1, it is shown that the access permission settings of the memory protection mechanism are invalidated by a physical attack method called a fault injection attack, thereby enabling memory access that was originally not allowed.

[0004] Prior art literature

[0005] Non-patent literature

[0006] Non-patent document 1: Nashimoto, Shoei, et al. "Bypassing Isolated Execution on RISC-Vusing Side-Channel-Assisted Fault-Injection and Its Countermeasure." IACR Transactions on Cryptographic Hardware and Embedded Systems (2022): 28-68. Summary of the invention

[0007] Problems to be solved by the invention

[0008] For example, in order to prevent physical attacks on TEE, there is a method of masking the entry point using the value of the protection object, that is, the set value of the access permission, and unmasking during execution to calculate the original entry point.

[0009] However, in the case of an OS that dynamically loads and maps a program as a protection object, the separation setting changes dynamically each time it is executed, so the mask processing of the entry point cannot be used. OS is an abbreviation of Operating System. An OS that dynamically loads and maps a program as a protection object refers to an OS that reads the program into memory, secures physical memory, and allocates logical addresses, thereby enabling the program to be executed.

[0010] The present disclosure aims to prevent unauthorized memory access by calculating migration to a program based on a jump address masked with a previously expected separation setting value.

[0011] Means for solving problems

[0012] The program processing device of the present disclosure has:

[0013] Setup data that specifies physical and logical addresses for a program or memory used by a program;

[0014] Call the wrapper, which is the function that performs the context switch;

[0015] an address mask table generating unit, which generates an address mask table according to the setting data;

[0016] a countermeasure application unit that adds the call wrapper to a program, determines a migration process for context switching from the program, and replaces the migration process with a process for jumping to a physical address where the call wrapper is expanded; and

[0017] An execution unit, which, during the execution of a program to which the countermeasure is applied, refers to the address mask table to secure memory and perform logical address allocation, and instead of directly obtaining a jump address in the migration process, changes the jump address obtained by referring to the address mask table to use a jump address that is demasked according to a set separation setting.

[0018] Effects of the Invention

[0019] In the present disclosure, even in an OS environment that dynamically loads and maps a program to be protected, by using an address mask table to load and map the program, the separation setting, the entry point, and the jump address can be fixed. In the present disclosure, since the migration to the program is calculated based on the jump address masked with the value of the separation setting expected in advance, when the separation setting becomes an unexpected value due to an attack, etc., the migration will not be correctly performed and the attack will not be established. Therefore, according to the program processing device of the present disclosure, it is possible to prevent unauthorized memory access. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a diagram showing a configuration example of a program processing device according to the first embodiment.

[0021] Figure 2 This is a diagram showing a configuration example of an address mask table according to the first embodiment.

[0022] Figure 3 This is a flowchart showing the operation of the program processing device according to the first embodiment.

[0023] Figure 4 This is a flowchart showing the operation of the address mask table generating unit according to the first embodiment.

[0024] Figure 5 This is a diagram showing an example of separation setting for realizing access control according to the first embodiment.

[0025] Figure 6 This is a flowchart showing the operation of the countermeasure application unit according to the first embodiment.

[0026] Figure 7 This is a flowchart showing the operation of the execution unit according to the first embodiment.

[0027] Figure 8 This is a diagram showing the process from the change of the separation setting to the execution of the jump address demasking process according to the first embodiment.

[0028] Fig. 9 This is a diagram showing a configuration example of a program processing device 100 according to the second embodiment.

[0029] Fig.10 This is a flowchart showing the operation of the program processing device 100 according to the second embodiment.

[0030] Fig.11 This is a flowchart showing the operation of the address mask table generating unit according to the second embodiment.

[0031] Fig.12 This is a flowchart showing the operation of the program countermeasure application unit of the second implementation mode.

[0032] Fig.13 This is a flowchart showing the operation of the security monitor countermeasure application unit of the second implementation mode. DETAILED DESCRIPTION

[0033] The present embodiment is described below using the accompanying drawings. In each figure, the same or corresponding parts are marked with the same reference numerals. In the description of the embodiment, the description of the same or corresponding parts is appropriately omitted or simplified. The arrows in the figure mainly represent data flow or processing flow.

[0034] Implementation Method 1

[0035] ***Description of the structure***

[0036] Figure 1 It is a diagram showing a configuration example of the program processing device 100 according to the present embodiment.

[0037] The program processing device 100 is a computer including a processor 101, a main storage memory 102, a storage device 103, an input / output interface 104, and a storage 105. These hardware are connected to each other via signal lines.

[0038] The processor 101 is an IC that performs calculation processing and controls other hardware.

[0039] The processor 101 has an operation register, loads commands and data into the operation register, and executes data processing according to the commands.

[0040] For example, the processor 101 is a CPU or an FPGA.

[0041] IC is the abbreviation of Integrated Circuit.

[0042] CPU is the abbreviation of Central Processing Unit.

[0043] FPGA is the abbreviation of Field Programable Gated Array.

[0044] The processor 101 is also called a processing circuit. That is, the functions of the program processing device 100 are implemented by the processing circuit.

[0045] The main storage memory 102 is at least one of a volatile storage device and a nonvolatile storage device. A specific example of a volatile storage device is a RAM. A specific example of a nonvolatile storage device is a ROM, a HDD, or a flash memory.

[0046] RAM is the abbreviation of Random Access Memory.

[0047] ROM is the abbreviation of Read Only Memory.

[0048] HDD is the abbreviation of Hard Disk Drive.

[0049] Hereinafter, the address refers to the memory address of the main storage memory 102 .

[0050] The storage device 103 is a nonvolatile storage device for storing data. Specific examples of the nonvolatile storage device are ROM, HDD, or flash memory.

[0051] The input / output interface 104 is an interface for input / output. For example, the input / output interface 104 is a serial communication interface or a debug interface. Specific examples of the serial communication interface are SPI, UART, or I2C. Specific examples of the debug interface are JTAG or JWD.

[0052] SPI is the abbreviation of Serial Peripheral Interface.

[0053] UART is the abbreviation of Universal Asynchronous Receiver Transmitter.

[0054] I2C is the abbreviation of Inter-Integrated Circuit.

[0055] JTAG is the abbreviation of Joint Test Action Group.

[0056] SWD is the abbreviation of Serial Wire Debug.

[0057] The memory 105 is a storage device.

[0058] A specific example of the memory 105 is a memory or a register.

[0059] The memory 105 stores data accessed by the processor 101 .

[0060] The memory 105 may be a part of the main storage memory 102 , a part of the storage device 103 , a register of the processor 101 , or an independent storage device.

[0061] The processor 101 includes elements such as a memory monitoring unit 110 , an address mask table generating unit 120 , a countermeasure applying unit 130 , and an executing unit 140 .

[0062] The memory monitoring unit 110 is implemented by hardware such as a memory monitoring unit built into a processor. For example, the memory monitoring unit 110 is a memory management unit that converts a logical address processed by software and a physical address processed by hardware, or a memory protection unit that prevents illegal memory access by a program.

[0063] The address mask table generating unit 120 , the countermeasure applying unit 130 , and the executing unit 140 are implemented by software.

[0064] The word "unit" in each of the memory monitoring unit 110, the address mask table generating unit 120, the countermeasure application unit 130 and the execution unit 140 may be replaced by "circuit", "step", "process", "processing" or "line". The program processing procedure causes the computer to perform memory monitoring processing, address mask table generating processing, countermeasure application processing and execution processing. The word "processing" in the memory monitoring processing, address mask table generating processing, countermeasure application processing and execution processing may be replaced by "program", "program product", "computer-readable storage medium storing a program" or "computer-readable recording medium recording a program". In addition, the program processing method is a method performed by executing the program processing procedure by the program processing device 100.

[0065] The program processing program may be provided by being stored in a computer-readable recording medium. In addition, the program processing program may be provided as a program product.

[0066] The storage device 103 stores:

[0067] An untrusted program 150 that operates through the processor 101;

[0068] Single or multiple trusted programs 151;

[0069] The countermeasure program 152 that executes the address mask table generation unit 120, the countermeasure application unit 130, and the execution unit 140;

[0070] The countermeasure-applied untrusted program 153 and the countermeasure-applied trusted program 154 generated by the countermeasure program 152 executing the countermeasure application unit 130;

[0071] an address mask table 155 generated by the address mask table generation unit 120 executed by the countermeasure program 152;

[0072] A security monitor 156 for changing the separation setting of the memory monitoring unit 110 required for executing the countermeasure applied untrusted program 153 and the countermeasure applied trusted program 154;

[0073] The countermeasure program 152 executes a call wrapper 157 required by the address mask table generation unit 120, the countermeasure application unit 130, and the execution unit 140; and

[0074] The countermeasure program 152 executes the setting data 158 required by the address mask table generating unit 120 .

[0075] The storage device 103 stores an operating system, a network driver, and a storage driver.

[0076] like Figure 1 As shown, the software and data stored in the storage device 103 are read into the main storage memory 102 .

[0077] The untrusted program 150 is an untrusted program executed on a normal OS.

[0078] The trusted program 151 is a trustworthy program executed in a secure environment (TEE).

[0079] The trusted program 151 is a protection target program that is a protection target.

[0080] The countermeasure-applied untrusted program 153 and the countermeasure-applied trusted program 154 are programs for which the countermeasure program 152 has implemented the attack countermeasure.

[0081] The security monitor 156 is a program that mainly changes the separation setting stored in the memory 105 and performs context switching between the countermeasure applied untrusted program 153 and the countermeasure applied trusted program 154 .

[0082] The security monitor 156 is a program that generally operates with higher authority than the countermeasure applied untrusted program 153 , the countermeasure applied trusted program 154 , and the OS.

[0083] The untrusted program 150 , the trusted program 151 , the countermeasure program 152 , the countermeasure-applied untrusted program 153 , the countermeasure-applied trusted program 154 , and the security monitor 156 of this embodiment are execution modules in an executable format.

[0084] The execution module is recorded in binary code, which is recorded in a machine language that can be interpreted by the processor 101.

[0085] Figure 1 The state is shown when the processor 101 reads the countermeasure program 152 into the main storage memory 102 and immediately before the execution unit 140 executes the program.

[0086] The countermeasure program 152 is a program for strengthening the security of the trusted program 151. Therefore, the countermeasure is applied to the untrusted program 150 as well.

[0087] The countermeasure program 152 is a program that realizes the functions of the address mask table generation unit 120 , the countermeasure application unit 130 , and the execution unit 140 .

[0088] The call wrapper 157 is a function that wraps the context switch (provides a certain process in an abstract manner) assigned by the proxy to fix the address of the entry point. In short, the call wrapper 157 executes an environment call exception command for calling the security monitor 156.

[0089] The call wrapper 157 is an execution module in the form of a library or the like.

[0090] The memory 105 stores separation settings. The separation settings refer to values ​​corresponding to the physical memory used by the untrusted program 153 with countermeasures applied, the trusted program 154 with countermeasures applied, the security monitor 156, and the shared memory shared by these programs. That is, it is a setting value for the memory monitoring unit 110 to monitor memory access based on the context state using these physical addresses as objects. For example, there are physical addresses and their ranges and access rights as protection objects. Access rights refer to permissions for executing / reading / writing a certain memory.

[0091] The setting data 158 is a setting value for generating the address mask table 155 .

[0092] Specifically, it means:

[0093] Mapping the logical address of the call wrapper 157 executed by the untrusted program 153 to which the countermeasure has been applied;

[0094] Mapping the logical address of the countermeasure applied trusted program 154;

[0095] The physical addresses used in shared memory; and

[0096] The size that may be used as shared memory varies (e.g., 128MB or 1GB, etc.).

[0097] The countermeasure application unit 130 includes a migration determination unit 111 , a migration process replacement unit 112 , and a countermeasure link unit 113 . These are auxiliary functions for realizing the countermeasure application unit 130 .

[0098] The execution unit 140 includes a memory securing unit 141, a loading unit 142, a jump address demasking unit 143, and an execution-time linking unit 144. These are auxiliary functions for implementing the functions of the execution unit 140 by extending a part of the processing of the security monitor 156 or the OS.

[0099] Figure 2 It is a diagram showing a configuration example of the address mask table 155 according to the present embodiment.

[0100] Here, before explaining the action, use Figure 2 A specific example of how to use the address mask table 155 will be described.

[0101] exist Figure 2 , the address mask table 155 and the state of the main storage memory 102 when the countermeasure-applied untrusted program 153 and the countermeasure-applied trusted program 154 are executed using the address mask table 155 are shown.

[0102] In the address mask table 155, the number (ID) and size (size) can be specified, and the logical address, physical address, mask entry point, mask return address, and purpose can be referenced. Each piece of information such as the logical address, physical address, mask entry point, mask return address, and purpose is also called content. The logical address is used as a logical address of the call wrapper 157 that maps the call of the countermeasure-applied untrusted program 153, or a logical address of the trusted program 154 that maps the countermeasure-applied. The physical address indicates the base physical address used by the shared memory (the starting address of the physical memory used).

[0103] The security monitor 156 has been deployed in the main storage memory 102.

[0104] The countermeasure-applied untrusted program 153 is loaded and mapped when executed, so the physical address and the logical address are automatically assigned. The call wrapper 157 refers to the logical address and assigns it from the row of ID=0 of the address mask table 155. The physical address can be an automatically secured area. In addition, the value after demasking the mask return address of this row indicates a restore command to the call source routine of the call wrapper 157.

[0105] The countermeasure applied trusted program 154 is loaded and mapped with reference to the address mask table 155 during the operation of the countermeasure applied untrusted program 153. As with the countermeasure applied untrusted program 153, the physical address to be used is allocated with reference to the automatically secured area, and the logical address to be mapped is allocated with reference to the row of ID=1 of the address mask table 155. The value after demasking the mask entry point of the row indicates the entry point before the call wrapper 157 is given to the start of the countermeasure applied trusted program 154. Similarly, the value after demasking the mask return address indicates the restore command to the call source routine of the call wrapper 157.

[0106] The shared memory specifies the physical address and the area is ensured. The logical address to be mapped can be automatically ensured. In addition, it is assumed that the size of the shared memory has variations according to the action of the countermeasure applied untrusted program 153. Therefore, the mask jump address of the countermeasure applied trusted program 154 has multiple variations.

[0107] ***Description of the action***

[0108] Next, the operation of the program processing device 100 of this embodiment will be described. The operation procedure of the program processing device 100 corresponds to the program processing method. In addition, the program that realizes the operation of the program processing device 100 corresponds to the program processing program.

[0109] Figure 3This is a flowchart showing the operation of the program processing device 100 according to the present embodiment.

[0110] It is assumed that the safety monitor 156 has already completed operation and the value of the setting data 158 has already been set before the operation starts.

[0111] Figure 3 The following diagram shows the operation of the program processing device 100 when the countermeasure program 152 is executed.

[0112] In step S110, the countermeasure program 152 executes the function of the address mask table generation unit 120. The address mask table generation unit 120 generates an address mask table 155 based on the setting data 158 that specifies the physical address and the logical address for the program or the memory used by the program. In the generation of the address mask table 155, the setting data 158 and the call wrapper 157 are input, and the address mask table 155 is output.

[0113] In step S120, the countermeasure program 152 executes the function of the countermeasure application unit 130. The countermeasure application unit 130 assigns the call wrapper 157, which is a function for performing context switching, to the program, and determines the migration process for performing context switching from the program. Then, the countermeasure application unit 130 replaces the migration process with a process for jumping to the physical address where the call wrapper 157 is expanded. In the application of the countermeasure, the address mask table 155, the call wrapper 157, the untrusted program 150, and the trusted program 151 are input, and the untrusted program 153 to which the countermeasure has been applied and the trusted program 154 to which the countermeasure has been applied are output.

[0114] Specifically, the countermeasure link unit 113 adds the call wrapper 157 to the program. The migration determination unit 111 determines the process of context switching from the program. The migration process replacement unit 112 replaces the determined migration process with a process that jumps to the address where the call wrapper 157 is expanded.

[0115] In step S130, the countermeasure program 152 executes the function of the execution unit 140. In the process of executing the program to which the countermeasure is applied, the execution unit 140 refers to the address mask table 155 to secure memory and perform logical address allocation. Then, instead of directly obtaining the jump address in the migration process, the execution unit 140 changes to use the jump address obtained by referring to the address mask table 155 and demasking the jump address according to the set separation setting. In the execution of the program, the address mask table 155, the call wrapper 157, the untrusted program 153 to which the countermeasure is applied, and the trusted program 154 to which the countermeasure is applied are used as inputs, and the processing of the untrusted program 153 to which the countermeasure is applied and the trusted program 154 to which the countermeasure is applied is executed. In addition, the security monitor 156 is also explicitly represented as an input in the flowchart, but as described above, it is assumed to have been executed in advance.

[0116] Specifically, the memory securing unit 141 and the loading unit 142 secure memory and allocate logical addresses by referring to the address mask table 155 during execution of the program to which the countermeasure is applied. The jump address demasking unit 143 demasks the jump address obtained by referring to the address mask table 155 according to the set separation setting, instead of directly obtaining the jump address in the migration process of the context switch.

[0117] Normally, the jump address is obtained from a certain memory. On the other hand, in the countermeasure of this embodiment, the following processing is implemented.

[0118] 1) Refer to the address mask table to obtain the masked jump address.

[0119] 2) Demasking is performed based on the set separation settings (specifically, registers such as pmpcfg and pmpadr described later).

[0120] Through the above process, the jump address that is the same as usual is restored. In the jump address demasking unit 143, such processing is performed.

[0121] <Address Mask Table Generation Process>

[0122] Figure 4 This is a flowchart showing the operation of the address mask table generating unit 120 according to the present embodiment.

[0123] based on Figure 4 , describing the operation of the address mask table generating unit 120 (step S110).

[0124] The purpose of the address mask table generation unit 120 is to generate Figure 2 The address mask table generation unit 120 generates the address mask table 155 by making a plurality of combinations of physical addresses and logical addresses of programs or memory used by the programs vary.

[0125] Setting data 158 is Figure 2 The logical addresses and physical addresses shown, as well as the size change of the shared memory, are the logical addresses of the call wrapper 157 that maps the call of the untrusted program 150, the logical addresses assigned to each trusted program 151, the physical address of the shared memory and its size change.

[0126] In step S111, the address mask table generation unit 120 initializes the address mask table 155. Specifically, Figure 2 All rows of address mask table 155 are shown set to empty.

[0127] In step S112 , the address mask table generation unit 120 calculates the size of the call wrapper and the return address.

[0128] The size of the call wrapper is the size of the execution module.

[0129] The return address is an address at which a restore command to the call source routine is configured in the call wrapper, for example, a command such as a jump command to an address indicated by a return address register of a processor.

[0130] In step S113, the address mask table generation unit 120 repeatedly executes the process by the number of changes in the size of the shared memory indicated by the setting data 158. This means that the process is repeatedly executed from iteration j=1 to j=(number of changes in size).

[0131] In step S114, the address mask table generation unit 120 obtains the configuration physical address and program size of the security monitor 156. For the physical address and program size, it is assumed that the values ​​are pre-stored in the storage device separately from the setting data 158. The security monitor 156 has been executed before the execution of the countermeasure program 152 and is protected by the memory monitoring unit 110. Therefore, unlike the method of this embodiment, the physical address and program size to be executed have been determined.

[0132] In step S115 , the address mask table generation unit 120 refers to the setting data 158 to obtain the physical address used by the shared memory.

[0133] In step S116 , the address mask table generation unit 120 calculates a mask value according to the separation setting.

[0134] As an example, in the RISC-V architecture, the separation setting is determined by the pmpadr register (address register) indicating the physical base address and protection size of the protection object and the pmpcfg register (configuration register) determining the access rights. The separation setting for setting the number of protection object programs. That is, in general, information on the physical address, size, and access rights is required to determine the separation setting.

[0135] Figure 5 This is a diagram showing an example of separation setting for realizing access control according to the present embodiment.

[0136] exist Figure 5In it, the access control status is indicated when the untrusted program 153 with countermeasures applied is in action and when the trusted program 154 with countermeasures applied is in action. In addition, for this purpose, the separate settings that should be set for the access control object are indicated, that is, the physical address, size, and access rights are indicated. In the case of untrusted action, it is assumed that the entire area can be accessed except for the programs that cannot be accessed (security monitor 156 and trusted program 154 with countermeasures applied). On the other hand, in the case of trusted action, it is assumed that the trusted program 154 with countermeasures applied is prohibited from accessing except for its own memory area and shared memory. In addition, if the permissions are not explicitly set, it is assumed that there is no access.

[0137] The separation settings used to implement such access control are as follows Figure 5 In the separation setting, the physical address, size, and permissions for untrusted and trusted 1 operations are shown.

[0138] The "established" physical address means that there is a set value for the program processing device 100. Specifically, it means the entire area of ​​the security monitor 156 or the main storage memory 102. The "undetermined" physical address means that it is determined at the time of execution. For example, the trusted program 154 with applied countermeasures is loaded and mapped with physical memory secured at the time of execution, so basically the physical address and size are not determined before execution. The "set" physical address means that it is specified by the setting data 158. It corresponds to the physical address of the shared memory.

[0139] The permission "0" means that all permissions for execution / write / read are granted. The entire area in untrusted operation, the area of ​​the trusted program 154 to which the countermeasures are applied in trusted 1 operation, and the shared memory can be accessed. The permission "×" means that all permissions for execution / write / read are not granted. For example, access to the security monitor 156 is always prohibited.

[0140] In summary, it can be seen that all separation settings of the security monitor 156, permissions of the trusted program 154 with applied countermeasures, and all separation settings and permissions of other (shared memory, etc.) untrusted actions are determined before the program is executed. Furthermore, when the size change of the setting data is taken into consideration, the size of other (shared memory, etc.) trusted actions can also be determined.

[0141] Based on the above, assuming Figure 5 In such an operation, the separation settings that can be used for mask value calculation are all the separation settings of the security monitor 156 and others (shared memory, etc.) and the permissions of the countermeasure trusted program 154. That is, the physical address and size of the countermeasure trusted program 154 are not used for mask value calculation.

[0142] In the following, the address register that specifies the physical address and size is represented as RegAddr, and the configuration register that specifies the permissions is represented as RegCfg. Figure 5 As shown, it is assumed that separate settings are performed for n register pairs (hereinafter referred to as entries).

[0143] Returning to step S116, the method of calculating the mask value according to the separation setting will be described.

[0144] The mask value can be calculated as shown in Formula 1 below.

[0145] Mask[j]=Hash(RegAddr[0]||RegCfg[0]||RegCfg[1]||…||RegCfg[n-1]||RegAddr[n, j]||RegCfg[n]) Formula (1)

[0146] Mask[j] represents the mask value based on the j-th size change.

[0147] Hash() represents a hash function.

[0148] || represents the combination of bit strings.

[0149] RegAddr[i] (i=1…n-1) represents the i-th address register,

[0150] RegAddr[n, j] (i=1…n) represents the nth address register based on the jth size change,

[0151] RegCfg[i] (i=1...n) represents the i-th configuration register.

[0152] like Figure 5 As shown, the shared memory setting during the trusted operation determines the setting of the address register by taking the size change into consideration, so only the nth address register has a change, such as RegAddr[n, j].

[0153] In step S117, the process of setting the number of logical addresses that the data has is repeatedly executed. This means that the process is repeatedly executed from iteration i=1 to i=(the number of logical addresses).

[0154] In step S118 , the setting data 158 is referenced to extract the i-th logical address.

[0155] In step S119, the masked logical address is calculated based on the logical address obtained in step S118 and the mask value calculated in step S116. The masked logical address to be calculated is as follows: Figure 2 As shown, there are two types: mask entry point and mask return address. This calculation can be expressed as formula (2).

[0156] AddrMask[i,j]=(Addr[i]+Offset)(+)Mask[j] Formula (2)

[0157] AddrMask[i, j] represents the mask jump address (entry point or return address) after masking the i-th logical address with the j-th mask value.

[0158] Offset is an offset value used to represent the entry point or return address.

[0159] (+) indicates an XOR (eXclusive OR) operation.

[0160] Offset is the size of the call wrapper and the return address calculated in step S112.

[0161] In the case where Offset represents the size of the call to the wrapper, such as Figure 2 The entry point is shown.

[0162] In the case where Offset represents the return address of the call to the wrapper, such as Figure 2 The return address is shown.

[0163] Additionally, since no entry point is required in the untrusted program 150, only the masked return address is calculated.

[0164] In addition, if Figure 5 As shown, the untrusted program 150 does not need to change in size. Therefore, the size change of j=1 indicates that the untrusted program 150 is processed exceptionally, and such a target action can be achieved by processing only i=1 in step S117. On the contrary, in the case of j>1, the target action can be achieved by ignoring i=1 in step S117. That is, it is possible to constitute Figure 2 Address mask table 155 is shown.

[0165] In step S1110, the original logical address (Addr[i]) and the masked logical address (AddrMask[i, j]) are registered in the address mask table 155. When the logical address acquired in step S117 is an address corresponding to the trusted program 151, both the masked entry point and the masked return address are registered.

[0166] In step S1111, the end of the iteration of step S117 is determined. That is, it is determined whether i is greater than the number of logical addresses. If i < the number of logical addresses, the process proceeds to step S117, and if i ≥ the number of logical addresses, the process proceeds to step S1112.

[0167] In step S1112, the end of the iteration of step S113 is determined. That is, it is determined whether j is greater than the number of logical addresses. If j < the number of size changes, the process proceeds to step S113, and if j ≥ the number of size changes, the process proceeds to step S1113.

[0168] In step S1113 , the physical address of the shared memory acquired in step S115 is registered in the address mask table 155 .

[0169] Through the above processing, it is possible to generate Figure 2 Address mask table 155 is shown.

[0170] <Countermeasure application processing>

[0171] Figure 6 This is a flowchart showing the operation of the countermeasure application unit 130 according to the present embodiment.

[0172] based on Figure 6 , explaining the operation of the countermeasure application unit 130 (step S120).

[0173] In step S121 , the countermeasure application unit 130 analyzes the untrusted program 150 and determines to migrate to the trusted program 151 .

[0174] Specifically, it is an environment call exception command. For example, in the case of RISC-V architecture, in the switch between trusted and untrusted, an environment call exception is usually used to call a program with higher authority (security monitor 156). That is, the execution location of the environment call exception command ECALL is determined. Step S121 is, for example, a process performed by the migration determination unit 111 of the countermeasure application unit 130.

[0175] In step S122, the countermeasure application unit 130 refers to the address mask table 155 and replaces the migration process with a jump instruction to the encapsulation function. Figure 2 As shown, in both the case of the untrusted program 150 and the case of the trusted program 151, the jump address of the migration destination is the logical address of the address mask table 155. That is, this address indicates the address of calling the wrapper (the entry point to the function). Step S122 is processed by the migration process replacement unit 112 of the countermeasure application unit 130, for example.

[0176] In step S123, the countermeasure application unit 130 adds a link process of calling the wrapper 157 to the untrusted program 150 instead of statically assigning the call wrapper 157 before executing the program. Thus, the generation of the countermeasure-applied untrusted program 153 is completed. Step S123 is, for example, a process performed by the countermeasure link unit 113 of the countermeasure application unit 130.

[0177] In addition, the reason why the call wrapper is not assigned at this time is as follows. In the case where the call wrapper 157 is assigned to the beginning of the untrusted program 150, the call wrapper 157 is operated when the entry point is executed, so the original processing is not executed. In addition, in the case where the call wrapper 157 is assigned to the end of the untrusted program 150, the entry point changes according to the size of the program, and the logical address of the address mask table 155 changes for each program. That is, in order to ensure the integrity of the processing while generating a common address mask table 155, it is necessary to link at the time of execution.

[0178] In the countermeasure application unit 130, a call wrapper is statically assigned to a trusted program. On the other hand, a call wrapper is not assigned to an untrusted program for the reasons described above.

[0179] In step S124, the countermeasure application unit 130 repeatedly executes the process for the number of trusted programs 151. This means that the process is repeatedly executed from iteration i=1 to i=(the number of trusted programs 151).

[0180] In step S125, the countermeasure application unit 130 analyzes the trusted program 151 corresponding to iteration i and determines to migrate to an untrusted program. This process is the same as step S121.

[0181] In step S126, the countermeasure application unit 130 refers to the address mask table 155 and replaces the migration process with a jump instruction to the encapsulation function. This process is the same as step S122.

[0182] In step S127, the countermeasure application unit 130 adds a call wrapper to the start of the trusted program 151. In other words, the trusted program 151 is combined as a bit string. Thus, the countermeasure application unit 130 completes the generation of the i-th trusted program 154 to which the countermeasure has been applied.

[0183] At this time, the countermeasure application unit 130 may also perform zero padding to align the size of the call wrapper to match the bit width of the processor. In this case, in step S112, the countermeasure application unit 130 also calculates the size of the call wrapper in consideration of zero padding.

[0184] In step S128, the end of the iteration of step S124 is determined. That is, it is determined whether i is greater than the number of trusted programs. If i < the number of trusted programs, the process returns to step S124, and if i ≥ the number of trusted programs, the process ends.

[0185] <Execution Process>

[0186] Figure 7 This is a flowchart showing the operation of the execution unit 140 according to this embodiment.

[0187] based on Figure 7The operation of the execution unit 140 (step S130 ) will be described.

[0188] The execution unit 140 executes the countermeasure applied untrusted program 153 , the security monitor 156 , and the countermeasure applied trusted program 154 alternately under control.

[0189] · Countermeasures applied to untrusted programs 153

[0190] In step 131, the execution unit 140 loads the countermeasure-applied untrusted program 153 and maps it to the main storage memory 102 for execution. Specifically, the execution unit 140 reserves physical memory and allocates logical addresses, and sets the program counter as the entry point. This is a normal operation when the OS executes a binary program.

[0191] In step S132, when executing the program, the execution unit 140 performs the dynamic link processing added in step S123 to link the call wrapper 157. That is, the execution unit 140 loads and maps the call wrapper 157 through the dynamic link processing action assigned by the countermeasure application unit 130 in step 123. The execution unit 140 ensures physical memory and allocates logical addresses. At this time, the logical address to be allocated is determined by referring to the address mask table 155. Specifically, Figure 2 As shown, the logical address of ID=0 is adopted.

[0192] This process is a dynamic link process assigned by the countermeasure application unit 130 in step 123 .

[0193] In step S133, the execution unit 140 reserves shared memory. At this time, instead of the OS using free physical memory, the memory reservation unit 141 functions to allocate physical memory with reference to the address mask table 155. Specifically, the physical address with ID = -1 is selected. The logical address may also use an automatically allocated address.

[0194] In step S134, the execution unit 140 loads and maps the trusted program 154 for which countermeasures have been applied. At this time, the loading unit 142 functions to obtain the logical address allocated to the free physical memory from the address mask table 155 instead of the OS using the free physical memory for loading and mapping. Specifically, the number of trusted programs 154 for which countermeasures have been applied that are loaded and mapped corresponds to the ID. For example, if it is the first program, ID=1, and if it is the nth program, ID=n.

[0195] In step S135, the execution unit 140 migrates to the countermeasure applied trusted program 154 mapped in step S134. This process is the process after the replacement in step S122, and calls out the call wrapper 157. That is, the security monitor 156 is called a bridge to migrate to the countermeasure applied trusted program 154.

[0196] Security Monitor 156

[0197] In step S136, the execution unit 140 changes the separation setting of the security monitor 156. Figure 5 As shown, the access rights are set according to untrusted and trusted actions.

[0198] In step S137, the execution unit 140 refers to the jump address from the address mask table 155, demasks and jumps. At this time, the entry point of the countermeasure-applied trusted program 154 is usually migrated according to the address table managed by the security monitor 156, but instead, the jump address demasking unit 143 replaces it with such processing.

[0199] Figure 8 This is a diagram showing the process from the change of the separation setting to the execution of the jump address demasking process according to the present embodiment.

[0200] based on Figure 8 , explaining the jump address demasking process from the change of the separation setting in step S136 to the demasking and jumping of the jump address in step S137.

[0201] Figure 8 The state in which the function of the jump address demasking unit 143 is executed according to the address mask table 155 is shown.

[0202] In the 100th line, the jump address demasking unit 143 refers to the 500th line to obtain data, and substitutes the data into the register reg of the separation setting of the management memory 105. Thus, the separation setting is changed.

[0203] In lines 110 to 150, the jump address demasking unit 143 obtains the masked entry point of the countermeasure applied trusted program 154 from the address mask table 155. To do this, the base address, ID, size, and content to be obtained (entry point, return address, etc.) are specified to load data.

[0204] The jump address demasking unit 143 performs demasking processing on lines 160 and 170. That is, the jump address demasking unit 143 demasks the masked address loaded in line 150 using the separation setting recorded in the memory 105. This processing is the inverse processing of equations (1) and (2), and can be expressed as the following equation (3).

[0205] Addr=AddrMask(+)Hash(RegAddr[0]||RegCfg[0]||RegCfg[1]||…||RegCfg[n-1]||RegAddr[n]||RegCfg[n]) Formula (3)

[0206] The value of the logical address obtained in this way is, for example, Figure 8 The value "0x9000 0100" shown in line 170 of . That is, as described later, this means that the call to the wrapper uses "0x9000 0000 to 0x9000 0100" and the entry point starts at "0x90000100".

[0207] Jump to the address obtained by unmasking on line 180.

[0208] Through the above operation, it is possible to realize unmasking the masked jump address and transition to an appropriate process after the separation setting is changed.

[0209] · Countermeasures applied to trusted programs 154

[0210] return Figure 7 In step S138 , the execution unit 140 executes the processing of the trusted program 154 to which the countermeasure has been applied.

[0211] In step S139, the execution unit 140 returns to the countermeasure-applied untrusted program 153. This process is the process after the replacement in step S126, and calls the call wrapper 157. That is, the security monitor 156 is called a bridge for returning to the countermeasure-applied untrusted program 153.

[0212] Security Monitor 156

[0213] In step S1310, the execution unit 140 changes the separation setting. This process is the same as step S136. However, the separation setting is set to a setting when it is unreliable.

[0214] In step S1311, the execution unit 140 refers to the jump address from the address mask table 155, demasks it, and jumps. This process is the same as step S137. However, the address referred to from the address mask table 155 is the masked return address of the untrusted program.

[0215] · Countermeasures applied to untrusted programs 153

[0216] In step S1312, the execution unit 140 returns to the process to which the countermeasure untrusted program 153 has been applied, and executes the remaining process.

[0217] The above is the operation of the program processing device 100. Figure 7 In the description, the original processing of each program is omitted, and only the processing related to context switching is extracted and explained.

[0218] ***Description of Features***

[0219] In the program processing device 100 of this embodiment, if using Figure 5As described above, the separation settings used in the calculation of the mask value are narrowed down to important separation settings for selection. That is, the combinatorial explosion that occurs when all possibilities are considered can be prevented, and the address mask table 155 of a realistic size can be generated.

[0220] The selection of the separation setting here is also related to not placing restrictions on the program size. Specifically, the physical address used by the countermeasure applied trusted program 154 is not used for calculation of the mask value, thereby preventing the need to predetermine the program size.

[0221] The use of the call wrapper 157 is related to uniquely restricting the return address in the context switch between untrusted and trusted. That is, not only is the return address fixed to achieve mask processing of the jump address, but it also has the effect of reducing the table size of the address mask table 155.

[0222] By making the setting data 158 have a variable size, it is possible to prevent restrictions on the shared memory size. This has the same meaning as not defining the program size of the countermeasure-applied trusted program 154, but it is necessary to use an address register derived from the physical address size of the shared memory in the calculation of the mask value. This is because, for example, Figure 5 As shown, in the context switch between untrusted and trusted, the setting of the nth address register (physical address and size) changes. It can be seen that if it is not included in the mask calculation, it will not be noticed that the value has been destroyed.

[0223] The changes of address mask table 155 are not limited to Figure 2 form.

[0224] For example, the address mask table 155 may be created with a change in the form of limiting the physical address and size of one or more trusted programs to which countermeasures have been applied. In this case, the size column of the address mask table 155 increases, and the combination increases by multiplication. In this case, when the execution unit 140 operates, in addition to the loading unit 142, it is necessary to use the function of the memory securing unit 141.

[0225] Alternatively, the physical address used by the shared memory may be fixed regardless of changes.

[0226] Since the address mask table 155 is generated in consideration of the change in the shared memory size, it is not limited to being used in the countermeasure-applied untrusted program 153 and the countermeasure-applied trusted program 154 generated by the countermeasure program 152. That is, even when the countermeasure program 152 is operated by providing another untrusted program 150 and trusted program 151, the same address mask table 155 is generated as long as the setting data 158 is the same.

[0227] Although the countermeasure program 152 has been described as executing the address mask table generation (step S110 ), countermeasure application (step S120 ), and execution (step S130 ) in series, only any one of them may be operated.

[0228] For example, only the execution unit 140 may be executed in the second and subsequent executions. That is, the generated countermeasure applied untrusted program 153, countermeasure applied trusted program 154, and address mask table 155 may be used to activate the existing call wrapper 157 and security monitor 156 to execute the program.

[0229] Alternatively, the new untrusted program 150 and trusted program 151 may be executed starting from the application of countermeasures without changing the setting data 158 .

[0230] The address mask table 155 can also be implemented as a hash table. Figure 8 As shown, the value that can be referenced when the ID, size, and content are specified and the hash value is taken can also be stored in the address. Thus, even if a fault attack is implemented in the reference process of the address mask table 155, it is possible to prevent unexpected values ​​(such as the original logical address value) from being exposed.

[0231] The address mask table 155 generated by the address mask table generation unit 120 in this way has a larger size and is a sparse table. In addition, when referring to the address mask table 155, the value obtained by hashing the ID, size, and content is changed to refer to the address mask table 155 as a key. As an example of hashing, it is shown in the following formula (4).

[0232] Hash(ID||size||content) formula (4)

[0233] ***Explanation of the effect***

[0234] In the program processing device 100 of the present embodiment, a mask value is calculated based on the logical address, physical address, and separation setting of each program specified by the setting data. Then, the program processing device 100 generates an address mask table recording the jump address masked together with the original logical address and physical address. Furthermore, the program processing device 100 replaces the migration process of the context switch process (processing in which untrusted and trusted change) of the execution object program with a call to the wrapper call. In addition, when executing, the program processing device 100 refers to the address mask table to ensure the physical address or allocate the logical address. The program processing device 100 uses the separation setting in the context switch to demask and migrate the masked jump address taken out from the address mask table.

[0235] Through the above-described operations, according to the program processing device 100 of the present embodiment, even in an OS environment, a mask processing scheme of a jump address can be applied by partially fixing a logical address or a physical address to execute a program.

[0236] In the program processing device 100 of this embodiment, the address mask table generation unit 120 generates an address mask table that records the mask values ​​of the entry point and the return address, and a list of logical addresses and physical addresses used by the program or shared memory based on the setting data. The setting data records the setting of the access rights of the TEE (separation setting), the logical address / physical address / shared memory used by the program (application), and the size change of the program size.

[0237] Furthermore, the countermeasure application unit assigns a call wrapper for proxy processing context switching to the untrusted and trusted programs based on the address mask table before execution.

[0238] Furthermore, the execution unit uses the address mask table to dynamically assign the call wrapper at the time of execution, and executes the untrusted program to which the countermeasure has been applied, the trusted program, and the security monitor.

[0239] The memory monitoring unit monitors memory access based on the set separation setting.

[0240] According to the program processing device 100 of this embodiment, even if it is a TEE in an OS environment, it is possible to perform masking / unmasking of the jump address by partially fixing the physical address of the configuration program or shared memory, or the allocated logical address. If a context switch occurs in a state where the separation setting is destroyed, the correct jump address cannot be calculated in the unmasking process, resulting in a jump to an abnormal address. Such an action is supplemented by the memory monitoring unit 110, which can prevent unauthorized memory access. That is, it can be guaranteed that the separation setting is correct when the program is in operation.

[0241] Implementation Method 2

[0242] In this embodiment, points different from the first embodiment and points additional to the first embodiment are mainly described.

[0243] In this embodiment, the same reference numerals are used to denote components having the same functions as those in Embodiment 1, and description thereof will be omitted.

[0244] ***Description of the structure***

[0245] Fig. 9 It is a diagram showing a configuration example of the program processing device 100 according to the present embodiment.

[0246] Special instructions and Figure 1 The structure of the program processing device 100 shown is different.

[0247] The processor 101 includes an address mask table generation unit 210, a program countermeasure application unit 220, and a security monitor countermeasure application unit 230. The program countermeasure application unit 220 includes a migration determination unit 111, a migration process replacement unit 112, an address specification unit 221, and a link unit 222. The security monitor countermeasure application unit 230 includes a context switch determination unit 231 and a demasking process addition unit 232.

[0248] The address mask table generation unit 210 , the program countermeasure application unit 220 , and the security monitor countermeasure application unit 230 are implemented by software.

[0249] The storage device 103 stores a countermeasure program 152 that is executed by the processor 101 and a call wrapper 157 used by the countermeasure program 152 .

[0250] like Fig. 9 As shown, in the main storage memory 102, the software and data stored in the storage device 103 are read, and the address mask table 155 generated by the countermeasure program 152, the applied countermeasure program 240 and the applied countermeasure security monitor 241 are stored.

[0251] The untrusted program 150, the trusted program 151, the security monitor 156, and the setting data 250 are inputted via the input / output interface 104. Also, the countermeasure program 152 is operated to output the applied countermeasure program 240 and the applied countermeasure security monitor 241.

[0252] The setting data 250 includes a logical address, a physical address, and a memory reservation process designation. The logical address and the physical address are the same as the setting data 158 of the first embodiment. Among them, the physical address includes the physical address of the security monitor 156.

[0253] The setting data 250 does not have a size change like the setting data 158 of the first embodiment, and calculates the masked address in a form suitable for the input untrusted program 150 and trusted program 151. Therefore, the setting data 250 has a memory securing process designation. That is, by designating the shared memory secured by the untrusted program 150 as a protection target or the location of the loading and mapping process of the trusted program 151, they can be analyzed and replaced in a manner that can apply the jump address mask.

[0254] The untrusted program 150, the trusted program 151, and the security monitor 156 of this embodiment are source codes.

[0255] The applied countermeasure program 240 and the applied countermeasure security monitor 241 are executable execution modules.

[0256] In other words, the program processing device 100 is simply a compiling device. It is assumed that the compiled program is run on a processor having a memory monitoring unit 110 .

[0257] ***Description of the action***

[0258] Next, the operation of the program processing device 100 of this embodiment will be described. The operation procedure of the program processing device 100 corresponds to the program processing method. In addition, the program that realizes the operation of the program processing device 100 corresponds to the program processing program.

[0259] Fig.10 This is a flowchart showing the operation of the program processing device 100 according to the present embodiment.

[0260] based on Fig.10 The operation of the program processing device 100 will be described.

[0261] In step S210, the countermeasure program 152 executes the function of the address mask table generation unit 210 to generate an address mask table. In generating the address mask table, the setting data 250, the call wrapper 157, and the security monitor 156 are input to generate the address mask table 155.

[0262] In step S220, the countermeasure program 152 executes the function of the program countermeasure application unit 220 to apply the countermeasure to the program. The program countermeasure application unit 220 assigns the call wrapper 157 as a function for context switching to the program, and determines the migration process for context switching from the program. Then, the program countermeasure application unit 220 replaces the migration process with a process for jumping to the physical address where the call wrapper 157 is expanded, specifies the logical address and the physical address according to the address mask table 155 to ensure memory, and performs logical address allocation.

[0263] At this time, the setting data 250, the call wrapper 157, the security monitor 156, the untrusted program 150, and the trusted program 151 are input to generate the applied countermeasure program 240 (the countermeasured untrusted program 153 and the countermeasured trusted program 154).

[0264] Specifically, the link unit 222 assigns the call wrapper 157 to the program. The migration determination unit 111 determines the process of context switching from the program. The migration process replacement unit 112 replaces the determined migration process with a process of jumping to the address where the call wrapper 157 is expanded. The address specification unit 221 specifies the logical address and the physical address according to the address mask table 155, secures the memory, and performs logical address allocation.

[0265] In step S230, the countermeasure program 152 executes the function of the security monitor countermeasure application unit 230 to apply the countermeasure to the security monitor 156. The security monitor countermeasure application unit 230 determines the context switch of the security monitor 156. Then, the security monitor countermeasure application unit 230 changes the jump address acquisition process that exists before the determined context switch to the following process. That is, it is changed to "refer to the address mask table 155 to obtain the masked jump address as the masked jump address, demask the obtained masked jump address according to the set separation setting, and calculate the jump address process." At this time, the address mask table 155 and the security monitor 156 are used as inputs, and the security monitor 241 with the countermeasure applied is output.

[0266] Specifically, the context switch determination unit 231 determines the context switch of the security monitor 156. Then, the demasking process addition unit 232 changes the jump address acquisition process that exists before the determined context switch as follows. That is, the demasking process addition unit 232 changes the jump address acquisition process to "acquire the masked jump address from the address mask table 155, perform the demasking process according to the separation setting at the time of executing the jump process, and calculate the jump address."

[0267] Let's use a more specific example to explain. For example, assume that we jump to the entry point of program 1.

[0268] Typically it is as follows.

[0269] generally:

[0270] RegJump<-Mem(entry_program1);

[0271] JUMP RegJump;

[0272] The program processing device 100 of this embodiment operates as follows.

[0273] Additional demasking process:

[0274] RegTemporary<-Mem(address_mask_table+offset);

[0275] RegTemporary<-RegTemporary xor pmpaddr; RegTemporary<-RegTemporaryxor pmpcfg;

[0276] RegJump<-RegTemporary;

[0277] JUMP RegJump;

[0278] Here, offset refers to the number of the jump address table. Figure 8 Here, it is assumed that the mask address after masking entry_program1 is stored. Therefore, when making the mask address table, that is, when masking, "entry_program1 xor pmpaddr xor pmpcfg" is placed at the address "address_mask_table+offset".

[0279] Fig.11 This is a flowchart showing the operation of the address mask table generating unit 210 according to the present embodiment.

[0280] based on Fig.11 , illustrating the generation of the address mask table (step S210).

[0281] Step S211 , step S212 , and steps S214 to S2111 are the same as step S111 , step S112 , steps S115 to S1111 , and step S1113 .

[0282] The following describes the steps that differ.

[0283] In step S213, the address mask table generation unit 210 refers to the setting data 250 to obtain the physical address of the security monitor 156 and obtains the program size from the security monitor 156. Similar to the first embodiment, these information are used to calculate the mask value based on the separation setting in step S215.

[0284] In order to obtain the program size, the source code may be compiled once. Alternatively, the memory size for the security monitor 156 may be given as the setting data 250 .

[0285] Fig.12This is a flowchart showing the operation of the program countermeasure application unit 220 according to the present embodiment.

[0286] based on Fig.12 , explaining the application of program countermeasures (step S220).

[0287] Step S221 , step S222 , and steps S226 to S2210 are the same as step S121 , step S122 , and steps S124 to S128 .

[0288] The following describes the steps that differ.

[0289] In step S223 , the program countermeasure application unit 220 adds the call wrapper 157 to the untrusted program 150 , and performs additional link processing by referring to the address mask table 155 .

[0290] As described above, the untrusted program 150 is executed after the initial execution of the OS expansion, so even if a call wrapper is given to the beginning or the end, it cannot be properly executed. Therefore, a call wrapper 157 is given to the untrusted program 150 once and reconfigured when it is executed.

[0291] First, the call wrapper 157 is added to the untrusted program 150. Next, a process of copying the call wrapper 157 to the address shown in the address mask table 155 is added to the untrusted program 150.

[0292] In step S222, since the migration process is rewritten to call the function assumed to be stored in the above-mentioned copy destination address, the call to the wrapper 157 succeeds.

[0293] In step S224, the program countermeasure application unit 220 first determines the loading and mapping process of the trusted program 151 by referring to the memory reservation process designation indicated by the setting data 158. Next, the logical address indicated by the address mask table 155 is designated as the left-hand logical address to be mapped at this time.

[0294] In step S225, the program countermeasure application unit 220 first determines the shared memory reservation process by referring to the memory reservation process designation indicated by the setting data 158. Next, the program countermeasure application unit 220 designates the physical address indicated by the address mask table 155 as the physical address to be reserved at this time.

[0295] In step S2211 , the applied countermeasure program 240 is generated by combining the previously generated applied countermeasure untrusted program 153 and the applied countermeasure trusted program 154 .

[0296] based on Fig.13 , explaining the application of security monitor countermeasures (step S230).

[0297] In step S231, the address mask table 155 is given to the security monitor 156. For example, the address mask table 155 shown in a two-dimensional array is directly added to the source code of the security monitor 156.

[0298] In step S232, the location of the context switch is determined. For example, in the RISC-V architecture, the security monitor 156 called by the environment call exception command (ECALL) migrates to the context destination after the switch by executing the exception return command (MRET). That is, the location of the context switch can be determined by determining the execution location of such a command.

[0299] In step S233, the address mask table 155 is referenced and demasking processing is added. Before the context switch determined in step S232, there is a location where the migration destination address is set. This processing is replaced as follows.

[0300] Before the change: Get the jump address (entry point or return address) from a specific location and set it as the migration destination.

[0301] After the change: The jump address is obtained from the address mask table 155, the demasking process is performed to calculate the jump address, and it is set as the migration destination.

[0302] The demasking method is the same as that in implementation mode 1.

[0303] ***Explanation of the effect***

[0304] According to the program processing device 100 of the present embodiment, it is possible to generate an applied countermeasure program 240 and an applied countermeasure security monitor 241 of a TEE assuming an OS environment. That is, by partially fixing the physical address at which the program or shared memory is configured and the assigned logical address for execution, the jump address can be masked / unmasked. If a context switch occurs in a state where the separation setting is destroyed, the correct jump address cannot be calculated in the unmasking process, resulting in a jump to an abnormal address. Such an action is supplemented by the memory monitoring unit 110, which can prevent unauthorized memory access. That is, it can be ensured that the separation setting is correct when the program is in operation.

[0305] In the above embodiments 1 and 2, the various parts of the program processing device are described as independent functional blocks. However, the structure of the program processing device may not be the structure as in the above embodiments. The functional blocks of the program processing device may be of any structure as long as they can realize the functions described in the above embodiments. In addition, the program processing device may not be a single device, but a system composed of multiple devices.

[0306] In addition, a plurality of parts in Embodiments 1 and 2 may be combined for implementation. Alternatively, a part of these embodiments may be implemented. In addition, these embodiments may be implemented as a whole or in part in any combination.

[0307] That is, in Embodiments 1 and 2, it is possible to freely combine the respective embodiments, or to modify any constituent element in the respective embodiments, or to omit any constituent element in the respective embodiments.

[0308] In addition, the above-mentioned embodiments are essentially preferred illustrations and are not intended to limit the scope of the present disclosure, the scope of the application of the present disclosure, and the scope of the use of the present disclosure. The above-mentioned embodiments can be variously changed as needed. For example, the process described using a flowchart or sequence diagram can be appropriately changed.

[0309] Description of symbols

[0310] 100: program processing device; 101: processor; 102: main storage memory; 103: storage device; 104: input / output interface; 105: memory; 110: memory monitoring unit; 120: address mask table generation unit; 130: countermeasure application unit; 111: migration determination unit; 112: migration processing replacement unit; 113: countermeasure linking unit; 140: execution unit; 141: memory securing unit; 142: loading unit; 143: jump address demasking unit; 144: execution linking unit; 150: untrusted program; 151: trusted program; 152: Countermeasure program; 153: untrusted program with applied countermeasures; 154: trusted program with applied countermeasures; 155: address mask table; 156: security monitor; 157: call wrapper; 158: setting data; 210: address mask table generation unit; 220: program countermeasure application unit; 221: address specification unit; 222: linking unit; 230: security monitor countermeasure application unit; 231: context switch determination unit; 232: demasking processing addition unit; 240: countermeasure program with applied countermeasures; 241: security monitor with applied countermeasures; 250: setting data.

Claims

1. A program processing device, wherein: The program processing device has: an address mask table generating unit that generates the address mask table based on setting data that specifies physical addresses and logical addresses for a program or a memory used by the program; a countermeasure application unit that assigns a call wrapper as a function for context switching to a program, determines a migration process for context switching from the program, and replaces the migration process with a process for jumping to a physical address where the call wrapper is expanded; as well as An execution unit, which, during the execution of a program to which the countermeasure is applied, refers to the address mask table to secure memory and perform logical address allocation, and instead of directly obtaining a jump address in the migration process, changes the jump address obtained by referring to the address mask table to use a jump address that is demasked according to a set separation setting.

2. The program processing device according to claim 1, wherein: The address mask table generating unit generates the address mask table by changing the physical address and the logical address for the program or the memory used by the program in the setting data using a plurality of combinations.

3. The program processing device according to claim 1 or 2, wherein: The countermeasure application unit adds a link process of the call wrapper instead of statically assigning the call wrapper before executing the program. The execution unit links the call wrapper by performing the dynamic linking process when executing the program.

4. The program processing device according to any one of claims 1 to 3, wherein: The address mask table generation unit generates the address mask table as a hash table.

5. A program processing device, wherein: The program processing device has: an address mask table generating unit that generates the address mask table based on setting data that specifies physical addresses and logical addresses for a program or a memory used by the program; a program countermeasure application unit that assigns a call wrapper as a function for performing context switching to the program, determines a migration process for performing context switching from the program, replaces the migration process with a process for jumping by specifying a physical address where the call wrapper is expanded, specifies a logical address and a physical address according to the address mask table to secure memory, and performs logical address allocation; as well as A security monitor countermeasure application unit determines the context switch of the security monitor and changes the jump address acquisition process that exists before the determined context switch to the following process: referring to the address mask table to obtain the masked jump address as the mask jump address, and demasking the obtained mask jump address according to the set separation setting to calculate the jump address.

6. A program processing method, wherein: The computer generates an address mask table based on setting data that specifies physical addresses and logical addresses for a program or memory used by the program. The computer assigns a call wrapper as a function for context switching to the program, determines a migration process for context switching from the program, and replaces the migration process with a process for jumping to a physical address where the call wrapper is expanded. When executing a program to which the countermeasure is applied, the computer refers to the address mask table to secure memory and perform logical address allocation. Instead of directly obtaining the jump address in the migration process, the computer changes to use a jump address obtained by demasking the jump address obtained by referring to the address mask table according to the set separation setting.

7. A program processing program, wherein: The program handler causes the computer to: an address mask table generation process for generating an address mask table based on setting data specifying physical addresses and logical addresses for a program or a memory used by the program; A countermeasure application process is provided to the program, a call wrapper as a function for performing context switching is assigned, a migration process for performing context switching is determined from the program, and the migration process is replaced by a process for jumping to a physical address where the call wrapper is expanded; as well as Execution processing, in the process of executing the program to which the countermeasure is applied, the address mask table is referenced to ensure memory and perform logical address allocation, instead of directly obtaining the jump address in the migration processing, the jump address obtained by referring to the address mask table is changed to a jump address after demasking according to the set separation setting.

8. A program processing method, wherein: The computer generates an address mask table based on setting data that specifies physical addresses and logical addresses for a program or memory used by the program. The computer assigns a call wrapper as a function for performing context switching to the program, determines a migration process for performing context switching from the program, replaces the migration process with a process for jumping to a physical address where the call wrapper is expanded, specifies a logical address and a physical address according to the address mask table to secure memory, and performs logical address allocation, The computer determines the context switch of the security monitor and changes the jump address acquisition process that exists before the determined context switch to the following process: refer to the address mask table to obtain the masked jump address as the mask jump address, and demask the obtained mask jump address according to the set separation setting to calculate the jump address.

9. A program processing program, wherein: The program handler causes the computer to: an address mask table generation process for generating an address mask table based on setting data specifying physical addresses and logical addresses for a program or a memory used by the program; A program countermeasure application process is provided, a call wrapper as a function for performing context switching is given to the program, a migration process for performing context switching is determined from the program, the migration process is replaced with a process for jumping to a physical address where the call wrapper is expanded, a logical address and a physical address are specified according to the address mask table to secure memory, and a logical address is allocated; as well as The security monitor countermeasure application process determines the context switch of the security monitor, and changes the jump address acquisition process that exists before the determined context switch to the following process: refer to the address mask table to obtain the masked jump address as the mask jump address, and demask the obtained mask jump address according to the set separation setting to calculate the jump address.

Images