Page table modification method and device, equipment and storage medium
The page table protection module running in a secure isolation environment modifies the page table, which solves the problem of attackers tampering with the page table and improves the security of the kernel.
Patent Information
- Application Number
- CN202411954912.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-26
- Publication Date
- 2025-05-02
AI Technical Summary
The prior art cannot effectively avoid unintended tampering with the page table by attackers, resulting in low kernel security.
The page table protection module run in a secure isolation environment can obtain page table modification instructions, and remove or restore the kernel-state write mapping to page table entries according to the physical page type and operations of the page table entries to ensure the security of the page table.
It effectively avoids attackers' unexpected tampering with the page table, prevents executable mapping of the new kernel and changes to existing memory layout, improves the security of page table modification, and thus improves the overall security of the kernel.
Smart Images
Figure CN119918044A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a page table modification method, device, equipment and storage medium. Background Art
[0002] Most current operating systems, such as Linux and Windows, store their security policies and access control policies in kernel memory, which is accessible in kernel mode. Attackers can gain access to the kernel through vulnerabilities and maliciously tamper with the kernel or user-mode page tables.
[0003] In some related technologies, the integrity of the page table can be verified. However, in common kernel attack scenarios, attackers often forge malicious modifications to the page table as normal modification behavior at runtime, so it is impossible to effectively prevent attackers from unexpectedly tampering with the page table, resulting in low kernel security. Summary of the invention
[0004] The present application provides a page table modification method, device, equipment and storage medium to solve the problem in the related art that the integrity of the page table cannot be effectively prevented from being unexpectedly tampered with by attackers, resulting in low kernel security.
[0005] In a first aspect, the present application provides a page table modification method, which is applied to a page table protection module, where the page table protection module runs in a secure isolation environment, including:
[0006] Obtaining a page table modification instruction, where the page table modification instruction is used to indicate a page table entry to be modified and an operation on the page table entry;
[0007] If the type of the physical page corresponding to the page table entry is in the initial state, and the operation is used to change the type of the physical page from the initial state to the page table, remove the kernel state write mapping of the page table entry, record the removal operation, and change the type of the physical page to the page table;
[0008] If the type of the physical page corresponding to the page table entry is a page table, and the operation is used to release the page table, the write mapping of the page table entry is restored through the recorded removal operation, and the type of the physical page is modified to the initial state.
[0009] In a second aspect, the present application provides a page table modification device, which is applied to a page table protection module, and the page table protection module runs in a secure isolation environment, including:
[0010] An acquisition module, used for acquiring a page table modification instruction, where the page table modification instruction is used for indicating a page table entry to be modified and an operation on the page table entry;
[0011] A processing module, configured to remove the write mapping of the page table entry in the kernel state, record the removal operation, and modify the type of the physical page to the page table if the type of the physical page corresponding to the page table entry is in the initial state and the operation is used to change the type of the physical page from the initial state to the page table;
[0012] The processing module is also used to restore the write mapping of the page table entry through the recorded removal operation and modify the type of the physical page to an initial state if the type of the physical page corresponding to the page table entry is a page table and the operation is used to release the page table.
[0013] In a third aspect, the present application provides an electronic device, comprising: a processor and a memory, wherein the memory stores code, and the processor runs the code stored in the memory to execute any method as described in the first aspect.
[0014] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement any method as in the first aspect.
[0015] In a fifth aspect, the present application provides a computer program product, comprising a computer program, which implements any one of the methods in the first aspect when executed by a processor.
[0016] The present application provides a page table modification method, device, equipment and storage medium, which can be executed by a page table protection module running in a secure isolation environment. Specifically, the method may include: obtaining a page table modification instruction, which can be used to indicate the page table entry to be modified and the operation on the page table entry. If the type of the physical page of the page table entry object is the initial state, and the operation on the page table entry is used to change the type of the physical page from the initial state to the page table, then remove the kernel state write mapping of the page table entry, record the removal operation, and modify the type of the physical page to the page table. If the type of the physical page corresponding to the page table entry is the page table, and the operation is used to release the page table, then restore the write mapping of the page table entry through the recorded removal operation, and modify the type of the physical page to the initial state. The present application only modifies the page table through the page table protection module in a secure isolation environment, removes the operating system's write permission to the physical page where the page table is located, effectively avoids attackers from unexpectedly tampering with the page table, prevents the addition of executable mappings of the kernel and the modification of the existing memory layout, etc., effectively improves the security of page table modification, and thus improves kernel security. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0018] Figure 1A schematic diagram of a scenario of modifying a page table based on an operating system provided in an embodiment of the present application;
[0019] Figure 2 A flow chart of a page table modification method provided in an embodiment of the present application;
[0020] Figure 3 A flow chart of a method for determining the type of physical page to be migrated provided in an embodiment of the present application;
[0021] Figure 4 A schematic diagram of a finite state machine provided in an embodiment of the present application;
[0022] Figure 5 A schematic diagram of a page table modification device provided in an embodiment of the present application;
[0023] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present application.
[0024] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION
[0025] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.
[0026] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.
[0027] Most current operating systems, such as Linux and Windows, store their security policies and access control policies in kernel memory, which is accessible in kernel state. Attackers can gain access to the kernel through vulnerabilities, which means they can access kernel memory and all resources, and can bypass kernel-level security protection measures.
[0028] In the kernel attack path, malicious tampering of the kernel or user-mode page table is a common attack method. When the operating system is running, the page table state changes dynamically, such as creating, deleting, and modifying page table entries to achieve physical memory allocation and release. Attackers often use kernel security vulnerabilities to tamper with the memory layout or modify the kernel code, thereby changing the expected behavior of the kernel.
[0029] In some related technologies, a page table integrity verification mechanism can be provided. However, in common kernel attack scenarios, attackers often forge malicious modifications to page tables as normal runtime modification behaviors, which effectively prevents attackers from unexpectedly tampering with page tables, and reduces kernel security.
[0030] Based on the above problems, the present application provides a page table modification method, apparatus, device and storage medium. The method is based on a series of defined rules and performs a series of security checks on page table modifications through a page table protection module running in a secure isolation environment, thereby identifying and preventing unexpected modifications to the page table, preventing attackers from destroying the memory layout and executing and reading and writing arbitrary memory, thereby effectively preventing attackers from exploiting security vulnerabilities to destroy the security of the operating system kernel.
[0031] Figure 1 A schematic diagram of a scenario of modifying a page table based on an operating system provided in an embodiment of the present application, such as Figure 1 As shown, the operating system may include three parts: user state, kernel state and hardware. Among them, the user state may include multiple applications; the kernel state includes a memory management module and a page table protection module, and the page table protection module runs in a secure isolation environment; the hardware includes an MMU (Memory Management Unit) and a random access memory (RAM) as physical memory. The random access memory can be divided into page table memory, application memory, etc.
[0032] In one implementation scenario, a user can send a memory allocation request or a memory release request to the kernel state through an application. The kernel state memory management module generates a corresponding page table modification instruction according to the memory allocation request or the memory release request, and sends the page table modification instruction to the page table protection module running in the secure isolation environment, and the page table protection module checks and verifies the page table modification instruction. After the verification is passed, the page table modification instruction is sent to the MMU, and the MMU executes the page table modification instruction to implement the page table modification.
[0033] In another implementation scenario, if there is no need to allocate or modify memory, such as reading the data of a certain application, the request initiated by the application can be sent to the MMU through the memory channel, and the MMU obtains the corresponding data. MMU is usually present in the current hardware architecture. The function of MMU is to convert virtual addresses and physical addresses. There is a page table base address register inside the MMU. Usually, when the system is initialized, the physical address of the kernel page table (page table) is written into the page table base address register, and then the MMU is enabled. After that, the CPU (Central Processing Unit) operates based on the virtual address (VA). The CPU sends the virtual address to the MMU through the internal bus. The MMU hardware unit will translate the virtual address into the corresponding physical address (PA) according to the address translation rules recorded in the page table specified by the page table base address register, and return the data corresponding to the physical address to the CPU.
[0034] It should be noted that the page table protection module can be deployed in kernel mode or exist independently, and this application does not impose any restrictions on this.
[0035] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.
[0036] Figure 2 A flow chart of a page table modification method provided in an embodiment of the present application is applied to a page table protection module. The page table protection module runs in a secure isolation environment and can be preset to have write permission to the memory where the page table entry is located. Figure 2 As shown, the method may include:
[0037] S201: Obtain a page table modification instruction, where the page table modification instruction is used to indicate a page table entry to be modified and an operation on the page table entry.
[0038] In some embodiments, the memory management module can generate a corresponding page table modification instruction based on a memory allocation request or a memory release request sent by a user, so as to implement memory allocation or release by modifying a page table entry. The memory management module sends the page table modification instruction to the page table protection module, which verifies the page table modification instruction.
[0039] The page table modification instruction may include a page table entry to be modified and an operation on the page table entry, wherein the page table entry to be modified may be represented by a virtual address of the page table entry, and the operation on the page table entry is the content included in the page table entry.
[0040] In some embodiments, for efficient management, physical memory is divided into fixed-size blocks, called pages. The size of a physical page is determined by the hardware and can be 4KB, 8KB, 16KB, etc. Part of the physical page is used to store a page table, which is a special data structure placed in the memory to record the mapping relationship between the first address of each block of physical memory and the virtual address.
[0041] Each page table may contain multiple page table entries. Usually, a page table entry may contain information of multiple fields such as valid bit, protection bit, physical page frame number, access bit, modification bit, etc. Among them, the valid bit is used to indicate whether the page table entry is valid; the protection bit is used to indicate the access rights of the physical page corresponding to the page table entry, which usually include read, write, execute and other permissions, which can also be called read mapping, write mapping and execute mapping, etc.; the physical page frame number is used to indicate the location of the physical page corresponding to the page table entry in the memory.
[0042] S202: If the type of the physical page corresponding to the page table entry is in the initial state, and the operation is used to change the type of the physical page from the initial state to the page table, remove the kernel state write mapping of the page table entry, record the removal operation, and modify the type of the physical page to the page table.
[0043] The page table may include a user state page table and a kernel page table, each of which contains multiple page table entries. The user state page table is used to manage the mapping relationship between the user state virtual memory space of the process and the physical memory. The kernel page table is used to represent the layout of the kernel state virtual address.
[0044] In some embodiments, the type of the physical page corresponding to the page table entry can be obtained through a finite state machine. A finite state machine is maintained for each page to track the type changes of the page table at runtime and maintain the consistency of the physical page type in real time.
[0045] In an implementation scenario, when the type of a physical page is changed from an initial state to a user-mode page table, the corresponding operation may be an allocation (alloc) operation.
[0046] In another implementation scenario, when the type of the physical page is changed from an initial state to a kernel page table, the corresponding operation may be a kernel page table initialization (init) operation.
[0047] In some embodiments, when the type of a physical page is changed from an initial state to a page table and the write mapping of the page table entry in the kernel state is removed, since the physical page is changed to a page table, other existing page table entries corresponding to the physical page also need to remove the write mapping. Specifically, all page table entries contained in the page table may be traversed to find the page table entry pointing to the physical page to remove the write mapping contained in the page table entry, and the removal operation is added to the historical page table entry operation record until the traversal is completed and the type of the physical page is set to the page table.
[0048] S203: If the type of the physical page corresponding to the page table entry is a page table, and the operation is used to release the page table, the write mapping of the page table entry is restored through the recorded removal operation, and the type of the physical page is modified to an initial state.
[0049] In one implementation scenario, the type of the physical page can be set to a user-mode page table. When the operation is a free operation, the user-mode page table can be modified to the initial state, that is, the physical page memory pointed to by the page table entry is cleaned up to release the physical memory. Specifically, the historical page table entry operation records can be traversed, and the write mapping of the corresponding page table entry can be restored through the recorded removal operation until the traversal is completed, and the type of the physical page is modified to the initial state. It should be noted that the number of page table entries that need to restore the write mapping can be one or more.
[0050] In another implementation scenario, for the kernel page table, it can be set that the kernel page table cannot be modified to a physical page in an initial state to ensure the normal operation of the kernel.
[0051] The embodiment of the present application provides a page table modification method, obtains a page table modification instruction, and the page table modification instruction is used to indicate the page table item to be modified and the operation on the page table item. If the type of the physical page corresponding to the page table item is the initial state, and the operation is used to change the type of the physical page from the initial state to the page table, then the kernel state write mapping of the page table item is removed, the removal operation is recorded, and the type of the physical page is modified to the page table. If the type of the physical page corresponding to the page table item is a page table, and the operation is used to release the page table, the write mapping of the page table item is restored through the recorded removal operation, and the type of the physical page is modified to the initial state. In the operating system of the present application, the page table modification operation is implemented by a page table protection module running in a secure isolation environment, and the operating system's write permission to the physical page where the page table is located is removed. The page table can only be modified in a secure isolation environment, which is conducive to preventing attackers from making unexpected tampering with the page table, preventing the addition of executable mappings of the kernel and the modification of the existing memory layout, effectively improving the security of page table modification, and thus helping to improve kernel security.
[0052] In one or more embodiments of the present application, Figure 3 A flow chart of a method for determining the type of physical page to be migrated provided in an embodiment of the present application, such as Figure 3 As shown, the details are as follows:
[0053] S301: After obtaining a page table modification instruction, determine the current type of the physical page corresponding to the page table entry.
[0054] In some embodiments, the type of physical page can be defined based on the different information stored in the physical page. Specifically, the initialization type of all physical pages, i.e., physical memory, can be collected, and the corresponding type mark can be added to the physical page. For example, if a physical page is used to store a page table, the type of the physical page is marked as a page table. In addition to the initial state and page table, the type of physical page can also include executable ordinary pages, writable ordinary pages, module code segments, module data segments, kernel code segments, and kernel data segments.
[0055] Among them, executable ordinary pages are used to store user-state program execution codes; writable ordinary pages are used to store readable and writable data; module code segments are used to store module program execution codes; module data segments are used to store module data; kernel code segments are used to store kernel execution codes; and kernel data segments are used to store kernel-state data.
[0056] The kernel data segment and the module data segment usually include a read-only data segment and a readable and writable data segment, and the module refers to a module dynamically loaded by the kernel.
[0057] S302: Determine the type of the physical page to be migrated based on the finite state machine according to the current type and operation, so as to modify the type of the physical page to the type to be migrated.
[0058] In some embodiments, the finite state machine may be provided with a mapping relationship between any two types of physical pages for corresponding operations of migration, such as type 1-operation-type 2, so that the type to be migrated can be obtained based on the type and operation of the current physical page.
[0059] In some embodiments, the page table modification instruction also includes permissions to be set for the page table entry, and determines the type of physical page to be migrated based on a finite state machine to modify the type of the physical page to the type to be migrated. It may include: based on a setting permission table, determining whether the physical page corresponding to the type to be migrated allows permissions to be set; if allowed, executing the page table modification instruction to modify the page table entry, and updating the type of the modified page table entry to the type to be migrated.
[0060] The setting permission table is used to record the permissions that are allowed or prohibited to be set corresponding to each type, and the permissions that are allowed or prohibited to be set include at least one of the following: write mapping, read mapping, and execute mapping.
[0061] In some embodiments, when the page table entries are modified while the operating system is running, the page table entries can be checked and verified in a secure isolation environment according to a predefined security policy, i.e., a permission table is set, to improve the security of the operating system. Specifically, the page table protection module can determine whether the corresponding page table entry modification is allowed for the physical page corresponding to the type of mapped physical memory to be migrated. By performing a legality check on the page table modification in a secure isolation environment, it is helpful to improve the security of the page table modification.
[0062] Modifying a page table entry means updating the content of the page table entry corresponding to the page table. Specifically, the protection bit, physical page frame number and other information contained in the page table entry may be modified, and this application does not impose any restrictions on this.
[0063] In one implementation scenario, if the current type of the physical page is in the initial state, the type to be migrated is determined to be an executable normal page according to the operation of the page table entry in the page table modification instruction, and the permission to be set of the page table entry is read mapping. If the permission table records that the executable normal page allows the setting of read mapping, then the page table entry can be modified, and the type of the physical page can continue to be migrated from the initial state to the executable normal page, thereby updating the physical page type.
[0064] In another implementation scenario, if the physical page corresponding to the type to be migrated prohibits the permission to be set, the current processing can be terminated without modifying the page table entry. Taking the executable normal page as an example, if the permission to be set is write mapping, the permission setting table records that the executable normal page does not allow write mapping to be set. At this time, the page table protection module determines that the page table entry cannot be modified and stops the current processing.
[0065] In another implementation scenario, if the type to be migrated is consistent with the current type, the physical page of this type allows the permissions to be set, but there are differences between the permissions to be set and the permissions contained in the current page table entry. For example, the permissions to be set are read mapping, and the permissions contained in the current page table entry are write mapping. At this time, the type of the current physical page can be migrated to the initial state, and then migrated from the initial state to the type to be migrated.
[0066] In some embodiments, the type of the physical page can be modified to the type to be migrated by MMU. MMU can modify the corresponding page table entry based on the virtual address of the page table entry to be modified. The specific process and implementation principle of modifying the page table entry can refer to the above embodiment and will not be repeated here.
[0067] In summary, after obtaining the page table modification instruction, the current type of the physical page corresponding to the page table entry can be determined, and further, the type of the physical page to be migrated can be determined based on the current type and operation. At the same time, in a secure isolation environment, it can also be determined based on the permission table to be set whether the physical page corresponding to the type to be migrated allows the permission to be set. If allowed, the page table entry can be modified and the type of the physical page can be updated, which improves the security of page table modification.
[0068] In one or more embodiments of the present application, the type of physical page to be migrated is determined based on the finite state machine according to the current type and operation, which may include the following situations:
[0069] In one implementation scenario, if the current type is an initial state and the operation is a write mapping, then based on a finite state machine, it is determined that the type to be migrated is a writable ordinary page;
[0070] If the current type is a writable normal page and the operation is to release memory, the type to be migrated is determined to be the initial state based on the finite state machine;
[0071] Among them, the permissions that are prohibited from being set for writable normal pages are execution mapping and module initialization.
[0072] Figure 4 A schematic diagram of a finite state machine provided in an embodiment of the present application is provided to clearly describe the specific information of physical page type migration and physical page type permission setting. Figure 4 Based on the finite state machine shown, the following Tables 1 and 2 are shown. Among them, the finite state machine includes the page table entry operation of the physical page type migration shown in Table 1 and the information such as the page table entry setting permissions corresponding to different physical page types contained in the setting permission table in Table 2.
[0073] Table 1 Physical page type migration table
[0074]
[0075] In Table 1, X map indicates execution mapping, where X indicates execution (Execute); W map indicates write mapping, where W indicates write (Write); rmmod indicates module deletion, and free indicates memory release. When the type of the physical page is in the initial state, it can be recorded as init.
[0076] Table 2 Setting permissions table
[0077]
[0078] Y in Table 2 stands for Yes, indicating that the page table entry corresponding to the physical page of this type can set the corresponding permissions, that is, read mapping, write mapping or execute mapping, and N stands for No, indicating that the page table entry corresponding to the physical page of this type cannot set the corresponding permissions.
[0079] The type migration of the physical page, that is, the type change, is performed in the page table entry modification process, that is, the modification content of the page table entry is identified, and then the type of the corresponding physical page is changed.
[0080] Combination Figure 4 As shown in Table 1, for a writable normal page, based on write mapping, the physical page in the initial state can be modified to a writable normal page. At the same time, based on the operation of releasing memory, the writable normal page can be modified to the physical page in the initial state, thereby realizing the migration of the writable normal page and the physical page in the initial state.
[0081] Combination Figure 4 As can be seen from Table 2, for writable normal pages, the prohibited permission is execution mapping to prevent attackers from adding new user-mode code segments. At the same time, module initialization is also prohibited, and read mapping and write mapping are allowed.
[0082] In one implementation scenario, if the current type is an initial state and the operation is to execute mapping, then based on a finite state machine, it is determined that the type to be migrated is an executable common page;
[0083] If the current type is an executable normal page and the operation is to release memory, the type to be migrated is determined to be the initial state based on the finite state machine;
[0084] Among them, the permissions that are prohibited from being set for executing ordinary pages are write mapping and module initialization.
[0085] Still combined Figure 4 As shown in the finite state machine shown in FIG. 1 and Table 1, for an executable normal page, based on the execution mapping, the type of the physical page can be modified from the initial state to the executable normal page. At the same time, based on the operation of releasing memory, the executable normal page can be modified to the initial state, thereby realizing the migration of the physical page type between the executable normal page and the initial state.
[0086] Combination Figure 4 As shown in Table 2, for executable normal pages, the prohibited permission is write mapping to prevent attackers from tampering with user-mode code segments, and module initialization is also prohibited. The operations allowed for executable normal pages are read mapping and execute mapping.
[0087] In one implementation scenario, if the current state is an initial state and the operation is module initialization, then based on a finite state machine, it is determined that the type to be migrated is a module code segment or a module data segment;
[0088] If the current type is a module code segment or a module data segment, and the operation is to delete the module, then based on the finite state machine, it is determined that the type to be migrated is the initial state;
[0089] Among them, the permissions that are prohibited from being set in the module code segment are read mapping, write mapping, and execute mapping, and the permissions that are prohibited from being set in the module data segment are read mapping, write mapping, and execute mapping.
[0090] The module segment shown in Table 1 includes a module code segment and a module data segment. Figure 4 As shown in the finite state machine shown in FIG. 1 and Table 1, for a module code segment or a module data segment, based on the module initialization operation, the type of the physical page can be modified from the initial state to the module code segment or the module data segment. At the same time, based on the module deletion operation, the module code segment or the module data segment can be modified to the initial state.
[0091] Combination Figure 4 As shown in Table 2, for the module code segment or the module data segment, the prohibited permissions include read mapping, write mapping and execute mapping, so as to prevent attackers from tampering with the data of the module code segment and the module data segment and destroying the contents of the module code segment and the module data segment.
[0092] In one implementation scenario, combined with Figure 4 As shown, for the kernel code segment or the kernel data segment, in order to ensure the normal operation of the kernel, the preset physical page is converted from the initial state to the kernel code segment or the kernel data segment only during the system initialization process. During the operation of the operating system, other types of physical pages cannot be converted to the kernel code segment or the kernel data segment, and the physical pages of the kernel code segment or the kernel data segment no longer increase or decrease. Therefore, the migration method of converting the physical page type init to the kernel code segment or the kernel data segment is not shown in Table 1.
[0093] At the same time, it is also necessary to set the type of physical page to be unable to be converted from the kernel code segment or the kernel data segment to the initial state.
[0094] Combination Figure 4 As shown in Table 2, the permissions that are prohibited from being set for the kernel code segment and the kernel data segment include read mapping, write mapping, and execute mapping, so as to prevent attackers from illegally tampering with the data of the kernel code segment and the kernel data segment and destroying the contents of the kernel code segment and the kernel data segment.
[0095] In some embodiments, Figure 4 Table 1 also shows the migration of the physical page type between the user state page table and the initial state. Specifically, based on the page table entry operation of allocation (alloc), the type of the physical page is changed from the initial state to the user state page table. Based on the page table entry operation of release (free), the type of the physical page can be changed from the user state page table to the initial state.
[0096] As can be seen from Table 2, the permissions that are prohibited from being set for the user-mode page table are read mapping, write mapping, and execute mapping, so as to prevent attackers from reading, writing, and executing the user-mode page table.
[0097] In some embodiments, Figure 4 Table 1 also shows the type migration between the kernel page table and the initial state. Specifically, based on the page table entry operation of kernel page table initialization (init), the type of the physical page can be changed from the initial state to the kernel page table.
[0098] As can be seen from Table 2, the permissions that are prohibited from being set for the kernel page table are read mapping, write mapping, and execute mapping, so as to prevent attackers from reading, writing, and executing the kernel page table.
[0099] The specific modification process of the user state page table and the kernel page table can refer to the other embodiments mentioned above, and the basic principles are basically the same, which will not be repeated here.
[0100] In some embodiments, the method provided in the embodiments of the present application can be implemented in C language or other computer languages, and the present application does not limit this.
[0101] In summary, the type of physical page to be migrated is determined based on the finite state machine according to the current type and the corresponding operation. Furthermore, based on the finite state machine, the permissions that are prohibited from being set for the physical page corresponding to the type to be migrated can also be obtained, so as to verify the permissions to be set contained in the page table modification instruction according to the permissions that are prohibited from being set. If the permissions that are prohibited from being set include the permissions to be set, the page table modification operation is stopped, preventing attackers from adding or deleting kernel-mode executable code to destroy the existing memory layout, destroy the kernel code segment and the content of the read-only data segment, destroy the module code segment and the content of the module read-only data segment, modify the page table, and other operations, thereby improving kernel security.
[0102] Figure 5 A schematic diagram of a page table modification device provided in an embodiment of the present application. Figure 5 As shown, an embodiment of the present application provides a page table modification device 500, which may include an acquisition module 501 and a processing module 502.
[0103] An acquisition module 501 is used to acquire a page table modification instruction, where the page table modification instruction is used to indicate a page table entry to be modified and an operation on the page table entry;
[0104] Processing module 502, for removing the write mapping of the page table entry in kernel state, recording the removal operation, and changing the type of the physical page to the page table if the type of the physical page corresponding to the page table entry is in the initial state and the operation is used to change the type of the physical page from the initial state to the page table;
[0105] The processing module 502 is further used to restore the write mapping of the page table entry through the recorded removal operation and modify the type of the physical page to an initial state if the type of the physical page corresponding to the page table entry is a page table and the operation is used to release the page table.
[0106] The device of this embodiment can be used to execute the method embodiment shown above. Its implementation principle and technical effect are similar and will not be repeated here.
[0107] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present application. Figure 6 As shown, an embodiment of the present application provides an electronic device 600 including a processor 601 and a memory 602, wherein the memory 602 stores codes, and the processor runs the codes stored in the memory 602 to execute the method as described in the above method embodiment.
[0108] The specific implementation process of the processor 601 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.
[0109] In the above Figure 6 In the illustrated embodiment, it should be understood that the processor 601 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.
[0110] The memory 602 may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk storage.
[0111] The processor 601 and the memory 602 are connected via a bus 603. The bus 603 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus 603 may be an address bus, a data bus, a control bus, etc. For ease of representation, the bus 603 in the drawings of the present application is not limited to only one bus or one type of bus.
[0112] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method of the above method embodiment.
[0113] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.
[0114] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.
[0115] An embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, the method provided in any embodiment of the present application is implemented.
[0116] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.
[0117] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.
Claims
1. A page table modification method, characterized in that: Applied to a page table protection module, the page table protection module runs in a secure isolation environment, the method comprising: Obtaining a page table modification instruction, wherein the page table modification instruction is used to indicate a page table entry to be modified and an operation on the page table entry; If the type of the physical page corresponding to the page table entry is in the initial state, and the operation is used to change the type of the physical page from the initial state to the page table, remove the write mapping of the page table entry in the kernel state, record the removal operation, and modify the type of the physical page to the page table; If the type of the physical page corresponding to the page table entry is a page table, and the operation is used to release the page table, the write mapping of the page table entry is restored through the recorded removal operation, and the type of the physical page is modified to an initial state.
2. The method according to claim 1, characterized in that The method further comprises: After obtaining the page table modification instruction, determining the current type of the physical page corresponding to the page table entry; According to the current type and the operation, the type of the physical page to be migrated is determined based on a finite state machine, so as to modify the type of the physical page to the type to be migrated.
3. The method according to claim 2, characterized in that The page table modification instruction also includes permissions to be set for the page table entry; The determining the type of the physical page to be migrated based on the finite state machine to modify the type of the physical page to the type to be migrated includes: Based on the permission setting table, determining whether the physical page corresponding to the type to be migrated allows the permission to be set; If permitted, executing the page table modification instruction to modify the page table entry, and updating the type of the modified page table entry to the type to be migrated; The setting permission table is used to record the permissions allowed or prohibited to be set corresponding to each type, and the permissions allowed or prohibited include at least one of the following: write mapping, read mapping, and execute mapping.
4. The method according to claim 3, characterized in that: The determining the type of the physical page to be migrated based on a finite state machine according to the current type and the operation includes: If the current type is the initial state and the operation is write mapping, then based on the finite state machine, determine that the type to be migrated is a writable ordinary page; If the current type is a writable ordinary page and the operation is to release memory, then based on a finite state machine, determining that the type to be migrated is an initial state; Among them, the permissions that are prohibited from being set for writable normal pages are execution mapping and module initialization.
5. The method according to claim 2, characterized in that: The determining the type of the physical page to be migrated based on a finite state machine according to the current type and the operation includes: If the current type is the initial state and the operation is to execute mapping, then based on the finite state machine, determining that the type to be migrated is an executable common page; If the current type is an executable common page and the operation is to release memory, then based on a finite state machine, determining that the type to be migrated is an initial state; Among them, the permissions that are prohibited from being set for the executable ordinary page are write mapping and module initialization.
6. The method according to claim 2, characterized in that The determining the type of the physical page to be migrated based on a finite state machine according to the current type and the operation includes: If the current state is the initial state and the operation is module initialization, then based on the finite state machine, determining that the type to be migrated is a module code segment or a module data segment; If the current type is a module code segment or a module data segment, and the operation is to delete the module, then based on a finite state machine, determining that the type to be migrated is an initial state; Among them, the permissions that are prohibited from being set in the module code segment are read mapping, write mapping and execute mapping, and the permissions that are prohibited from being set in the module data segment are read mapping, write mapping and execute mapping.
7. A page table modification device, characterized in that: Applied to a page table protection module, the page table protection module runs in a secure isolation environment, including: An acquisition module, used for acquiring a page table modification instruction, wherein the page table modification instruction is used for indicating a page table entry to be modified and an operation on the page table entry; A processing module, configured to remove the write mapping of the page table entry in the kernel state, record the removal operation, and modify the type of the physical page to the page table if the type of the physical page corresponding to the page table entry is in the initial state and the operation is used to change the type of the physical page from the initial state to the page table; The processing module is also used to restore the write mapping of the page table entry through the recorded removal operation and modify the type of the physical page to an initial state if the type of the physical page corresponding to the page table entry is a page table and the operation is used to release the page table.
8. An electronic device, comprising: A processor and a memory, wherein the memory stores codes, and the processor runs the codes stored in the memory to execute the method according to any one of claims 1 to 6.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.
10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.