Endpoint management method and device

Abstract

The invention relates to the technical field of computer operating systems, in particular to an endpoint management method, which comprises the following steps of: creating at least one target endpoint capable of realizing inter-thread communication for a new thread based on a preset endpoint processing strategy, associating the new thread with each endpoint, and starting the new thread to execute a target task, the new thread carries a minimum permission set for completing the target task, and each endpoint corresponds to a corresponding owner list and an access control list which are used for limiting access to each endpoint; the preset endpoint processing strategy comprises an endpoint creation strategy and an endpoint destruction strategy; in the process of executing the target task by each endpoint, monitoring the state of each endpoint in real time by adopting an endpoint table, and triggering a safety alarm and taking corresponding measures under the condition that the state of each endpoint is in an abnormal communication behavior; and recording the communication activity of each endpoint in the process of executing the target task, and managing the endpoints among the seL4 microkernel processes through analysis and auditing.

Description

Technical Field

[0001] The present application relates to the technical field of computer operating systems, and in particular to an endpoint management method and device. Background Art

[0002] seL4 is a high-performance, high-security microkernel operating system that provides an endpoint-based IPC mechanism that allows processes to send information and capabilities. However, in traditional implementations, there are potential security risks due to the lack of sophisticated endpoint management.

[0003] In view of this, how to provide an endpoint management method to ensure that only legitimate and authorized processes can communicate effectively has become a technical problem that urgently needs to be solved. Summary of the invention

[0004] The embodiments of the present application provide an endpoint management method, an endpoint management device, an electronic device and a computer storage medium, which are used to solve the problem of how to prevent unauthorized processes from accessing and modifying endpoint data and ensure the security and stability of the system.

[0005] In a first aspect of an embodiment of the present application, an endpoint management method is provided, characterized in that it includes: based on a preset endpoint processing strategy, creating at least one target endpoint that can realize inter-thread communication for a new thread, associating the new thread and each of the endpoints, and starting the new thread to execute a target task, wherein the new thread follows the principle of least privilege, and the new thread carries a minimum privilege set for completing the target task, and each of the endpoints corresponds to a corresponding owner list and access control list for limiting access to each of the endpoints; the preset endpoint processing strategy includes an endpoint creation strategy and an endpoint destruction strategy; in the process of each of the endpoints executing the target task, an endpoint table is used to monitor the status of each of the endpoints in real time, and when the status of the endpoint is in an abnormal communication behavior, a security alarm is triggered and corresponding measures are taken; the communication activities of each of the endpoints in the process of executing the target task are recorded, and the endpoints between the seL4 microkernel processes are managed through analysis and auditing.

[0006] In a second aspect of an embodiment of the present application, an endpoint management device is provided, characterized in that it includes:

[0007] The association module is configured to create at least one target endpoint for the new thread that can realize inter-thread communication based on a preset endpoint processing strategy, associate the new thread with each endpoint, and start the new thread to execute the target task, wherein each endpoint has a corresponding owner list and access control list corresponding to each endpoint, which is used to limit access to each endpoint; the preset endpoint processing strategy includes an endpoint creation strategy and an endpoint destruction strategy;

[0008] The monitoring module is configured to monitor the status of each endpoint in real time using an endpoint table when each endpoint is executing the target task, and trigger a security alarm and take corresponding measures when the status of the endpoint is in abnormal communication behavior;

[0009] The management module is configured to record the communication activities of each endpoint in the process of executing the target task, and manage the endpoints between the seL4 microkernel processes through analysis and auditing.

[0010] In a third aspect of an embodiment of the present application, a computing device is provided, including:

[0011] Memory and processor;

[0012] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the above endpoint management method are implemented.

[0013] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned endpoint management method are implemented.

[0014] The present application provides an endpoint management method, comprising: first, based on a preset endpoint processing strategy, creating at least one target endpoint for a new thread that can realize inter-thread communication, associating the new thread and each of the endpoints, and starting the new thread to execute a target task, wherein the new thread follows the principle of least privilege, and the new thread carries a minimum privilege set for completing the target task, and each of the endpoints corresponds to a corresponding owner list and access control list for limiting access to each of the endpoints; the preset endpoint processing strategy includes an endpoint creation strategy and an endpoint destruction strategy; then, in the process of each of the endpoints executing the target task, an endpoint table is used to monitor the status of each of the endpoints in real time, and when the status of the endpoint is in abnormal communication behavior, a security alarm is triggered and corresponding measures are taken; finally, the communication activities of each of the endpoints in the process of executing the target task are recorded, and the endpoints between seL4 microkernel processes are managed through analysis and auditing.

[0015] The application of the endpoint management method provided in the embodiment of the present application has the following beneficial effects:

[0016] Security enhancement: This invention significantly improves the security of IPC in seL4 system by performing fine-grained access control and ownership management on endpoints. Access control lists (ACLs) ensure that only authorized processes can communicate with endpoints, effectively preventing unauthorized access and potential security threats;

[0017] Performance optimization: The seL4 microkernel is designed to balance performance and security. By optimizing endpoint management, the present invention not only enhances security, but also helps maintain the high performance characteristics of the system. This is because the optimization of endpoint management reduces unnecessary security checks and data transmission, thereby reducing the impact of performance bottlenecks;

[0018] Formal verification: seL4 emphasizes the formal verification of its IPC mechanism, which means that the endpoint management method of the present invention can be verified for correctness and security through formal methods. This verification process helps ensure the stability and reliability of the system;

[0019] Flexibility and scalability: The endpoint management method of the present invention provides a flexible framework that can be adjusted according to different application scenarios and security requirements. This flexibility enables the system to adapt to changing security environments and technical requirements;

[0020] Easy to maintain and update: By introducing endpoint status monitoring and communication auditing, the present invention makes system maintenance and updating easier. Any abnormal behavior can be discovered and handled in a timely manner, and the communication log records are also convenient for post-analysis and auditing;

[0021] In summary, this application optimizes the management of endpoint structures and capability structures to ensure that only legitimate and authorized processes can communicate effectively, which not only enhances the security of IPC in the seL4 system, but also provides the possibility of formal verification while maintaining the high performance of the system, increases the flexibility and scalability of the system, and makes system maintenance and updating easier, while also ensuring the confidentiality of data.

[0022] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, which can be implemented in accordance with the contents of the specification, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0024] Figure 1 A schematic diagram of the structure of an endpoint management system provided in an embodiment of the present application;

[0025] Figure 2 A flowchart of an endpoint management method provided in an embodiment of the present application;

[0026] Figure 3 A schematic diagram of the structure of an endpoint management device provided in an embodiment of the present application;

[0027] Figure 4 A structural block diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0029] See also Figure 1 , Figure 1 This is a schematic diagram of the structure of an endpoint management system provided by an embodiment of the present application. Figure 1 As shown, the endpoint management system involves multiple key components, which achieve highly secure and flexible inter-process communication (IPC) through close collaboration.

[0030] Specifically, the endpoint management system is a seL4 microkernel, and the core components of the component architecture of the system include: kernel (i.e. Kernel) 101, endpoint (i.e. Endpoint) 102, capability space (i.e. Capability Space, CSpace) 103, thread (i.e. Thread) 104, IPC framework (i.e. IPC Framework) 105, frame (i.e. Frame) 106 and scheduler (i.e. Scheduler) 107.

[0031] The seL4 kernel 101 is the core of the system, responsible for managing hardware resources, scheduling threads, handling interrupts, and providing basic system services. The kernel itself is very small and contains only the most basic functions to reduce the attack surface. Mode of action: The kernel interacts with the user space through a message passing mechanism to ensure the stability and security of the system.

[0032] Endpoint 102 is the basic unit of IPC and is used to pass messages between threads. Each endpoint has a unique identifier and can be in different states (such as idle, connected, waiting, etc.). Mode of operation: Threads send and receive messages through endpoints, and the kernel is responsible for maintaining the status of endpoints and message queues.

[0033] Capability Space Function 103: Each thread has its own capability space, which contains the capabilities of all resources that the thread can access. Capability is an unforgeable credential used to access specific objects (such as endpoints, frames, threads, etc.). How it works: Capability space ensures that only threads with corresponding capabilities can access specific resources through permission control, thereby achieving strong isolation and security.

[0034] Thread 104 is the basic execution unit in the system. Each thread has its own register state, stack and capability space. Mode of operation: Threads communicate with other threads through endpoints, and the kernel is responsible for scheduling the execution of threads.

[0035] The IPC framework 105 is a mechanism for implementing efficient IPC in seL4, which supports multiple communication modes and protocols. Mode of action: The IPC framework implements communication between threads through endpoints and message passing mechanisms to ensure the security and efficiency of communication.

[0036] Frame 106 is a memory area used to store data, which can be shared or exclusively used by multiple threads. Function: Frames are managed through capability spaces, and only threads with corresponding capabilities can access data in the frames.

[0037] The scheduler 107 is responsible for managing the threads in the system and deciding which thread should get CPU time. How it works: The scheduler allocates CPU time based on the priority and status of the threads to ensure fairness and responsiveness of the system.

[0038] In the embodiment of the present application, the interaction mode between the various components is as follows: between the kernel and the endpoint, the kernel is responsible for creating, destroying and managing the endpoint, and maintaining the status and message queue of the endpoint; between the endpoint and the thread, the thread sends and receives messages through the endpoint to achieve inter-process communication; between the capability space and the endpoint / frame, the capability space includes the access capability to the endpoint and frame, ensuring that only threads with corresponding capabilities can access these resources; between the IPC framework and the endpoint, the IPC framework uses the endpoint as the basic unit of communication, and achieves communication between threads through a message passing mechanism; between the scheduler and the thread, the scheduler allocates CPU time according to the priority and status of the thread to ensure the fairness and responsiveness of the system.

[0039] In summary, highly secure and flexible inter-process communication is achieved through the close collaboration of a series of key components. These components include kernel, endpoint, capability space, thread, IPC framework, frame and scheduler. They achieve security and efficiency of communication through capability-based access control and message passing mechanism. At the same time, security mechanisms such as the principle of least privilege and formal verification are followed to ensure the overall security and reliability of the system.

[0040] See also Figure 2 , Figure 2 A flowchart of an endpoint management method provided in an embodiment of the present application. Figure 2 As shown, the specific steps include the following steps.

[0041] Step S202: based on the preset endpoint processing strategy, at least one target endpoint that can realize inter-thread communication is created for the new thread, and the new thread and each of the endpoints are associated, and the new thread is started to execute the target task, wherein the new thread follows the principle of least privilege, and the new thread carries the minimum privilege set to complete the target task, and each of the endpoints has a corresponding owner list and access control list corresponding to each of the endpoints, which is used to limit access to each of the endpoints; the preset endpoint processing strategy includes an endpoint creation strategy and an endpoint destruction strategy;

[0042] Step S204: When each of the endpoints is executing the target task, the endpoint table is used to monitor the status of each of the endpoints in real time. When the status of the endpoint is in abnormal communication behavior, a security alarm is triggered and corresponding measures are taken;

[0043] Step S206: Record the communication activities of each endpoint in the process of executing the target task, and manage the endpoints between seL4 microkernel processes through analysis and auditing.

[0044] It should be noted that the principle of least privilege here: seL4 follows the principle of least privilege, that is, each thread only has the minimum set of permissions required to complete the task. This helps reduce potential security risks.

[0045] Access control lists here: Through capability spaces and access control lists (ACLs), seL4 implements fine-grained permission control and strong isolation. Only threads with corresponding capabilities can access specific resources, thus preventing unauthorized access and potential security threats.

[0046] The embodiment of the present application provides an endpoint management method for enhancing the security of inter-process communication in the sel4 microkernel system, which ensures that only legal and authorized processes can communicate effectively by optimizing the management of endpoint structures and capability structures. Specifically, the following steps are included: endpoint creation and destruction, endpoint access control, endpoint ownership transfer, endpoint status monitoring, endpoint encrypted communication, and endpoint communication auditing.

[0047] The embodiment of the present application defines a strict endpoint creation and destruction policy to ensure that each newly created endpoint has a clear owner and access control list (ACL), and is destroyed in a timely manner when the endpoint is no longer needed.

[0048] In the embodiment of the present application, based on the preset endpoint creation strategy, at least one target endpoint that can realize inter-thread communication is created for the new thread, including:

[0049] In the case of creating a new thread, a corresponding thread control block and a virtual address space are allocated to the new thread, and the thread state in the thread control block is initialized, wherein the thread control block carries the thread state and thread attributes corresponding to the new thread, and the thread state carries the thread priority and scheduling policy; the virtual address control carries the thread code, thread data and thread stack corresponding to the new thread;

[0050] At least one endpoint is created based on the thread control block and the virtual address space corresponding to the new thread, and each endpoint corresponds to an access control list, wherein each endpoint corresponding to the new thread included in the access control list is used to receive or send messages.

[0051] In actual applications, the creation of endpoints specifically includes the following steps: First, create a thread control block: In seL4, each thread has a thread control block (TCB), which contains the thread's state and attributes. When you need to create a new thread, you first need to allocate a TCB for the thread; then, allocate address space: allocate a virtual address space (VAS) for the new thread, which will contain the thread's code, data, and stack; second, create an IPC endpoint: In seL4, inter-process communication (IPC) is implemented through endpoints. An endpoint is an object used to send and receive messages. In order to achieve communication between threads, you need to create one or more endpoints for the new thread; then, set the thread state: initialize the thread state in the TCB, including the thread's priority, scheduling policy, etc.; then, associate the endpoint with the thread: associate the created endpoint with the new thread, so that the thread can communicate with other threads through these endpoints; finally, start the thread: After completing the above steps, the new thread can be started and begin to execute its task.

[0052] The method creates at least one target endpoint for the new thread to realize inter-thread communication based on a preset endpoint destruction strategy, including: when the thread corresponding to the new thread executing the target task terminates, the thread control block is recycled and each endpoint corresponding to the new thread is automatically destroyed.

[0053] It also includes: when the thread process corresponding to the execution of the target task by the new thread conforms to the burst thread, the new thread is manually destroyed before the thread is terminated so that the new thread conforms to the target endpoint corresponding to the burst thread, wherein before manually destroying each of the endpoints, it is determined that the target endpoint completes the message sending and receiving tasks, as well as the interaction tasks with other endpoints.

[0054] In actual applications, endpoint destruction can be achieved in two ways. One is automatic destruction: when a thread terminates, its TCB will be recycled, and all endpoints associated with the thread will be automatically destroyed. This is the main strategy for endpoint destruction in seL4, which ensures the timely release of resources. The second is manual destruction: in some cases, a thread may need to manually destroy its endpoint before termination. This can be achieved by calling relevant system calls or APIs, but it is generally not recommended because the automatic destruction mechanism is efficient and safe enough.

[0055] In addition, the embodiment of the present application also considers its safety when destroying: before destroying the endpoint, seL4 will ensure that there is no unfinished message transmission or other activities related to the endpoint. This is achieved by checking the status of the endpoint and related data structures to ensure the safety of the destruction operation.

[0056] In another embodiment of the present application, the method further includes: when the ownership of the target endpoint is transferred in the new thread corresponding to the target task, through the verification strategy, a permission check, a status check and a consistency check are performed on the thread corresponding to the execution of the target task, wherein the permission check is to check the capability set of the thread corresponding to the target task to determine the right to modify the status information and owner information of each endpoint on the thread; the status check is to check the current status of each endpoint on the thread corresponding to the target task to determine that each endpoint on the thread is in an unused state; the consistency check is to check the system data structure using a synchronization mechanism.

[0057] In practical applications, the verification of endpoints specifically includes the following three aspects: The first aspect is permission checking: Before transferring ownership of the endpoint, the system must verify whether the thread initiating the transfer has sufficient permissions to perform this operation. This usually involves checking the thread's capability set to ensure that it has the right to modify the state and owner information of the endpoint; the second aspect is state checking: the system also needs to check the current state of the endpoint to ensure that it is in a state that can be safely transferred. For example, if the endpoint is being used (such as message transmission in progress), it may be necessary to wait for the current operation to complete before transferring ownership; the third aspect is consistency checking: when updating system data structures, it must be ensured that all related changes are atomic and will not cause data inconsistencies or race conditions. This may require the use of locks or other synchronization mechanisms to protect critical data structures.

[0058] During the process of each endpoint executing the target task, an endpoint table is used to monitor the status of each endpoint in real time, including: using an endpoint table to track the endpoint status corresponding to each endpoint, wherein the endpoint table carries an entry corresponding to each endpoint, the entry carries a group of status bits, and the status bits carry status information of each endpoint; periodically checking the endpoint table to update the status information of each endpoint.

[0059] In actual applications, the specific implementation method for endpoint status monitoring is: real-time monitoring of the endpoint status, any abnormal communication behavior will trigger a security alarm, and take corresponding measures.

[0060] Specifically, the method for real-time monitoring of the status of the endpoint includes: implementing real-time monitoring of the endpoint status through an endpoint table, a status bit, a periodic check, an event-driven mechanism, and strict authority and access control.

[0061] More specifically, endpoint table: Use the endpoint table to track the status of all endpoints in the system. Each endpoint has a corresponding entry in the table, which contains the status information of the endpoint, such as whether it is in use, the other endpoint ID connected, permissions, etc.

[0062] Status bits: Each entry in the endpoint table contains a set of status bits that represent different states of the endpoint, such as idle, busy, waiting to close, etc. These status bits provide the system with instant information about the current state of the endpoint.

[0063] Periodic Check: Periodically check the endpoint table to update the status of the endpoint to ensure that the system is aware of the current status of the endpoint, especially for long-running or resource-intensive tasks.

[0064] Event-driven: Supports event-driven monitoring mechanism. When the state of an endpoint changes (such as from idle to busy), the system triggers an event and notifies the relevant monitoring module or handler.

[0065] Access permissions: Access to the endpoint table is controlled. Only threads or processes with appropriate permissions can access or modify the endpoint table. This helps prevent unauthorized access and potential security risks.

[0066] Capability system: Uses a capability-based access control model, where each process has its own capability space (CSpace). The capability space contains references to all resources (including endpoints) that the process can access. In this way, it is ensured that only legitimate operations can access or modify the state of the endpoint.

[0067] Debug interface: Provides a debugging interface that allows developers or system administrators to view and modify the status of endpoints in real time. The interface includes command line tools, graphical interfaces, or APIs.

[0068] Logging: To facilitate post-analysis and troubleshooting, record the change history of endpoint status. These logs can provide valuable information about system behavior and performance.

[0069] When the state of the endpoint is in abnormal communication behavior, a security alarm is triggered and corresponding measures are taken, including: when the state of the endpoint is in abnormal communication behavior, a security alarm is triggered, and an error report is generated and recorded in a log, wherein the abnormal types corresponding to the abnormal communication behavior include permission violation, endpoint non-existence, deadlock, memory leakage and security vulnerability exploitation; according to the abnormal type and severity of the abnormal communication behavior, corresponding measures are taken; spatial isolation and communication isolation are used to strongly isolate the endpoint corresponding to the abnormal communication behavior in the thread; in response to the abnormal communication behavior There is a resource leakage or cannot be released normally, resource recovery and cleanup measures are taken; the abnormal communication behavior is sent to the user end, and the corresponding instructions sent by the user end are executed.

[0070] It should be noted that the permission violation here is: when a thread attempts to access an endpoint that it does not have permission to access, this may cause a permission violation exception.

[0071] Endpoint does not exist here: If a thread tries to access an endpoint that has been destroyed or never created, this may cause an endpoint does not exist exception. Message queue overflow: In some implementations, if an endpoint's message queue is full and another thread tries to send more messages to the queue, this may cause a message queue overflow exception.

[0072] Deadlock here: Although it is not common, in complex IPC scenarios, if multiple threads wait for each other to release resources (such as endpoints), deadlock may occur. In this case, the system will not be able to continue execution until the deadlock is resolved.

[0073] Memory leaks here: If the endpoint or its related resources (such as message queues, buffers, etc.) are not properly released when no longer needed, memory leaks may occur. Over time, this may exhaust the system's available memory and affect the stability of the system.

[0074] Security vulnerabilities here: Although seL4 has a high level of security, there are still potential security vulnerabilities. If these vulnerabilities are exploited, attackers may try to manipulate the state or behavior of the endpoint to bypass security mechanisms or perform malicious operations.

[0075] Measures to deal with abnormal behavior include: error reporting and logging, exception handling mechanisms, security isolation, resource recycling and cleanup, user notification and intervention, and self-repair and recovery.

[0076] Specifically, error reporting and logging: When abnormal behavior of an endpoint is monitored, the seL4 microkernel will generate an error report and record relevant information in the log. These logs can be used for post-analysis to help developers or system administrators understand the cause and context of the abnormality.

[0077] Exception handling mechanism: The seL4 microkernel has a sound exception handling mechanism that can capture and handle various exceptions. For abnormal behavior of the endpoint, the kernel will take appropriate measures based on the type and severity of the exception. For example, for exceptions such as permission violations or endpoint non-existence, the kernel may terminate the relevant operation and return an error code to the caller.

[0078] Security isolation: The seL4 microkernel uses space and communication isolation to achieve strong isolation between processes. This isolation mechanism prevents abnormal behavior of one process from affecting other processes. When abnormal behavior of an endpoint is monitored, the kernel ensures that the exception is confined to the relevant process and does not spread to other processes or system components.

[0079] Resource recovery and cleanup: If abnormal behavior of an endpoint causes resource leakage or cannot be released normally, the seL4 microkernel will take resource recovery and cleanup measures. This may include closing endpoints that are no longer needed, releasing related message queues or buffers, etc. Through these measures, the kernel can ensure system stability and rational use of resources.

[0080] User notification and intervention: In some cases, the seL4 microkernel may send notifications to users to inform them of abnormal behavior of an endpoint. This helps users understand the health of the system in a timely manner and take intervention measures when necessary. For example, users may receive an error message telling them that an endpoint has a permission issue or has been shut down.

[0081] Self-healing and recovery: In some simple anomalies, the seL4 microkernel may attempt to self-heal and recover. For example, if an endpoint is unable to communicate due to a temporary network problem, the kernel may automatically reestablish the connection after the problem is resolved. However, for more complex anomalies, self-healing may not be a viable option and user or system administrator intervention is required.

[0082] In another embodiment of the present application, the method further includes: encrypting the sensitive data using an encryption algorithm.

[0083] In actual applications, the specific implementation method of endpoint encrypted communication is: for the transmission of sensitive information, an encryption algorithm is used to encrypt the data to ensure that even if the data is intercepted, it cannot be interpreted by unauthorized processes.

[0084] Encrypted communication of endpoints is achieved through capability-based access control. Each thread has its own capability space (CSpace), which contains the capabilities of all resources that the thread can access. When a thread needs to communicate with other threads, it uses the IPC (inter-process communication) mechanism to send or receive messages through the endpoint. During the message passing process, it ensures that only threads with corresponding capabilities can access specific endpoints, thereby achieving encryption and isolation of communication. This mechanism effectively prevents unauthorized access and potential security threats.

[0085] In actual applications, the specific implementation method of endpoint communication auditing is to record all communication activities conducted through the endpoint, including time, participating processes, amount of data transmitted, etc., for subsequent analysis and auditing.

[0086] Through the above method, the security of inter-process communication in the seL4 microkernel system can be effectively enhanced, and the system can be protected from potential security threats.

[0087] The application of the method provided in the embodiments of the present application can bring a series of advantages and beneficial effects, including but not limited to the following points:

[0088] Security enhancement: This invention significantly improves the security of IPC in seL4 system by performing fine-grained access control and ownership management on endpoints. Access control lists (ACLs) ensure that only authorized processes can communicate with endpoints, effectively preventing unauthorized access and potential security threats;

[0089] Performance optimization: The seL4 microkernel is designed to balance performance and security. By optimizing endpoint management, the present invention not only enhances security, but also helps maintain the high performance characteristics of the system. This is because the optimization of endpoint management reduces unnecessary security checks and data transmission, thereby reducing the impact of performance bottlenecks;

[0090] Formal verification: seL4 emphasizes the formal verification of its IPC mechanism, which means that the endpoint management method of the present invention can be verified for correctness and security through formal methods. This verification process helps ensure the stability and reliability of the system;

[0091] Flexibility and scalability: The endpoint management method of the present invention provides a flexible framework that can be adjusted according to different application scenarios and security requirements. This flexibility enables the system to adapt to changing security environments and technical requirements;

[0092] Easy to maintain and update: By introducing endpoint status monitoring and communication auditing, the present invention makes system maintenance and updating easier. Any abnormal behavior can be discovered and handled in a timely manner, and the communication log records are also convenient for post-analysis and auditing;

[0093] Data confidentiality: For the transmission of sensitive information, the present invention uses an encryption algorithm to encrypt the data, which can ensure the confidentiality of the data and prevent information leakage even if the data is intercepted;

[0094] In summary, the present invention not only enhances the security of IPC in the seL4 system, but also provides the possibility of formal verification while maintaining the high performance of the system, increases the flexibility and scalability of the system, and makes the maintenance and update of the system easier, while also ensuring the confidentiality of data. These advantages and beneficial effects make the present invention have important application value and broad market potential in the field of operating systems.

[0095] Corresponding to the above method embodiment, this specification also provides an endpoint management device embodiment, Figure 3 This is a schematic diagram of the structure of an endpoint management device provided in an embodiment of the present application. Figure 3 As shown, the device comprises:

[0096] The association module 302 is configured to create at least one target endpoint for the new thread that can realize inter-thread communication based on a preset endpoint processing strategy, associate the new thread with each endpoint, and start the new thread to execute the target task, wherein each endpoint has a corresponding owner list and access control list corresponding to each endpoint, which is used to limit access to each endpoint; the preset endpoint processing strategy includes an endpoint creation strategy and an endpoint destruction strategy;

[0097] The monitoring module 304 is configured to monitor the status of each endpoint in real time using an endpoint table when each endpoint is performing the target task, and trigger a security alarm and take corresponding measures when the status of the endpoint is in abnormal communication behavior;

[0098] The management module 306 is configured to record the communication activities of each endpoint during the execution of the target task, and manage the endpoints between the seL4 microkernel processes through analysis and auditing.

[0099] In an optional embodiment, the association module 302 is further configured to:

[0100] In the case of creating a new thread, a corresponding thread control block and a virtual address space are allocated to the new thread, and the thread state in the thread control block is initialized, wherein the thread control block carries the thread state and thread attributes corresponding to the new thread, and the thread state carries the thread priority and scheduling policy; the virtual address control carries the thread code, thread data and thread stack corresponding to the new thread;

[0101] At least one endpoint is created based on the thread control block and the virtual address space corresponding to the new thread, and each endpoint corresponds to an access control list, wherein each endpoint corresponding to the new thread included in the access control list is used to receive or send messages.

[0102] In an optional embodiment, the association module 302 is further configured to:

[0103] When the thread corresponding to the target task executed by the new thread terminates, the thread control block is recovered, and each of the endpoints corresponding to the new thread is automatically destroyed.

[0104] In an optional embodiment, the association module 302 is further configured to:

[0105] When the thread process corresponding to the target task executed by the new thread conforms to the burst thread, the thread is manually destroyed before termination to make the new thread conform to the target endpoint corresponding to the burst thread, wherein before manually destroying each endpoint, it is determined that the target endpoint completes the message sending and receiving tasks, as well as the interaction tasks with other endpoints.

[0106] In an optional embodiment, the device is further configured to:

[0107] The verification module is configured to perform permission check, status check and consistency check on the thread corresponding to the target task through a verification strategy when the ownership of the target endpoint is transferred in the new thread corresponding to the target task, wherein the permission check is to check the capability set of the thread corresponding to the target task to determine the right to modify the status information and owner information of each endpoint on the thread; the status check is to check the current status of each endpoint on the thread corresponding to the target task to determine that each endpoint on the thread is in an unused state; and the consistency check is to check the system data structure using a synchronization mechanism.

[0108] In an optional embodiment, the monitoring module 304 is further configured to:

[0109] An endpoint table is used to track the endpoint status corresponding to each of the endpoints, wherein the endpoint table carries an entry corresponding to each of the endpoints, the entry carries a set of status bits, and the status bits carry status information of each of the endpoints;

[0110] The endpoint table is checked periodically to update the status information of each endpoint.

[0111] In an optional embodiment, the monitoring module 304 is further configured to:

[0112] When the state of the endpoint is in abnormal communication behavior, a security alarm is triggered, and an error report is generated and recorded in the log, wherein the abnormal types corresponding to the abnormal communication behavior include permission violation, endpoint non-existence, deadlock, memory leak and security vulnerability exploitation;

[0113] Taking corresponding measures according to the abnormal type and severity of the abnormal communication behavior;

[0114] The endpoints corresponding to the abnormal communication behaviors in the thread are strongly isolated by using spatial isolation and communication isolation;

[0115] In response to the abnormal communication behavior causing resource leakage or failure to release resources normally, taking resource recovery and cleanup measures;

[0116] The abnormal communication behavior is sent to the user terminal, and the corresponding instructions sent by the user terminal are executed.

[0117] In an optional embodiment, the device is further configured to:

[0118] The encryption module is configured to encrypt sensitive data using an encryption algorithm.

[0119] The application of the device provided in the embodiments of the present application can bring a series of advantages and beneficial effects, including but not limited to the following points:

[0120] Security enhancement: This invention significantly improves the security of IPC in seL4 system by performing fine-grained access control and ownership management on endpoints. Access control lists (ACLs) ensure that only authorized processes can communicate with endpoints, effectively preventing unauthorized access and potential security threats;

[0121] Performance optimization: The seL4 microkernel is designed to balance performance and security. By optimizing endpoint management, the present invention not only enhances security, but also helps maintain the high performance characteristics of the system. This is because the optimization of endpoint management reduces unnecessary security checks and data transmission, thereby reducing the impact of performance bottlenecks;

[0122] Formal verification: seL4 emphasizes the formal verification of its IPC mechanism, which means that the endpoint management method of the present invention can be verified for correctness and security through formal methods. This verification process helps ensure the stability and reliability of the system;

[0123] Flexibility and scalability: The endpoint management method of the present invention provides a flexible framework that can be adjusted according to different application scenarios and security requirements. This flexibility enables the system to adapt to changing security environments and technical requirements;

[0124] Easy to maintain and update: By introducing endpoint status monitoring and communication auditing, the present invention makes system maintenance and updating easier. Any abnormal behavior can be discovered and handled in a timely manner, and the communication log records are also convenient for post-analysis and auditing;

[0125] Data confidentiality: For the transmission of sensitive information, the present invention uses an encryption algorithm to encrypt the data, which can ensure the confidentiality of the data and prevent information leakage even if the data is intercepted;

[0126] In summary, the present invention not only enhances the security of IPC in the seL4 system, but also provides the possibility of formal verification while maintaining the high performance of the system, increases the flexibility and scalability of the system, and makes the maintenance and update of the system easier, while also ensuring the confidentiality of data. These advantages and beneficial effects make the present invention have important application value and broad market potential in the field of operating systems.

[0127] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the endpoint management device, since it is basically similar to the endpoint management method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the endpoint management method embodiment.

[0128] Figure 4 This is a block diagram of a computing device provided in an embodiment of the present application. The components of the computing device 400 include but are not limited to a memory 410 and a processor 420. The processor 420 is connected to the memory 410 via a bus 430, and the database 450 is used to store data.

[0129] The computing device 400 also includes an access device 440, which enables the computing device 400 to communicate via one or more networks 460. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 440 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0130] In one embodiment of the present specification, the above components of the computing device 400 and Figure 4 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 4 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0131] The computing device 400 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 400 may also be a mobile or stationary server.

[0132] The processor 420 is used to execute the following computer executable instructions, which implement the steps of the above-mentioned endpoint management method when executed by the processor.

[0133] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computing device embodiment, since it is basically similar to the endpoint management method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the endpoint management method embodiment.

[0134] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned endpoint management method.

[0135] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computer-readable storage medium embodiment, since it is basically similar to the endpoint management method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the endpoint management method embodiment.

[0136] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned endpoint management method.

[0137] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computer program embodiment, since it is basically similar to the endpoint management method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the endpoint management method embodiment.

[0138] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0139] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0140] It should be noted that the above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of the present specification.

[0141] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0142] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. An endpoint management method, characterized in that: include: Based on the preset endpoint processing strategy, at least one target endpoint that can realize inter-thread communication is created for the new thread, and the new thread and each endpoint are associated, and the new thread is started to execute the target task, wherein the new thread follows the principle of least privilege, and the new thread carries the minimum privilege set to complete the target task, and each endpoint has a corresponding owner list and access control list corresponding to each endpoint, which is used to limit access to each endpoint; the preset endpoint processing strategy includes an endpoint creation strategy and an endpoint destruction strategy; During the execution of the target task by each endpoint, the status of each endpoint is monitored in real time using an endpoint table, and when the status of the endpoint is in abnormal communication behavior, a security alarm is triggered and corresponding measures are taken; The communication activities of each endpoint in the process of executing the target task are recorded, and the endpoints between the seL4 microkernel processes are managed through analysis and auditing.

2. The method according to claim 1, characterized in that: The step of creating at least one target endpoint for the new thread based on a preset endpoint processing strategy to enable inter-thread communication includes: In the case of creating a new thread, a corresponding thread control block and a virtual address space are allocated to the new thread, and the thread state in the thread control block is initialized, wherein the thread control block carries the thread state and thread attributes corresponding to the new thread, and the thread state carries the thread priority and scheduling policy; the virtual address control carries the thread code, thread data and thread stack corresponding to the new thread; At least one endpoint is created based on the thread control block and the virtual address space corresponding to the new thread, and each endpoint corresponds to an access control list, wherein each endpoint corresponding to the new thread included in the access control list is used to receive or send messages.

3. The method according to claim 1, characterized in that The step of creating at least one target endpoint for the new thread based on a preset endpoint processing strategy to enable inter-thread communication includes: When the thread corresponding to the target task executed by the new thread terminates, the thread control block is recovered, and each of the endpoints corresponding to the new thread is automatically destroyed.

4. The method according to claim 3, characterized in that The method of creating at least one target endpoint for the new thread based on a preset endpoint processing strategy to implement inter-thread communication also includes: When the thread process corresponding to the target task executed by the new thread conforms to the burst thread, the thread is manually destroyed before termination to make the new thread conform to the target endpoint corresponding to the burst thread, wherein before manually destroying each endpoint, it is determined that the target endpoint completes the message sending and receiving tasks, as well as the interaction tasks with other endpoints.

5. The method according to claim 1, characterized in that The method further comprises: When the ownership of the target endpoint is transferred in the new thread corresponding to the target task, the thread corresponding to the target task is subjected to permission check, status check and consistency check through verification strategy, wherein the permission check is to check the capability set of the thread corresponding to the target task to determine the right to modify the status information and owner information of each endpoint on the thread; the status check is to check the current status of each endpoint on the thread corresponding to the target task to determine that each endpoint on the thread is in an unused state; the consistency check is to check the system data structure by adopting a synchronization mechanism.

6. The method according to claim 1, characterized in that The process of each endpoint executing the target task is to use an endpoint table to monitor the status of each endpoint in real time, including: An endpoint table is used to track the endpoint status corresponding to each of the endpoints, wherein the endpoint table carries an entry corresponding to each of the endpoints, the entry carries a set of status bits, and the status bits carry status information of each of the endpoints; The endpoint table is checked periodically to update the status information of each endpoint.

7. The method according to claim 1, characterized in that When the state of the endpoint is in abnormal communication behavior, a security alarm is triggered and corresponding measures are taken, including: When the state of the endpoint is in abnormal communication behavior, a security alarm is triggered, and an error report is generated and recorded in the log, wherein the abnormal types corresponding to the abnormal communication behavior include permission violation, endpoint non-existence, deadlock, memory leak and security vulnerability exploitation; Taking corresponding measures according to the abnormal type and severity of the abnormal communication behavior; The endpoints corresponding to the abnormal communication behaviors in the thread are strongly isolated by using spatial isolation and communication isolation; In response to the abnormal communication behavior causing resource leakage or failure to release resources normally, taking resource recovery and cleanup measures; The abnormal communication behavior is sent to the user terminal, and the corresponding instructions sent by the user terminal are executed.

8. The method according to claim 1, characterized in that The method further comprises: Use encryption algorithms to encrypt sensitive data.

9. An endpoint management device, characterized in that: include: The association module is configured to create at least one target endpoint for the new thread that can realize inter-thread communication based on a preset endpoint processing strategy, associate the new thread with each endpoint, and start the new thread to execute the target task, wherein each endpoint has a corresponding owner list and access control list corresponding to each endpoint, which is used to limit access to each endpoint; the preset endpoint processing strategy includes an endpoint creation strategy and an endpoint destruction strategy; The monitoring module is configured to monitor the status of each endpoint in real time using an endpoint table when each endpoint is executing the target task, and trigger a security alarm and take corresponding measures when the status of the endpoint is in abnormal communication behavior; The management module is configured to record the communication activities of each endpoint during the execution of the target task, and manage the endpoints between the seL4 microkernel processes through analysis and auditing.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an implementation program for information transmission, and when the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images