RT-Thread security protection method based on PMP

Abstract

The invention discloses an RT-Thread security protection method based on a PMP, and the method comprises the steps: firstly enabling an RT-Thread to reconstruct a thread management module and a context switching module, achieving the hierarchical isolation of a machine mode and a user mode, and adapting to an RISC-V security architecture; secondly, dividing memory hierarchies and setting permissions for the adapted RT-Thread system, and creating a data structure management memory area based on the divided memory hierarchies; and then designing a secure memory application, access and authentication strategy based on the divided memory hierarchy and data structure. And finally, based on the security memory application, access and authentication strategies, designing a thread dynamic permission configuration and nested isolation strategy, and completing security protection of the RT-Thread. According to the invention, multi-level security protection of the memory area is realized, a security strategy is realized in a lightweight manner, security protection with finer granularity can be achieved, and the system security is enhanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of embedded real-time operating system security, and particularly relates to an RT-Thread security protection method based on the physical memory protection (PMP) mechanism of the RISC-V architecture. Background Art

[0002] RISC-V is an open-source instruction set architecture (ISA) based on the reduced instruction set design principle (RISC). Due to its advantages such as modularity, strong flexibility, and high openness, it has been widely promoted in application scenarios such as embedded devices, the Internet of Things (IoT), and industrial control. To support the permission management of system memory access, RISC-V designs three privilege modes: Machine mode (M), Supervisor mode (S), and User mode (U). Among them, the machine mode has the highest privilege and can access all system resources and configure hardware registers, while the user mode has the lowest privilege and is usually used to run untrusted user applications to achieve basic memory isolation and access control.

[0003] To further ensure the security of memory access and prevent untrusted applications from illegally accessing protected memory areas, RISC-V provides a physical memory protection (PMP) mechanism. PMP relies on a set of dedicated registers to configure the access permissions of memory areas, thereby achieving memory access isolation. PMP configuration involves two types of registers: configuration registers (pmpcfg) and address registers (pmpaddr). The configuration register stores memory access permission information, including read, write, execute permissions, address matching methods (such as NAPOT address mode), and lock bits. The role of the lock bit is to prevent the table entry from being tampered with or to elevate permissions when switching privilege modes. The address register is used to specify the starting address and address range of the protected memory area, thereby achieving precise memory area division and permission control.

[0004] Each PMP consists of a configuration register and an address register, which are used to define a memory area and its access permissions. However, the RISC-V hardware implementation usually only supports a limited number of PMPs (usually 4 to 16), resulting in limitations in the system when performing complex memory isolation configurations. Especially in an embedded multi-task environment, when multiple applications or threads need to dynamically allocate memory areas and configure access permissions, the limitation of the number of PMPs will lead to insufficient flexibility in memory protection and may even reduce the system performance due to frequent switching of table entry configurations.

[0005] RT-Thread is a lightweight and modular real-time operating system, widely used in resource-constrained embedded systems. It supports core functions such as multi-thread scheduling, dynamic memory management, file system, device drivers, etc. In complex embedded applications, the system usually needs to allocate independent memory areas for different threads or applications to ensure that they cannot access other threads or memory resources beyond the authorized scope. Therefore, how to use the RISC-V PMP mechanism to achieve efficient memory protection isolation in RT-Thread has become an important technical issue for improving system security. Summary of the Invention

[0006] In view of the memory security requirements of RISC-V architecture-based embedded systems in a multi-tasking environment, the present invention proposes a memory protection method based on the RT-Thread real-time operating system. For the RT-Thread real-time operating system, by dynamically configuring the PMP register set, fine-grained memory area division, and access permission control strategies, physical memory isolation between tasks and dynamic protection of critical system resources are achieved, which can be applied to the security protection of sensitive data and programs in Internet of Things devices and high-reliability embedded systems.

[0007] The method includes:

[0008] S1. RT-Thread adapts to the RISC-V security architecture.

[0009] Native RT-Thread runs in the machine mode of RISC-V by default, and the user mode is not enabled. To support the RISC-V multi-privilege-level security architecture and implement subsequent security management mechanisms, it is necessary to reconstruct modules such as thread management and context switching to achieve hierarchical isolation between the machine mode and the user mode.

[0010] S2. Divide the memory hierarchy and set permissions for the adapted RT-Thread.

[0011] The system memory area of the adapted RT-Thread is divided into three levels according to functions and security: SEC_CTL, SEC_DATA, APP_RUN. In addition, a PMP entry is added under APP_RUN to create a sub-domain DISO_Zone.

[0012] SEC_CTL (Security Control Area), fixedly allocates continuous physical memory to store the global access control list (ACL), hash tokens of security threads, and security data of the RT-Thread system. It is configured with exclusive read / write permissions (R / W) for the machine mode (M-Mode) through PMP entries, and user mode threads cannot access it.

[0013] SEC_DATA (Secure Data Area), for secure threads to store sensitive data such as encryption keys and secure protocol stacks. It is configured as machine mode management (R / W) through PMP entries, and user mode can only access it through system calls after security authentication, with dynamic permission opening.

[0014] APP_RUN (Application Run Area) is the default running space for all threads except system threads, with user mode read / write (R / W) permission.

[0015] DISO_Zone (Dynamic Isolation Zone) is a specific area belonging to the application running area, which is dynamically adjusted according to the system operation, changes the PMP entry configuration with thread switching, and serves as isolation protection between user threads.

[0016] S3. Based on the divided memory hierarchy, create data structures to manage memory areas.

[0017] Define a memory area division structure zone_cfg in the divided security control area. The structure zone_cfg records the memory addresses divided in S2, including the level serial number, start and end addresses of the memory hierarchy.

[0018] Define an access control list structure acl. The structure contains thread ID, security level, accessible memory areas and permissions.

[0019] Define a token structure token, which contains a secure thread token, thread ID, random number, timestamp, etc.

[0020] S4. Based on the divided memory hierarchy and data structures, design security memory application, access and authentication strategies.

[0021] Secure threads in user mode apply for and access the memory of the secure data area by calling the extended system interface function, and submit authentication parameters such as thread ID, timestamp and random number for authentication. The RT-Thread kernel processes the request through interrupts and blocks direct operation of the secure area in user mode.

[0022] After the interrupt is triggered, the kernel queries the acl entries in the security control area to verify whether the thread has access permission. If it is a secure thread, extract the pre-stored token hash value and validity period in the security control area, compare it with the hash value calculated from the submitted parameters. If it passes, allocate memory and update the newly allocated memory information in the acl entry. If the comparison fails, an exception is triggered, and the kernel closes the exception thread and reclaims resources.

[0023] Ordinary threads in user mode cannot pass the authentication link when applying for secure memory, and the kernel directly rejects and triggers an exception. The memory access process is the same as the application.

[0024] S5. Based on the security memory application, access, and authentication policies, design the thread dynamic permission configuration and nested isolation policies to complete the security protection of RT-Thread.

[0025] When the thread switches, the kernel updates the PMP registers of the dynamic isolation area through inline assembly according to the acl information of the currently running thread, protecting only the memory area of the current thread in the application running area to form nested isolation.

[0026] If a thread accesses the memory area of other threads in the application running area out of bounds, a hardware exception will be triggered. The kernel parses the mcause and the machine mode exception value register mtval register to locate the violation behavior, freezes the thread, and records it.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] 1. Based on the PMP mechanism of RT-Thread integrating RSIC-V, the present invention classifies memory areas, isolates sensitive data to prevent tampering, realizes multi-level security protection of memory areas, and lightweightly implements security policies.

[0029] 2. The present invention introduces a security control access mechanism. Through precise control of thread permissions and mutual isolation between threads, finer-grained security protection can be achieved, enhancing the system security. Brief Description of the Drawings

[0030] Figure 1 is the overall structure diagram of the method;

[0031] Figure 2 is the structure diagram of the PMP register;

[0032] Figure 3 is the schematic diagram of memory space division;

[0033] Figure 4 is the flowchart of thread creation;

[0034] Figure 5 is the flowchart of system memory application;

[0035] Figure 6 is the structure diagram of Zone nested isolation;

[0036] Figure 7 is the test effect of system operation and secure threads;

[0037] Figure 8 is the test effect of isolation between user-mode threads. Detailed Embodiment

[0038] The embodiment of the present invention provides a PMP-based RT-Thread security protection method, referring toFigure 1 As shown in the figure, the method specifically includes:

[0039] S1. Adapt the security architecture of RT-Thread to RISC-V

[0040] S1.1. Modify the assembly files context_gcc.S and interrupt_gcc.S that handle the context of RT-Thread to completely save the thread context in different modes. In the original context-saving assembly of RT-Thread, instead of saving the interrupt enable status bit MPIE of the machine mode status register mstatus before entering the interrupt, save the entire mstatus register.

[0041] S1.2. During the context restoration process, change the default behavior of loading mstatus to the machine mode to completely restore the status of the mstatus register saved in the thread stack before, so that it can completely save and restore the thread context in both machine and user modes.

[0042] S1.3. Modify functions such as thread stack initialization and thread initialization. During the stack initialization process of the thread stack initialization function, the kernel needs to modify the privilege mode bit MPP of the mstatus register according to the thread security level. The MPP of the kernel thread is set to 0b11, and the MPP of the secure thread and normal thread is set to 0b00; in the thread initialization function, call functions such as acl registration and token generation created. The acl registration function is used to register the access control list of the thread, and the token generation function generates the key required for secure thread authentication through SM3. These data will be stored in the security control area.

[0043] S2. Divide the memory hierarchy and permissions

[0044] S2.1. As Figure 2 shown in the figure, write the permissions and protection modes to bits 0 to 4 of the pmpcfg register, and write the protected area to the pmpaddr register. Divide the memory space into: SEC_CTL (security control area), SEC_DATA (secure data area), APP_RUN (application running area), which correspond to pmp0, pmp1, and pmp3 respectively, as specifically Figure 3 shown in the figure.

[0045] S2.2. Set the memory size of the security control area to 4K, which is used to store core data related to system management such as the global access control list and secure thread tokens. The pmp0cfg is configured to be readable and writable only in machine mode, with the NAPOT protection mode, and the pmpaddr0 address is adjacent to the kernel area.

[0046] S2.3. Set the memory size of the secure data area to 4K to store sensitive data such as the keys of secure threads. Set pmp1cfg to machine mode management (R / W), which can be accessed by users after authentication. Use NAPOT protection mode, and the pmpaddr1 address is after the secure control area.

[0047] S2.4. Divide a part of the remaining space into an application running area, which is the running space for user threads. Lock the pmp3cfg permission, and the permission will be dynamically opened in combination with the dynamic isolation area; the dynamic isolation area, as a sub - area of the application running area, is not set, and the pmp2cfg and pmpaddr2 settings will be dynamically updated by the system during runtime.

[0048] S3. Create data structures for managing memory areas

[0049] S3.1. In the 4K space of the secure control area, define the structure bodies zone_cfg, acl, and token respectively. The structure body zone_cfg contains the level serial number, start and end addresses of the memory hierarchy; the access control list acl records the thread ID, security level, accessible memory areas and permissions, and the accessible areas are divided into ordinary areas and secure areas; in addition, the token structure body token contains the identification key, secure thread token, thread ID, random number, timestamp, etc.

[0050] S3.2. The data in zone_cfg will be pre - written according to the hierarchical settings. The identification key in token is preset by the system and used as the basis for creating secure threads. The remaining token parameters and acl are registered and generated when RT - Thread creates a thread. Before that, the thread creation function needs to be modified. In addition to the parameters required for normal thread creation, this function also needs to support passing in the identification key, as shown specifically Figure 4 as follows.

[0051] S3.3. When the RT - Thread system receives a thread creation request, it will verify the identification key passed in by the thread creation function. If the key passes, it proves that there is permission to create a secure thread. Then, call the national cryptography SM3 algorithm to generate a secure thread token in combination with the thread ID, random number, timestamp, etc., and then register the acl form; if the key fails or is not passed in, it is an ordinary thread, and only the acl form will be registered. The forms of each subsequent thread are maintained by the system kernel.

[0052] S4. Secure memory application, access, and authentication policies

[0053] S4.1. As Figure 5 shown, whether it is a secure thread or an ordinary thread, when applying for ordinary memory in the application running area during operation, it can be directly obtained, and only need to update the memory area under its name in the corresponding acl form.

[0054] S4.2. Additionally, if a secure thread needs to apply for secure memory in the secure data area, it needs to call the system interface function, which needs to be extended according to the usage scenario. Here, authentication parameters such as the thread ID, timestamp, and random number are submitted during the call, and then the kernel responds to the call request.

[0055] S4.3. The kernel queries the acl entries in the secure control area, extracts the pre-stored token hash value and validity period in the secure control area, and calls SM3 to calculate a new hash value again based on the submitted information. The two hashes are compared. If passed, the secure memory in the secure data area is allocated to the thread, and at the same time, the acl entries are updated to add information about the newly allocated memory. If the verification fails, an exception is triggered, and the system shuts down the thread to recycle resources.

[0056] S4.4. The access policy for secure memory is the same as the application policy. The operations of the secure thread on the secure memory also need to call the system interface. By passing authentication, access data, and operation commands, the kernel executes the corresponding function according to the passed parameters. The secure thread does not directly operate on the secure memory area.

[0057] S5. Thread dynamic permission configuration and nested isolation policy

[0058] S5.1. Adjust the RT-Thread kernel thread scheduling function, call the created pmp update function before the thread switching function, find the acl entries according to the information of the thread to be switched, and dynamically update the pmp entries in the dynamic isolation area before each entry into the next thread, and open the application running area permissions (R / W / X) of the next thread to form nested protection, as Figure 6 shown.

[0059] S5.2. When a malicious thread is running, it can only access the part of the area defined by the dynamic isolation area in the application running area. When the malicious thread accesses other areas of the application running area beyond the boundary, or accesses the secure control area or the secure data area, a hardware exception will be immediately triggered and enter the hardware exception interrupt handling function.

[0060] S5.3. After the exception is triggered, the kernel will parse the data in the mcause and the machine mode exception value register mtval, locate the violation behavior, freeze the thread and record it.

[0061] S5.4. When a legitimate thread is running, the dynamic update pmp function will open the memory space of the application running area to which the thread belongs during thread switching. The legitimate thread can then access its own area, and the security mechanism will not cause any interference to the operation of the legitimate thread.

[0062] To demonstrate the effects achieved by the invention, in combination with the attached Figure 7 、 Figure 8Explanation is as follows.

[0063] When the RT-Thread system starts, the system first partitions the memory area and initializes the memory pool and control area according to zone_cfg, such as Figure 7 Part A. The address range of the security control area divided is: 0x20003000 - 0x20003fff, the address range of the security data area is: 0x20004000 - 0x20004fff, and the address range of the application running area is: 0x20005000 - 0x2001f800. Then the security data area and the application running area are initialized as memory pools.

[0064] The specific test cases are Figure 7 shown in Part B, which are control commands exported by RT-Thread, including the creation of security threads and ordinary threads and the test commands for security threads and ordinary threads.

[0065] The test process is as Figure 7 shown at C. By entering secapp_init through the msh console, a security thread will be created, printing that the running mode of the security thread is user mode, the issued token is 0x6f6e6c07a22e53a31b0ff811853fb45057106fdebcb9e6306712e7ee22e05647, and information such as the ID. The security memory address area automatically allocated by the system for the security thread is: 0x20004004.

[0066] Combined with the sec_test alloc sec instruction to test the reading and writing of the security memory area of the security thread. The test routine attempts to write the data abcd into the allocated security memory 0x0x20004004. The kernel calculates the token hash as 0x6f6e6c07a22e53a31b0ff811853fb45057106fdebcb9e6306712e7ee22e05647 again according to the authentication information passed in by the thread, which is the same as the token issued when the thread was created, and the authentication passes and the operation can be performed. After the writing is successful, read the data from this address. The reading process also needs to perform the authentication operation first, and the printed result at D indicates that the test is normal and error-free.

[0067] Figure 8 Shown is the creation of an ordinary thread and the test of the access and isolation effects. After entering normal_init in the console, an ordinary thread will be created and information such as the name and running mode of the thread will be printed, such as Figure 8 shown in A. After the ordinary thread runs, after entering the nor_test alloc sec command, as Figure 8At point B in it, the thread attempts to apply for secure memory but the token verification fails and the operation is rejected.

[0068] Figure 8 In C in it, the console inputs "nor_test alloc" to allocate normal memory. The memory block address 0x20008000 is successfully obtained and the address area is successfully accessed. At this time, the test routine attempts to illegally access the address 0x2000a000, immediately triggering a system exception and printing the exception data.

Claims

1. A security protection method for RT-Thread based on PMP, characterized in that, It includes the following steps: S1. Refactor the thread management and context switching modules of RT-Thread to achieve hierarchical isolation between machine mode and user mode, and adapt to the security architecture of RISC-V; S2. Divide the memory levels of the adapted RT-Thread and set permissions; S3. Based on the divided memory levels, create data structures to manage memory regions; S4. Based on the divided memory levels and data structures, design security memory application, access, and authentication policies; S5. Based on the security memory application, access, and authentication policies, design thread dynamic permission configuration and nested isolation policies to complete the security protection of RT-Thread.

2. The RT-Thread security protection method based on PMP according to claim 1, wherein The specific implementation process of step S1 is as follows: S1.

1. Modify the assembly file for RT-Thread to handle the context, and completely save the thread context in different modes. In the original context-saving assembly of RT-Thread, change the saving of the interrupt enable status bit MPIE in the machine mode status register mstatus before entering the interrupt to the saving of the entire mstatus; S1.

2. During the context restoration process, change the default loading of mstatus to the machine mode to completely restore the status of the mstatus register saved in the thread stack before, so as to completely save and restore the thread context in both machine and user modes; S1.

3. Modify the thread stack initialization and thread initialization functions; In the thread stack initialization function, during the stack initialization process, the kernel modifies the privilege mode bit MPP of the mstatus register before entering the interrupt according to the thread security level. The MPP of the kernel thread is set to 0b11, and the MPP of the secure thread and ordinary thread is set to 0b00; in the thread initialization function, call the created acl registration and token generation functions. The acl registration function is used to register the access control list of the thread, and the token generation function generates the key required for secure thread authentication through SM3.

3. The RT-Thread security protection method based on PMP according to claim 2, wherein The specific process of dividing the memory levels and setting permissions in S2 is as follows: Divide the system memory area of the adapted RT-Thread into three levels according to functions and security: the security control area SEC_CTL, the security data area SEC_DATA, and the application running area APP_RUN, and add a PMP entry under APP_RUN to create a sub-domain, namely the dynamic isolation area DISO_Zone; For the SEC_CTL, continuously allocate physical memory fixedly, store the global access control list ACL, the hash token of the secure thread, and the security data of the RT-Thread system; configure it with exclusive read / write permissions R / W for the machine mode M-Mode through PMP entries, and user-mode threads cannot access it; The SEC_DATA is used for secure threads to store encryption keys and security protocol stack data; Configure it with read / write management in the machine mode through PMP entries, and user mode can only access it through system calls after security authentication, and dynamically open permissions; The APP_RUN is the default running space for all threads except system threads, and the permission is read / write R / W in user mode; The DISO_Zone is dynamically adjusted according to the system operation, and changes the PMP entry configuration with thread switching, serving as isolation protection between user threads.

4. The RT-Thread security protection method based on PMP according to claim 3, wherein, The creation of the data structure for managing the memory area described in S3 specifically includes: Define a memory area division structure zone_cfg in the divided security control area. The structure zone_cfg records the memory addresses divided in S2, including the level serial number of the memory hierarchy, the start and end addresses; Define an access control list structure acl, which includes thread ID, security level, accessible memory area and permissions; Define a token structure token, which includes a secure thread token, thread ID, random number and timestamp.

5. The RT-Thread security protection method based on PMP according to claim 4, wherein The data in the structure zone_cfg will be pre-written according to the hierarchical settings. The identification key in the token is preset by the system and serves as the basis for creating a secure thread. The remaining token parameters and acl are registered and generated when RT-Thread creates a thread. Before that, modify the thread creation function. In addition to the parameters required for normal thread creation, the created function supports passing in the identification key; When RT-Thread receives a thread creation request, it verifies the identification key passed in by the thread creation function. If the key passes, it proves that there is permission to create a secure thread. It calls the national cryptography SM3 algorithm to generate a secure thread token in combination with the thread ID, random number, and timestamp, and then registers the acl form; If the key fails or is not passed in, it is an ordinary thread, and only the acl form is registered. The acl form of each subsequent thread is maintained by the RT-Thread kernel.

6. The RT-Thread security protection method based on PMP according to claim 5, wherein The design of the security memory application, access and authentication strategy is as follows: The secure thread in user mode applies for and accesses the memory in the secure data area by calling the RT-Thread interface function, and submits the thread ID, timestamp and random number for authentication. The RT-Thread kernel processes the request through an interrupt, blocking the user mode from directly operating on the secure area; After the interrupt is triggered, the kernel queries the acl entries in the security control area to verify whether the thread has access permission; If it is a secure thread, extract the pre-stored token hash value and validity period in the security control area, compare it with the hash value calculated from the submitted parameters. If it passes, allocate memory and update the newly allocated memory information in the acl entry; If the comparison fails, an exception is triggered, and the kernel closes the exception thread and reclaims resources; Ordinary threads in user mode cannot pass the authentication link when applying for secure memory, and the kernel directly rejects and triggers an exception; The memory access process is the same as the application.

7. The RT-Thread security protection method based on PMP according to claim 6, wherein The design of the thread dynamic permission configuration and nested isolation strategy is as follows: When the thread switches, the kernel updates the PMP register of the dynamic isolation area through inline assembly according to the acl information of the currently running thread, protecting the memory area of the current thread in the application running area, forming nested isolation; If a thread accesses the memory area of other threads in the application running area out of bounds, a hardware exception is triggered. The kernel parses the mcause and the machine mode exception value register mtval to locate the violation behavior, freezes the thread and records it.

Images