Hypervisor-based security defense method and device
By managing process memory allocation and release through the Hypervisor, especially by setting the memory area of secure data structures to read-only, the security risks of Linux operating systems being compromised are resolved, achieving defense-in-depth against the operating system.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING YUANXIN JUNSHENG TECH CO LTD
- Filing Date
- 2025-12-26
- Publication Date
- 2026-04-21
AI Technical Summary
The Linux operating system in the present technology has significant security risks and is easily compromised by malicious code or attackers, which threatens the integrity of the operating system's security mechanisms.
By managing the allocation and release of memory for processes through the Hypervisor, especially by setting the memory area of secure data structures to read-only, critical security data is ensured to be controlled by the Hypervisor, preventing attackers from tampering with it.
Even if the operating system kernel is compromised, the integrity of the operating system's security mechanisms can still be guaranteed, enabling effective defense of the operating system and preventing the modification of critical security data.
Smart Images
Figure CN121902159A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of virtualization technology, and more specifically, to a security defense method and apparatus based on Hypervisor. Background Technology
[0002] With the development of internet technology, application security is threatened by various factors, including security vulnerabilities in the code itself, malicious code injection, and unauthorized attacks or accidental operations by users. How to effectively defend against these security threats has become an urgent problem to solve. Summary of the Invention
[0003] This disclosure provides a hypervisor-based security defense method and apparatus, which can solve the problem of significant security risks posed by the compromise of the Linux operating system in existing technologies. The technical solution provided by this disclosure is as follows: According to one aspect of the embodiments of this disclosure, a Hypervisor-based security defense method is provided, the method comprising: In response to a preset trigger operation, the memory processing type is determined; the memory processing type includes memory allocation or memory release. The hvc command is invoked by calling the virtual machine monitor corresponding to the memory processing type to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command.
[0004] Optionally, the step of invoking the hvc command by calling the virtual machine monitor corresponding to the memory processing type to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command includes: Based on the memory processing type, determine the target interface corresponding to the memory processing type; The target interface calls the hvc command corresponding to the memory processing type to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command.
[0005] Optionally, the interface parameters of the target interface include read / write status parameters and data structure information parameters; When the memory processing type is memory allocation, the read / write status parameter is configured to read-only; the data structure information parameter is configured to be information of at least one secure data structure; the secure data structure is a data structure related to the operating system security mechanism. The step of calling the hvc command corresponding to the memory processing type through the target interface to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command includes: The target interface calls the hvc command corresponding to the memory allocation to instruct the Hypervisor to allocate corresponding memory regions for each secure data structure by executing the Hypervisor memory allocation function, and to set the read / write status of the memory regions corresponding to each secure data structure to read-only.
[0006] Optionally, when the memory handling type is memory release, the step of calling the hvc command corresponding to the memory handling type through the target interface to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command includes: The target interface calls the hvc command corresponding to memory release to instruct the Hypervisor to release the memory regions allocated to each security data structure by executing the Hypervisor memory release function.
[0007] Optionally, the at least one security data structure includes a first data structure, a second data structure, and a third data structure; the first data structure is used to store the authentication and access control information of the process, the second data structure is used to store the security context of the process, and the third data structure is used to store instances of mounted file systems.
[0008] Optionally, the response to a preset trigger operation to determine the memory processing type includes any one of the following: In response to a launch operation for any application, a process corresponding to the application is created, and the memory processing type is determined to be memory allocation; In response to an exit operation for any application, the process corresponding to the application is terminated, and the memory handling type is determined to be memory release.
[0009] Optionally, the step of invoking the hvc command by calling the virtual machine monitor corresponding to the memory processing type to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command includes: By invoking the hvc command corresponding to the memory processing type, the central processing unit switches from the exception level of the operating system kernel to the exception level of the hypervisor, and the hypervisor executes the hypervisor processing function corresponding to the hvc command.
[0010] According to another aspect of the present disclosure, a hypervisor-based security defense device is provided, the device comprising: A memory processing type determination module is used to determine the memory processing type in response to a preset trigger operation; the memory processing type includes memory allocation or memory release. The memory processing module is used to invoke the hvc command by calling the virtual machine monitor corresponding to the memory processing type, so as to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command.
[0011] According to another aspect of the present disclosure, an electronic device is provided, the electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the above-described Hypervisor-based security defense methods.
[0012] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of any of the hypervisor-based security defense methods described above.
[0013] According to one aspect of the present disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the steps of any of the Hypervisor-based security defense methods described above.
[0014] The beneficial effects of the technical solutions provided in this disclosure are: In this embodiment of the disclosure, the allocation or release of process memory is implemented through a hypervisor with higher privileges. Even if the operating system kernel is compromised by a malicious application, the integrity of the operating system's security mechanism can still be guaranteed, thus achieving effective defense against security threats to the operating system.
[0015] Furthermore, the Hypervisor allocates corresponding memory regions for each secure data structure and sets the read / write status of the memory regions corresponding to each secure data structure to read-only. Each secure data structure stores critical information related to security mechanisms, including process identity and permission information, process security context, and mounted file information. Even if the operating system is compromised, attackers cannot obtain this critical security data because it is managed by the Hypervisor. Moreover, by setting the read / write status of the memory regions of each secure data structure to read-only, attackers cannot modify the data stored in each secure data structure, thus achieving a defense-in-depth against the secure data structures in the operating system. Attached Figure Description
[0016] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments of this disclosure will be briefly introduced below.
[0017] Figure 1 A flowchart illustrating a hypervisor-based security defense method provided in this embodiment of the disclosure; Figure 2 This is a schematic diagram of the hierarchical structure under the ARM architecture. Figure 3 A schematic diagram illustrating a memory processing procedure provided in an embodiment of this disclosure; Figure 4 A schematic diagram of a Hypervisor-based security defense device provided in this embodiment of the present disclosure; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation
[0018] The embodiments of this disclosure are described below with reference to the accompanying drawings. It should be understood that the embodiments described below with reference to the accompanying drawings are exemplary descriptions for explaining the technical solutions of the embodiments of this disclosure, and do not constitute a limitation on the technical solutions of the embodiments of this disclosure.
[0019] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the terms “comprising” and “including” as used in embodiments of this disclosure mean that the corresponding feature can be implemented as the presented feature, information, data, step, operation, element, and / or component, but do not exclude implementation as other features, information, data, step, operation, element, component, and / or combinations thereof supported by the art. It should be understood that when we say that an element is “connected” or “coupled” to another element, the one element can be directly connected or coupled to the other element, or it can mean that the one element and the other element are connected through an intermediate element. Furthermore, “connected” or “coupled” as used herein can include wireless connection or wireless coupling. The term “and / or” as used herein indicates at least one of the items defined by the term, for example, “A and / or B” or “A, B” indicates implementation as “A,” or implementation as “B,” or implementation as “A and B.”
[0020] To make the objectives, technical solutions, and advantages of this disclosure clearer, the embodiments of this disclosure will be described in further detail below with reference to the accompanying drawings.
[0021] The following description of several exemplary embodiments illustrates the technical solutions of this disclosure and the technical effects produced by these solutions. It should be noted that the following embodiments can be referenced, learned from, or combined with each other. Identical terms, similar features, and similar implementation steps in different embodiments will not be repeated.
[0022] Figure 1 A flowchart illustrating a hypervisor-based security defense method provided in this disclosure is shown below. Figure 1 As shown, the method includes: Step S110: In response to a preset trigger operation, determine the memory processing type; the memory processing type includes memory allocation or memory release. Step S120: Instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command by calling the virtual machine monitor corresponding to the memory processing type.
[0023] Specifically, in the ARM architecture, the privilege level is called the Exception Level (EL). Figure 2 This is a schematic diagram of the hierarchical structure under the ARM architecture, such as... Figure 2 As shown, the ARM architecture defines three permission levels: EL0: User Mode, used to run ordinary applications, with the lowest privileges, and cannot directly access hardware resources.
[0024] EL1: Kernel Mode, used to run the operating system kernel and device drivers. The kernel runs at this level and has full access to hardware resources.
[0025] EL2: Hypervisor Mode, used to run the Hypervisor. The Hypervisor can manage multiple operating system kernels running on EL1 and provide virtualization support.
[0026] Here, svc stands for Supervisor Call, where Supervisor refers to the operating system kernel. The function of the svc command is to cause the central processing unit (CPU) to switch from EL0 (application mode) to EL1 (kernel mode). hvc stands for Hypervisor Call, and the function of the hvc command is to cause the central processing unit (CPU) to switch from EL1 (kernel mode) to EL2 (Hypervisor mode).
[0027] The method provided in this disclosure can be applied to any electronic device. The execution entity of the method provided in this disclosure can be the operating system kernel in the electronic device, that is, the central processing unit in kernel mode. The operating system can be a Linux system.
[0028] The electronic devices can be terminals or servers. Servers can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers or server clusters that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Terminals can be smartphones (such as Android phones, iOS phones, etc.), tablets, laptops, digital broadcast receivers, MIDs (Mobile Internet Devices), PDAs (Personal Digital Assistants), desktop computers, smart home appliances, in-vehicle terminals (such as in-vehicle navigation terminals, in-vehicle computers, etc.), smart speakers, smartwatches, etc.
[0029] When any application in an electronic device starts or exits, the operating system kernel can create or terminate the process of that application. When creating the process of that application, memory needs to be allocated for that process; when terminating the process of that application, memory needs to be released for that process.
[0030] Optionally, in response to a preset trigger operation, the memory processing type is determined, including: In response to a launch operation for any application, create the process corresponding to the application and determine the memory handling type as memory allocation; In response to an exit operation for any application, terminate the process corresponding to the application and determine the memory handling type as memory release.
[0031] Specifically, when any application starts, the operating system kernel responds to the application's startup operation by creating the corresponding process for that application and determining the memory handling type as memory allocation.
[0032] When any application exits, the operating system kernel responds to the exit operation of that application by terminating the process corresponding to that application and determining the memory handling type as memory release.
[0033] After determining the memory processing type, the operating system kernel can instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command by calling the hvc command corresponding to the memory processing type.
[0034] The `hvc` command triggers an exception, causing the CPU to immediately switch from the current EL1 exception level mode to the higher privileged EL2 exception level. When the CPU is in EL2 (i.e., trapped in Hypervisor mode), it can be understood that processing is done through the Hypervisor. In other words, the operating system kernel can call the `hvc` command corresponding to the memory handling type to cause the CPU to switch from the operating system kernel's exception level to the Hypervisor's exception level (i.e., from EL1 to EL2), and then execute the Hypervisor processing function corresponding to that `hvc` command through the Hypervisor.
[0035] Hypervisor processing functions can be understood as the function code that the hypervisor can execute. The corresponding Hypervisor processing functions differ depending on the HVC command for different memory handling types. When the memory handling type is memory allocation, the corresponding Hypervisor processing function can be the Hypervisor memory allocation function; when the memory handling type is memory deallocation, the corresponding Hypervisor processing function can be the Hypervisor memory deallocation function.
[0036] In existing technologies, process memory is typically allocated or released through the SLUB (Simple List-based UnqueuedBlock, an efficient memory allocator for managing small memory objects in the Linux kernel) allocator in the operating system kernel. In this embodiment, the allocation or release of process memory is achieved through a hypervisor with higher privileges. Even if the operating system kernel is compromised by a malicious application, the integrity of the operating system's security mechanism can still be guaranteed, thus achieving effective defense against security threats to the operating system.
[0037] Figure 3 This is a schematic diagram of a memory processing procedure provided in an embodiment of the present disclosure, such as... Figure 3 As shown, the hvc command is invoked by calling the virtual machine monitor corresponding to the memory handling type to instruct the hypervisor to execute the hypervisor processing function corresponding to the hvc command, including: Step S210: Based on the memory processing type, determine the target interface corresponding to the memory processing type; Step S220: Call the hvc command corresponding to the memory processing type through the target interface to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command.
[0038] Specifically, different interfaces can be set for different memory processing types. After determining the memory processing type, the interface corresponding to the memory processing type can be used as the target interface, and the HVC command corresponding to the memory processing type can be called through the target interface.
[0039] Optionally, the target interface may include at least one interface parameter, which may include a read / write status parameter and a data structure information parameter. The read / write status parameter can be used to characterize the read / write status of the allocated memory region, and the data structure information parameter can be used to characterize the data structure to be processed.
[0040] Linux's security mechanism visualizes security abstractions (such as identity, permissions, and policies) as a set of interrelated core data structures. When a security-related operation occurs, the kernel's security subsystem queries and compares the information stored in these data structures to ultimately decide whether to allow or deny the operation.
[0041] Data structures related to operating system security mechanisms can be called secure data structures. Secure data structures can store critical data that ensures the security of the operating system. When attackers break into the operating system kernel, they can modify these secure data structures to increase their access privileges, causing a great security threat.
[0042] Secure data structures can specifically include at least the following: The first data structure (i.e., `struct cred`): `struct cred` is a key data structure in the Linux kernel used to manage process credentials, primarily storing process authentication and access control information. `struct cred` records user ID, group ID, and permission identifiers, used by the kernel to verify a process's access rights to resources during permission checks. This data structure uniformly manages the permission attributes of processes and threads within the kernel. When exploiting privilege escalation vulnerabilities: tampering with the `cred` data structure (e.g., setting all ID fields to 0) can achieve privilege escalation.
[0043] The second data structure (i.e., struct task_security_struct): struct task_security_struct is the core data structure in the Linux Security Module (LSM) used to store the security context of a process, and is mainly used in security subsystems such as SELinux. This data structure typically contains multiple security identifiers (SIDs) to identify the security attributes of a process under different operating scenarios.
[0044] The third data structure (i.e., struct vfsmount): struct vfsmount is a key data structure in the Linux kernel that describes instances of mounted file systems. Its definition includes the following core fields and functions: mount relationship management, file system association, namespace and sharing mechanisms, and state and lifecycle control.
[0045] When the memory processing type is memory allocation, the read / write status information in the interface parameters of the target interface can be configured as read-only, and the data structure information can be configured as information of at least one secure data structure, such as the name of at least one secure data structure, or the data structure identifier of at least one secure data structure.
[0046] Based on this, the target interface calls the HVC command corresponding to the memory processing type to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the HVC command, including: The target interface calls the corresponding hvc command for memory allocation, instructing the Hypervisor to allocate corresponding memory regions for each secure data structure by executing the Hypervisor memory allocation function, and setting the read / write status of the memory regions corresponding to each secure data structure to read-only.
[0047] Specifically, when the read / write status information in the interface parameters of the target interface is configured as read-only and the data structure information is configured as at least one secure data structure, the target interface calls the corresponding hvc command for memory allocation, and the Hypervisor executes the Hypervisor memory allocation function to allocate the corresponding memory area for each secure data structure, and sets the read / write status of the memory area corresponding to each secure data structure to read-only.
[0048] In this embodiment, a Hypervisor allocates corresponding memory regions for each secure data structure and sets the read / write status of the memory regions corresponding to each secure data structure to read-only. Each secure data structure stores key information related to security mechanisms, including process identity and permission information, process security context, and mounted file information. Even if the operating system is compromised, attackers cannot obtain this critical security data because it is managed by the Hypervisor. Furthermore, by setting the read / write status of the memory regions of each secure data structure to read-only, attackers cannot modify the data stored in each secure data structure, thus achieving defense-in-depth against the secure data structures in the operating system.
[0049] As an optional embodiment, when the memory handling type is memory release, the hvc command corresponding to the memory handling type is called through the target interface to instruct the Hypervisor to execute the Hypervisor handling function corresponding to the hvc command, including: The target interface calls the corresponding hvc command to release memory, instructing the Hypervisor to release the memory regions allocated for each security data structure by executing the Hypervisor memory release function.
[0050] Specifically, when the memory processing type is memory release, the target interface calls the corresponding hvc command for memory release, and the Hypervisor executes the Hypervisor memory release function to release the memory areas allocated for each security data structure.
[0051] For example, when allocating memory for the `struct cred`, `struct task_security_struct`, and `struct vfsmount` data structures, the SLUB allocator's allocation function calls `hypervisor_ro_alloc` (the target interface for memory allocation), and then it calls a corresponding `hvc` command to notify the Hypervisor to allocate the memory. When freeing memory for these three data structures, the SLUB allocator's allocation function calls `hypervisor_ro_free`, and then it calls a corresponding `hvc` command to release the memory through the Hypervisor. In other words, these three data structures are used by the operating system kernel, but are allocated and freed by the higher-privilege Hypervisor. Even if the operating system kernel is compromised and privileges are escalated, control remains with the Hypervisor, thus ensuring that the operating system's security attributes are not compromised.
[0052] Optionally, the interface parameters of the target interface may include process parameters. Assuming a process with process identifier "first identifier" is created, the memory processing type is first determined to be memory allocation. In the interface corresponding to memory allocation, the read / write status information is configured to read-only, the data structure information is configured to include at least one secure data structure, and the process parameter is configured as the process identifier. The correspondence between the process identifier and at least one secure data structure can be recorded. When it is necessary to terminate the process, the memory processing type is determined to be memory release. In the interface corresponding to memory release, the process parameter is configured as the process identifier. Then, based on the recorded correspondence between the process identifier and at least one secure data structure, at least one secure data structure of the memory to be released can be determined.
[0053] In this embodiment of the disclosure, the integrity of the operating system security mechanism is ensured by allocating and releasing data structures for security attributes in the Hypervisor.
[0054] Figure 4 A schematic diagram of a Hypervisor-based security defense device provided in this disclosure embodiment is shown below. Figure 4 As shown, the apparatus of this embodiment may include: The memory processing type determination module 310 is used to determine the memory processing type in response to a preset trigger operation; the memory processing type includes memory allocation or memory release. The memory processing module 320 is used to call the hvc command by invoking the virtual machine monitor corresponding to the memory processing type, so as to instruct the virtual machine monitor Hypervisor to execute the Hypervisor processing function corresponding to the hvc command.
[0055] As an optional embodiment, when the memory processing module invokes the hvc command by calling the virtual machine monitor corresponding to the memory processing type to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command, it is used to: Based on the memory processing type, determine the target interface corresponding to the memory processing type; The target interface calls the hvc command corresponding to the memory processing type to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command.
[0056] As an optional embodiment, the interface parameters of the target interface include read / write status parameters and data structure information parameters; When the memory processing type is memory allocation, the read / write status parameter is configured to read-only; the data structure information parameter is configured to be information of at least one secure data structure; the secure data structure is a data structure related to the operating system security mechanism. When the memory processing module calls the hvc command corresponding to the memory processing type through the target interface to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command, it is used to: The target interface calls the hvc command corresponding to the memory allocation to instruct the Hypervisor to allocate corresponding memory regions for each secure data structure by executing the Hypervisor memory allocation function, and to set the read / write status of the memory regions corresponding to each secure data structure to read-only.
[0057] As an optional embodiment, when the memory processing type is memory release, the memory processing module, when calling the hvc command corresponding to the memory processing type through the target interface to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command, is used to: The target interface calls the hvc command corresponding to memory release to instruct the Hypervisor to release the memory regions allocated to each security data structure by executing the Hypervisor memory release function.
[0058] As an optional embodiment, the at least one security data structure includes a first data structure, a second data structure, and a third data structure; the first data structure is used to store the authentication and access control information of the process, the second data structure is used to store the security context of the process, and the third data structure is used to store instances of mounted file systems.
[0059] As an optional embodiment, the memory processing type determination module is used for any of the following: In response to a launch operation for any application, a process corresponding to the application is created, and the memory processing type is determined to be memory allocation; In response to an exit operation for any application, the process corresponding to the application is terminated, and the memory handling type is determined to be memory release.
[0060] As an optional embodiment, when the memory processing module invokes the hvc command by calling the virtual machine monitor corresponding to the memory processing type to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command, it is used to: By invoking the hvc command corresponding to the memory processing type, the central processing unit switches from the exception level of the operating system kernel to the exception level of the hypervisor, and the hypervisor executes the hypervisor processing function corresponding to the hvc command.
[0061] In this embodiment of the disclosure, the allocation or release of process memory is implemented through a hypervisor with higher privileges. Even if the operating system kernel is compromised by a malicious application, the integrity of the operating system's security mechanism can still be guaranteed, thus achieving effective defense against security threats to the operating system.
[0062] Furthermore, the Hypervisor allocates corresponding memory regions for each secure data structure and sets the read / write status of the memory regions corresponding to each secure data structure to read-only. Each secure data structure stores critical information related to security mechanisms, including process identity and permission information, process security context, and mounted file information. Even if the operating system is compromised, attackers cannot obtain this critical security data because it is managed by the Hypervisor. Moreover, by setting the read / write status of the memory regions of each secure data structure to read-only, attackers cannot modify the data stored in each secure data structure, thus achieving a defense-in-depth against the secure data structures in the operating system.
[0063] The apparatus of this disclosure embodiment can execute the method provided in this disclosure embodiment, and its implementation principle is similar, and it has corresponding technical effects. The actions performed by each module in the apparatus of each embodiment of this disclosure correspond to the steps in the method of each embodiment of this disclosure. For a detailed functional description of each module of the apparatus, please refer to the description in the corresponding method shown above, and it will not be repeated here.
[0064] In this disclosure, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.
[0065] This disclosure provides an electronic device including a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement the steps of the method provided in any optional embodiment of this disclosure. Compared with the prior art, this achieves the following: by allocating or releasing the memory of processes through a hypervisor with higher privileges, the integrity of the operating system's security mechanisms can be guaranteed even after the operating system kernel has been compromised by malicious applications, thus achieving effective defense against security threats to the operating system.
[0066] In one alternative embodiment, an electronic device is provided, such as Figure 5As shown, Figure 5 The illustrated electronic device 4000 includes a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, for example, via a bus 4002. Optionally, the electronic device 4000 may further include a transceiver 4004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 4004 is not limited to one type, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of this disclosure.
[0067] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with this disclosure. Processor 4001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.
[0068] Bus 4002 may include a pathway for transmitting information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 4002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.
[0069] The memory 4003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium capable of carrying or storing computer programs and capable of being read by a computer, without limitation herein.
[0070] The memory 4003 is used to store computer programs that execute embodiments of the present disclosure, and its execution is controlled by the processor 4001. The processor 4001 is used to execute the computer programs stored in the memory 4003 to implement the steps shown in the foregoing method embodiments.
[0071] Among them, electronic devices include, but are not limited to: mobile terminals such as mobile phones, laptops, digital radio receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (such as in-vehicle navigation terminals), wearable devices, etc., as well as fixed terminals such as digital TVs, desktop computers, etc.
[0072] This disclosure provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the steps and corresponding content of the aforementioned method embodiments.
[0073] This disclosure also provides a computer program product, including a computer program that, when executed by a processor, can implement the steps and corresponding content of the aforementioned method embodiments.
[0074] It should be understood that although arrows indicate various operation steps in the flowcharts of the embodiments of this disclosure, the order in which these steps are implemented is not limited to the order indicated by the arrows. Unless explicitly stated herein, in some implementation scenarios of the embodiments of this disclosure, the implementation steps in each flowchart can be executed in other orders as required. Furthermore, some or all of the steps in each flowchart may include multiple sub-steps or multiple stages based on the actual implementation scenario. Some or all of these sub-steps or stages can be executed at the same time, and each sub-step or stage can also be executed at different times. In scenarios where execution times differ, the execution order of these sub-steps or stages can be flexibly configured as required, and the embodiments of this disclosure do not limit this.
[0075] The above description is only an optional implementation method for some implementation scenarios of this disclosure. It should be noted that for those skilled in the art, other similar implementation methods based on the technical concept of this disclosure, without departing from the technical concept of this disclosure, also fall within the protection scope of the embodiments of this disclosure.
Claims
1. A security defense method based on Hypervisor, characterized in that, include: In response to a preset trigger operation, determine the memory processing type; The memory processing types include memory allocation or memory release; The hvc command is invoked by calling the virtual machine monitor corresponding to the memory processing type to instruct the virtual machine monitor (Hypervisor) to execute the Hypervisor processing function corresponding to the hvc command.
2. The method according to claim 1, characterized in that, The step of invoking the hvc command by calling the virtual machine monitor corresponding to the memory processing type to instruct the virtual machine monitor (Hypervisor) to execute the Hypervisor processing function corresponding to the hvc command includes: Based on the memory processing type, determine the target interface corresponding to the memory processing type; The target interface calls the hvc command corresponding to the memory processing type to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command.
3. The method according to claim 2, characterized in that, The interface parameters of the target interface include read / write status parameters and data structure information parameters; When the memory processing type is memory allocation, the read / write status parameter is configured to read-only; the data structure information parameter is configured to be information of at least one secure data structure; the secure data structure is a data structure related to the operating system security mechanism. The step of calling the hvc command corresponding to the memory processing type through the target interface to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command includes: The target interface calls the hvc command corresponding to the memory allocation to instruct the Hypervisor to allocate corresponding memory regions for each secure data structure by executing the Hypervisor memory allocation function, and to set the read / write status of the memory regions corresponding to each secure data structure to read-only.
4. The method according to claim 3, characterized in that, When the memory handling type is memory release, the step of calling the hvc command corresponding to the memory handling type through the target interface to instruct the Hypervisor to execute the Hypervisor processing function corresponding to the hvc command includes: The target interface calls the hvc command corresponding to the memory release, instructing the Hypervisor to release the memory regions allocated to each security data structure by executing the Hypervisor memory release function.
5. The method according to claim 3, characterized in that, The at least one security data structure includes a first data structure, a second data structure, and a third data structure; the first data structure is used to store the authentication and access control information of the process, the second data structure is used to store the security context of the process, and the third data structure is used to store instances of mounted file systems.
6. The method according to any one of claims 1 to 5, characterized in that, The response to a preset trigger operation determines the memory processing type, including any one of the following: In response to a launch operation for any application, a process corresponding to the application is created, and the memory processing type is determined to be memory allocation; In response to an exit operation for any application, the process corresponding to the application is terminated, and the memory handling type is determined to be memory release.
7. The method according to any one of claims 1 to 5, characterized in that, The step of invoking the hvc command by calling the virtual machine monitor corresponding to the memory processing type to instruct the virtual machine monitor (Hypervisor) to execute the Hypervisor processing function corresponding to the hvc command includes: By invoking the hvc command corresponding to the memory processing type, the central processing unit switches from the exception level of the operating system kernel to the exception level of the hypervisor, and the hypervisor executes the hypervisor processing function corresponding to the hvc command.
8. A security defense device based on a hypervisor, characterized in that, include: The memory processing type determination module is used to determine the memory processing type in response to a preset trigger operation; The memory processing types include memory allocation or memory release; The memory processing module is used to invoke the hvc command by calling the virtual machine monitor corresponding to the memory processing type, so as to instruct the virtual machine monitor Hypervisor to execute the Hypervisor processing function corresponding to the hvc command.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the method according to any one of claims 1 to 7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 7.
11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 7.