Information processing apparatus, and information processing method

Abstract

Enhance the security and robustness of the information processing device. An information processing device related to the technology disclosed in this specification includes a system call unit that processes system calls issued when an application uses functions provided by the system software. The system call unit includes a system call main processing unit that processes system calls, a system call restriction control unit that performs restriction control on the execution of system call processing, and a memory data inspection unit that inspects memory data from which the data structure of the system call can be traced from the memory data address passed by the application to the system call unit.

Description

Technical Field

[0001] The technology disclosed in this specification relates to information processing.

Background Art

[0002] An automatic control system is generally a system in which multiple functions cooperate and integrate to perform recognition, judgment, and control.

[0003] For example, an automatic driving system is composed of an automatic driving control unit that generates optimal control parameters from surrounding situations, an engine control unit, a brake control unit, and a steering control unit that respectively realize engine control, brake control, and steering control of a vehicle.

[0004] With the advancement of the autonomy level (e.g., the automatic driving level), an automatic control system constitutes the entire system by network-connecting a plurality of diverse information processing devices. Furthermore, even when adding or updating the services or functions provided by the information processing devices constituting the automatic control system, or when diagnosing the information processing devices, the information processing devices connect to an external system or diagnostic equipment and cooperate to perform processing.

[0005] On the other hand, as the connection and cooperation processing with various systems or devices become more sophisticated, the security risks of the automatic control system also increase. In response, generally, there is an information processing device that has a function of virtually separating the execution environment of software using system software such as an operating system or a container.

[0006] However, even from the programs operating in those execution environments, there remain intentional or accidental risks such as causing the system to malfunction or invading security assets by finding and exploiting vulnerable parts of the system to take over the execution environment.

[0007] In response to such problems, for example, in Patent Document 1, in an application composed of a plurality of programs including a library, a computer, an operation rule application method, and an operating system to which an operation rule for determining whether to permit a system call is applicable are proposed based on which of individual programs (library, application main body) the issued system call belongs to.

[0008] Also, for example, in Patent Document 2, a server computer system control method is proposed in which means for creating an allowable set of system calls by dividing the execution process of a monitored application into processing phases, elapsed time, and other time-dependent elements is provided, and the operating system monitors the execution of a sequence of system calls using the allowable set prepared for each phase in accordance with changes in the processing phase.

Prior Art Documents

Patent Documents

[0009]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0010] The behavior of a service or function with respect to a system is observed by system calls to system software such as an operating system.

[0011] In Patent Document 1, for system calls issued from an application, the operating system determines whether to process the system call for each program (main body, library) that is the source of the issuance.

[0012] In Patent Document 2, an allowable set of system calls is provided and monitored for each processing phase (each time segment) of an application.

[0013] However, the system calls to be issued are infinite in terms of the content of the arguments defined in their call interfaces and their combinations. Even with these disclosure means, the risk of security attacks using the permitted system calls remains. That is, it is not sufficient to determine the permission of system calls only by judging the system call type based on registers or register values according to the application binary interface (ABI) of the system calls.

[0014] The technology disclosed in the present specification has been made in view of the problems described above, and is a technology for strengthening the security of an information processing apparatus.

Means for Solving the Problems

[0015] An information processing apparatus according to a first aspect of the technology disclosed in the present specification is an information processing apparatus in which system software operates on computer hardware including an arithmetic unit and a main memory device, and the system software includes a system call unit that processes system calls issued when an application uses functions provided by the system software. The system call unit includes a system call main processing unit that processes the system calls, a system call restriction control unit that performs restriction control on the execution of the system calls, and a memory data inspection unit that inspects memory data corresponding to the system calls by tracing the data structure of the system calls from the memory data address passed by the application to the system call unit. and a memory data integrity assurance unit that performs a process of ensuring the integrity of the memory data using a pointer address that traces the data structure of the system call from the memory data address passed by the application to the system call unit 。

Advantages of the Invention

[0016] According to at least the first aspect of the technology disclosed in the present specification, it is possible to trace the data structure of a system call based on the memory data address specified by the argument of the system call and verify the validity of the content of the memory data.

[0017] In addition, the objectives, features, aspects, and advantages related to the technology disclosed in the specification of the present application will become even clearer by the following detailed description and the accompanying drawings.

Brief Description of the Drawings

[0018]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Figure 17

Figure 18

Figure 19

Figure 20

Figure 21

Embodiments for Carrying Out the Invention

[0019] Hereinafter, embodiments will be described with reference to the accompanying drawings. In the following embodiments, detailed features and the like are also shown for the purpose of explaining the technology, but these are examples, and not all of them are necessarily essential features for the embodiments to be practicable.

[0020] Note that the drawings are shown schematically, and for the sake of convenience of explanation, omissions or simplifications of the configuration may be made in the drawings as appropriate. Also, the mutual relationships of the sizes and positions of the configurations shown in different drawings are not necessarily accurately described and may be changed as appropriate. Further, in drawings such as a plan view that is not a cross-sectional view, hatching may be added in order to facilitate understanding of the content of the embodiment.

[0021] Also, in the explanations shown below, the same reference numerals are attached to and illustrated for similar components, and their names and functions are also considered the same. Therefore, detailed explanations thereof may be omitted to avoid duplication.

[0022] Also, in the explanations described in the present specification, when a certain component is described as "including", "containing", or "having", etc., it is not an exclusive expression that excludes the existence of other components, unless otherwise specified.

[0023] Also, in the explanations described in the present specification, even when ordinal numbers such as "first" or "second" are used, these terms are used for convenience in order to facilitate understanding of the content of the embodiment, and the content of the embodiment is not limited to the order or the like that may be caused by these ordinal numbers.

[0024] <First Embodiment> Hereinafter, an information processing apparatus and an information processing method according to the present embodiment will be described.

[0025] <Regarding the Configuration of the Information Processing Apparatus> FIG. 1 is a block diagram showing an example of the configuration of an information processing apparatus 1000 according to the present embodiment.

[0026] The information processing apparatus 1000 includes at least a system software 1100, a computer hardware 1200, a system call restriction control setting unit 1300, and applications 1400 and 1401.

[0027] The system call restriction control setting unit 1300 operates on the system software 1100 and may operate within a virtualized and isolated software execution environment of the system setting control container execution environment 1301. The system call restriction control setting unit 1300 sets information related to the system call restriction setting for the system call restriction control table setting unit 1120 in the system software 1100.

[0028] The applications 1400 and 1401 operate on the system software 1100 and may operate within a virtualized and isolated software execution environment of the application container execution environment 1402.

[0029] The system software 1100 includes at least a system call unit 1110, a system call restriction control table setting unit 1120, a log recording unit 1121, a context management unit 1122, a scheduler 1123, a process state management data 1130, a thread state management data 1140, system call restriction control tables 1150, 1151, 1152, and a watchpoint context table 1160.

[0030] Also, when the system call restriction control setting unit 1300, the application 1400 (user program), and the application 1401 (user program) operate in the container execution environment, they may include container execution environment management data 1170. When not including the container execution environment management data 1170, the system call restriction control table 1152 is not provided.

[0031] The system call unit 1110 processes system calls issued from user programs (system call restriction control setting unit 1300, application 1400, and application 1401) operating on the system software 1100. A system call is issued when an application utilizes functions provided by the system software 1100.

[0032] The system call restriction control table setting unit 1120 sets the system call restriction control tables 1150, 1151, and 1152 based on information regarding system call restriction settings from the system call restriction control setting unit 1300.

[0033] The log recording unit 1121 records at least the information output by the system call unit 1110. The log recording is stored, for example, in the main memory device 1205 and the non-volatile memory device 1206 of the computer hardware 1200. The non-volatile memory device 1206 permanently holds the recorded data.

[0034] The context management unit 1122 manages at least the processes or threads representing the executable states of the system call restriction control setting unit 1300, application 1400, and application 1401 operating on the system software 1100 (in the computer hardware 1200).

[0035] The scheduler 1123 assigns the processes or threads representing the executable states of the system call restriction control setting unit 1300, application 1400, and application 1401 operating on the system software 1100 to the arithmetic cores 1201 and 1202 of the computer hardware 1200 to enable program execution.

[0036] The process state management data 1130 describes, for each process including the process state, information regarding at least the system call restriction control setting unit 1300 operating on the system software 1100, and the processes representing the executable states of the applications 1400 and 1401.

[0037] The thread state management data 1140 describes, for each thread, information regarding at least the system call restriction control setting unit 1300 operating on the system software 1100, and the threads representing the minimum execution units that share the memory space of the process in the processes representing the executable states of the applications 1400 and 1401. The thread state management data 1140 may be held in association with the process state management data 1130. In other words, the process state management data 1130 may be data that manages including the thread state management data 1140.

[0038] The system call restriction control tables 1150, 1151, and 1152 describe information regarding restriction control in the execution of system calls.

[0039] When performing system call restriction control for each execution environment, the system call restriction control table may be held in association with the container execution environment management data 1170 as the system call restriction control table 1152. When performing system call restriction control for each process, the system call restriction control table 1151 may be held in association with the process state management data 1130. When performing system call restriction control for each thread, the system call restriction control table 1150 may be held in association with the thread state management data 1140.

[0040] The watchpoint context table 1160 holds information for setting and controlling the watchpoint mechanisms 1203 and 1204 of the computer hardware 1200. The watchpoint context table 1160 may be held in association with the process state management data 1130 for each user process that shares the memory space.

[0041] The container execution environment management data 1170 is held for each container execution environment that virtually separates the execution environment of the program. The container execution environment management data 1170 holds at least the system call restriction control setting unit 1300 included in the container execution environment (system setting control container execution environment 1301, application container execution environment 1402), and the process state management data 1130 of the applications 1400 and 1401.

[0042] The system call unit 1110 includes at least a system call restriction control unit 1111, a user memory data fetch unit 1112, a system call main processing unit 1113, a memory data inspection unit 1114, a memory data integrity ensuring unit 1115, a memory data permission determination unit 1116, and a user memory data fetch event processing unit 1117.

[0043] The system call restriction control unit 1111 performs restriction control in the execution of system call processing.

[0044] The user memory data fetch unit 1112 follows the data structure based on the memory data address specified by the argument of the system call issued from the system call restriction control setting unit 1300, applications 1400 and 1401 operating on the system software 1100, and performs the process of fetching the data (memory data) of the user memory into the memory within the system software (for example, the kernel program of the operating system).

[0045] The system call main processing unit 1113 executes the processing of system calls issued from the system call restriction control setting unit 1300, the application 1400, and the application 1401 that operate on the system software 1100.

[0046] The memory data inspection unit 1114 traces the data structure of the system call based on the memory data address specified by the argument of the system call passed from the application to the system call unit 1110. Then, the memory data inspection unit 1114 performs a process of verifying the validity of the content of the data (memory data) in the user memory corresponding to the system call.

[0047] The memory data integrity assurance unit 1115 traces the data structure from the memory data address specified by the argument of the system call and performs a process of ensuring the integrity of the content of the data (memory data) in the user memory.

[0048] The memory data permission determination unit 1116 traces the data structure based on the memory data address specified by the argument of the system call and performs a permission determination on the content of the data (memory data) in the user memory.

[0049] When the user memory data import event processing unit 1117 is set to generate an event in the user memory data import unit 1112 after performing a process of importing the data in the user memory into the memory within the system software (for example, the kernel program of the operating system), the user memory data import event processing unit 1117 performs event processing due to the event generation.

[0050] The computer hardware 1200 includes at least the arithmetic core 1201, the arithmetic core 1202, the watchpoint mechanisms 1203 and 1204, the main memory device 1205, the non-volatile storage device 1206, and the peripheral device 1207.

[0051] The arithmetic cores 1201 and 1202 are provided with at least one, and the scheduler 1123 of the system software 1100 performs assignment control on the system call restriction control setting unit 1300, the application 1400, and the application 1401 that operate on the system software 1100 including within the container execution environment (system setting control container execution environment 1301, application container execution environment 1402). Also, the arithmetic cores 1201 and 1202 may include a cache for temporarily holding the data of the main memory device 1205.

[0052] The arithmetic cores 1201 and 1202 may execute programs stored in the main memory device 1205, the non-volatile memory device 1206, an external CD-ROM, an external DVD-ROM, or an external flash memory, etc. That is, for example, it may be a central processing unit (CPU), a microprocessor, a microcomputer, or a digital signal processor (DSP).

[0053] When the arithmetic cores 1201 and 1202 execute programs stored in the main memory device 1205, the non-volatile memory device 1206, an external CD-ROM, an external DVD-ROM, or an external flash memory, etc., the system software 1100 is realized by software, firmware, or a combination of software and firmware in which the programs stored in the main memory device 1205 and the non-volatile memory device 1206 are executed by the arithmetic cores 1201 and 1202.

[0054] Software and firmware may be described as programs and stored in the main memory device 1205 and the non-volatile memory device 1206. In that case, the arithmetic cores 1201 and 1202 realize the above functions by reading and executing the programs stored in the main memory device 1205 and the non-volatile memory device 1206. That is, the main memory device 1205 and the non-volatile memory device 1206 may store programs that, when executed by the arithmetic cores 1201 and 1202, result in the realization of the above functions.

[0055] Also, the arithmetic cores 1201 and 1202 may be dedicated hardware. That is, for example, they may be a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination of these circuits.

[0056] When the arithmetic cores 1201 and 1202 are dedicated hardware, the system software 1100 is realized by the operation of the arithmetic cores 1201 and 1202. Note that the functions of the system software 1100 may be realized by separate circuits or a single circuit.

[0057] The watchpoint mechanisms 1203 and 1204 may be provided with at least one or more, and may be provided corresponding to each of the arithmetic cores 1201 and 1202. The watchpoint mechanism is hardware that monitors and restricts access to memory data. The watchpoint mechanism may be provided with one or more watchpoints capable of setting access monitoring and access restriction to memory data. The watchpoint may be set via a watchpoint register (not shown here).

[0058] The scheduler 1123 of the system software 1100 performs allocation control for the system call restriction control setting unit 1300, application 1400, and application 1401 that operate on the system software 1100 including within the container execution environment (system setting control container execution environment 1301, application container execution environment 1402).

[0059] The main memory device 1205 stores data for performing arithmetic processing. The storage area of the main memory device 1205 is subject to allocation control by the system call restriction control setting unit 1300, application 1400, and application 1401 that operate on the system software 1100 including within the container execution environment (system setting control container execution environment 1301, application container execution environment 1402).

[0060] The non-volatile storage device 1206 permanently holds the recorded data. The storage area of the non-volatile storage device 1206 is subject to allocation control by the system call restriction control setting unit 1300, application 1400, and application 1401 that operate on the system software 1100 including within the container execution environment (system setting control container execution environment 1301, application container execution environment 1402).

[0061] The main memory device 1205 and the non-volatile memory device 1206 may be, for example, a memory (recording medium) including a volatile or non-volatile semiconductor memory such as a hard disk drive (i.e., HDD), a random access memory (i.e., RAM), a read only memory (i.e., ROM), a flash memory, an erasable programmable read only memory (EPROM), and an electrically erasable programmable read-only memory (EEPROM), a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, or a DVD, or any recording medium to be used in the future.

[0062] The peripheral device 1207 is a peripheral device included in the information processing apparatus 1000. The peripheral device 1207 may include a communication device and a security module device. The peripheral device 1207 performs assignment control on the system call restriction control setting unit 1300, the application 1400, and the application 1401 that operate on the system software 1100 including within the container execution environment (the system setting control container execution environment 1301 and the application container execution environment 1402).

[0063] FIG. 2 is a diagram showing examples of the system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152 according to the present embodiment.

[0064] The system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152 each include a permitted system call 2000, system call argument information 2001, a permitted set 2002, and capture information 2003 of permitted determination target data.

[0065] The permission system call 2000 describes an identifier of a system call that the system call section 1110 of the system software 1100 permits to execute (permits a system call invocation).

[0066] The system call argument information 2001 describes, for each permission system call 2000, information on the data structure of the arguments of the system call.

[0067] For example, in the permission system call described in the permission system call 2000 (described as syscall_n in FIG. 2), the arguments are composed of a first argument, a second argument, and a third argument, and information on the data structures of the first argument, the second argument, and the third argument is exemplified.

[0068] The information on the data structure of the first argument exemplifies that the register x0 holds a data type (described as unsigned int) that is a 32-bit unsigned integer.

[0069] The information on the data structure of the second argument exemplifies that the register x1 holds a data type (described as char *) that indicates the start address of string data as a memory data address.

[0070] The information on the data structure of the third argument exemplifies that the register x2 holds a data type (described as struct A *) that indicates the address of structure A as a memory data address.

[0071] The information on the data type of structure A of the third argument exemplifies that it holds a data type bool that is a Bool value for a1 indicating a symbol of the data, and a data type (described as struct B *) that indicates the address of structure B data as a memory data address for a2 indicating a symbol of the data.

[0072] The information on the data type of structure B exemplifies that it holds, in b1 indicating the symbol of the data, a data type which is a 32-bit signed integer (described as int), and in b2 indicating the symbol of the data, a data type indicating an array having n 64-bit signed integer data as a memory data address (described as long[n]).

[0073] The allowable set 2002 describes the information on the allowable range of data for each system call argument information 2001. For the description of the allowable range, for example, mathematical expressions and formal expressions such as equal signs, inequality signs, logical formulas, or a set of character strings may be described in a regular expression.

[0074] For example, the data allowable range of the first argument in the permission system call described in the permission system call 2000 (described as syscall_n in FIG. 2) is exemplified as an integer smaller than PATH_MAX (described as x0<PATH_MAX). Note that PATH_MAX may be defined as a positive integer value.

[0075] The data allowable range of the second argument exemplifies that it is "a character string consisting of one or more characters including lowercase letters a to z, uppercase letters A to Z, numbers 0 to 9, and the symbol / as a character string", and "the length of the character string is smaller than PATH_MAX".

[0076] The data allowable range of the third argument exemplifies that there is no setting for the address of structure A (it may be regarded as allowed), and no setting for the data of structure A (it may be regarded as allowed). Also, for the data of structure B, it exemplifies that "b1 which is a 32-bit signed integer is greater than 0", and "the absolute value of each element value of the array having n 64-bit signed integer data is greater than 16".

[0077] The capture information 2003 of the data to be acceptance-determined describes, for each permission system call 2000, at least the order of completion of the capture of the data in the user memory (memory data), the data to be captured, and the size of the captured data. The data to be acceptance-determined corresponds to the memory data that is acceptance-determined using the acceptance set 2002.

[0078] For example, in the permission system call described in the permission system call 2000 (in FIG. 2, it is described as syscall_n), it is exemplified that, first, the data of the structure B is captured by the size of the data of the structure B (using a2 indicating the address symbol of the structure B, it is described as {1, a2, size_a2}). Second, it is exemplified that the data of the string of the second argument is captured by the size of the data of the string (using x1 indicating the address symbol of the structure B, it is described as {2, x1, size_x1}).

[0079] FIG. 3 is a diagram showing an example of the watch point context table 1160 according to the present embodiment.

[0080] The watch point context table 1160 includes a watch point identifier 3000, a thread identifier 3001, an acceptance determination sequence number 3002, a system call identifier 3003, a watch point register setting value 3004, and a watch point state 3005.

[0081] The watch point identifier 3000 describes an identifier indicating the watch points provided by the watch point mechanisms 1203 and 1204.

[0082] For example, it is exemplified that one watch point mechanism includes n watch points indicated by watch point identifiers WP_0 to WP_n - 1.

[0083] The thread identifier 3001 describes an identifier indicating the thread to which the watch point indicated by the watch point identifier 3000 is assigned.

[0084] The allowable determination sequence number 3002 describes the allowable determination order of the data to be determined for setting a watchpoint for each thread identifier 3001. In the allowable determination sequence number 3002, it is shown as at least one set including the thread identifier 3001 and a number indicating the allowable determination order of the data to be determined for setting a watchpoint.

[0085] The system call identifier 3003 describes an identifier indicating a system call (in other words, a system call issued by a thread to which a watchpoint is to be assigned) that is subject to system call restriction control using the watchpoint indicated by the watchpoint identifier 3000.

[0086] The watchpoint register setting value 3004 describes information on the register setting value of the watchpoint indicated by the watchpoint identifier 3000. The watchpoint register setting value 3004 includes at least information corresponding to a memory data address, information corresponding to a size value, and access permission information in order to set a memory area for monitoring and controlling access to memory data.

[0087] The watchpoint state 3005 describes the state of the watchpoint indicated by the watchpoint identifier 3000. The watchpoint state 3005 includes at least in use and free.

[0088] For example, taking FIG. 3 as an example, the watchpoints indicated by the watchpoint identifiers WP_i and WP_j are in use in the system call restriction control of the system call indicated by syscall_n issued by the thread indicated by the thread identifier TID_o. Among them, the watchpoint identifier WP_i has the first allowable determination order, the watchpoint identifier WP_j has the second allowable determination order, and information including an address range with ReadOnly permission as the watchpoint register setting value for each of the watchpoint identifier WP_i and the watchpoint identifier WP_j is exemplified.

[0089] Also, the watchpoint indicated by the watchpoint identifier WP_k is in use in the system call control of the system call indicated by syscall_r issued by the threads indicated by the thread identifier TID_p and the thread identifier TID_q. The allow determination order is the first, and it exemplifies information including an address range with ReadOnly permission as the watchpoint register setting value. As in the example of the watchpoint identifier WP_k, multiple threads may use the same watchpoint register setting value in the system call control of the same system call. If any thread is not using the watchpoint, it may be in an idle state.

[0090] Note that the watchpoint identifier WP_0 and the watchpoint identifier WP_n - 1 exemplify the case where the watchpoint state is idle.

[0091] <Regarding the operation of the information processing apparatus> FIG. 4 is a flowchart showing an example of the operation flow of the system call unit 1110 according to the present embodiment.

[0092] In step ST4000, the system call unit 1110 starts the system call process.

[0093] In step ST4001, the system call unit 1110 executes the process of the system restriction process of the system call restriction control unit 1111.

[0094] In step ST4002, if the determination result of the system call restriction control permits, the system call unit 1110 proceeds to step ST4003. If the determination result of the system call restriction control does not permit, the system call unit 1110 proceeds to step ST4005.

[0095] In step ST4003, the system call unit 1110 executes the data capture process of the user memory data capture unit 1112. If the process is successful, it proceeds to step ST4004. If the process fails, it proceeds to step ST4005.

[0096] In step ST4004, the system call unit 1110 executes the system call process of the system call main process unit 1113.

[0097] In step ST4005, the system call unit 1110 executes the evidence log recording of the log recording unit 1121.

[0098] In step ST4006, the system call unit 1110 executes the post-processing of the system call restriction control of the system call restriction control unit 1111.

[0099] In step ST4007, the system call unit 1110 ends the system call process.

[0100] FIG. 5 is a flowchart showing an example of the operation flow of the system call restriction control unit 1111 according to the present embodiment.

[0101] In step ST5000, the system call restriction control unit 1111 starts the system call restriction control process.

[0102] In step ST5001, the system call restriction control unit 1111 obtains an entry of the permitted system call 2000 that matches the system call issued from the system call restriction control table 1150, the system call restriction control table 1151, the system call restriction control table 1152, the system call restriction control setting unit 1300, the application 1400, and the application 1401 and for which an execution request has been made.

[0103] In step ST5002, the system call restriction control unit 1111 determines whether there is an entry for the permitted system call 2000. If there is an entry for the permitted system call 2000, the process proceeds to step ST5003. If there is no entry for the permitted system call 2000, the process proceeds to step ST5007.

[0104] In step ST5003, the system call restriction control unit 1111 performs a permission determination on the system call argument value. If the result of the permission determination is permission, the process proceeds to step ST5004. If the result of the permission determination is non - permission, the process proceeds to step ST5007. The permission determination of the system call argument value is made by determining whether the argument information (excluding the memory data address) among the system call argument information 2001 corresponding to the permitted system call 2000 is included in the allowable set 2002. For example, in the system call restriction control tables 1150, 1151, and 1152 shown in FIG. 2, among the system call argument information 2001 corresponding to the entry of syscall_n of the permitted system call 2000, the argument information that is not the memory data address becomes the first argument among the first to third arguments, and it is illustrated that it is only necessary to determine whether the first argument is included in the corresponding allowable set 2002.

[0105] In step ST5004, the system call restriction control unit 1111 requests the memory data inspection unit 1114 to execute the process of memory data inspection.

[0106] In step ST5005, if the determination result of the memory data inspection is permission, the system call restriction control unit 1111 proceeds to step ST5006. If the determination result of the memory data inspection is non - permission, the system call restriction control unit 1111 proceeds to step ST5007.

[0107] In step ST5006, the system call restriction control unit 1111 sets the determination result of the system call restriction to permission.

[0108] In step ST5007, the system call control unit 1111 sets the determination result of the system call control to not permitted.

[0109] In step ST5008, the system call control unit 1111 ends the system call control process.

[0110] Figure 6 is a flowchart showing an example of the operation flow of the memory data inspection unit 1114 according to the present embodiment.

[0111] In step ST6000, the memory data inspection unit 1114 starts the memory data inspection process.

[0112] In step ST6001, the memory data inspection unit 1114 executes the memory data integrity ensuring process of the memory data integrity ensuring unit 1115.

[0113] In step ST6002, the memory data inspection unit 1114 executes the memory data permission determination process of the memory data permission determination unit 1116.

[0114] In step ST6003, the memory data inspection unit 1114 ends the memory data inspection process.

[0115] Figure 7 is a flowchart showing an example of the operation flow of the memory data integrity ensuring unit 1115 according to the present embodiment.

[0116] In step ST7000, the memory data integrity ensuring unit 1115 starts the memory data integrity ensuring process.

[0117] In step ST7001, the memory data integrity ensuring unit 1115 acquires the capture information 2003 of the data to be permitted determination from the system call control table 1150, the system call control table 1151, and the system call control table 1152.

[0118] In step ST7002, the memory data integrity assurance unit 1115 attempts to secure, from the watch point context table 1160, entries of the watch point identifier 3000 for which the watch point state 3005 is in the free state, for the number of entries of the data subject to allowance determination. For example, in the system call restriction control tables 1150, 1151, and 1152 shown in FIG. 2, it is exemplified that the number of entries of the data subject to allowance determination is two from the capture information 2003 of the data subject to allowance determination.

[0119] In step ST7003, the memory data integrity assurance unit 1115 assigns the secured entries of the watch point identifier 3000 in the order of data capture completion of the data subject to allowance determination, and sets each corresponding entry (each entry of the thread identifier 3001, the allowance determination sequence number 3002, the system call identifier 3003, and the watch point register setting value 3004) for the entry of the watch point identifier 3000.

[0120] In step ST7004, if the memory data integrity assurance unit 1115 fails to secure entries of the watch point identifier 3000 for the number of entries of the data subject to allowance determination in step ST7002, after the capture process of the data with the last data capture completion order among the data subject to allowance determination for which the entries of the watch point identifier 3000 are assigned in step ST7003, the memory data integrity assurance unit 1115 sets the occurrence of an event in the user memory data capture event processing unit 1117.

[0121] In step ST7005, the memory data integrity assurance unit 1115 repeats steps ST7005, ST7006, ST7007, and ST7008 for each entry of the assigned watch point identifier 3000.

[0122] In step ST7006, when a thread belonging to the same process state management data 1130 as the thread specified by the thread identifier 3001 is being executed on another arithmetic core, the memory data integrity assurance unit 1115 sets the watchpoint registers of the corresponding arithmetic core's watchpoint mechanism 1203 and watchpoint mechanism 1204 according to the watchpoint register setting value 3004. Also, the watchpoint state 3005 entry in the watchpoint context table 1160 is set to in use.

[0123] In step ST7007, for the memory data for which a watchpoint was set in step ST7006, the memory data integrity assurance unit 1115 assigns an authentication code to each pointer address that can trace from the memory data address in the system call argument information 2001 to the memory data address of the watchpoint register setting value.

[0124] For example, in the system call restriction control tables 1150, 1151, and 1152 shown in FIG. 2, in the entry of syscall_n of the permitted system call 2000, for the third argument, the memory data address held in register x2 (described as struct A * indicating the address of structure A) has already been passed to the system call unit 1110, so it may be excluded from the target of authentication code assignment, and each subsequent pointer address becomes the target of authentication code assignment (the address of structure B owned by structure A, a2, and the memory data address described as struct B * are the targets).

[0125] In step ST7008, the memory data integrity assurance unit 1115 determines whether or not to end for the entry of the assigned watchpoint identifier 3000. If it is to end, it proceeds to step ST7009. If it is not to end, it returns to step ST7005.

[0126] In step ST7009, the memory data integrity assurance unit 1115 ends the memory data integrity assurance process.

[0127] FIG. 8 is a flowchart showing an example of the operation flow of the memory data integrity assurance unit 1115 according to the present embodiment.

[0128] In step ST7010, the memory data integrity assurance unit 1115 starts the memory data integrity assurance release process.

[0129] In step ST7011, the memory data integrity assurance unit 1115 releases the authentication code for each pointer address that traces from the memory data address of the system call argument information 2001 to the memory data address of the watchpoint setting, which was performed in step ST7007.

[0130] In step ST7012, if a thread belonging to the same process state management data 1130 as the thread specified by the thread identifier 3001 is being executed on another arithmetic core, the memory data integrity assurance unit 1115 releases the watchpoint setting that was performed in step ST7006.

[0131] In step ST7013, the memory data integrity assurance unit 1115 deletes the entry of the target thread identifier from the thread identifier 3001 entry and the allow determination sequence number 3002 entry in the watchpoint context table 1160. If those entries become empty, the watchpoint state 3005 entry is set to empty.

[0132] In step ST7014, the memory data integrity assurance unit 1115 ends the memory data integrity assurance release process.

[0133] FIG. 9 is a flowchart showing an example of the operation flow of the memory data permission determination unit 1116 according to the present embodiment.

[0134] In step ST8000, the memory data permission determination unit 1116 starts the memory data permission determination process.

[0135] In step ST8001, the memory data permission determination unit 1116 repeats steps ST8001, ST8002, ST8003, ST8004, ST8005, ST8006, and ST8007 for each entry of the assigned watch point identifier 3000.

[0136] In step ST8002, the memory data permission determination unit 1116 acquires the allowable set 2002 of the corresponding memory data from the system call restriction control tables 1150, 1151, and 1152. For example, in the system call restriction control tables 1150, 1151, and 1152 shown in FIG. 2, the allowable set 2002 entry corresponding to the memory data address indicated by the second argument of the system call argument information 2001 and the allowable set 2002 entry corresponding to the "struct B: structure data" traced from the memory data address indicated by the third argument may be acquired.

[0137] In step ST8003, while checking whether the authentication code given in step ST7007 is complete, the memory data permission determination unit 1116 traces from the memory data address in the system call argument information 2001 to the memory data address described in the watch point register setting value 3004 entry set in step ST7003. Note that the reference process of the pointer address including the assignment of the authentication code to the pointer address and the check of whether the assigned authentication code is complete may be performed using instructions supported as hardware functions by the arithmetic cores 1201 and 1202. Also, whether the authentication code is complete can be confirmed, for example, if the value of the authentication code when calculating and assigning the authentication code from the pointer address and the encryption key (e.g., common key) matches the value calculated for the authentication code at the time of confirmation, it can be confirmed that the pointer address is complete (not tampered with). Here, the encryption key (common key) can be managed by the system software, inside the arithmetic core, or the hardware security module.

[0138] If the process of step ST8003 fails, the memory data permission determination unit 1116 disallows the memory data permission determination in step ST8010 and further proceeds to step ST8009. If the process of step ST8003 succeeds, it proceeds to step ST8005. Here, the failure of the process of step ST8003 corresponds to the case where the authentication code is not complete in the process of step ST8003. If the pointer address is tampered with, the check of the authentication code given in step ST7007 fails, and as a result, the process of tracing to the memory data address described in the watch point register setting value 3004 entry fails. On the other hand, the success of the process of step ST8003 corresponds to the case where the authentication code is complete in the process of step ST8003. The process of step ST8003 is considered successful when it is possible to trace from the memory data address in the system call argument information 2001 to the memory data address described in the watch point register setting value 3004 entry set in step ST7003.

[0139] In step ST8005, the memory data permission determination unit 1116 determines whether the memory data within the memory data address range described in the watchpoint register setting value 3004 entry set in step ST7003 is included in the allowable set 2002 acquired in step ST8002. If the memory data within the memory data address range is not included in the allowable set 2002, the memory data permission determination is made not permitted in step ST8010, and the process further proceeds to step ST8009.

[0140] In step ST8007, the memory data permission determination unit 1116 determines whether the entry of the assigned watchpoint identifier 3000 has ended. If it has ended, the process proceeds to step ST8008. If it has not ended, the process returns to step ST8001.

[0141] In step ST8008, the memory data permission determination unit 1116 permits the memory data permission determination.

[0142] In step ST8009, the memory data permission determination unit 1116 ends the memory data permission determination process.

[0143] FIG. 10 is a flowchart showing an example of the operation flow of the user memory data capture event processing unit 1117 according to the present embodiment.

[0144] In step ST9000, the user memory data capture event processing unit 1117 starts the user memory data capture event processing process.

[0145] In step ST9001, the user memory data capture event processing unit 1117 acquires the corresponding watch point identifier 3000 entry in the watch point context table 1160 based on the thread identifier 3001 and the system call identifier 3003 of the user memory data capture event occurrence. Note that the setting of the event occurrence of the user memory data capture event processing unit 1117 is performed in step ST7004.

[0146] In step ST9002, the user memory data capture event processing unit 1117 repeats steps ST9002, ST9003, and ST9004 for each entry of the watch point identifier 3000 acquired in step ST9001.

[0147] In step ST9003, the user memory data capture event processing unit 1117 executes the release of the memory data integrity assurance by the memory data integrity assurance unit 1115 (already described in FIG. 8).

[0148] In step ST9004, the user memory data capture event processing unit 1117 determines whether to end for the entry of the watch point identifier 3000 acquired in step ST9001. If it is to end, it proceeds to step ST9005. If it is not to end, it returns to step ST9002.

[0149] In step ST9005, the user memory data capture event processing unit 1117 executes a memory data inspection (described in FIG. 6) for the entries of the data to be determined for acceptance for which the permission determination has not been performed.

[0150] In step ST9006, the user memory data capture event processing unit 1117 ends the user memory data capture event processing step.

[0151] Here, the process of the system call restriction control post-processing in step ST4006 illustrated in FIG. 4 may be configured to skip step ST9005 illustrated in FIG. 10 and proceed to step ST9000, step ST9001, step ST9002, step ST9003, step ST9004, and then proceed to step ST9006. Also, step ST9001 may be to obtain the corresponding watch point identifier 3000 entry of the watch point context table 1160 based on the thread identifier 3001 that made the system request and the system call identifier 3003, instead of the thread identifier 3001 of the user memory data capture event occurrence.

[0152] FIG. 11 is a flowchart showing an example of the operation flow of the context switch of the context management unit 1122 by the scheduler 1123 according to the present embodiment. Note that the context switch of the context management unit 1122 by the scheduler 1123 may operate on each of the arithmetic cores 1201 and 1202 with respect to its own arithmetic core.

[0153] In step ST10000, the context management unit 1122 starts the context switch process.

[0154] In step ST10001, the context management unit 1122 determines whether the current execution thread is the target of the watch point setting. If it is the target, it proceeds to step ST10002. If it is not the target, it proceeds to step ST10003.

[0155] Regarding the determination method, for example, when the current execution thread belongs to the same process state management data 1130 as the thread specified by the thread identifier 3001 in the watch point context table 1160 and the watch point state 3005 is in use, it may be determined that it is the target of the watch point setting.

[0156] In step ST10002, the context management unit 1122 cancels the setting of the watchpoint indicated by the watchpoint identifier 3000 of the watchpoint mechanism corresponding to the arithmetic core to be context-switched.

[0157] In step ST10003, the context management unit 1122 determines whether the thread to be executed next is the target of watchpoint setting. If it is the target, the process proceeds to step ST10004. If it is not the target, the process proceeds to step ST10005.

[0158] Regarding the determination method, for example, when the thread to be executed next belongs to the same process state management data 1130 as the thread specified by the thread identifier 3001 in the watchpoint context table 1160 and the watchpoint state 3005 is in use, it may be determined that it is the target of watchpoint setting.

[0159] In step ST10004, the context management unit 1122 performs the setting of the watchpoint indicated by the watchpoint identifier 3000 of the watchpoint mechanism corresponding to the arithmetic core to be managed according to the watchpoint register setting value 3004 entry corresponding to the thread identifier 3001.

[0160] In step ST10005, the context management unit 1122 ends the context switch process.

[0161] Note that, for example, when the current execution thread and the thread to be executed next are the same, or when there is no difference in the watchpoint register setting value 3004 between the current execution thread and the thread to be executed next, etc., when the cancellation and setting of the watchpoint are unnecessary, the operation flow of the context switch shown in FIG. 11 may be omitted.

[0162] <Second Embodiment> An information processing apparatus and an information processing method according to the present embodiment will be described. In the following description, components similar to those described in the above-described embodiment will be denoted by the same reference numerals and illustrated, and detailed descriptions thereof will be omitted as appropriate.

[0163] <Regarding the configuration of the information processing apparatus> FIG. 12 is a block diagram showing an example of the configuration of an information processing apparatus 1000A according to the present embodiment. The difference from FIG. 1 is that the information processing apparatus 1000A includes a breakpoint context table 1180 instead of a watchpoint context table 1160, and includes breakpoint mechanisms 1208 and 1209 instead of watchpoint mechanisms 1203 and 1204. However, both a watchpoint context table 1160 and a breakpoint context table 1180 may be provided, or both a watchpoint mechanism 1203, a watchpoint mechanism 1204 and a breakpoint mechanism 1208, a breakpoint mechanism 1209 may be provided.

[0164] The breakpoint context table 1180 holds information for setting and controlling the breakpoint mechanisms 1208 and 1209 of the computer hardware 1200. The breakpoint context table 1180 may be held in association with the process state management data 1130 for each user process. Further, it may be held in association with the thread state management data 1140 for each thread (not shown here).

[0165] The breakpoint mechanisms 1208 and 1209 may be provided with at least one or more, and may be provided corresponding to each of the arithmetic cores 1201 and 1202. The breakpoint mechanism is hardware that monitors the execution of any instruction address of a program deployed in memory and generates an event. The breakpoint mechanism may be provided with one or more breakpoints that enable monitoring and setting of restrictions on instruction addresses. The breakpoint may be set via a breakpoint register (not shown here).

[0166] FIG. 13 is a diagram showing examples of the system call restriction control tables 1150, 1151, and 1152 according to the present embodiment. The difference from FIG. 2 is that a part of the content of the entry of the import information of the data to be subjected to the allowability determination is different.

[0167] The import information 2004 of the data to be subjected to the allowability determination describes, for each permission system call 2000, at least the order of completion of data import from the user memory, the data to be imported, and the import completion processing address of the memory data to be determined allowable using the allowable set 2002.

[0168] FIG. 14 is a diagram showing an example of the breakpoint context table 1180 according to the present embodiment. The difference from FIG. 3 is that there are a breakpoint identifier 3006, a breakpoint register setting value 3007, and a breakpoint state 3008. Here, the thread identifier 3001 indicates the thread that uses the breakpoint. Also, the system call identifier 3003 indicates the system call issued by the thread that uses the breakpoint. Also, the allowability determination sequence number 3002 indicates the allowability determination order of the data to be subjected to the allowability determination that uses the breakpoint.

[0169] The breakpoint identifier 3006 describes an identifier indicating the breakpoint provided in the breakpoint mechanisms 1208 and 1209.

[0170] The breakpoint register setting value 3007 describes the information of the register setting value of the breakpoint indicated by the breakpoint identifier 3006. Since the breakpoint register setting value 3007 is used to monitor the execution of the instruction address and generate an event, it includes at least information corresponding to the address of the user data loading completion process that becomes the instruction address.

[0171] The breakpoint status 3008 describes the status (usage status) of the breakpoint indicated by the breakpoint identifier 3006. The breakpoint status 3008 includes at least "in use" and "available".

[0172] <Regarding the operation of the information processing apparatus> FIG. 15 is a flowchart showing an example of the operation flow of the system call restriction control unit 1111 according to the present embodiment.

[0173] In the operation flow of the system call restriction control unit 1111, the difference from FIG. 5 is that there is no processing for the determination result of the memory data inspection in step ST5005. In other words, in step ST5004, the system call restriction control unit 1111 requests the memory data inspection unit 1114 to execute the process of memory data inspection. Thereafter, in step ST5006, the system call restriction control unit 1111 sets the determination result of the system call restriction control to "permitted".

[0174] FIG. 16 is a flowchart showing an example of the operation flow of the memory data inspection unit 1114 according to the present embodiment.

[0175] In the operation flow of the memory data inspection unit 1114, the difference from FIG. 6 is that there is no memory data permission determination process in step ST6002. In other words, in step ST6001, the memory data inspection unit 1114 executes the memory data integrity assurance process of the memory data integrity assurance unit 1115. Then, in step ST6003, the memory data inspection unit 1114 ends the memory data inspection process.

[0176] FIG. 17 is a flowchart showing an example of the operation flow of the memory data integrity assurance unit 1115 according to the present embodiment.

[0177] In step ST7000, the memory data integrity assurance unit 1115 starts the memory data integrity assurance process.

[0178] In step ST7001, the memory data integrity assurance unit 1115 acquires the capture information 2003 of the data to be permitted determination from the system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152.

[0179] Next, in step ST7015, the memory data integrity assurance unit 1115 attempts to secure, from the breakpoint context table 1180, the entries of the breakpoint identifiers 3006 for which the breakpoint state 3008 is in the free state, for the number of entries of the data to be permitted determination.

[0180] In step ST7016, the memory data integrity assurance unit 1115 assigns the entries of the secured breakpoint identifiers 3006 in the order of completion of data capture of the data to be permitted determination, and sets the respective entries (the respective entries of the thread identifier 3001, the permitted determination serial number 3002, the system call identifier 3003, and the breakpoint register setting value 3007) corresponding to the entries of the breakpoint identifier 3006.

[0181] In step ST7017, the memory data integrity assurance unit 1115 repeats steps ST7017, ST7018, and ST7019 for each entry of the assigned breakpoint identifier 3006.

[0182] In step ST7018, the memory data integrity assurance unit 1115 sets a breakpoint for the self - arithmetic core that processes system calls according to the breakpoint register setting value 3007. Also, the breakpoint state 3008 entry in the breakpoint context table 1180 is set to in - use.

[0183] In step ST7019, the memory data integrity assurance unit 1115 determines whether to end for the entry of the assigned breakpoint identifier 3006. If it is time to end, it proceeds to step ST7009. If it is not time to end, it returns to step ST7017.

[0184] In step ST7009, the memory data integrity assurance unit 1115 ends the memory data integrity assurance process.

[0185] Figure 18 is a flowchart showing an example of the operation flow of the memory data integrity assurance unit 1115 according to the present embodiment.

[0186] In step ST7010, the memory data integrity assurance unit 1115 starts the memory data integrity release process.

[0187] In step ST7020, the memory data integrity assurance unit 1115 deletes the entry of the target thread identifier from the thread identifier 3001 entry and the allow - determination sequence number 3002 entry in the breakpoint context table 1180. When those entries become empty, the breakpoint state 3008 entry is set to empty.

[0188] In step ST7014, the memory data integrity assurance unit 1115 ends the memory data integrity assurance release process.

[0189] FIG. 19 is a flowchart showing an example of the operation flow of the memory data permission determination unit 1116 according to the present embodiment.

[0190] In step ST8000, the memory data permission determination unit 1116 starts the memory data permission determination process.

[0191] In step ST8010, the memory data permission determination unit 1116 repeats step ST8010, step ST8002, step ST8011, step ST8006, and step ST8012 for each entry of the breakpoint acquired in the process of step ST9007 described later.

[0192] In step ST8002, the memory data permission determination unit 1116 acquires the allowable set 2002 of the corresponding memory data from the system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152. For example, in the system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152 shown in FIG. 2, an entry of the allowable set 2002 corresponding to the memory data address indicated by the second argument of the system call argument information 2001 and an entry of the allowable set 2002 corresponding to the "struct B: structure data" traced from the memory data address indicated by the third argument may be acquired.

[0193] In step ST8011, the memory data permission determination unit 1116 determines whether the data to be permitted determination corresponding to the breakpoint is included in the allowable set 2002 acquired in step ST8002. If the data to be permitted determination corresponding to the breakpoint is not included in the allowable set 2002, the memory data permission determination in step ST8010 is not permitted, and the process further proceeds to step ST8009.

[0194] In step ST8012, the memory data permission determination unit 1116 determines whether to end for the entry of the breakpoint acquired in the process of step ST9007 described later. If it is determined to end, the process proceeds to step ST8008. If it is not determined to end, the process returns to step ST8010.

[0195] In step ST8008, the memory data permission determination unit 1116 permits the memory data permission determination.

[0196] In step ST8009, the memory data permission determination unit 1116 ends the memory data permission determination process.

[0197] Figure 20 is a flowchart showing an example of the operation flow of the user memory data capture event processing unit 1117 according to the present embodiment.

[0198] In step ST9000, the user memory data capture event processing unit 1117 starts the user memory data capture event processing process.

[0199] In step ST9007, the user memory data capture event processing unit 1117 acquires the corresponding breakpoint identifier 3006 entry of the breakpoint context table 1180 based on the thread identifier 3001 and the system call identifier 3003 of the user memory data capture event occurrence (event caused by the execution of the instruction address set at the breakpoint). Note that the setting of the event occurrence of the user memory data capture event processing unit 1117 is performed in step ST7018.

[0200] In step ST9008, the user memory data capture event processing unit 1117 executes the memory data permission determination process of the memory data permission determination unit 1116.

[0201] Note that the determination result obtained by executing the memory data permission determination process is associated with whether the data import process of the user memory in step ST4003 shown in FIG. 4 is successful or failed.

[0202] In step ST9009, the user memory data import event processing unit 1117 repeats step ST9009, step ST9003, and step ST9010 for each entry of the acquired breakpoint.

[0203] In step ST9003, the user memory data import event processing unit 1117 executes the release of memory data integrity of the memory data integrity ensuring unit 1115 (already described in FIG. 8).

[0204] In step ST9010, the user memory data import event processing unit 1117 determines whether to end for the entry of the breakpoint. If it is the end, it proceeds to step ST9005. If it is not the end, it returns to step ST9009.

[0205] In step ST9005, the user memory data import event processing unit 1117 executes a memory data inspection (already described in FIG. 6) for entries of the data to be subjected to the permission determination for which the permission determination has not been performed among the data subject to the permission determination.

[0206] In step ST9006, the user memory data import event processing unit 1117 ends the user memory data import event processing step.

[0207] FIG. 21 is a flowchart showing an example of the operation flow of the context switch of the context management unit 1122 by the scheduler 1123 according to the present embodiment.

[0208] In step ST10000, the context management unit 1122 starts the context switch step.

[0209] In step ST10006, the context management unit 1122 determines whether the current execution thread is a target for breakpoint setting. If it is the target, the process proceeds to step ST10007. If it is not the target, the process proceeds to step ST10008.

[0210] Regarding the determination method, for example, when the current execution thread is the thread specified by the thread identifier 3001 in the breakpoint context table 1180 and the breakpoint state 3008 is in use, it may be determined that it is a target for breakpoint setting.

[0211] In step ST10007, the context management unit 1122 cancels the setting of the breakpoint indicated by the breakpoint identifier 3006 of the breakpoint mechanism corresponding to the arithmetic core to be managed.

[0212] In step ST10008, the context management unit 1122 determines whether the next execution thread is a target for breakpoint setting. If it is the target, the process proceeds to step ST10009. If it is not the target, the process proceeds to step ST10005.

[0213] Regarding the determination method, for example, when the next execution thread is the thread specified by the thread identifier 3001 in the breakpoint context table 1180 and the breakpoint state 3008 is in use, it may be determined that it is a target for breakpoint setting.

[0214] In step ST10009, the context management unit 1122 sets the breakpoint indicated by the breakpoint identifier 3006 of the breakpoint mechanism corresponding to the arithmetic core to be managed according to the breakpoint register setting value 3007 entry corresponding to the thread identifier 3001.

[0215] In step ST10005, the context management unit 1122 ends the context switch process.

[0216] In addition, for example, when the current execution thread and the next execution thread are the same, or when there is no difference in the breakpoint register setting value 3007 between the current execution thread and the next execution thread, etc., when it is not necessary to cancel and set the watchpoint, the operation flow of the context switch shown in FIG. 21 may be omitted.

[0217] <Regarding the effects caused by the above-described multiple embodiments> Next, examples of the effects caused by the above-described multiple embodiments are shown. In the following description, the effects are described based on the specific configurations shown in the above-described multiple embodiments. However, within the range where the same effects are produced, they may be replaced with other specific configurations shown in the present specification. That is, hereinafter, for the sake of convenience, only one of the corresponding specific configurations may be representatively described, but the representatively described specific configuration may be replaced with other corresponding specific configurations.

[0218] In addition, such replacement may be made across multiple embodiments. That is, even when the respective configurations shown in different embodiments are combined and the same effects are produced.

[0219] According to the embodiments described above, the information processing apparatus is an information processing apparatus 1000 (or information processing apparatus 1000A) in which system software 1100 operates on computer hardware 1200 including an arithmetic unit and a main memory device 1205. Here, the arithmetic unit corresponds to, for example, an arithmetic core 1201 or an arithmetic core 202. The system software 1100 includes a system call unit 1110 that processes system calls issued when an application 1400 (or application 1401) uses functions provided by the system software 1100. The system call unit 1110 includes a system call main processing unit 1113 that processes system calls, a system call restriction control unit 1111 that performs restriction control on the execution of system call processing, and a memory data inspection unit 1114 that inspects memory data corresponding to the system call by tracing the data structure of the system call from the memory data address passed by the application 1400 (or application 1401) to the system call unit 1110.

[0220] According to such a configuration, it is possible to trace the data structure of the system call based on the memory data address specified by the argument of the system call and verify the validity of the content of the memory data. Further, according to the verification of the validity of the content of the memory data, it is possible to defend against a Time-of-check to time-of-use (TOCTTOU) attack that may occur before the system call processing by the kernel of the operating system modifies the content of the memory data, and prevent unauthorized intrusion into the system, so that the security of the information processing apparatus can be strengthened.

[0221] In addition, when other configurations exemplified in the present specification are appropriately added to the above configuration, that is, even when other configurations in the present specification that are not mentioned as the above configuration are appropriately added, the same effects can be achieved.

[0222] <Regarding modifications of the above-described multiple embodiments> In the above-described multiple embodiments, the dimensions, shapes, relative arrangement relationships, implementation conditions, etc. of each component may be described, but these are all examples in all aspects and are not limiting.

[0223] Therefore, countless variations and equivalents not shown in the examples are envisioned within the scope of the technology disclosed in the specification of this application. For example, it includes cases where at least one component is deformed, added, or omitted, and further includes cases where at least one component in at least one embodiment is extracted and combined with components in other embodiments.

[0224] Also, as long as there is no contradiction, when it is described in the above-described embodiments that a component is provided with "one", the component may be provided with "one or more".

[0225] For example, when the system software is a hypervisor and the system call is a hypercall, or when the system software is a security monitor and the system call is a security monitor call, etc. are included. That is, it includes cases where at least one component is deformed, added, or omitted, and further includes cases where at least one component is extracted and combined with components of other embodiments.

[0226] Furthermore, each component in the above-described embodiments is a conceptual unit, and within the scope of the technology disclosed in the specification of this application, it includes cases where one component consists of multiple structures, cases where one component corresponds to a part of a certain structure, and further includes cases where multiple components are provided in one structure.

[0227] Also, each component in the above-described embodiments includes structures having other structures or shapes as long as they perform the same function.

[0228] Also, the descriptions in this specification are for all purposes related to this technology and none of them are admitted to be prior art.

Description of Reference Numerals

[0229] 1000 Information processing apparatus, 1000A Information processing apparatus, 1100 System software, 1110 System call section, 1111 System call restriction control section, 1112 User memory data capture section, 1113 System call main processing section, 1114 Memory data inspection section, 1115 Memory data integrity assurance section, 1116 Memory data permission determination section, 1117 User memory data capture event processing section, 1120 System call restriction control table setting section, 1121 Log recording section, 1122 Context management section, 1123 Scheduler, 1130 Process state management data, 1140 Thread state management data, 1150 System call restriction control table, 1151 System call restriction control table, 1152 System call restriction control table, 1160 Watchpoint context table, 1170 Container execution environment management data, 1180 Breakpoint context table, 1200 Computer hardware, 1201 Arithmetic core, 1202 Arithmetic core, 1203 Watchpoint mechanism, 1204 Watchpoint mechanism, 1205 Main memory device, 1206 Non-volatile memory device, 1207 Peripheral device, 1208 Breakpoint mechanism, 1209 Breakpoint mechanism, 1300 System call restriction control setting section, 1301 System setting control container execution environment, 1400 Application, 1401 Application, 1402 Application container execution environment, 2000 Permitted system call, 2001 System call argument information, 2002 Permissible set, 2003 Capture information, 2004 Capture information, 3000 Watchpoint identifier, 3001 Thread identifier, 3002 Permission determination sequence number, 3003 System call identifier, 3004 Watchpoint register setting value, 3005 Watchpoint state, 3006 Breakpoint identifier, 3007 Breakpoint register setting value, 3008 Breakpoint state.

Claims

1. An information processing device in which system software runs on computer hardware including an arithmetic unit and a main memory unit, the system software includes a system call unit that processes a system call issued when an application uses a function provided by the system software; The system call unit: a system call body processing unit for processing the system call; a system call restriction control unit that performs restriction control of execution of the system call processing; a memory data inspection unit that inspects memory data corresponding to the system call by tracing a data structure of the system call from a memory data address that the application passes to the system call unit; a memory data integrity ensuring unit that performs processing to ensure the integrity of the memory data by using a pointer address that traces the data structure of the system call from the memory data address that the application passes to the system call unit, Information processing device.

2. The information processing device according to claim 1 , The memory data address is specified by an argument of the system call. Information processing device.

3. 3. The information processing device according to claim 1, the system call unit further includes a memory data permission determination unit that traces the data structure of the system call from the memory data address passed by the application to the system call unit and performs permission determination for the memory data; Information processing device.

4. 3. The information processing device according to claim 1, The system software comprises: a system call restriction control table describing information regarding the restriction control in the processing execution of the system call; A system call restriction control table setting unit that sets the system call restriction control table, the information processing device further includes a system call restriction control setting unit that sets information on the system call restriction setting for the system call restriction control table setting unit in the system software; Information processing device.

5. The information processing device according to claim 4, the computer hardware further comprises a watchpoint mechanism for monitoring and restricting access to the memory data; the system software further comprising a watchpoint context table for holding information for setting and controlling the watchpoint mechanism; Information processing device.

6. 3. The information processing device according to claim 1, The system call unit: a user memory data fetch unit which generates a user memory data fetch event, which is an event for fetching the memory data into a memory managed by the system software by tracing the data structure of the system call from the memory data address passed by the application to the system call unit; a user memory data import event processing unit for processing an event occurring in the user memory data import unit, Information processing device.

7. 3. The information processing device according to claim 1, The computer hardware further comprises a non-volatile storage device for permanently storing the recorded data; the system software further comprises a log recording unit that records information output by the system call unit; Information processing device.

8. The information processing device according to claim 5, The system software comprises: a context management unit that manages a process or a thread that indicates a state when a user program including the application is executed on the computer hardware; a scheduler that manages allocation of processes or threads to the computer hardware; Thread state management data for holding the state and information of the thread for each of the threads; process state management data for holding a state and information of the process for each process and managing the state and information including the thread state management data of the thread managed by the process; container execution environment management data that is stored for each container execution environment that virtually separates an execution environment of a program and that manages the container execution environment including the process state management data of the process managed by the container execution environment; The watch point context table is configured in association with the process state management data, The system call restriction control table is configured by being linked to the thread state management data, the process state management data, or the container execution environment management data. Information processing device.

9. The information processing device according to claim 5, The system call restriction control table includes: an allowed system call for which the system call unit allows a system call to be invoked; system call argument information indicating information on a data structure of an argument of the permitted system call; an allowable set which is information on an allowable range of data for each of the system call argument information; and import information of the memory data to be subjected to the allowable judgment, the import information indicating the import information of the memory data to be allowed and judged to be allowable using the allowable set; The import information of the allowable determination target data is Information indicating the memory data to be imported; The size of the memory data to be imported; and a completion order of the memory data fetching. Information processing device.

10. The information processing device according to claim 9, The watchpoint context table comprises: a watchpoint identifier indicating a watchpoint provided by the watchpoint mechanism; a thread identifier indicating the thread to which the watchpoint is to be assigned; a system call identifier indicating a system call issued by a thread to which the watchpoint is to be assigned; an allowance determination order number indicating an allowance determination order of the allowance determination target data for which the watch point is set; a watchpoint register setting value which is information on the register setting value of the watchpoint; a watchpoint state which is information indicating a usage status of the watchpoint; The watchpoint register setting value includes information of a memory area for monitoring and controlling access to the memory data. Information processing device.

11. The information processing device according to claim 9, The computer hardware further comprises a breakpoint mechanism for monitoring execution of an arbitrary instruction address of a program and generating an event when the instruction is executed; the system software further comprising a breakpoint context table for holding information for setting and controlling the breakpoint mechanism; Information processing device.

12. The information processing device according to claim 9, the system call restriction control table includes, in the import information of the data subject to allowance determination, an import completion processing address of the memory data that is allowed or not determined by using information of the allowable set; Information processing device.

13. The information processing device according to claim 11, The breakpoint context table comprises: A breakpoint identifier indicating a breakpoint included in the breakpoint mechanism; a thread identifier indicating a thread that uses the breakpoint; a system call identifier indicating a system call issued by a thread that uses the breakpoint; an allowance judgment order number indicating an allowance judgment order of the allowance judgment target data using the breakpoint; A breakpoint register setting value which is information on the register setting value of the breakpoint; a breakpoint status which is information indicating a usage status of the breakpoint, The breakpoint register setting value includes information on an address of a user data fetch completion process. Information processing device.

14. The information processing device according to claim 6, The computer hardware further comprises a non-volatile storage device for permanently storing the recorded data; the system software further comprises the system call unit and a log recording unit that records information output by the system call unit; The system call unit: Execute a system restriction process of the system call restriction control unit, when a result of the determination of the system restriction process by the system call restriction control unit is permission, executes a data import process by the user memory data import unit; When the data import process is successful, the system call main processing unit executes a system call process; when a result of the determination of the system restriction process by the system call restriction control unit is not permitted and when the data import process is successful, the log recording unit executes trail log recording; Executing post-processing of the system call restriction control of the system call restriction control unit. Information processing device.

15. The information processing device according to claim 5, The system call restriction control unit, Obtaining an entry for a permitted system call from the system call restriction control table; If there is an entry for the permitted system call, a permission determination is made for the argument values ​​of the system call; When the permission determination of the argument value of the system call is permission, the memory data inspection unit executes memory data inspection; When the memory data inspection permission determination of the memory data inspection unit is permission, a determination result of the system call restriction control is set to permission; when there is no entry for the permitted system call, when the permission determination of the argument value of the system call is not permitted, and when the computer hardware includes the watchpoint mechanism and the permission determination of the memory data inspection by the memory data inspection unit is not permitted, the determination result of the system call restriction control is set to not permitted. Information processing device.

16. The information processing device according to claim 5, The system call unit: a memory data integrity assurance unit that performs a process of ensuring the integrity of the memory data by tracing a pointer address that traces the data structure of the system call from the memory data address that the application passes to the system call unit and tracing the data structure; a memory data permission determination unit that traces the data structure of the system call from the memory data address passed by the application to the system call unit and performs permission determination for the memory data, The memory data inspection unit, Execute memory data integrity assurance by the memory data integrity assurance unit; When the computer hardware includes the watchpoint mechanism, the memory data permission determination unit executes the memory data permission determination. Information processing device.

17. The information processing device according to claim 8, The system call restriction control table includes: an allowed system call for which the system call unit allows a system call to be invoked; system call argument information indicating information on a data structure of an argument of the permitted system call; an allowable set, which is information on an allowable data set for each of the system call argument information; and import information of the memory data to be subjected to the allowable judgment, the import information indicating the import information of the memory data to be allowed and judged to be allowable using the allowable set; The import information of the allowable determination target data is Information indicating the memory data to be imported; The size of the memory data to be imported; The order of completion of fetching the memory data is included; The watchpoint context table comprises: a watchpoint identifier indicating a watchpoint provided by the watchpoint mechanism; a thread identifier indicating the thread to which the watchpoint is to be assigned; a system call identifier indicating a system call issued by a thread to which the watchpoint is to be assigned; an allowance determination order number indicating an allowance determination order of the allowance determination target data for which the watch point is set; a watchpoint register setting value which is information on the register setting value of the watchpoint; a watchpoint state which is information indicating a usage status of the watchpoint; the watchpoint register setting value includes information of a memory area for monitoring and controlling access to the memory data; The system call unit: a memory data integrity assurance unit that performs a process of ensuring the integrity of the memory data by tracing a pointer address that traces the data structure of the system call from the memory data address that the application passes to the system call unit and tracing the data structure; a user memory data fetch unit which generates a user memory data fetch event, which is an event for fetching the memory data into a memory managed by the system software by tracing the data structure of the system call from the memory data address passed by the application to the system call unit; a user memory data import event processing unit that processes an event generated in the user memory data import unit, The memory data integrity assurance unit, Acquires import information of the allowance determination target data from the system call restriction control table; Attempting to secure an entry for the watchpoint identifier that is free in the watchpoint context table in a number equal to the number of entries for the permissible determination target data; allocating the reserved watchpoint identifier entries in the order of completion of data fetching of the permissibility determination target data, and setting the corresponding thread identifier, the permissibility determination order number, the system call identifier, and the watchpoint register setting value entries; when the number of entries of the watchpoint identifiers corresponding to the number of entries of the permissible determination target data cannot be secured, after the data that is the last data to be fetched in the order of completion of data fetching to which the entry of the watchpoint identifier is assigned is fetched, an event is set to occur in the user memory data fetch event processing unit; for each entry of the assigned watchpoint identifier, when a thread belonging to the same process state management data as the thread identified by the thread identifier is being executed in another processor core, set a watchpoint register of the watchpoint mechanism of the processor core in which the thread belonging to the process state management data is being executed according to the watchpoint register setting value; marking the watchpoint state entry in the watchpoint context table as in use; assigning an authentication code to each pointer address that can be traced from the memory data address indicated by the system call argument information of the system call restriction control table to the memory data address of the watchpoint register setting value for the memory data in which the watchpoint is set; Information processing device.

18. The information processing device according to claim 17, The system call restriction control table includes: an allowed system call for which the system call unit allows a system call to be invoked; system call argument information indicating information on a data structure of an argument of the permitted system call; an allowable set, which is information on an allowable data set for each of the system call argument information; and import information of the memory data to be subjected to the allowable judgment, the import information indicating the import information of the memory data to be allowed and judged to be allowable using the allowable set; The import information of the allowable determination target data is Information indicating the memory data to be imported; The size of the memory data to be imported; The order of completion of fetching the memory data is included; The watchpoint context table comprises: a watchpoint identifier indicating a watchpoint provided by the watchpoint mechanism; a thread identifier indicating the thread to which the watchpoint is to be assigned; a system call identifier indicating a system call issued by a thread to which the watchpoint is to be assigned; an allowance determination order number indicating an allowance determination order of the allowance determination target data for which the watch point is set; a watchpoint register setting value which is information on the register setting value of the watchpoint; a watchpoint state which is information indicating a usage status of the watchpoint; the watchpoint register setting value includes information of a memory area for monitoring and controlling access to the memory data; the system call unit further includes a memory data permission determination unit that traces the data structure of the system call from the memory data address passed by the application to the system call unit and performs permission determination for the memory data, The memory data permission determination unit, For each entry of the assigned watchpoint identifier, obtaining an allowable set of corresponding memory data from the system call limit control table; tracing from the memory data address of the system call argument information to the memory data address described in the entry of the set watchpoint register setting value while checking whether the assigned authentication code is complete; If the step of tracing the memory data address while checking the integrity of the authentication code fails, the memory data permission determination is determined to be unpermitted, and the processing of the memory data permission determination unit is terminated. determining whether the memory data in the memory data address range described in the entry of the set watchpoint register setting value is included in the allowable set; If the memory data is not included in the allowable set, the memory data permission determination is determined to be not allowable and the process of the memory data permission determination unit is terminated. When the memory data is included in the allowable set, the memory data permission determination is allowed. Information processing device.

19. The information processing device according to claim 15, The system call restriction control table includes: an allowed system call for which the system call unit allows a system call to be invoked; system call argument information indicating information on a data structure of an argument of the permitted system call; an allowable set, which is information on an allowable data set for each of the system call argument information; and import information of the memory data to be subjected to the allowable judgment, the import information indicating the import information of the memory data to be allowed and judged to be allowable using the allowable set; The import information of the allowable determination target data is Information indicating the memory data to be imported; The size of the memory data to be imported; The order of completion of fetching the memory data is included; The watchpoint context table comprises: a watchpoint identifier indicating a watchpoint provided by the watchpoint mechanism; a thread identifier indicating the thread to which the watchpoint is to be assigned; a system call identifier indicating a system call issued by a thread to which the watchpoint is to be assigned; an allowance determination order number indicating an allowance determination order of the allowance determination target data for which the watch point is set; a watchpoint register setting value which is information on the register setting value of the watchpoint; a watchpoint state which is information indicating a usage status of the watchpoint; the watchpoint register setting value includes information of a memory area for monitoring and controlling access to the memory data; The system call unit: a user memory data fetch unit which generates a user memory data fetch event, which is an event for fetching the memory data into a memory managed by the system software by tracing the data structure of the system call from the memory data address passed by the application to the system call unit; a user memory data import event processing unit that processes an event occurring in the user memory data import unit; a memory data integrity assurance unit that performs a process of tracing a pointer address for tracing the data structure of the system call from the memory data address passed by the application to the system call unit and tracing the data structure to ensure the integrity of the memory data, The user memory data import event processing unit, As a step of a system call restriction control post-processing, an entry of a corresponding watch point identifier in the watch point context table is obtained from a thread identifier indicating the occurrence of the user memory data capture event and the system call identifier; canceling memory data integrity protection of the memory data integrity protection unit for each entry of the obtained watch point identifier; performing the memory data inspection on entries for which permission determination has not been performed among the permission determination target data; Information processing device.

20. The information processing device according to claim 16, The system call restriction control table includes: an allowed system call for which the system call unit allows a system call to be invoked; system call argument information indicating information on a data structure of an argument of the permitted system call; an allowable set, which is information on an allowable data set for each of the system call argument information; and import information of the memory data to be subjected to the allowable judgment, the import information indicating the import information of the memory data to be allowed and judged to be allowable using the allowable set; The import information of the allowable determination target data is Information indicating the memory data to be imported; The size of the memory data to be imported; The order of completion of fetching the memory data is included; The watchpoint context table comprises: a watchpoint identifier indicating a watchpoint provided by the watchpoint mechanism; a thread identifier indicating the thread to which the watchpoint is to be assigned; a system call identifier indicating a system call issued by a thread to which the watchpoint is to be assigned; an allowance determination order number indicating an allowance determination order of the allowance determination target data for which the watch point is set; a watchpoint register setting value which is information on the register setting value of the watchpoint; a watchpoint state which is information indicating a usage status of the watchpoint; the watchpoint register setting value includes information of a memory area for monitoring and controlling access to the memory data; The system software comprises: a context management unit that manages a process or a thread that indicates a state when a user program including the application is executed on the computer hardware; a scheduler that manages allocation of processes or threads to the computer hardware; Thread state management data for holding the state and information of the thread for each of the threads; process state management data for holding a state and information of the process for each process and managing the state and information including the thread state management data of the thread managed by the process; container execution environment management data that is stored for each container execution environment that virtually separates an execution environment of a program and that manages the container execution environment including the process state management data of the process managed by the container execution environment; The watch point context table is configured in association with the process state management data, the system call restriction control table is configured in association with the thread state management data, the process state management data, or the container execution environment management data; The process of canceling the memory data integrity assurance by the memory data integrity assurance unit includes: Releasing the authentication code for each pointer address tracing from the memory data address indicated by the system call argument information to the memory data address at which the watch point is set; canceling the setting of the watchpoint when a thread belonging to the same process state management data as the thread identified by the thread identifier is being executed by another processor core; In the watchpoint context table, the entry of the target thread identifier is deleted from the entry of the thread identifier and the entry of the permission determination sequence number, and when these entries become empty, the entry of the watchpoint state is made empty. Information processing device.

21. The information processing device according to claim 8, The system call restriction control table includes: an allowed system call for which the system call unit allows a system call to be invoked; system call argument information indicating information on a data structure of an argument of the permitted system call; an allowable set, which is information on an allowable data set for each of the system call argument information; and import information of the memory data to be subjected to the allowable judgment, the import information indicating the import information of the memory data to be allowed and judged to be allowable using the allowable set; The import information of the allowable determination target data is Information indicating the memory data to be imported; The size of the memory data to be imported; The order of completion of fetching the memory data is included; The watchpoint context table comprises: a watchpoint identifier indicating a watchpoint provided by the watchpoint mechanism; a thread identifier indicating the thread to which the watchpoint is to be assigned; a system call identifier indicating a system call issued by a thread to which the watchpoint is to be assigned; an allowance determination order number indicating an allowance determination order of the allowance determination target data for which the watch point is set; a watchpoint register setting value which is information on the register setting value of the watchpoint; a watchpoint state which is information indicating a usage status of the watchpoint; the watchpoint register setting value includes information of a memory area for monitoring and controlling access to the memory data; The process of the context switch of the context management unit by the scheduler includes: Determines whether the current thread of execution is the target of a watchpoint, If the current execution thread is a target for a watchpoint setting, canceling the setting of the watchpoint indicated by the watchpoint identifier of the watchpoint mechanism corresponding to the processing core that is the target of the context switch; Determine whether the next thread to be executed is the target of a watchpoint setting, If the thread to be executed next is a target for setting a watchpoint, a watchpoint indicated by a watchpoint identifier of a watchpoint mechanism corresponding to the processor core that is the target of the context switch is set according to an entry of the watchpoint register setting value corresponding to the thread identifier; The determination of whether the execution thread is a target for watchpoint setting is made by determining that the execution thread is a target for watchpoint setting when the execution thread belongs to the same process state management data as the thread identified by the thread identifier and the watchpoint state is in use. Information processing device.

22. The information processing device according to claim 13, the system call unit further comprises a memory data integrity ensuring unit that performs processing to ensure the integrity of the memory data by tracing a pointer address that traces the data structure of the system call from the memory data address that the application passes to the system call unit and the data structure; The processing of the memory data integrity assurance unit in the information processing device including the breakpoint mechanism in the computer hardware, Acquires import information of the allowance determination target data from the system call restriction control table; Attempting to secure an entry for the breakpoint identifier that is vacant in the breakpoint context table in a number equal to the number of entries of the data subject to the allowable determination; allocating the reserved breakpoint identifier entries in the order of completion of data import of the allowability determination target data, and setting corresponding entries of the thread identifier, the allowability determination order number, the system call identifier, and the breakpoint register setting value; for each entry of the assigned breakpoint identifier, setting the breakpoint of the own computing core which processes the system call in accordance with the breakpoint register setting value; marking the breakpoint state entry in the breakpoint context table as in use; Information processing device.

23. The information processing device according to claim 13, the system call unit further includes a memory data permission determination unit that traces the data structure of the system call from the memory data address passed by the application to the system call unit and performs permission determination for the memory data, The processing of the memory data permission determination unit in the information processing device including the breakpoint mechanism in the computer hardware, For each entry of the assigned breakpoint identifier, obtain an allowable set of corresponding memory data from the system call restriction control table; determining whether the allowable determination target data corresponding to the breakpoint is included in the obtained allowable set; If the data subject to the permission determination is not included in the permission set, the memory data permission determination is determined to be not permitted and the process of the memory data permission determination unit is terminated. Information processing device.

24. The information processing device according to claim 13, The system call unit: a memory data integrity assurance unit that performs a process of ensuring the integrity of the memory data by tracing a pointer address that traces the data structure of the system call from the memory data address that the application passes to the system call unit and tracing the data structure; a user memory data fetch unit which generates a user memory data fetch event, which is an event for fetching the memory data into a memory managed by the system software by tracing the data structure of the system call from the memory data address passed by the application to the system call unit; a user memory data import event processing unit that processes an event generated in the user memory data import unit, The processing of the user memory data fetch event processing unit in the information processing device including the breakpoint mechanism in the computer hardware, obtaining an entry of a corresponding breakpoint identifier in the breakpoint context table based on a thread identifier indicating the occurrence of the user memory data import event and the system call identifier; Performing an authorization determination of the memory data; For each entry of the acquired breakpoint identifier, cancelling memory data integrity protection of the memory data integrity protection unit; performing the memory data inspection on entries for which permission determination has not been performed among the permission determination target data; Information processing device.

25. The information processing device according to claim 13, the system call unit includes a memory data integrity ensuring unit that performs a process of ensuring the integrity of the memory data by tracing a pointer address that traces the data structure of the system call from the memory data address that the application passes to the system call unit and tracing the data structure; A process of canceling the memory data integrity protection in the information processing device including the breakpoint mechanism in the computer hardware, In the breakpoint context table, an entry of the target thread identifier is deleted from the entry of the thread identifier and the entry of the permission determination sequence number, and when these entries become empty, the entry of the breakpoint state is made empty. Information processing device.

26. The information processing device according to claim 13, The system software comprises: a context management unit that manages a process or a thread that indicates a state when a user program including the application is executed on the computer hardware; a scheduler that manages allocation of processes or threads to the computer hardware; Thread state management data for holding the state and information of the thread for each of the threads; process state management data for holding a state and information of the process for each process and managing the state and information including the thread state management data of the thread managed by the process; container execution environment management data that is stored for each container execution environment that virtually separates an execution environment of a program and that manages the container execution environment including the process state management data of the process managed by the container execution environment; The watch point context table is configured in association with the process state management data, the system call restriction control table is configured in association with the thread state management data, the process state management data, or the container execution environment management data; A process of a context switch of the context management unit by the scheduler in the information processing device including the breakpoint mechanism in the computer hardware, Determine whether the current thread of execution is eligible for a breakpoint, If the current execution thread is a target for setting a breakpoint, canceling the setting of the breakpoint indicated by the breakpoint identifier of the breakpoint mechanism corresponding to the processing core that is the target of the context switch; Determine whether the next thread to be executed is a target for setting a breakpoint, If the thread to be executed next is a target for setting a breakpoint, a breakpoint indicated by a breakpoint identifier of a breakpoint mechanism corresponding to the processor core that is the target of the context switch is set according to an entry of the breakpoint register setting value corresponding to the thread identifier; The determination of whether the execution thread is a target for setting a breakpoint is made by determining that the execution thread is a target for setting a breakpoint when the execution thread is a thread identified by a thread identifier in the breakpoint context table and a breakpoint state is in use. Information processing device.

27. An information processing method in which system software runs on computer hardware including an arithmetic unit and a main memory, In the system software, Processing system calls issued when an application uses a function provided by the system software; performing restriction control on execution of the system call processing; inspecting memory data corresponding to the system call by tracing a data structure of the system call from a memory data address passed by the application to the system software; performing a process of ensuring the integrity of the memory data using a pointer address that traces the data structure of the system call from the memory data address that the application passes to the system software; Information processing methods.

Images