Security protection method, apparatus and system, and intelligent driving device

Abstract

A security protection method, apparatus and system, and an intelligent driving device. The method may comprise: a security monitoring apparatus deployed in a first virtual machine acquiring kernel data of a second virtual machine, and determining a security state of the second virtual machine on the basis of the kernel data of the second virtual machine; when the second virtual machine has a security problem, the security monitoring apparatus sending a prompt message to a virtual machine manager (VMM), wherein the prompt message is used for indicating that the second virtual machine has a security problem; and after receiving the prompt message, the VMM performing security management on the second virtual machine, wherein the security of the first virtual machine is higher than that of the second virtual machine. The solution of the present application can improve the security of the second virtual machine.

Description

Safety protection method, device, system and intelligent driving equipment

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on August 11, 2023, with application number 202311018366.7 and application name “Safety protection methods, devices, systems and intelligent driving equipment”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of safety protection technology, and more specifically, to a safety protection method, device, system and intelligent driving equipment. Background Art

[0003] With the development of computer technology, virtual machine technology has been widely used in vehicles, robots, servers, and other fields. Taking vehicles as an example, the current mainstream in-vehicle systems can use a virtual machine manager (VMM) to launch multiple virtual machines. These multiple virtual machines can run multiple operating systems, either the same or different. This can prevent interference between different applications and improve application reliability and flexibility.

[0004] In current technology, the virtual machines started by the vehicle system mainly include high-security virtual machines and low-security virtual machines. Among them, the high-security virtual machine is the security foundation of the entire system. It has no direct network exposure and is relatively safe. The low-security virtual machine will face more network attack surfaces, with a higher risk of remote attacks and security risks.

[0005] Therefore, how to improve the security of low-security virtual machines is an urgent problem that needs to be solved.

[0006] Summary of the Invention

[0007] The present application provides a security protection method, device, system and intelligent driving equipment that can improve the security of low-security virtual machines.

[0008] In a first aspect, a security protection method is provided, which is applied to a security monitoring device deployed on a first virtual machine. The method includes: obtaining kernel data of a second virtual machine; determining the security status of the second virtual machine based on the kernel data of the second virtual machine; and sending a prompt message to a VMM when a security problem exists in the second virtual machine, wherein the prompt message is used to indicate that a security problem exists in the second virtual machine, and the VMM is used to perform security management on the second virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

[0009] Among them, kernel data is the data that the operating system relies on during runtime and can reflect the security status of the kernel.

[0010] This application monitors the security status of a second virtual machine with lower security by deploying a security monitoring device in a first virtual machine with higher security, and uses VMM to perform security management on the second virtual machine when security issues are detected in the second virtual machine, thereby improving the security of the second virtual machine.

[0011] In combination with the first aspect, in certain implementations of the first aspect, the working mode of the security monitoring device includes a security monitoring mode, in which the security monitoring device runs instructions through a first address space, wherein the first address space includes a user mode address space and a kernel mode address space, the user mode address space in the first address space is used to map application data of the security monitoring device, and the kernel mode address space in the first address space is used to map kernel data of the second virtual machine, and obtaining the kernel data of the second virtual machine includes: obtaining the kernel data of the second virtual machine from the kernel mode address space in the first address space.

[0012] Among them, the application data of the security monitoring device refers to the collection of codes and data that realize its security monitoring function; the kernel data of the second virtual machine refers to the data on which the operation of the second virtual machine operating system depends, which can reflect the security status of its kernel.

[0013] The first address space may be constructed by a VMM.

[0014] It should be noted that based on traditional technology, the data of the security monitoring device and the second virtual machine are usually mapped to different address spaces (for example, the data of the security monitoring device can be mapped to the second address space associated with the security monitoring device, and the data of the second virtual machine can be mapped to the third address space associated with the security monitoring device). Therefore, the security monitoring device usually cannot directly access the kernel data of the second virtual machine.

[0015] Based on this, the present application proposes that a new address space (i.e., the first address space mentioned above) can be constructed, in which the user-mode address space is mainly used to map the application data of the security monitoring device, and the kernel-mode address space is mainly used to map the kernel data of the second virtual machine, so as to realize the fusion of the address space of the security monitoring device and the address space of the second virtual machine, and then realize the acquisition of the kernel data of the second virtual machine.

[0016] In combination with the first aspect, in certain implementations of the first aspect, the mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space is achieved by changing the page table on the extended page table pointing to the kernel of the first virtual machine to a page table pointing to the kernel of the second virtual machine.

[0017] It should be understood that based on traditional technology, the second address space associated with the security monitoring device usually includes a user-mode address space and a kernel-mode address space. The user-mode address space is usually used to map the application data of the security monitoring device, and the kernel-mode address space is usually used to map the kernel data of the first virtual machine.

[0018] In order to achieve the fusion of the address space of the security monitoring device and the address space of the second virtual machine, this application proposes that the first address space can be constructed based on the second address space. Specifically, the page table in the second address space that originally pointed to the kernel of the first virtual machine can be changed to point to the page table of the kernel of the second virtual machine to construct a new first address space. Based on this new address space, the user-mode address space can still be used to map the application data of the security monitoring device, while the kernel-mode address space can be used to map the kernel data of the second virtual machine.

[0019] Alternatively, in actual operation, the first address space may not be constructed based on the second address space, but may be constructed directly by the VMM. However, it should be understood that in this manner, the VMM needs to maintain the consistency of the page table, which is a relatively complex process.

[0020] In combination with the first aspect, in some implementations of the first aspect, the kernel data of the second virtual machine is mapped as read-only.

[0021] Based on the solution of the present application, the kernel data of the second virtual machine can be mapped as read-only, so that the kernel data of the second virtual machine is neither executable nor writable in the kernel mode address space of the first address space, and therefore will not cause an attack on the first virtual machine and will not affect the second virtual machine.

[0022] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: obtaining the kernel data of the second virtual machine when the first condition is met, the first condition including: the second virtual machine creates a new process, or before the second virtual machine issues a vehicle control instruction; or, obtaining the kernel data of the second virtual machine according to a preset period.

[0023] The present application can perform monitoring operations when the second virtual machine creates a new process to ensure the security of the new process; it can also perform monitoring operations when the second virtual machine generates but does not issue a vehicle control instruction to ensure the security of the vehicle control instruction; it can also perform monitoring operations according to a preset period to ensure the security of the second virtual machine.

[0024] In combination with the first aspect, in some implementations of the first aspect, determining the security status of the second virtual machine based on the kernel data of the second virtual machine includes: determining whether the second virtual machine is invaded by an attacker based on the kernel data of the second virtual machine.

[0025] Specifically, when it is determined that the second virtual machine is invaded by an attacker, it can be considered that the second virtual machine has a security problem; when it is determined that the second virtual machine is not invaded by an attacker, it can be considered that the second virtual machine has no security problem.

[0026] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: determining whether the second virtual machine has been invaded by an attacker based on at least one of the following: determining based on the task list and scheduling queue on the second virtual machine; determining based on whether the process with high privileges on the second virtual machine is on the whitelist; determining based on whether the configuration file and implementation of the security access control policy of the second virtual machine comply with a known whitelist; determining based on whether the access rights of the key partition in the disk file system of the second virtual machine are read-only; determining based on whether the second virtual machine has an abnormal network connection.

[0027] In combination with the first aspect, in certain implementations of the first aspect, the working mode of the security monitoring device also includes a system call mode, and the system call mode and the security monitoring mode are executed alternately. In this system call mode, the security monitoring device runs instructions through a second address space, and the second address space includes a user state address space and a kernel state address space. The user state address space in the second address space is used to map the application data of the security monitoring device, and the kernel state address space in the second address space is used to map the kernel data of the first virtual machine.

[0028] It should be understood that when using a security monitoring device to monitor the kernel data of the second virtual machine, the system call mode and the security monitoring mode can be executed alternately, wherein the security monitoring mode is used to obtain the kernel data of the second virtual machine, and the system call mode is used to provide system call support for the monitoring function.

[0029] In combination with the first aspect, in some implementations of the first aspect, the security management includes: forcing a safe restart.

[0030] Based on the solution of the present application, if there is a security issue in the second virtual machine, the VMM can force a safe restart of the second virtual machine to ensure the security of the second virtual machine.

[0031] In a second aspect, a security protection method is provided, which is applied to a VMM and includes: receiving a prompt message sent by a security monitoring device, wherein the prompt message is used to indicate that there is a security problem with a second virtual machine, the security monitoring device is deployed on a first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine; and performing security management on the second virtual machine.

[0032] Based on the solution of the present application, when the VMM learns that the second virtual machine has a security problem, the VMM can perform security management on the second virtual machine, thereby improving the security of the second virtual machine.

[0033] In combination with the second aspect, in certain implementations of the second aspect, the method also includes: constructing a first address space, which is used to run the instructions of the security monitoring device, and the first address space includes a user state address space and a kernel state address space, the user state address space of the first address space is used to map the application data of the security monitoring device, and the kernel state address space of the first address space is used to map the kernel data of the second virtual machine.

[0034] It should be noted that based on traditional technology, the data of the security monitoring device and the second virtual machine are usually mapped to different address spaces (for example, the data of the security monitoring device can be mapped to the second address space associated with the security monitoring device, and the data of the second virtual machine can be mapped to the third address space associated with the security monitoring device). Therefore, the security monitoring device usually cannot directly access the kernel data of the second virtual machine.

[0035] Based on this, the present application proposes that a new address space (i.e., the first address space mentioned above) can be constructed using VMM. The user-mode address space in the new address space is mainly used to map the application data of the security monitoring device, and the kernel-mode address space is mainly used to map the kernel data of the second virtual machine, so as to realize the fusion of the address space of the security monitoring device and the address space of the second virtual machine.

[0036] In combination with the second aspect, in certain implementations of the second aspect, constructing the first address space includes: changing the page table on the extended page table pointing to the kernel of the first virtual machine to a page table pointing to the kernel of the second virtual machine, so as to realize the mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space.

[0037] It should be understood that based on traditional technology, the second address space associated with the security monitoring device usually includes a user-mode address space and a kernel-mode address space. The user-mode address space is usually used to map the application data of the security monitoring device, and the kernel-mode address space is usually used to map the kernel data of the first virtual machine.

[0038] To achieve the fusion of the security monitoring device address space and the second virtual machine address space, this application proposes that the VMM can construct a first address space based on the second address space. Specifically, the VMM can modify the page table in the second address space that originally pointed to the first virtual machine kernel to point to the page table of the second virtual machine kernel to construct a new first address space. Based on this new address space, the user-mode address space can still be used to map the application data of the security monitoring device, while the kernel-mode address space can be used to map the kernel data of the second virtual machine.

[0039] In combination with the second aspect, in some implementations of the second aspect, the secure management of the second virtual machine includes: forcibly restarting the second virtual machine securely.

[0040] Based on the solution of the present application, if there is a security issue in the second virtual machine, the VMM can force a safe restart of the second virtual machine to ensure the security of the second virtual machine.

[0041] In a third aspect, a security protection device is provided, which is applied to a security monitoring device, which is deployed on a first virtual machine. The device includes: an acquisition unit, which is used to obtain kernel data of a second virtual machine; a processing unit, which is used to determine the security status of the second virtual machine based on the kernel data of the second virtual machine; and a transceiver unit, which is used to send a prompt message to the VMM when there is a security problem with the second virtual machine, wherein the prompt message is used to indicate that there is a security problem with the second virtual machine, and the VMM is used to perform security management on the second virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

[0042] In combination with the third aspect, in certain implementations of the third aspect, the working mode of the security monitoring device includes a security monitoring mode, in which the security monitoring device runs instructions through a first address space, wherein the first address space includes a user mode address space and a kernel mode address space, the user mode address space in the first address space is used to map application data of the security monitoring device, and the kernel mode address space in the first address space is used to map kernel data of the second virtual machine, and the acquisition unit is used to: obtain the kernel data of the second virtual machine from the kernel mode address space in the first address space.

[0043] In combination with the third aspect, in certain implementations of the third aspect, the mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space is achieved by changing the page table on the extended page table pointing to the kernel of the first virtual machine to a page table pointing to the kernel of the second virtual machine.

[0044] In combination with the third aspect, in certain implementations of the third aspect, the kernel data of the second virtual machine is mapped as read-only.

[0045] In combination with the third aspect, in certain implementations of the third aspect, the acquisition unit is also used to: obtain the kernel data of the second virtual machine when the first condition is met, and the first condition includes: the second virtual machine creates a new process, or before the second virtual machine issues a vehicle control instruction; or, the acquisition unit is also used to: obtain the kernel data of the second virtual machine according to a preset period.

[0046] In combination with the third aspect, in certain implementations of the third aspect, the processing unit is configured to: determine whether the second virtual machine is invaded by an attacker based on kernel data of the second virtual machine.

[0047] In combination with the third aspect, in certain implementations of the third aspect, the processing unit is further used to: determine whether the second virtual machine has been invaded by an attacker based on at least one of the following: determine based on the task list and scheduling queue on the second virtual machine; determine based on whether the process with high privileges on the second virtual machine is on the whitelist; determine based on whether the configuration file and implementation of the security access control policy of the second virtual machine comply with a known whitelist; determine based on whether the access rights of the key partition in the disk file system of the second virtual machine are read-only; determine based on whether the second virtual machine has an abnormal network connection.

[0048] In combination with the third aspect, in certain implementations of the third aspect, the working mode of the security monitoring device also includes a system call mode, and the system call mode and the security monitoring mode are executed alternately. In this system call mode, the security monitoring device runs instructions through a second address space, and the second address space includes a user state address space and a kernel state address space. The user state address space in the second address space is used to map the application data of the security monitoring device, and the kernel state address space in the second address space is used to map the kernel data of the first virtual machine.

[0049] In combination with the third aspect, in certain implementations of the third aspect, the security management includes: forcing a safe restart.

[0050] In a fourth aspect, a security protection device is provided, which is applied to a VMM and includes: a transceiver unit for receiving a prompt message sent by a security monitoring device, wherein the prompt message is used to indicate that there is a security problem with the second virtual machine, and the security monitoring device is deployed on the first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine; a processing unit for performing security management on the second virtual machine.

[0051] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is also used to: construct a first address space, which is used to run the instructions of the security monitoring device, and the first address space includes a user state address space and a kernel state address space, the user state address space of the first address space is used to map the application data of the security monitoring device, and the kernel state address space of the first address space is used to map the kernel data of the second virtual machine.

[0052] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is also used to: change the page table on the extended page table pointing to the kernel of the first virtual machine to a page table pointing to the kernel of the second virtual machine, so as to realize the mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space.

[0053] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is used to: forcibly restart the second virtual machine safely.

[0054] In the fifth aspect, a security protection device is provided, including an input and output interface, a processor and a memory, the processor is used to control the input and output interface to send and receive signals or information, the memory is used to store computer programs, and the processor is used to call and run the computer program from the memory, so that the security protection device executes the security protection method in the first aspect or any possible implementation method of the first aspect.

[0055] In the sixth aspect, a security protection device is provided, comprising an input / output interface, a processor and a memory, wherein the processor is used to control the input / output interface to send and receive signals or information, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the security protection device executes the security protection method in the second aspect or any possible implementation method of the second aspect.

[0056] In the seventh aspect, a safety protection system is provided, comprising a safety protection device as in the third aspect or any possible implementation of the third aspect; or comprising a safety protection device as in the fourth aspect or any possible implementation of the fourth aspect; or comprising a safety protection device as in the fifth aspect; or comprising a safety protection device as in the sixth aspect.

[0057] In the eighth aspect, a security protection system is provided, including: a VMM, a first virtual machine and a second virtual machine, the security of the first virtual machine is higher than that of the second virtual machine, the first virtual machine includes a security monitoring device, wherein the security monitoring device includes the security protection device as in the third aspect or any possible implementation of the third aspect; the VMM includes the security protection device as in the fourth aspect or any possible implementation of the fourth aspect.

[0058] In the ninth aspect, a computer-readable medium is provided, which stores a program code. When the program code runs on a computer, the computer executes the security protection method in the first aspect or any possible implementation of the first aspect; or, executes the security protection method in the second aspect or any possible implementation of the second aspect.

[0059] In the tenth aspect, a computer program product is provided, comprising instructions. When the instructions are run on a computer, the security protection method as in the first aspect or any possible implementation of the first aspect is executed, or the security protection method as in the second aspect or any possible implementation of the second aspect is executed.

[0060] In the eleventh aspect, a computing device is provided, comprising: at least one processor and a memory, wherein the at least one processor is coupled to the memory and is used to read and execute instructions in the memory to execute the security protection method as in the first aspect or any possible implementation of the first aspect; or, to execute the security protection method as in the second aspect or any possible implementation of the second aspect.

[0061] In the twelfth aspect, a chip is provided, which includes a circuit for executing a security protection method such as the first aspect or any possible implementation of the first aspect; or, includes a circuit for executing a security protection method such as the second aspect or any possible implementation of the second aspect.

[0062] In the thirteenth aspect, an intelligent driving device is provided, comprising a protective device as in the third aspect or any possible implementation of the third aspect; or, comprising a protective device as in the fourth aspect or any possible implementation of the fourth aspect; or, comprising a safety protection device as in the fifth aspect; or, comprising a safety protection device as in the sixth aspect; or, comprising a safety protection system as in the seventh aspect; or, comprising a safety protection system as in the eighth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] FIG1 is a functional schematic diagram of an intelligent driving device 100 provided in an embodiment of the present application;

[0064] FIG2 is a schematic diagram of a safety protection system provided in an embodiment of the present application;

[0065] FIG3 is a schematic diagram of a security protection method provided in an embodiment of the present application;

[0066] FIG4 is a schematic diagram of the structure of a first address space provided in an embodiment of the present application;

[0067] FIG5 is a schematic diagram of the conversion principle of an address space and a physical address provided in an embodiment of the present application;

[0068] FIG6 is a schematic diagram of a page table modification provided by an embodiment of the present application;

[0069] FIG7 is a schematic diagram of the life cycle of a security monitoring device provided in an embodiment of the present application;

[0070] FIG8 is a schematic structural diagram of a safety protection device 800 provided in an embodiment of the present application;

[0071] FIG9 is a schematic structural diagram of a safety protection device 900 provided in an embodiment of the present application;

[0072] FIG10 is a schematic block diagram of the hardware structure of the security monitoring device 1000 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0073] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; “and / or” in this article is a description of the association relationship of associated objects, indicating that three relationships can exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0074] In this application, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural.

[0075] In the embodiments of this application, prefixes such as "first" and "second" are used only to distinguish different description objects and have no limiting effect on the position, order, priority, quantity, or content of the described objects. The use of prefixes such as ordinal numbers in the embodiments of this application to distinguish description objects does not constitute a limitation on the described objects. For a statement of the described objects, please refer to the description in the context of the claims or embodiments, and the use of such prefixes should not constitute an unnecessary limitation.

[0076] The following first introduces the professional terms involved in this application.

[0077] VMM: Also known as hypervisor, it is a small software layer used to create and manage multiple independently running virtual machines. It can logically separate multiple virtual machines from each other and allocate its own underlying computing power, memory, network, and disk to each virtual machine.

[0078] root: Also known as the root user, it has the highest permissions in the system, such as starting or stopping a process, deleting or adding users, adding or disabling hardware, creating new files, modifying files, or deleting all files, etc.

[0079] A process whitelist is a list of processes approved by the user or administrator. It should be understood that only processes listed in the whitelist are allowed; processes not listed are blocked. A whitelist prevents users or attackers from inserting unauthorized processes or viruses.

[0080] An address space is a set of addresses that a process can use to address memory. The operating system assigns each process its own address space, independent of the address spaces of other processes. Since no process can access physical addresses, the operating system provides a mechanism to map the virtual addresses of different processes to the physical addresses of different memory locations.

[0081] Page table: A data structure used to convert virtual addresses into physical addresses.

[0082] Extended page table: A data structure managed by the VMM when hardware virtualization is enabled. When hardware virtualization is enabled, the page table managed by the virtual machine kernel translates virtual addresses into intermediate addresses. The extended page table further translates intermediate addresses into physical addresses. This translation process is performed by the hardware memory management unit (MMU).

[0083] Translation table base register (TTBR): Used to store the base address of the first-level page table, including TTBR0 and TTBR1. TTBR0 stores the base address of the first-level page table for user processes, and TTBR1 stores the base address of the first-level page table for kernel space. When hardware virtualization is enabled, the TTBR stores the intermediate address of the base page table managed by the virtual machine kernel.

[0084] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings.

[0085] The solution of the present application can be applied to intelligent driving devices, for example, in vehicle-mounted computing platforms such as the central computing platform, intelligent driving domain controller, cockpit domain controller, microcontroller unit (MCU), and electronic control unit (ECU) in intelligent driving devices.

[0086] Among them, intelligent driving devices can include road vehicles, water vehicles, air vehicles, industrial equipment, agricultural equipment, or entertainment equipment, etc. For example, the intelligent driving device can be a vehicle, which is a vehicle in the broad sense, and can be a transportation tool (such as a commercial vehicle, passenger car, motorcycle, flying car, train, etc.), an industrial vehicle (such as a forklift, trailer, tractor, etc.), an engineering vehicle (such as an excavator, bulldozer, crane, etc.), agricultural equipment (such as a lawn mower, harvester, etc.), amusement equipment, toy vehicles, etc. This application does not specifically limit the type of vehicle. For another example, the intelligent driving device can be a vehicle such as an airplane or a ship.

[0087] The present application solution can also be applied to servers, smart terminals, smart homes, vehicle-mounted embedded devices, etc. For example, it can be applied to smartphones, desktop computers, laptops, tablet computers, wearable devices, robots, etc.

[0088] 1 , the application scenarios of the present application are exemplarily introduced by taking an intelligent driving device as an example.

[0089] Figure 1 is a functional schematic diagram of an intelligent driving device 100 provided in an embodiment of the present application. The intelligent driving device 100 may include a perception system 110 and a computing platform 120, wherein the perception system 110 may include one or more sensors for sensing information about the environment surrounding the intelligent driving device 100. For example, the perception system 110 may include a positioning system, which may be a global positioning system (GPS), a Beidou system, or other positioning systems. The perception system 110 may also include one or more of an inertial measurement unit (IMU), a lidar, a millimeter-wave radar, an ultrasonic radar, and a camera device.

[0090] The computing platform 120 is used to analyze and process data sensed by the perception system 110 and to control some or all functions of the intelligent driving device 100. Based on virtualization technology, the computing platform 120 may include a hardware layer 121, a virtual machine (VMM) 122 running on the hardware layer 121, and one or more virtual machines 123 (or one or more virtual machine isolation domains initiated by the VMM) running on the VMM 122. The hardware layer 121 may include a processor 1211, physical memory 1212, a hard disk 1213, and a network interface device 1214. The processor 1211 may be one or more; the network interface device 1214 may be a network adapter or network card for connecting to any connectable network, such as the Internet or an enterprise network. Each virtual machine 123 may include one or more application programs 1231 and an operating system 1232. The operating system includes a kernel. The kernel is the core of the operating system and is primarily responsible for core tasks such as process management, disk management, task scheduling, and memory management.

[0091] The processor 1211 is a circuit capable of processing signals. In one implementation, the processor 1211 may be a circuit capable of reading and executing instructions, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP). In another implementation, the processor 1211 may implement certain functions through the logical relationship of a hardware circuit. The logical relationship of the hardware circuit is fixed or reconfigurable. For example, the processor 1211 is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as a field programmable gate array (FPGA). In a reconfigurable hardware circuit, the process of the processor 1211 loading a configuration file to implement hardware circuit configuration can be understood as the process of the processor 1211 loading instructions to implement the functions of some or all of the above units. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

[0092] Virtual machines on computing platform 120 typically include high-security virtual machines and low-security virtual machines. High-security virtual machines are the security foundation of the entire system, lacking direct network exposure and therefore relatively secure. Low-security virtual machines, on the other hand, face a wider range of network attack surfaces and carry a higher risk of remote attacks. For example, the entertainment domain virtual machines in smart driving devices deploy numerous networked applications and third-party entertainment applications. These processes carry a high risk of vulnerabilities, often serving as entry points for remote attackers to compromise the vehicle's computer system.

[0093] Based on this, the present application proposes a security protection method, which mainly uses a security monitoring device deployed in a high-security virtual machine to monitor the security status of a low-security virtual machine, and when a security problem is detected, uses the VMM to perform security management on the low-security virtual machine to improve the security performance of the low-security virtual machine.

[0094] Figure 2 is a schematic diagram of a security protection system provided in an embodiment of the present application. As shown in Figure 2, security protection system 200 includes a first virtual machine 210, a second virtual machine 220, a virtual machine (VMM) 230, and a security monitoring device 211 deployed in first virtual machine 210. First virtual machine 210 lacks direct network exposure and is relatively secure, thus being considered a high-security virtual machine. Second virtual machine 220 faces a greater network attack surface and presents security risks, thus being considered a low-security virtual machine.

[0095] The security monitoring device 211 can be understood as a chip, module or processor in the first virtual machine 210. In this application, it is mainly used to monitor the kernel data of the second virtual machine 220. For specific monitoring methods, please refer to steps S310 to S330 in method 300 below.

[0096] The security monitoring device 211 can have two operating modes: security monitoring mode and system service call mode, which can be executed alternately. In the security monitoring mode, the security monitoring device 211 can access the kernel data of the second virtual machine 220 and determine the security status of the second virtual machine 220; in the system service call mode, the security monitoring device 211 can complete the service call tasks involved.

[0097] The VMM 230 is used to perform security management on the second virtual machine. For a specific management method, please refer to steps S330 and S340 in the method 300 below.

[0098] The security protection system 200 may include one low-security virtual machine or multiple low-security virtual machines. The first virtual machine 210 may monitor one low-security virtual machine or multiple low-security virtual machines, without limitation.

[0099] Based on the architecture shown in Figure 2, the security protection method is introduced in detail in combination with Figure 3.

[0100] Figure 3 is a schematic diagram of a security protection method provided in an embodiment of the present application. Method 300 can be applied to the computing platform 120 or security protection system 200 described above, and specifically, can be applied to the security monitoring device 211 and VMM 230 in security protection system 200. As shown in Figure 3, method 300 includes steps S310 to S340, which are described in detail below.

[0101] S310: The security monitoring device obtains kernel data of the second virtual machine. The security monitoring device is deployed on the first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

[0102] Among them, kernel data is the data that the operating system relies on during runtime and can reflect the security status of the kernel.

[0103] Specifically, the security monitoring device can obtain the kernel data of the second virtual machine from the kernel address space in the first address space. As shown in Figure 4, the first address space includes a user-mode address space and a kernel-mode address space, wherein the user-mode address space of the first address space is used to map the application data of the security monitoring device, and the kernel-mode address space of the first address space is used to map the kernel data of the second virtual machine.

[0104] Among them, the application data of the security monitoring device refers to the collection of codes and data that realize its security monitoring function; the kernel data of the second virtual machine refers to the data on which the operation of the second virtual machine operating system depends, which can reflect the security status of its kernel.

[0105] It should be understood that the first address space is a newly constructed address space by the VMM and is specifically used to monitor the second virtual machine. The construction of the first address space is described in detail below with reference to the accompanying drawings.

[0106] It should be noted that in conventional technologies, the data of the first and second virtual machines are typically mapped to different address spaces. For example, the data of a security monitoring device deployed in the first virtual machine is typically mapped to a second address space associated with the security monitoring device, while the data of the second virtual machine is mapped to a third address space associated with the second virtual machine.

[0107] FIG5 is a schematic diagram of the conversion principle of an address space and a physical address provided in an embodiment of the present application. As shown in FIG5 , the address space includes a user-mode address space and a kernel-mode address space. Based on conventional technology, taking a security monitoring device as an example, the user-mode address space in the second address space associated with the security monitoring device is mainly used to map the application data of the security monitoring device, and the kernel-mode address space is mainly used to map the kernel data of the first virtual machine; taking the second virtual machine as an example, the user-mode address space in the third address space associated with the second virtual machine is mainly used to map the application data of the second virtual machine, and the kernel-mode address space is mainly used to map the kernel data of the second virtual machine.

[0108] It should be understood that the physical address (PA) corresponding to the user-mode address space is usually pointed to by TTBR0, and the PA corresponding to the kernel-mode address space is pointed to by TTBR1. A virtual address is translated through the TTBR and multi-level page tables (for example, the three-level page tables (PGD, PMD, PTE) or (PGD', PMD', PTE') shown in Figure 5) and ultimately converted into a PA. It should also be understood that when hardware virtualization is enabled, the TTBR and all page table entries translate into an intermediate physical address (IPA). The IPA needs to be translated through the stage 2 page table to become a PA, where the stage 2 page table is maintained by the VMM.

[0109] Because based on traditional technology, the data of the security monitoring device and the second virtual machine are usually mapped to different address spaces (ie, the second address space and the third address space mentioned above), the security monitoring device cannot directly access the kernel data of the second virtual machine.

[0110] Based on this, the present application proposes that a new address space (i.e., the first address space mentioned above) can be constructed using VMM. The user-mode address space in the new address space is mainly used to map the application data of the security monitoring device, and the kernel-mode address space is mainly used to map the kernel data of the second virtual machine, so as to realize the fusion of the address space of the security monitoring device and the address space of the second virtual machine, and then realize the acquisition of the kernel data of the second virtual machine.

[0111] Optionally, the VMM can construct the first address space based on the second address space. Specifically, the VMM can modify the page table in the second address space that originally pointed to the kernel of the first virtual machine to point to the page table of the kernel of the second virtual machine, thereby constructing a new first address space. Based on this new address space, the user-mode address space can still be used to map the application data of the security monitoring device, while the kernel-mode address space can be used to map the kernel data of the second virtual machine.

[0112] Alternatively, the VMM may construct the first address space directly instead of constructing the first address space based on the second address space. However, it should be understood that in this manner, the VMM needs to additionally maintain the consistency of the page table, which is a relatively complex process.

[0113] FIG6 is a schematic diagram of a page table modification provided by an embodiment of the present application. As shown in FIG6 , by rewriting the page table entry on stage 2 corresponding to the kernel mode address space of the second address space (i.e., changing stage2 to stage2'), the stage 1 page table (wherein the stage 1 page table refers to the PGD, PMD, and PTE page tables) is redirected so that the TTBR1 originally pointing to the kernel of the first virtual machine points to the kernel of the second virtual machine, thereby constructing a fused address space (i.e., the first address space).

[0114] The kernel data of the second virtual machine can be mapped as read-only, so that the kernel data of the second virtual machine is neither executable nor writable in the kernel mode address space of the first address space, thus causing no attack on the first virtual machine and no impact on the second virtual machine.

[0115] S320: The security monitoring device determines the security status of the second virtual machine according to the kernel data of the second virtual machine.

[0116] Optionally, the security monitoring device can determine whether the second virtual machine is invaded by an attacker based on the kernel data of the second virtual machine, and when the second virtual machine is invaded by an attacker, it is considered that there is a security problem with the second virtual machine; when the second virtual machine is not invaded by an attacker, it is considered that there is no security problem with the second virtual machine.

[0117] The security monitoring device may determine whether the second virtual machine is hacked by an attacker based on at least one of the following:

[0118] In a first example, the security monitoring device may determine whether the second virtual machine is invaded by an attacker based on a task list and a scheduling queue on the second virtual machine.

[0119] It should be understood that the kernel of the second virtual machine maintains a task list of running processes within the second virtual machine system. To erase traces of their intrusion, a root attacker may remove their own node from the task list. However, an attacker is typically unable to remove themselves from the kernel's scheduling queue, as the system will not schedule the process after removal. Therefore, by comparing the task list and the scheduling queue, it is possible to determine whether there are hidden processes, that is, whether there are traces of a root attack.

[0120] In a second example, the security monitoring device can determine whether the second virtual machine has been hacked by an attacker based on whether the highly privileged processes on the second virtual machine are on a whitelist. For example, if all highly privileged processes are on the whitelist, the second virtual machine can be determined to have not been hacked by an attacker; if some highly privileged processes are not on the whitelist, the second virtual machine can be determined to have been hacked by an attacker.

[0121] In a third example, the security monitoring device can determine whether the second virtual machine has been hacked by an attacker based on whether the configuration file and implementation of the security access control policy of the second virtual machine conform to a known whitelist. For example, if the configuration file and implementation of the security access control policy conform to the known whitelist, the second virtual machine can be determined to have not been hacked by an attacker; if the configuration file and implementation of the security access control policy do not conform to the known whitelist, the second virtual machine can be determined to have been hacked by an attacker.

[0122] In a fourth example, the security monitoring device may determine whether the second virtual machine has been hacked by an attacker based on whether the access permission for a key partition in the second virtual machine's disk file system is read-only. For example, if the access permission for a key partition in the second virtual machine's disk file system is read-only, the second virtual machine may be deemed not to have been hacked by an attacker; if the access permission for a key partition in the second virtual machine's disk file system is not read-only, the second virtual machine may be deemed to have been hacked by an attacker.

[0123] In Example 5, the security monitoring device may determine whether the second virtual machine has been hacked by an attacker based on whether the second virtual machine has an abnormal network connection. For example, if the second virtual machine does not have an abnormal network connection, it may be considered that the second virtual machine has not been hacked by an attacker; if the second virtual machine has an abnormal network connection, it may be considered that the second virtual machine has been hacked by an attacker.

[0124] It should be understood that the above determination method is only an example, and in actual operation, the security monitoring device may also determine whether the second virtual machine is invaded by an attacker in other ways, without limitation.

[0125] Optionally, the security monitoring device can also determine whether the second virtual machine has problems such as module execution function failure based on the kernel data of the second virtual machine, and when the second virtual machine has these problems, it is considered that the second virtual machine has security problems; when the second virtual machine does not have these problems, it is considered that the second virtual machine does not have security problems.

[0126] Optionally, the security monitoring device may also determine whether the second virtual machine has other problems according to the kernel data of the second virtual machine, and determine the security status of the second virtual machine based on these problems, without limitation.

[0127] S330: When the second virtual machine has a security problem, the security monitoring device sends a prompt message to the VMM; correspondingly, the VMM receives the prompt message sent by the security monitoring device, wherein the prompt message is used to indicate that the second virtual machine has a security problem.

[0128] S340: The VMM performs security management on the second virtual machine.

[0129] Optionally, the VMM may force a safe restart of the second virtual machine to implement safety management to ensure the safety of the second virtual machine; or may modify kernel data in the second virtual machine to implement safety management to ensure the safety of the second virtual machine.

[0130] Based on the solution of the present application, the security monitoring device deployed in the high-security virtual machine (for example, the first virtual machine) can monitor the security status of the low-security virtual machine (for example, the second virtual machine), and when it is monitored that there is a security problem in the low-security virtual machine, it can send a prompt message to the VMM to use the VMM to perform security management of the low-security virtual machine, thereby improving the security performance of the low-security virtual machine.

[0131] Optionally, when the security monitoring device determines that there is a security problem with the second virtual machine, it may also notify the virtual machine administrator, who then performs security management on the second virtual machine.

[0132] In one implementation, the monitoring operation (ie, method 300 ) may be performed according to a preset period, ie, the security monitoring device may obtain kernel data of the second virtual machine according to the preset period and monitor the security status of the second virtual machine.

[0133] In another implementation, the monitoring operation can be performed when a first condition is met. The first condition can include when the second virtual machine creates a new process or before the second virtual machine issues a vehicle control command. For example, the monitoring operation can be triggered when the second virtual machine creates a new process to ensure the security of the new process; or the monitoring operation can be triggered when the second virtual machine generates but has not yet issued a vehicle control command to ensure the security of the vehicle control command.

[0134] The security monitoring device can operate in two modes: a security monitoring mode and a system call mode. These modes can be executed alternately to ensure the normal operation of the security monitoring device's monitoring function. In security monitoring mode, the security monitoring device executes instructions in the first address space to retrieve kernel data from the second virtual machine. In system call mode, the security monitoring device executes instructions in the second address space to provide system call support for the monitoring function. The description of the first and second address spaces can be found above and will not be repeated here.

[0135] FIG7 is a schematic diagram of the life cycle of a security monitoring device provided in an embodiment of the present application. As shown in FIG7 , when the security monitoring device is started, when a request is received to check the second virtual machine, the VMM helps it to build and switch to the first address space to enter the security monitoring mode. In the security monitoring mode, the kernel data of the second virtual machine can be checked; during this process, if the security monitoring device requires the support of the system call, it can switch to the system call mode, that is, switch to the second address space originally corresponding to the first virtual machine to implement the system call; after the system call is completed, it can switch back to the security monitoring mode. This cycle is executed until the inspection task is completed and the inspection result is output.

[0136] The above-mentioned security monitoring device can be used to monitor one low-security virtual machine, and can also be used to monitor multiple low-security virtual machines.

[0137] For example, when the security monitoring device receives requests to check multiple low-security virtual machines at the same time, the VMM can help the multiple low-security virtual machines to respectively build address spaces that are integrated with the security monitoring device, and then traverse each low-security virtual machine in turn as shown in Figure 7 to complete the inspection.

[0138] In the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0139] The above describes in detail the method provided by the embodiment of the present application. The following describes in detail the apparatus provided by the embodiment of the present application in conjunction with Figures 8 to 10. It should be understood that the description of the apparatus embodiment corresponds to the description of the method embodiment. Therefore, for matters not described in detail, please refer to the method embodiment above. For the sake of brevity, it will not be repeated here.

[0140] Figure 8 is a schematic diagram of the structure of a security protection device 800 provided in an embodiment of the present application. Optionally, the device 800 can be a security monitoring device, or a chip, processor or module in a security monitoring device, etc., without limitation. The security monitoring device is deployed in a first virtual machine. As shown in Figure 8, the device 800 includes an acquisition unit 810, a processing unit 820 and a transceiver unit 830. It should be understood that the transceiver unit 830 has the ability to send and / or receive data, and the transceiver unit 830 can be an interface circuit in a specific implementation.

[0141] Among them, the acquisition unit 810 is used to: obtain the kernel data of the second virtual machine; the processing unit 820 is used to: determine the security status of the second virtual machine based on the kernel data of the second virtual machine; the transceiver unit 830 is used to: when there is a security problem with the second virtual machine, send a prompt message to the VMM, wherein the prompt message is used to indicate that there is a security problem with the second virtual machine, and the VMM is used to perform security management on the second virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

[0142] Optionally, the operating mode of the security monitoring device may include a security monitoring mode, in which the security monitoring device executes instructions through a first address space. The first address space includes a user mode address space and a kernel mode address space, the user mode address space in the first address space is used to map application data of the security monitoring device, and the kernel mode address space in the first address space is used to map kernel data of the second virtual machine. The acquisition unit 810 may be configured to acquire the kernel data of the second virtual machine from the kernel mode address space in the first address space.

[0143] Optionally, mapping the kernel data of the second virtual machine to the kernel mode address space in the first address space can be achieved by changing the page table pointing to the kernel of the first virtual machine on the extended page table to a page table pointing to the kernel of the second virtual machine.

[0144] Optionally, the kernel data of the second virtual machine may be mapped as read-only.

[0145] Optionally, the acquisition unit 810 can also be used to: obtain the kernel data of the second virtual machine when the first condition is met, the first condition including: the second virtual machine creates a new process, or before the second virtual machine issues a vehicle control instruction; or, the acquisition unit 810 can also be used to: obtain the kernel data of the second virtual machine according to a preset period.

[0146] Optionally, the processing unit 820 may be configured to determine, based on kernel data of the second virtual machine, whether the second virtual machine is invaded by an attacker.

[0147] Optionally, the processing unit 820 can also be used to determine whether the second virtual machine has been invaded by an attacker based on at least one of the following: determining based on the task list and scheduling queue on the second virtual machine; determining based on whether the process with high privileges on the second virtual machine is on the whitelist; determining based on whether the configuration file and implementation of the security access control policy of the second virtual machine comply with a known whitelist; determining based on whether the access rights to key partitions in the disk file system of the second virtual machine are read-only; determining based on whether there is an abnormal network connection with the second virtual machine.

[0148] Optionally, the operating mode of the security monitoring device may further include a system call mode, and the system call mode and the security monitoring mode may be executed alternately. In the system call mode, the security monitoring device executes instructions through a second address space, the second address space including a user mode address space and a kernel mode address space, the user mode address space in the first address space being used to map application data of the security monitoring device, and the kernel mode address space in the second address space being used to map kernel data of the first virtual machine.

[0149] Optionally, the above-mentioned safety management may include: forcing a safe restart.

[0150] FIG9 is a schematic diagram of the structure of a security protection device 900 provided in an embodiment of the present application. Optionally, the device 900 may be a VMM, or a chip, processor, or module within the VMM, without limitation. As shown in FIG9 , the device 900 includes a transceiver unit 910 and a processing unit 920. It should be understood that the transceiver unit 910 has the ability to send and / or receive data, and in a specific implementation, the transceiver unit 910 may be an interface circuit.

[0151] Among them, the transceiver unit 910 is used to: receive a prompt message sent by a security monitoring device, wherein the prompt message is used to indicate that there is a security problem with the second virtual machine, the security monitoring device is deployed on the first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine; the processing unit 920 is used to: perform security management on the second virtual machine.

[0152] Optionally, the processing unit 920 can also be used to: construct a first address space, which is used to run instructions of the security monitoring device, and the first address space includes a user state address space and a kernel state address space, the user state address space of the first address space is used to map application data of the security monitoring device, and the kernel state address space of the first address space is used to map kernel data of the second virtual machine.

[0153] Optionally, the processing unit 920 can also be used to: change the page table pointing to the first virtual machine kernel on the extended page table to a page table pointing to the second virtual machine kernel, so as to realize the mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space.

[0154] Optionally, the processing unit 920 may be configured to: forcibly restart the second virtual machine safely.

[0155] Figure 10 is a schematic block diagram of the hardware structure of a security monitoring device 1000 provided in an embodiment of the present application. Optionally, the device 1000 can be a computer device. The device 1000 includes a memory 1010, a processor 1020, and a communication interface 1030. The memory 1010, processor 1020, and communication interface 1030 can be connected to each other via a bus.

[0156] The memory 1010 may be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1010 may store programs. When the program stored in the memory 1010 is executed by the processor 1020, the processor 1020 is configured to perform the steps of the method 300 of the embodiment of the present application.

[0157] The processor 1020 may be a CPU, a microprocessor, an ASIC, a GPU, or one or more integrated circuits, configured to execute relevant programs to implement the various steps in the method 300 of the embodiment of the method of the present application.

[0158] The processor 1020 may also be an integrated circuit chip with signal processing capabilities. During implementation, each step in the method 300 of the present application may be completed by hardware integrated logic circuits in the processor 1020 or by software instructions.

[0159] The communication interface 1030 uses a transceiver device such as, but not limited to, a transceiver to implement communication between the apparatus 1000 and other devices or a communication network.

[0160] The embodiment of the present application further provides a computer-readable storage medium, comprising instructions, which, when executed on a computer, enable the computer to execute the various steps in the above-mentioned method 300.

[0161] The embodiment of the present application further provides a computer program product, which includes instructions. When the instructions are run on a computer, each step in the above method 300 is executed.

[0162] An embodiment of the present application further provides a computing device, comprising: at least one processor and a memory, wherein the at least one processor is coupled to the memory and is configured to read and execute instructions in the memory to perform each step in the above method 300.

[0163] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in the memory through the data interface and executes each step in the above method 300, or the chip executes each step in the above method 300 through a hardware circuit.

[0164] An embodiment of the present application also provides an intelligent driving device, including the above-mentioned device 800 and / or device 900 and / or system 200.

[0165] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0166] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0167] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0168] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0169] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0170] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0171] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A safety protection method, characterized in that: The method is applied to a security monitoring device, the security monitoring device is deployed on a first virtual machine, and the method includes: Obtaining kernel data of the second virtual machine; determining a security state of the second virtual machine according to the kernel data of the second virtual machine; When the second virtual machine has a security problem, a prompt message is sent to the virtual machine manager VMM, wherein the prompt message is used to indicate that the second virtual machine has a security problem, and the VMM is used to perform security management on the second virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

2. The method according to claim 1, characterized in that The working mode of the security monitoring device includes a security monitoring mode. In the security monitoring mode, the security monitoring device runs instructions through a first address space, wherein the first address space includes a user state address space and a kernel state address space, the user state address space in the first address space is used to map application data of the security monitoring device, and the kernel state address space in the first address space is used to map kernel data of the second virtual machine, and obtaining the kernel data of the second virtual machine includes: The kernel data of the second virtual machine is obtained from the kernel state address space in the first address space.

3. The method according to claim 2, characterized in that The mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space is achieved by changing the page table pointing to the kernel of the first virtual machine on the extended page table to a page table pointing to the kernel of the second virtual machine.

4. The method according to claim 3, characterized in that The kernel data of the second virtual machine is mapped as read-only.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: When a first condition is met, the kernel data of the second virtual machine is obtained, the first condition including: the second virtual machine creates a new process, or before the second virtual machine issues a vehicle control instruction; or, The kernel data of the second virtual machine is obtained according to a preset period.

6. The method according to any one of claims 1 to 5, characterized in that Determining the security status of the second virtual machine according to the kernel data of the second virtual machine includes: Determine whether the second virtual machine is invaded by an attacker according to the kernel data of the second virtual machine.

7. The method according to claim 6, characterized in that The method further includes: determining whether the second virtual machine is hacked by an attacker according to at least one of the following: Determining according to the task list and the scheduling queue on the second virtual machine; Determining based on whether the process with high privileges on the second virtual machine is in the whitelist; Determining based on whether the configuration file and implementation of the security access control policy of the second virtual machine conform to a known whitelist; Determining according to whether the access permission of the key partition in the disk file system of the second virtual machine is read-only; The determination is made based on whether the second virtual machine has an abnormal network connection.

8. The method according to claim 2, characterized in that: The working mode of the security monitoring device also includes a system call mode, and the system call mode and the security monitoring mode are executed alternately. In the system call mode, the security monitoring device runs instructions through a second address space, and the second address space includes a user state address space and a kernel state address space. The user state address space in the second address space is used to map application data of the security monitoring device, and the kernel state address space in the second address space is used to map kernel data of the first virtual machine.

9. The method according to any one of claims 1 to 8, characterized in that The safety management includes: forcing a safe restart.

10. A safety protection method, characterized in that: The method is applied to a virtual machine manager VMM, and the method comprises: receiving a prompt message sent by a security monitoring device, wherein the prompt message is used to indicate that a security problem exists in the second virtual machine, the security monitoring device is deployed on the first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine; Perform security management on the second virtual machine.

11. The method according to claim 10, characterized in that The method further comprises: Construct a first address space, the first address space is used to run the instructions of the security monitoring device, the first address space includes a user state address space and a kernel state address space, the user state address space of the first address space is used to map the application data of the security monitoring device, and the kernel state address space of the first address space is used to map the kernel data of the second virtual machine.

12. The method according to claim 11, characterized in that The constructing the first address space comprises: The page table pointing to the first virtual machine kernel on the extended page table is changed to a page table pointing to the second virtual machine kernel, so as to implement mapping of the kernel data of the second virtual machine to the kernel state address space in the first address space.

13. The method according to any one of claims 10 to 12, characterized in that The performing security management on the second virtual machine includes: The second virtual machine is restarted safely.

14. A safety protection device, characterized in that: The device is applied to a security monitoring device, the security monitoring device is deployed in a first virtual machine, and the device includes: An acquisition unit, used for acquiring kernel data of the second virtual machine; a processing unit, configured to determine a security state of the second virtual machine according to the kernel data of the second virtual machine; The transceiver unit is used to send a prompt message to the virtual machine manager VMM when there is a security problem with the second virtual machine, wherein the prompt message is used to indicate that there is a security problem with the second virtual machine, the VMM is used to perform security management on the second virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine.

15. The device according to claim 14, characterized in that The working mode of the security monitoring device includes a security monitoring mode. In the security monitoring mode, the security monitoring device runs instructions through a first address space, wherein the first address space includes a user state address space and a kernel state address space, the user state address space in the first address space is used to map application data of the security monitoring device, and the kernel state address space in the first address space is used to map kernel data of the second virtual machine, and the acquisition unit is used to: The kernel data of the second virtual machine is obtained from the kernel state address space in the first address space.

16. The device according to claim 15, characterized in that The mapping of the kernel data of the second virtual machine to the kernel mode address space in the first address space is achieved by changing the page table pointing to the kernel of the first virtual machine on the extended page table to a page table pointing to the kernel of the second virtual machine.

17. The device according to claim 16, characterized in that The kernel data of the second virtual machine is mapped as read-only.

18. The device according to any one of claims 14 to 17, characterized in that The acquisition unit is further used to: acquire kernel data of the second virtual machine when a first condition is met, wherein the first condition includes: the second virtual machine creates a new process, or before the second virtual machine issues a vehicle control instruction; or, the acquisition unit is further used to: The kernel data of the second virtual machine is obtained according to a preset period.

19. The device according to any one of claims 14 to 18, characterized in that The processing unit is used for: Determine whether the second virtual machine is invaded by an attacker according to the kernel data of the second virtual machine.

20. The device according to claim 19, characterized in that The processing unit is further configured to determine whether the second virtual machine is invaded by an attacker according to at least one of the following: Determining according to the task list and the scheduling queue on the second virtual machine; Determining based on whether the process with high privileges on the second virtual machine is in the whitelist; Determining based on whether the configuration file and implementation of the security access control policy of the second virtual machine conform to a known whitelist; Determining according to whether the access permission of the key partition in the disk file system of the second virtual machine is read-only; The determination is made based on whether the second virtual machine has an abnormal network connection.

21. The device according to claim 15, characterized in that The working mode of the security monitoring device also includes a system call mode, and the system call mode and the security monitoring mode are executed alternately. In the system call mode, the security monitoring device runs instructions through a second address space, and the second address space includes a user state address space and a kernel state address space. The user state address space in the second address space is used to map application data of the security monitoring device, and the kernel state address space in the second address space is used to map kernel data of the first virtual machine.

22. The device according to any one of claims 14 to 21, characterized in that The safety management includes: forcing a safe restart.

23. A safety protection device, characterized in that: The device is applied to a virtual machine manager VMM, and the device comprises: a transceiver unit, configured to receive a prompt message sent by a security monitoring device, wherein the prompt message is used to indicate that a security problem exists in the second virtual machine, the security monitoring device is deployed on the first virtual machine, and the security of the first virtual machine is higher than that of the second virtual machine; A processing unit is used to perform security management on the second virtual machine.

24. The device according to claim 23, characterized in that The processing unit is also used for: Constructing a first address space, the first address space is used to run the instructions of the security monitoring device, the first address space includes A user state address space and a kernel state address space, wherein the user state address space of the first address space is used to map application data of the security monitoring device, and the kernel state address space of the first address space is used to map kernel data of the second virtual machine.

25. The device according to claim 24, characterized in that The processing unit is also used for: The page table pointing to the first virtual machine kernel on the extended page table is changed to a page table pointing to the second virtual machine kernel, so as to implement mapping of the kernel data of the second virtual machine to the kernel state address space in the first address space.

26. The device according to any one of claims 23 to 25, characterized in that The processing unit is used for: The second virtual machine is restarted safely.

27. A safety protection device, characterized in that: It includes an input / output interface, a processor and a memory, the processor is used to control the input / output interface to send and receive signals or information, the memory is used to store computer programs, and the processor is used to call and run the computer program from the memory, so that the safety protection device runs the safety protection method as described in any one of claims 1 to 9.

28. A safety protection device, characterized in that: It includes an input-output interface, a processor and a memory, the processor is used to control the input-output interface to send and receive signals or information, the memory is used to store computer programs, and the processor is used to call and run the computer program from the memory, so that the safety protection device runs the safety protection method as described in any one of claims 10 to 13.

29. A safety protection system, characterized in that: include: A virtual machine manager VMM, a first virtual machine and a second virtual machine, wherein the first virtual machine has a higher security than the second virtual machine, and the first virtual machine includes a security monitoring device, wherein: The security monitoring device comprises a device as claimed in any one of claims 14 to 22 and 27; The VMM comprises the apparatus as claimed in any one of claims 23 to 26 and 28.

30. An intelligent driving device, characterized in that: Includes the safety protection device as described in any one of claims 14 to 28; or includes the safety protection system as described in claim 29.

Images