Information processing device and information processing method

Abstract

The present invention enhances the security of an information processing device. This information processing device, which pertains to the features disclosed in the description of the present application, comprises a system call unit that processes system calls issued by system software when an application uses a function provided from the system software. The system call unit is provided with: a system call body processing unit that processes system calls; a system call restriction control unit that performs control that limits the execution of system call processing; and a memory data inspection unit that inspects memory data obtained by tracking the data structure of system calls from a memory data address that the application passes to the system call unit.

Description

Information processing device and information processing method

[0001] The technology disclosed herein relates to information processing.

[0002] An automatic control system is generally a system in which multiple functions cooperate and integrate to perform perception, judgment, and control.

[0003] For example, an autonomous driving system is composed of an autonomous driving control unit that generates optimal control parameters based on the surrounding conditions, an engine control unit that realizes engine control, brake control, and steering control of the vehicle, respectively, a brake control unit, and a steering control unit.

[0004] As the level of autonomy (e.g., autonomous driving level) becomes more advanced, automatic control systems are configured as a whole by connecting a plurality of diverse information processing devices through a network. Furthermore, when adding or updating services or functions provided by the information processing devices that configure the automatic control system, or when diagnosing the information processing devices, the information processing devices connect to external systems or diagnostic devices and perform processing in cooperation with them.

[0005] On the other hand, as connections and collaborative processing with various systems or devices become more sophisticated, the security risks of automatic control systems also increase. In response to this, information processing devices generally have the function of virtually isolating software execution environments using system software such as an operating system or container.

[0006] However, even with programs running in these environments, there remains the risk of intentional or accidental attacks, such as finding and exploiting vulnerabilities in the system to take over the environment and cause the system to malfunction or to infringe on security assets.

[0007] In response to such issues, for example, Patent Document 1 proposes a computer, an operation rule application method, and an operating system that can apply operation rules that determine whether to permit an issued system call based on which individual program (library or application itself) the system call belongs to in an application composed of multiple programs including libraries.

[0008] Furthermore, for example, Patent Document 2 proposes a server computer system control method in which a means is provided for dividing the execution process of a monitored application into processing phases, elapsed time, and other time-dependent elements to create an allowable set of system calls, and the operating system monitors the execution of a sequence of system calls using the allowable sets prepared for each phase in accordance with fluctuations in the processing phase.

[0009] Japanese Patent No. 5131563 Japanese Patent Laid-Open No. 2006-330864

[0010] The behavior of a service or function with respect to a system is observed through system calls to system software such as an operating system.

[0011] In Patent Document 1, for a system call issued from an application, the operating system determines whether or not to process the system call for each program (main body, library) that issues the system call.

[0012] In Patent Document 2, an allowable set of system calls is set for each processing phase (each time segment) of an application and monitored.

[0013] However, the number of arguments and their combinations that can be issued by a system call is infinite, and even with these disclosed methods, the risk of security attacks using authorized system calls remains. In other words, determining whether a system call is authorized by determining the system call type or register values ​​based on the system call's application binary interface (ABI) is not sufficient.

[0014] The technology disclosed in this specification has been made in consideration of the problems described above, and is a technology for enhancing the robustness of the security of information processing devices.

[0015] An information processing device that is a first aspect of the technology disclosed in the present specification is an information processing device in which system software runs on computer hardware including an arithmetic unit and a main memory device, and the system software has a system call unit that processes system calls issued when an application uses a function provided by the system software, and the system call unit has a system call main processing unit that processes the system call, a system call restriction control unit that controls the restriction of the processing execution of the system call, and a memory data inspection unit that inspects the memory data corresponding to the system call by tracing the data structure of the system call from the memory data address passed by the application to the system call unit.

[0016] According to at least the first aspect of the technology disclosed in this specification, it is possible to trace the data structure of a system call based on the memory data address specified in the argument of the system call and verify the validity of the contents of the memory data.

[0017] Furthermore, objects, features, aspects, and advantages associated with the technology disclosed herein will become more apparent from the detailed description and accompanying drawings set forth below.

[0018] 1 is a block diagram showing an example of a configuration of an information processing device according to an embodiment. FIG. 1 is a diagram showing examples of a system call restriction control table, a system call restriction control table, and a system call restriction control table according to an embodiment. FIG. 2 is a diagram showing an example of a watchpoint context table according to an embodiment. FIG. 3 is a flowchart showing an example of an operation flow of a system call unit according to an embodiment. FIG. 4 is a flowchart showing an example of an operation flow of a system call restriction control unit according to an embodiment. FIG. 5 is a flowchart showing an example of an operation flow of a memory data inspection unit according to an embodiment. FIG. 6 is a flowchart showing an example of an operation flow of a memory data integrity assurance unit according to an embodiment. FIG. 7 is a flowchart showing an example of an operation flow of a memory data permission determination unit according to an embodiment. FIG. 8 is a flowchart showing an example of an operation flow of a user memory data capture event processing unit according to an embodiment. FIG. 9 is a flowchart showing an example of an operation flow of a context switch of a context management unit by a scheduler according to an embodiment. FIG. 10 is a block diagram showing an example of a configuration of an information processing device according to an embodiment. FIG. 11 is a diagram showing examples of a system call restriction control table, a system call restriction control table, and a system call restriction control table according to an embodiment. FIG. 12 is a diagram showing an example of a breakpoint context table according to an embodiment. FIG. 13 is a flowchart showing an example of an operation flow of a system call restriction control unit according to an embodiment. FIG. 14 is a flowchart showing an example of an operation flow of a memory data inspection unit according to an embodiment. FIG. 15 is a flowchart showing an example of an operation flow of a memory data integrity assurance unit according to an embodiment. 10 is a flowchart showing an example of an operation flow of a memory data permission determination unit according to an embodiment; FIG. 11 is a flowchart showing an example of an operation flow of a user memory data acquisition event processing unit according to an embodiment; FIG. 12 is a flowchart showing an example of an operation flow of a context switch of a context management unit by a scheduler according to an embodiment;

[0019] Hereinafter, embodiments will be described with reference to the accompanying drawings. In the following embodiments, detailed features are shown for the purpose of explaining the technology, but these are merely examples and are not necessarily essential features for enabling the embodiments to be implemented.

[0020] The drawings are schematic, and for the sake of convenience, components may be omitted or simplified as appropriate. The relative sizes and positions of components shown in different drawings are not necessarily accurately depicted and may be changed as appropriate. Hatching may also be used in drawings such as plan views that are not cross-sectional views to facilitate understanding of the embodiments.

[0021] In the following description, the same components are denoted by the same reference numerals, and their names and functions are also the same. Therefore, detailed descriptions of them may be omitted to avoid duplication.

[0022] Furthermore, in the description given in this specification, when a certain component is described as "comprising," "including," or "having," unless otherwise specified, this is not an exclusive expression that excludes the presence of other components.

[0023] Furthermore, in the description of this specification, even if ordinal numbers such as "first" or "second" are used, these terms are used for convenience to make it easier to understand the contents of the embodiments, and the contents of the embodiments are not limited to the order that may result from these ordinal numbers.

[0024] First Embodiment An information processing device and an information processing method according to this embodiment will be described below.

[0025] <Configuration of Information Processing Apparatus> FIG. 1 is a block diagram showing an example of the configuration of an information processing apparatus 1000 according to this embodiment.

[0026] The information processing apparatus 1000 includes at least system software 1100 , computer hardware 1200 , a system call restriction control setting unit 1300 , an application 1400 , and an application 1401 .

[0027] The system call restriction control setting unit 1300 operates on the system software 1100, and may operate within a virtually separated software execution environment of the system setting control container execution environment 1301. The system call restriction control setting unit 1300 sets information regarding the system call restriction setting for the system call restriction control table setting unit 1120 in the system software 1100.

[0028] The application 1400 and the application 1401 run on the system software 1100 and may run within a virtually isolated software execution environment of the application container execution environment 1402 .

[0029] The system software 1100 includes at least a system call unit 1110, a system call restriction control table setting unit 1120, a log recording unit 1121, a context management unit 1122, a scheduler 1123, process state management data 1130, thread state management data 1140, a system call restriction control table 1150, a system call restriction control table 1151, a system call restriction control table 1152, and a watchpoint context table 1160.

[0030] Furthermore, when the system call restriction control setting unit 1300, the application 1400 (user program), and the application 1401 (user program) run in a container execution environment, they may include container execution environment management data 1170. Note that when the container execution environment management data 1170 is not included, the container execution environment management data 1170 does not include the system call restriction control table 1152.

[0031] The system call unit 1110 processes system calls issued by user programs (the system call restriction control setting unit 1300, the application 1400, and the application 1401) running on the system software 1100. A system call is issued when an application uses a function provided by the system software 1100.

[0032] The system call restriction control table setting unit 1120 sets the system call restriction control table 1150 , the system call restriction control table 1151 , and the system call restriction control table 1152 based on information on system call restriction setting from the system call restriction control setting unit 1300 .

[0033] The log recording unit 1121 records at least the information output by the system call unit 1110. The log record is saved, for example, in the main memory device 1205 and non-volatile memory device 1206 of the computer hardware 1200. The non-volatile memory device 1206 permanently holds the recorded data.

[0034] The context management unit 1122 manages at least the system call restriction control setting unit 1300, the application 1400, and the process or thread representing the executable state (on the computer hardware 1200) of the application 1401, which operate on the system software 1100.

[0035] The scheduler 1123 assigns at least the system call restriction control setting unit 1300, application 1400, and processes or threads representing the executable state of application 1401, which operate on the system software 1100, to the computing cores 1201 and 1202 of the computer hardware 1200, thereby enabling the program to be executed.

[0036] The process state management data 1130 describes, for each process, information indicating the executable state of at least the system call restriction control setting unit 1300, application 1400, and application 1401 that operate on the system software 1100, including the state of the process.

[0037] The thread state management data 1140 describes, for each thread, information about a thread that represents the smallest execution unit that shares the memory space of a process in a process that represents the executable state of at least the system call restriction control setting unit 1300, application 1400, and application 1401 that operate on the system software 1100. The thread state management data 1140 may be stored in association with the process state management data 1130. In other words, the process state management data 1130 may be data that is managed by including the thread state management data 1140.

[0038] The system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152 describe information relating to restriction control in the execution of system call processing.

[0039] When limiting system calls for each execution environment, the system call limit control table 1152 may be stored in association with the container execution environment management data 1170. When limiting system calls for each process, the system call limit control table 1151 may be stored in association with the process state management data 1130. When limiting system calls for each thread, the system call limit control table 1150 may be stored in association with the thread state management data 1140.

[0040] The watchpoint context table 1160 holds information for setting and controlling the watchpoint mechanisms 1203 and 1204 of the computer hardware 1200. The watchpoint context table 1160 may be held in association with the process state management data 1130 for each user process that shares a memory space.

[0041] The container execution environment management data 1170 is held for each container execution environment that virtually separates the execution environment of a program. The container execution environment management data 1170 holds at least the system call restriction control setting unit 1300, the application 1400, and the process state management data 1130 of the application 1401, which are included in the container execution environments (the system setting control container execution environment 1301 and the application container execution environment 1402).

[0042] The system call unit 1110 includes at least a system call restriction control unit 1111, a user memory data acquisition unit 1112, a system call main body processing unit 1113, a memory data inspection unit 1114, a memory data integrity assurance unit 1115, a memory data permission determination unit 1116, and a user memory data acquisition event processing unit 1117.

[0043] The system call restriction control unit 1111 controls restrictions on the execution of system call processing.

[0044] The user memory data acquisition unit 1112 traces the data structure based on the memory data address specified by the argument of the system call issued from the system call restriction control setting unit 1300, application 1400, and application 1401 operating on the system software 1100, and performs processing to acquire the data (memory data) from the user memory into the memory within the system software (for example, the kernel program of the operating system).

[0045] The system call main processing unit 1113 executes processing of system calls issued by the system call restriction control setting unit 1300 , application 1400 , and application 1401 that operate on the system software 1100 .

[0046] The memory data inspection unit 1114 traces the data structure of the system call based on the memory data address specified in the argument of the system call passed from the application to the system call unit 1110. Then, the memory data inspection unit 1114 performs processing to verify the validity of the contents of the data (memory data) in the user memory corresponding to the system call.

[0047] The memory data integrity assurance unit 1115 traces the data structure from the memory data address specified by the argument of the system call, and performs processing to ensure the integrity of the contents of the data in the user memory (memory data).

[0048] The memory data permission determination unit 1116 traces the data structure based on the memory data address specified by the argument of the system call, and determines whether the contents of the data in the user memory (memory data) are permitted.

[0049] The user memory data import event processing unit 1117 performs event processing when an event is set to occur in the user memory data import unit 1112 after processing to import data from the user memory into memory within the system software (for example, the kernel program of the operating system).

[0050] The computer hardware 1200 includes at least an operation core 1201 , an operation core 1202 , a watchpoint mechanism 1203 , a watchpoint mechanism 1204 , a main memory device 1205 , a non-volatile memory device 1206 , and a peripheral device 1207 .

[0051] At least one or more computing cores 1201 and 1202 are provided, and a scheduler 1123 of the system software 1100 controls allocation to a system call restriction control setting unit 1300, an application 1400, and an application 1401 that operate on the system software 1100 including the container execution environment (a system setting control container execution environment 1301, an application container execution environment 1402). The computing cores 1201 and 1202 may also include a cache that temporarily stores data from the main memory device 1205.

[0052] The operation cores 1201 and 1202 may execute programs stored in the main memory device 1205, the non-volatile memory device 1206, an external CD-ROM, an external DVD-ROM, or an external flash memory, etc. That is, they may be, for example, a central processing unit (CPU), a microprocessor, a microcomputer, or a digital signal processor (DSP).

[0053] When the computing cores 1201 and 1202 execute programs stored in the main memory device 1205, the non-volatile memory device 1206, an external CD-ROM, an external DVD-ROM, or an external flash memory, the system software 1100 is realized by software, firmware, or a combination of software and firmware that executes the programs stored in the main memory device 1205 and the non-volatile memory device 1206 by the computing cores 1201 and 1202.

[0054] The software and firmware may be written as a program and stored in the main memory device 1205 and the non-volatile memory device 1206. In this case, the processor core 1201 and the processor core 1202 realize the above functions by reading and executing the program stored in the main memory device 1205 and the non-volatile memory device 1206. In other words, the main memory device 1205 and the non-volatile memory device 1206 may store a program that, when executed by the processor core 1201 and the processor core 1202, results in the above functions being realized.

[0055] Additionally, the computing cores 1201 and 1202 may be dedicated hardware, such as a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination thereof.

[0056] When the processor cores 1201 and 1202 are dedicated hardware, the system software 1100 is realized by the operation of the processor cores 1201 and 1202. Note that the functions of the system software 1100 may be realized by separate circuits or by a single circuit.

[0057] At least one watchpoint mechanism 1203 and one watchpoint mechanism 1204 may be provided, one for each of the processor cores 1201 and 1202. The watchpoint mechanism is hardware that monitors and restricts access to memory data. The watchpoint mechanism may have one or more watchpoints that can monitor access to memory data and set access restrictions. The watchpoints may be set via a watchpoint register (not shown here).

[0058] The scheduler 1123 of the system software 1100 controls allocation to the system call restriction control setting unit 1300, application 1400, and application 1401 that operate on the system software 1100, including within the container execution environment (system setting control container execution environment 1301, application container execution environment 1402).

[0059] The main memory device 1205 stores data for performing arithmetic processing. The system software 1100 controls allocation of the storage area of ​​the main memory device 1205 to the system call restriction control setting unit 1300, the application 1400, and the application 1401 that run on the system software 1100, including the container execution environment (system setting control container execution environment 1301, application container execution environment 1402).

[0060] The non-volatile storage device 1206 permanently stores the recorded data. The system software 1100 controls allocation of the storage area of ​​the non-volatile storage device 1206 to the system call restriction control setting unit 1300, the application 1400, and the application 1401 that run on the system software 1100, including the container execution environment (system setting control container execution environment 1301, application container execution environment 1402).

[0061] The main memory device 1205 and the non-volatile memory device 1206 may be, for example, a hard disk drive (HDD), a random access memory (RAM), a read only memory (ROM), a flash memory, an erasable programmable read only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or other volatile or non-volatile semiconductor memory, a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, or a DVD (DVD), or any other memory medium that will be used in the future.

[0062] The peripheral device 1207 is a peripheral device included in the information processing apparatus 1000. The peripheral device 1207 may include a communication device and a security module device. The system software 1100 controls allocation of the peripheral device 1207 to the system call restriction control setting unit 1300, the application 1400, and the application 1401 that run on the system software 1100, including the container execution environment (system setting control container execution environment 1301, application container execution environment 1402).

[0063] FIG. 2 is a diagram showing examples of the system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152 according to this embodiment.

[0064] The system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152 each include permitted system calls 2000, system call argument information 2001, a permitted set 2002, and information 2003 on data to be subjected to permission determination.

[0065] The permitted system call 2000 describes an identifier indicating a system call that the system call unit 1110 of the system software 1100 permits to be executed (permits to call the system call).

[0066] The system call argument information 2001 describes, for each permitted system call 2000, information on the data structure of the system call arguments.

[0067] For example, in the permitted system call described in permitted system call 2000 (described as syscall_n in FIG. 2), the argument is composed of a first argument, a second argument, and a third argument, and the data structure information of the first argument, the second argument, and the third argument is illustrated.

[0068] The information on the data structure of the first argument indicates that register x0 holds a data type that is a 32-bit unsigned integer (described as unsigned int).

[0069] The data structure information of the second argument shows that register x1 holds a data type (described as char *) that indicates the start address of character string data as a memory data address.

[0070] The data structure information of the third argument shows that register x2 holds a data type (described as struct A *) that indicates the address of structure A as a memory data address.

[0071] The data type information of the third argument, structure A, is exemplified by storing the data type bool, which is a Boolean value, in a1, which indicates the data symbol, and the data type (written as struct B *), which indicates the address of the structure B data as a memory data address, in a2, which indicates the data symbol.

[0072] The data type information of structure B shows that b1, which indicates the data symbol, holds a data type that is a 32-bit signed integer (written as int), and b2, which indicates the data symbol, holds a data type that indicates an array having n pieces of 64-bit signed integer data as memory data addresses (written as long[n]).

[0073] The allowable set 2002 describes information on the allowable range of data for each piece of system call argument information 2001. The allowable range may be described using, for example, mathematical expressions and formal expressions such as equal signs, inequalities, and logical expressions, or a set of character strings written in regular expressions.

[0074] For example, the allowable data range of the first argument in the permitted system call (described as syscall_n in FIG. 2) described in permitted system call 2000 is illustrated as an integer smaller than PATH_MAX (described as x0<PATH_MAX). Note that PATH_MAX may be defined as a positive integer value.

[0075] The allowable data range for the second argument is, for example, "a string of one or more characters consisting of lowercase letters a to z, uppercase letters A to Z, numbers 0 to 9, and the symbol / ," and "the length of the string must be less than PATH_MAX."

[0076] The data allowable range of the third argument is exemplified as not set (may be considered allowable) for the address of structure A, and not set (may be considered allowable) for the data of structure A. Also, for the data of structure B, the following are exemplified: "b1, a 32-bit signed integer, is greater than 0" and "the absolute value of each element of an array having n pieces of 64-bit signed integer data is greater than 16."

[0077] The import information 2003 for data subject to allowance determination describes at least the order in which data (memory data) from the user memory has been imported, the data to be imported, and the size of the imported data for each permitted system call 2000. The data subject to allowance determination corresponds to memory data for which allowance is determined using the allowable set 2002.

[0078] For example, the permitted system call described in permitted system call 2000 (denoted as syscall_n in FIG. 2) first illustrates fetching the data of structure B up to the size of the data of structure B (denoted as {1, a2, size_a2} using a2 indicating the address symbol of structure B), and second illustrates fetching the data of the character string of the second argument up to the size of the data of the character string (denoted as {2, x1, size_x1} using x1 indicating the address symbol of structure B).

[0079] FIG. 3 is a diagram showing an example of the watchpoint context table 1160 according to this embodiment.

[0080] The watchpoint context table 1160 includes a watchpoint identifier 3000 , a thread identifier 3001 , an admissibility determination order number 3002 , a system call identifier 3003 , a watchpoint register setting value 3004 , and a watchpoint state 3005 .

[0081] The watchpoint identifier 3000 describes an identifier indicating a watchpoint that the watchpoint mechanism 1203 and the watchpoint mechanism 1204 have.

[0082] For example, one watchpoint mechanism is illustrated as having n watchpoints designated by watchpoint identifiers WP_0 to WP_n-1.

[0083] The thread identifier 3001 describes an identifier indicating the thread to which the watchpoint indicated by the watchpoint identifier 3000 is assigned.

[0084] The allowable determination order number 3002 describes the allowable determination order of allowable determination target data for which a watchpoint is set for each thread identifier 3001. The allowable determination order number 3002 is shown as a pair including at least the thread identifier 3001 and a number indicating the allowable determination order of the allowable determination target data for which a watchpoint is set.

[0085] The system call identifier 3003 describes an identifier indicating a system call that is subject to system call restriction control using the watchpoint indicated by the watchpoint identifier 3000 (in other words, a system call issued by a thread to which a watchpoint is assigned).

[0086] The watchpoint register setting value 3004 describes information on the register setting value of the watchpoint indicated by the watchpoint identifier 3000. The watchpoint register setting value 3004 includes at least information equivalent to a memory data address, information equivalent to a size value, and access permission information in order to set a memory area for monitoring and controlling access to memory data.

[0087] The watchpoint state 3005 describes the state of the watchpoint indicated by the watchpoint identifier 3000. The watchpoint state 3005 includes at least in-use and free.

[0088] For example, in the example of Figure 3, the watchpoints indicated by the watchpoint identifiers WP_i and WP_j are being used in the system call restriction control of the system call indicated by syscall_n issued by the thread indicated by the thread identifier TID_o, and among them, the watchpoint identifier WP_i is first in the allowable judgment order, and the watchpoint identifier WP_j is second in the allowable judgment order, and the watchpoint identifier WP_i and the watchpoint identifier WP_j each show information including an address range for which ReadOnly is permitted as a watchpoint register setting value.

[0089] Furthermore, the watchpoint indicated by the watchpoint identifier WP_k is in use in the system call restriction control of the system call indicated by syscall_r issued by the threads indicated by the thread identifiers TID_p and TID_q, is first in the order of permission determination, and exemplifies information including an address range for which ReadOnly is permitted as the watchpoint register setting value. As in the example of the watchpoint identifier WP_k, multiple threads may use the same watchpoint register setting value in the system call restriction control of the same system call, and if none of the threads is using the watchpoint, it may be in an empty state.

[0090] The watchpoint identifier WP_0 and the watchpoint identifier WP_n-1 are exemplified as being in an empty watchpoint state.

[0091] <Operation of Information Processing Device> FIG. 4 is a flowchart showing an example of the operation flow of the system call unit 1110 according to this embodiment.

[0092] In step ST4000, system call section 1110 starts the system call process.

[0093] In step ST4001, the system call section 1110 executes the system restriction process of the system call restriction control section 1111.

[0094] In step ST4002, if the determination result of the system call restriction control is permission, system call section 1110 proceeds to step ST4003, or if the determination result of the system call restriction control is not permission, proceeds to step ST4005.

[0095] In step ST4003, system call section 1110 executes the data fetch process of user memory data fetch section 1112. If the process is successful, the process proceeds to step ST4004. If the process is unsuccessful, the process proceeds to step ST4005.

[0096] In step ST4004, the system call section 1110 executes the system call processing of the system call main processing section 1113.

[0097] In step ST4005, the system call section 1110 causes the log recording section 1121 to record the trace log.

[0098] In step ST4006, the system call section 1110 executes post-processing of the system call restriction control of the system call restriction control section 1111.

[0099] In step ST4007, the system call section 1110 ends the system call process.

[0100] FIG. 5 is a flowchart showing an example of the operation flow of the system call restriction control unit 1111 according to this embodiment.

[0101] In step ST5000, the system call restriction control unit 1111 starts the system call restriction control process.

[0102] In step ST5001, the system call restriction control unit 1111 obtains from the system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152 the entry of the permitted system call 2000 that matches the system call issued and requested to be executed by the system call restriction control setting unit 1300, the application 1400, and the application 1401.

[0103] In step ST5002, system call restriction control unit 1111 determines whether or not there is an entry for permitted system call 2000. If there is an entry for permitted system call 2000, the process proceeds to step ST5003. If there is no entry for permitted system call 2000, the process proceeds to step ST5007.

[0104] In step ST5003, system call restriction control unit 1111 determines whether the system call argument value is permitted. If the result of the permission determination is permission, the process proceeds to step ST5004. If the result of the permission determination is permission denial, the process proceeds to step ST5007. The permission determination for the system call argument value is performed by determining whether or not the argument information that is not a memory data address in system call argument information 2001 corresponding to permitted system call 2000 is included in permitted set 2002. For example, in system call restriction control table 1150, system call restriction control table 1151, and system call restriction control table 1152 shown in FIG. 2, the argument information that is not a memory data address in system call argument information 2001 corresponding to the entry for syscall_n of permitted system call 2000 is the first argument of the first to third arguments, and it is determined whether or not the first argument is included in the corresponding permitted set 2002.

[0105] In step ST5004, the system call restriction control unit 1111 requests the memory data inspection unit 1114 to execute the memory data inspection process.

[0106] In step ST5005, if the determination result of the memory data inspection is permission, system call restriction control section 1111 proceeds to step ST5006, or if the determination result of the memory data inspection is not permission, proceeds to step ST5007.

[0107] In step ST5006, system call restriction control section 1111 sets the determination result of system call restriction control to permission.

[0108] In step ST5007, system call restriction control section 1111 sets the determination result of system call restriction control to "not permitted."

[0109] In step ST5008, the system call restriction control unit 1111 ends the system call restriction control process.

[0110] FIG. 6 is a flowchart showing an example of the operation flow of the memory data inspection unit 1114 according to this embodiment.

[0111] In step ST6000, memory data inspection section 1114 starts the memory data inspection process.

[0112] In step ST6001, the memory data inspection unit 1114 executes the memory data integrity ensuring process of the memory data integrity ensuring unit 1115.

[0113] In step ST6002, memory data inspection section 1114 executes the memory data permission determination process of memory data permission determination section 1116.

[0114] In step ST6003, memory data inspection section 1114 ends the memory data inspection process.

[0115] FIG. 7 is a flowchart showing an example of the operation flow of the memory data integrity assurance unit 1115 according to this embodiment.

[0116] In step ST7000, memory data integrity ensuring section 1115 starts the memory data integrity ensuring process.

[0117] In step ST7001, the memory data integrity ensuring unit 1115 acquires the capture information 2003 of the data subject to admissibility determination from the system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152.

[0118] In step ST7002, the memory data integrity ensuring unit 1115 attempts to secure entries of the watchpoint identifier 3000 for which the watchpoint state 3005 is empty, for the number of entries of the data subject to allowance determination, from the watchpoint context table 1160. For example, the system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152 shown in Fig. 2 illustrate that the number of entries of the data subject to allowance determination is two, based on the import information 2003 of the data subject to allowance determination.

[0119] In step ST7003, the memory data integrity assurance unit 1115 assigns entries of the secured watchpoint identifier 3000 in the order in which data retrieval for the data subject to acceptance determination is completed, and sets each entry corresponding to the entry of the watchpoint identifier 3000 (the entries for the thread identifier 3001, acceptance determination order number 3002, system call identifier 3003, and watchpoint register setting value 3004).

[0120] In step ST7004, if the memory data integrity assurance unit 1115 was unable to secure entries for watchpoint identifier 3000 for the number of entries of the data subject to allowable judgment in step ST7002, it sets an event occurrence in the user memory data acquisition event processing unit 1117 after the acquisition process of the last data among the data subject to allowable judgment to which an entry for watchpoint identifier 3000 was assigned in step ST7003.

[0121] In step ST7005, the memory data integrity ensuring unit 1115 repeats steps ST7005, ST7006, ST7007 and ST7008 for each entry of the assigned watch point identifier 3000.

[0122] In step ST7006, if a thread belonging to the same process state management data 1130 as the thread identified by the thread identifier 3001 is being executed in another processing core, the memory data integrity ensuring unit 1115 sets the watchpoint registers of the watchpoint mechanism 1203 and the watchpoint mechanism 1204 of the corresponding processing core according to the watchpoint register setting value 3004. Also, the watchpoint state 3005 entry in the watchpoint context table 1160 is set to "in use."

[0123] In step ST7007, the memory data integrity assurance unit 1115 assigns an authentication code to each pointer address that can be traced from the memory data address of the system call argument information 2001 to the memory data address of the watchpoint register setting value for the memory data for which a watchpoint was set in step ST7006.

[0124] For example, in the system call restriction control tables 1150, 1151, and 1152 shown in FIG. 2, in the entry for syscall_n of permitted system call 2000, the memory data address held in register x2 (denoted as struct A * indicating the address of structure A) in the third argument has already been passed to system call unit 1110 and may therefore not be subject to authentication code assignment, and each pointer address beyond that is subject to authentication code assignment (a2, which is the address of structure B owned by structure A, and the memory data address denoted as struct B * are subject to authentication code assignment).

[0125] In step ST7008, the memory data integrity ensuring unit 1115 determines whether or not the entry of the assigned watch point identifier 3000 has been completed. If the entry has been completed, the process proceeds to step ST7009. If the entry has not been completed, the process returns to step ST7005.

[0126] In step ST7009, the memory data integrity ensuring unit 1115 ends the memory data integrity ensuring process.

[0127] FIG. 8 is a flowchart showing an example of the operation flow of the memory data integrity assurance unit 1115 according to this embodiment.

[0128] In step ST7010, the memory data integrity assurance unit 1115 starts the memory data integrity assurance cancellation process.

[0129] In step ST7011, the memory data integrity ensuring unit 1115 cancels the authentication code for each pointer address tracing from the memory data address of the system call argument information 2001 executed in step ST7007 to the memory data address of the watchpoint setting.

[0130] In step ST7012, if a thread belonging to the same process state management data 1130 as the thread identified by the thread identifier 3001 is being executed in another processing core, the memory data integrity assurance unit 1115 cancels the watchpoint setting performed in step ST7006.

[0131] In step ST7013, the memory data integrity assurance unit 1115 deletes the entry for the target thread identifier from the thread identifier 3001 entry and the allowable judgment order number 3002 entry in the watchpoint context table 1160, and if these entries become empty, sets the watchpoint state 3005 entry to empty.

[0132] In step ST7014, the memory data integrity assurance unit 1115 ends the memory data integrity assurance cancellation process.

[0133] FIG. 9 is a flowchart showing an example of the operation flow of the memory data permission determining unit 1116 according to this embodiment.

[0134] In step ST8000, memory data permission determination section 1116 starts the memory data permission determination process.

[0135] In step ST8001, memory data permission determination section 1116 repeats steps ST8001, ST8002, ST8003, ST8004, ST8005, ST8006 and ST8007 for each entry of assigned watch point identifier 3000.

[0136] In step ST8002, memory data permission determination unit 1116 acquires allowed set 2002 of the relevant memory data from system call restriction control table 1150, system call restriction control table 1151, and system call restriction control table 1152. For example, in system call restriction control table 1150, system call restriction control table 1151, and system call restriction control table 1152 shown in Fig. 2, it is sufficient to acquire an allowed set 2002 entry that corresponds to the memory data address indicated by the second argument of system call argument information 2001 and an allowed set 2002 entry that corresponds to "struct B: structure data" traced from the memory data address indicated by the third argument.

[0137] In step ST8003, the memory data permission determination unit 1116 traces from the memory data address in the system call argument information 2001 to the memory data address described in the watchpoint register setting value 3004 entry set in step ST7003 while checking whether the authentication code assigned in step ST7007 is complete. Note that the assignment of the authentication code to the pointer address and the pointer address reference process, including checking whether the assigned authentication code is complete, may be performed using instructions supported as hardware functions in the operation cores 1201 and 1202. Furthermore, whether the authentication code is complete can be confirmed by, for example, calculating the authentication code from the pointer address and a cryptographic key (e.g., a common key) and assigning the authentication code. If the value of the authentication code matches the value calculated in the same way during verification, the pointer address can be confirmed to be complete (not tampered with). Here, the cryptographic key (common key) can be managed by system software, within the operation core, or by a hardware security module.

[0138] If the processing of step ST8003 fails, the memory data permission determination unit 1116 determines in step ST8010 that the memory data is not permitted, and then proceeds to step ST8009. If the processing of step ST8003 is successful, the processing proceeds to step ST8005. Here, failure of the processing of step ST8003 corresponds to the case where the authentication code is found to be incomplete in the processing of step ST8003. If the pointer address has been tampered with, verification of the authentication code assigned in step ST7007 fails, and as a result, the processing of tracing to the memory data address described in the watchpoint register setting value 3004 entry is deemed to have failed. On the other hand, success of the processing of step ST8003 corresponds to the case where the authentication code is found to be complete in the processing of step ST8003. If it is possible to trace from the memory data address in the system call argument information 2001 to the memory data address described in the watchpoint register setting value 3004 entry set in step ST7003, the processing of step ST8003 is deemed to have succeeded.

[0139] In step ST8005, memory data permission determination unit 1116 determines whether or not the memory data in the memory data address range described in the watchpoint register setting value 3004 entry set in step ST7003 is included in allowed set 2002 acquired in step ST8002. If the memory data in the memory data address range is not included in allowed set 2002, memory data permission determination is denied in step ST8010, and the process proceeds to step ST8009.

[0140] In step ST8007, memory data permission determination section 1116 determines whether or not the entry of assigned watch point identifier 3000 has been completed. If it has been completed, the process proceeds to step ST8008. If it has not been completed, the process returns to step ST8001.

[0141] In step ST8008, memory data permission determination section 1116 determines that the memory data is permitted.

[0142] In step ST8009, memory data permission determination section 1116 ends the memory data permission determination process.

[0143] FIG. 10 is a flowchart showing an example of the operation flow of the user memory data fetch event processing unit 1117 according to this embodiment.

[0144] In step ST9000, user memory data fetch event processing section 1117 starts a user memory data fetch event processing step.

[0145] In step ST9001, the user memory data fetch event processing unit 1117 acquires the entry of the corresponding watch point identifier 3000 in the watch point context table 1160 based on the thread identifier 3001 and system call identifier 3003 of the user memory data fetch event occurrence. Note that the setting of the event occurrence in the user memory data fetch event processing unit 1117 is performed in step ST7004.

[0146] In step ST9002, user memory data fetch event processing section 1117 repeats steps ST9002, ST9003 and ST9004 for each entry of watch point identifier 3000 acquired in step ST9001.

[0147] In step ST9003, the user memory data fetch event processing section 1117 cancels the memory data integrity assurance section 1115's memory data integrity assurance (already described in FIG. 8).

[0148] In step ST9004, user memory data fetch event processing section 1117 determines whether or not the entry of watch point identifier 3000 acquired in step ST9001 has ended. If it has ended, the process proceeds to step ST9005. If it has not ended, the process returns to step ST9002.

[0149] In step ST9005, the user memory data fetch event processing unit 1117 executes memory data inspection (described in FIG. 6) on entries for which permission determination has not yet been performed among the data subject to permission determination.

[0150] In step ST9006, user memory data fetch event processing section 1117 ends the user memory data fetch event processing step.

[0151] 4 may be configured to omit step ST9005 illustrated in Fig. 10 and proceed to step ST9000, step ST9001, step ST9002, step ST9003, step ST9004, and then proceed to step ST9006. Also, step ST9001 may acquire the corresponding watchpoint identifier 3000 entry in watchpoint context table 1160 based on the thread identifier 3001 that made the system request and the system call identifier 3003, rather than the thread identifier 3001 of the occurrence of the user memory data fetch event.

[0152] 11 is a flowchart showing an example of an operational flow of a context switch of the context management unit 1122 by the scheduler 1123 according to this embodiment. Note that the context switch of the context management unit 1122 by the scheduler 1123 may operate on the own computation core in each of the computation cores 1201 and 1202.

[0153] In step ST10000, the context management unit 1122 starts the context switch process.

[0154] In step ST10001, the context management unit 1122 determines whether or not the current execution thread is a target for setting a watchpoint. If it is a target, the process proceeds to step ST10002. If it is not a target, the process proceeds to step ST10003.

[0155] Regarding the determination method, for example, if the currently executing thread is a thread belonging to the same process state management data 1130 as the thread identified by the thread identifier 3001 in the watchpoint context table 1160, and the watchpoint state 3005 is in use, it may be determined that the thread is the target of the watchpoint setting.

[0156] In step ST10002, the context management unit 1122 cancels the setting of the watchpoint indicated by the watchpoint identifier 3000 of the watchpoint mechanism corresponding to the processor core that is the subject of the context switch.

[0157] In step ST10003, the context management unit 1122 determines whether the thread to be executed next is a target for setting a watchpoint. If it is a target, the process proceeds to step ST10004. If it is not a target, the process proceeds to step ST10005.

[0158] Regarding the determination method, for example, if the next thread to be executed belongs to the same process state management data 1130 as the thread identified by the thread identifier 3001 in the watchpoint context table 1160 and the watchpoint state 3005 is in use, it may be determined that the thread is the target for setting a watchpoint.

[0159] In step ST10004, the context management unit 1122 sets a watchpoint indicated by the watchpoint identifier 3000 of the watchpoint mechanism corresponding to the processor core it manages, in accordance with the watchpoint register setting value 3004 entry corresponding to the thread identifier 3001.

[0160] In step ST10005, the context management unit 1122 ends the context switching process.

[0161] In addition, if there is no need to clear and set a watchpoint, for example, if the current execution thread and the next execution thread are the same, or if there is no difference in the watchpoint register setting value 3004 between the current execution thread and the next execution thread, the context switch operation flow shown in Figure 11 may be omitted.

[0162] Second Embodiment An information processing device and an information processing method according to this embodiment will be described. In the following description, components similar to those described in the above embodiments will be denoted by the same reference numerals, and detailed descriptions thereof will be omitted as appropriate.

[0163] <Configuration of Information Processing Device> Fig. 12 is a block diagram showing an example of the configuration of an information processing device 1000A according to this embodiment. The difference from Fig. 1 is that the information processing device 1000A includes a breakpoint context table 1180 instead of the watchpoint context table 1160, and includes breakpoint mechanisms 1208 and 1209 instead of the watchpoint mechanisms 1203 and 1204. However, it is also possible to include both the watchpoint context table 1160 and the breakpoint context table 1180, or to include both the watchpoint mechanisms 1203 and 1204 and the breakpoint mechanisms 1208 and 1209.

[0164] The breakpoint context table 1180 holds information for setting and controlling the breakpoint mechanisms 1208 and 1209 of the computer hardware 1200. The breakpoint context table 1180 may hold information for each user process, linked to the process state management data 1130. The breakpoint context table 1180 may also hold information for each thread, linked to the thread state management data 1140 (not shown here).

[0165] At least one breakpoint mechanism 1208 and one breakpoint mechanism 1209 may be provided, one for each of the processor cores 1201 and 1202. The breakpoint mechanism is hardware that monitors the execution of any instruction address of a program deployed in memory and generates an event. The breakpoint mechanism may be provided with one or more breakpoints that can monitor the execution of instruction addresses and set restrictions. The breakpoints may be set via a breakpoint register (not shown here).

[0166] 13 is a diagram showing examples of a system call restriction control table 1150, a system call restriction control table 1151, and a system call restriction control table 1152 according to this embodiment. The difference from FIG. 2 is that some of the contents of the entries for the import information of the data subject to acceptance determination are different.

[0167] The data import information 2004 for the data to be judged as permissible contains, for each permitted system call 2000, at least the order in which data import from the user memory is completed, the data to be imported, and the memory data import completion processing address for which permissibility is judged using the permitted set 2002.

[0168] Figure 14 is a diagram showing an example of the breakpoint context table 1180 according to this embodiment. The difference from Figure 3 is that it includes a breakpoint identifier 3006, a breakpoint register setting value 3007, and a breakpoint state 3008. Here, the thread identifier 3001 indicates the thread that uses the breakpoint. Furthermore, the system call identifier 3003 indicates the system call issued by the thread that uses the breakpoint. Furthermore, the allowance determination order number 3002 indicates the allowance determination order of the allowance determination target data that uses the breakpoint.

[0169] The breakpoint identifier 3006 describes an identifier indicating the breakpoint that the breakpoint mechanism 1208 and the breakpoint mechanism 1209 have.

[0170] The breakpoint register setting value 3007 describes information on the register setting value of the breakpoint indicated by the breakpoint identifier 3006. The breakpoint register setting value 3007 includes at least information equivalent to the address of the user data fetch completion process, which is the instruction address, in order to set an event to occur by monitoring the execution of the instruction address.

[0171] The breakpoint status 3008 describes the status (usage status) of the breakpoint indicated by the breakpoint identifier 3006. The breakpoint status 3008 includes at least in use and free.

[0172] <Operation of Information Processing Device> FIG. 15 is a flowchart showing an example of the operation flow of the system call restriction control unit 1111 according to this embodiment.

[0173] The operational flow of system call restriction control unit 1111 differs from that of Fig. 5 in that there is no processing of the determination result of the memory data inspection in step ST5005. In other words, in step ST5004, system call restriction control unit 1111 requests memory data inspection unit 1114 to execute the memory data inspection process. Thereafter, in step ST5006, system call restriction control unit 1111 sets the determination result of the system call restriction control to "permit."

[0174] FIG. 16 is a flowchart showing an example of the operation flow of the memory data inspection unit 1114 according to this embodiment.

[0175] The operational flow of memory data inspection unit 1114 differs from that of Fig. 6 in that it does not include the memory data permission determination process of step ST6002. In other words, in step ST6001, memory data inspection unit 1114 executes the memory data integrity assurance process of memory data integrity assurance unit 1115. Thereafter, in step ST6003, memory data inspection unit 1114 ends the memory data inspection process.

[0176] FIG. 17 is a flowchart showing an example of the operation flow of the memory data integrity assurance unit 1115 according to this embodiment.

[0177] In step ST7000, memory data integrity ensuring section 1115 starts the memory data integrity ensuring process.

[0178] In step ST7001, the memory data integrity ensuring unit 1115 acquires the capture information 2003 of the data subject to admissibility determination from the system call restriction control table 1150, the system call restriction control table 1151, and the system call restriction control table 1152.

[0179] Next, in step ST7015, the memory data integrity ensuring unit 1115 attempts to secure from the breakpoint context table 1180 entries of the breakpoint identifier 3006 whose breakpoint state 3008 is empty, for the number of entries of the data to be subjected to the allowable determination.

[0180] In step ST7016, the memory data integrity assurance unit 1115 assigns entries of the secured breakpoint identifiers 3006 in the order in which data import of the data subject to acceptance judgment is completed, and sets each entry corresponding to the entry of the breakpoint identifier 3006 (the entries for the thread identifier 3001, acceptance judgment order number 3002, system call identifier 3003, and breakpoint register setting value 3007).

[0181] In step ST7017, the memory data integrity ensuring unit 1115 repeats steps ST7017, ST7018 and ST7019 for each entry of the allocated breakpoint identifier 3006.

[0182] In step ST7018, the memory data integrity assurance unit 1115 sets a breakpoint for the local computation core that processes the system call in accordance with the breakpoint register setting value 3007. Also, the breakpoint status 3008 entry in the breakpoint context table 1180 is set to "in use."

[0183] In step ST7019, the memory data integrity ensuring unit 1115 determines whether or not the entries of the allocated breakpoint identifier 3006 are complete. If the entries are complete, the process proceeds to step ST7009. If the entries are not complete, the process returns to step ST7017.

[0184] In step ST7009, the memory data integrity ensuring unit 1115 ends the memory data integrity ensuring process.

[0185] FIG. 18 is a flowchart showing an example of the operation flow of the memory data integrity assurance unit 1115 according to this embodiment.

[0186] In step ST7010, the memory data integrity assurance unit 1115 starts the memory data integrity assurance cancellation process.

[0187] In step ST7020, the memory data integrity assurance unit 1115 deletes the entry for the target thread identifier from the thread identifier 3001 entry and the allowable judgment order number 3002 entry in the breakpoint context table 1180, and if these entries become empty, sets the breakpoint state 3008 entry to empty.

[0188] In step ST7014, the memory data integrity assurance unit 1115 ends the memory data integrity assurance cancellation process.

[0189] FIG. 19 is a flowchart showing an example of the operation flow of the memory data permission determining unit 1116 according to this embodiment.

[0190] In step ST8000, memory data permission determination section 1116 starts the memory data permission determination process.

[0191] In step ST8010, the memory data permission decision unit 1116 repeats steps ST8010, ST8002, ST8011, ST8006 and ST8012 for each breakpoint entry acquired in the process of step ST9007 described later.

[0192] In step ST8002, memory data permission determination unit 1116 acquires allowed set 2002 of the relevant memory data from system call restriction control table 1150, system call restriction control table 1151, and system call restriction control table 1152. For example, in system call restriction control table 1150, system call restriction control table 1151, and system call restriction control table 1152 shown in Fig. 2, it is sufficient to acquire an allowed set 2002 entry that corresponds to the memory data address indicated by the second argument of system call argument information 2001 and an allowed set 2002 entry that corresponds to "struct B: structure data" traced from the memory data address indicated by the third argument.

[0193] In step ST8011, memory data permission decision section 1116 decides whether or not the data subject to permission decision corresponding to the breakpoint is included in permission set 2002 acquired in step ST8002. If the data subject to permission decision corresponding to the breakpoint is not included in permission set 2002, memory data permission decision is denied in step ST8010, and the process proceeds to step ST8009.

[0194] In step ST8012, memory data permission decision section 1116 decides whether or not the entry of the breakpoint acquired in the process of step ST9007 (described later) has ended. If it has ended, the process proceeds to step ST8008. If it has not ended, the process returns to step ST8010.

[0195] In step ST8008, memory data permission determination section 1116 determines that the memory data is permitted.

[0196] In step ST8009, memory data permission determination section 1116 ends the memory data permission determination process.

[0197] FIG. 20 is a flowchart showing an example of the operation flow of the user memory data fetch event processing unit 1117 according to this embodiment.

[0198] In step ST9000, user memory data fetch event processing section 1117 starts a user memory data fetch event processing step.

[0199] In step ST9007, the user memory data fetch event processing unit 1117 acquires the corresponding breakpoint identifier 3006 entry in the breakpoint context table 1180 based on the thread identifier 3001 and system call identifier 3003 of the user memory data fetch event occurrence (event caused by execution of the instruction address set at the breakpoint). Note that the setting of the event occurrence in the user memory data fetch event processing unit 1117 is performed in step ST7018.

[0200] In step ST9008, the user memory data fetch event processing section 1117 executes the memory data permission determination process of the memory data permission determination section 1116.

[0201] The result of the determination made by the execution of the memory data permission determination step is associated with the success or failure of the data import process from the user memory in step ST4003 shown in FIG.

[0202] In step ST9009, the user memory data fetch event processing section 1117 repeats steps ST9009, ST9003 and ST9010 for each acquired breakpoint entry.

[0203] In step ST9003, the user memory data fetch event processing section 1117 cancels the memory data integrity assurance section 1115's memory data integrity assurance (already described in FIG. 8).

[0204] In step ST9010, the user memory data fetch event processing section 1117 determines whether or not the entry of the breakpoint has ended. If it has ended, the process proceeds to step ST9005. If it has not ended, the process returns to step ST9009.

[0205] In step ST9005, the user memory data fetch event processing unit 1117 executes memory data inspection (already described in FIG. 6) on entries for which permission determination has not yet been performed among the data subject to permission determination.

[0206] In step ST9006, user memory data fetch event processing section 1117 ends the user memory data fetch event processing step.

[0207] FIG. 21 is a flowchart showing an example of the operation flow of a context switch of the context management unit 1122 by the scheduler 1123 according to this embodiment.

[0208] In step ST10000, the context management unit 1122 starts the context switch process.

[0209] In step ST10006, the context management section 1122 determines whether or not the currently executed thread is a target for setting a breakpoint. If it is a target, the process proceeds to step ST10007. If it is not a target, the process proceeds to step ST10008.

[0210] Regarding the determination method, for example, if the currently executing thread is the thread identified by the thread identifier 3001 in the breakpoint context table 1180 and the breakpoint state 3008 is in use, it may be determined that the thread is the target for setting a breakpoint.

[0211] In step ST10007, the context management unit 1122 cancels the setting of the breakpoint indicated by the breakpoint identifier 3006 of the breakpoint mechanism corresponding to the processor core that it manages.

[0212] In step ST10008, the context management section 1122 determines whether or not the thread to be executed next is a target for setting a breakpoint. If it is a target, the process proceeds to step ST10009. If it is not a target, the process proceeds to step ST10005.

[0213] Regarding the determination method, for example, if the thread to be executed next is the thread identified by the thread identifier 3001 in the breakpoint context table 1180 and the breakpoint state 3008 is in use, it may be determined that the thread is the target for setting a breakpoint.

[0214] In step ST10009, the context management unit 1122 sets a breakpoint indicated by the breakpoint identifier 3006 of the breakpoint mechanism corresponding to the processing core being managed, in accordance with the breakpoint register setting value 3007 entry corresponding to the thread identifier 3001.

[0215] In step ST10005, the context management unit 1122 ends the context switching process.

[0216] In addition, if there is no need to clear or set a watchpoint, for example, if the current execution thread and the next execution thread are the same, or if there is no difference in the breakpoint register setting value 3007 between the current execution thread and the next execution thread, the context switch operation flow shown in Figure 21 may be omitted.

[0217] <Regarding the Effects Produced by the Multiple Embodiments Described Above> Next, examples of the effects produced by the multiple embodiments described above will be described. Note that in the following description, the effects will be described based on the specific configurations exemplified in the multiple embodiments described above, but these may be replaced with other specific configurations exemplified in the present specification to the extent that similar effects are produced. In other words, for convenience, only one of the associated specific configurations may be described as a representative below, but the representatively described specific configuration may be replaced with another associated specific configuration.

[0218] Furthermore, the replacement may be made across multiple embodiments, i.e., configurations illustrated in different embodiments may be combined to produce the same effect.

[0219] According to the embodiment described above, the information processing apparatus is the information processing apparatus 1000 (or the information processing apparatus 1000A) in which the system software 1100 runs on the computer hardware 1200 including the arithmetic unit and the main memory device 1205. Here, the arithmetic unit corresponds to, for example, the arithmetic core 1201 or the arithmetic core 202. The system software 1100 includes a system call unit 1110 that processes a system call issued when the application 1400 (or the application 1401) uses a function provided by the system software 1100. The system call unit 1110 includes a system call main processing unit 1113 that processes the system call, a system call restriction control unit 1111 that restricts and controls the execution of the system call, and a memory data inspection unit 1114 that inspects the memory data corresponding to the system call by tracing the data structure of the system call from the memory data address passed by the application 1400 (or the application 1401) to the system call unit 1110.

[0220] With this configuration, it is possible to trace the data structure of a system call based on the memory data address specified by the argument of the system call and verify the validity of the memory data content. Furthermore, verifying the validity of the memory data content prevents time-of-check-to-time-of-use (TOCTTOU) attacks that attempt to tamper with the memory data content, which may occur before the system call is processed by the kernel of the operating system, and prevents unauthorized intrusion into the system, thereby improving the security of the information processing device.

[0221] Furthermore, even if other configurations shown as examples in this specification are appropriately added to the above configuration, that is, even if other configurations in this specification that were not mentioned as the above configuration are appropriately added, the same effect can be achieved.

[0222] <Regarding Modifications of the Multiple Embodiments Described Above> In the multiple embodiments described above, the dimensions, shapes, relative positional relationships, and implementation conditions of each component may be described, but these are merely examples in all aspects and are not limiting.

[0223] Therefore, countless modifications and equivalents not shown as examples are contemplated within the scope of the technology disclosed in the present specification, including, for example, modifying, adding, or omitting at least one component, and further, extracting at least one component from at least one embodiment and combining it with a component from another embodiment.

[0224] Furthermore, unless a contradiction arises, when it is stated in the above-described embodiments that "one" component is provided, "one or more" of that component may be provided.

[0225] For example, this includes the case where the system software is a hypervisor and the system call is a hypercall, the case where the system software is a secure monitor and the system call is a secure monitor call, etc. In other words, this includes the case where at least one component is modified, added, or omitted, or the case where at least one component is extracted and combined with a component of another embodiment.

[0226] Furthermore, each component in the embodiments described above is a conceptual unit, and the scope of the technology disclosed in this specification includes cases where one component is made up of multiple structures, cases where one component corresponds to a part of a structure, and even cases where multiple components are provided in one structure.

[0227] Furthermore, each of the components in the embodiments described above includes structures having other structures or shapes as long as they perform the same function.

[0228] Furthermore, the descriptions in this specification are incorporated by reference for all purposes related to the present technology, and none of them are admitted to be prior art.

[0229] 1000 Information processing device, 1000A Information processing device, 1100 System software, 1110 System call unit, 1111 System call restriction control unit, 1112 User memory data acquisition unit, 1113 System call main body processing unit, 1114 Memory data inspection unit, 1115 Memory data integrity assurance unit, 1116 Memory data permission determination unit, 1117 User memory data acquisition event processing unit, 1120 System call restriction control table setting unit, 1121 Log recording unit, 1122 Context management unit, 1123 Scheduler, 1130 Process state management data, 1140 Thread state management data, 1150 System call restriction control table, 1151 System call restriction control table, 1152 System call restriction control table, 1160 Watchpoint context table, 1170 Container execution environment management data, 1180 Breakpoint context table, 1200 Computer hardware, 1201 Computing core, 1202 computing core, 1203 watchpoint mechanism, 1204 watchpoint mechanism, 1205 main memory, 1206 non-volatile memory, 1207 peripheral device, 1208 breakpoint mechanism, 1209 breakpoint mechanism, 1300 system call restriction control setting unit, 1301 system setting control container execution environment, 1400 application, 1401 application, 1402 application container execution environment, 2000 permitted system call, 2001 system call argument information, 2002 permitted set, 2003 captured information, 2004 captured information, 3000 watchpoint identifier, 3001 thread identifier, 3002 permission determination order number, 3003 system call identifier, 3004 watchpoint register setting value, 3005 watchpoint state, 3006 breakpoint identifier, 3007 breakpoint register setting value, 3008 breakpoint state.

Claims

1. An information processing device in which system software runs on computer hardware including an arithmetic unit and a main memory, the system software comprising a system call unit that processes system calls issued when an application uses a function provided by the system software, the system call unit comprising: a system call main processing unit that processes the system calls; a system call restriction control unit that controls the restriction of the processing execution of the system calls; and a memory data inspection unit that inspects the memory data corresponding to the system calls by tracing the data structure of the system call from the memory data address passed by the application to the system call unit.

2. An information processing device according to claim 1, wherein the system call unit further comprises a memory data integrity ensuring unit that performs processing to ensure the integrity of the memory data using a pointer address that traces the data structure of the system call from the memory data address passed by the application to the system call unit.

3. An information processing device according to claim 1 or 2, wherein the system call unit further comprises a memory data permission determination unit that traces the data structure of the system call from the memory data address passed to the system call unit by the application and determines whether the memory data is permitted.

4. An information processing device according to any one of claims 1 to 3, wherein the system software further comprises: a system call restriction control table that describes information regarding the restriction control in the processing execution of the system call; and a system call restriction control table setting unit that sets the system call restriction control table; and the information processing device further comprises a system call restriction control setting unit that sets the information regarding the system call restriction setting for the system call restriction control table setting unit in the system software.

5. An information processing device according to claim 4, wherein the computer hardware further comprises a watchpoint mechanism that monitors and restricts access to the memory data, and the system software further comprises a watchpoint context table that holds information for setting and controlling the watchpoint mechanism.

6. An information processing device according to any one of claims 1 to 5, wherein the system call unit further comprises: a user memory data acquisition unit that traces the data structure of the system call from the memory data address passed by the application to the system call unit and acquires the memory data into memory managed by the system software; and a user memory data acquisition event processing unit that processes events generated in the user memory data acquisition unit.

7. An information processing device according to any one of claims 1 to 6, wherein the computer hardware further comprises a non-volatile storage device that permanently stores recorded data, and the system software further comprises a log recording unit that records information output by the system call unit.

8. An information processing device according to claim 5, wherein the system software comprises: a context management unit that manages processes or threads that indicate the state when a user program including the application is executed on the computer hardware; a scheduler that manages allocation of processes or threads to the computer hardware; thread state management data that holds the state and information of the thread for each thread; process state management data that holds the state and information of the process for each process and manages it including the thread state management data of the thread managed by the process; and container execution environment management data that holds the state and information of the process for each container execution environment that virtually separates the program execution environment and manages it including the process state management data of the process managed by the container execution environment; the watchpoint context table is configured in association with the process state management data; and the system call restriction control table is configured in association with the thread state management data, the process state management data, or the container execution environment management data.

9. An information processing device according to claim 5 or 8, wherein the system call restriction control table includes permitted system calls for which the system call unit permits system call invocation, system call argument information indicating information on the data structure of the arguments of the permitted system calls, an allowable set which is information on the allowable range of data for each of the system call argument information, and import information for data subject to allowability judgment indicating import information for the memory data for which allowability is judged using the allowable set, and the import information for the data subject to allowability judgment includes information indicating the memory data to be imported, the size of the memory data to be imported, and the order in which the import of the memory data is completed.

10. An information processing device according to claim 9, wherein the watchpoint context table includes: a watchpoint identifier indicating a watchpoint provided by the watchpoint mechanism; a thread identifier indicating a thread to which the watchpoint is to be assigned; a system call identifier indicating a system call issued by the thread to which the watchpoint is to be assigned; an allowable judgment order number indicating the allowable judgment order of the allowable judgment target data for which the watchpoint is set; a watchpoint register setting value which is information on the register setting value of the watchpoint; and a watchpoint state which is information on the usage status of the watchpoint, and the watchpoint register setting value includes information on a memory area that monitors and controls access to the memory data.

11. An information processing device according to claim 9, wherein the computer hardware further comprises a breakpoint mechanism that monitors the execution of any instruction address of a program and generates an event when the instruction is executed, and the system software further comprises a breakpoint context table that holds information for setting and controlling the breakpoint mechanism.

12. An information processing device according to claim 9, wherein the system call restriction control table includes, in the import information of the data subject to allowability judgment, an address of the memory data import completion process for which allowability is judged using the information of the allowable set.

13. An information processing device according to claim 11, wherein the breakpoint context table includes: a breakpoint identifier indicating a breakpoint provided by the breakpoint mechanism; a thread identifier indicating a thread that uses the breakpoint; a system call identifier indicating a system call issued by the thread that uses the breakpoint; an allowable judgment order number indicating the allowable judgment order of the allowable judgment target data that uses the breakpoint; a breakpoint register setting value that is information on the register setting value of the breakpoint; and a breakpoint status that is information on the usage status of the breakpoint, and the breakpoint register setting value includes information on the address of the user data import completion process.

14. An information processing device according to claim 6, wherein the computer hardware further comprises a non-volatile storage device that permanently stores recorded data, the system software further comprises the system call unit and a log recording unit that records information output by the system call unit, the system call unit executes the system restriction processing of the system call restriction control unit, and if the determination result of the system restriction processing of the system call restriction control unit is permission, executes the data import processing of the user memory data import unit, and if the data import processing is successful, the system call main processing unit executes system call processing, and if the determination result of the system restriction processing of the system call restriction control unit is permission and if the data import processing is successful, the log recording unit executes trace log recording, and executes post-processing of the system call restriction control of the system call restriction control unit.

15. An information processing device according to claim 5, wherein the system call restriction control unit obtains an entry for a permitted system call from the system call restriction control table, and if there is an entry for the permitted system call, makes a determination as to whether the argument value of the system call is permitted, and if the determination as to whether the argument value of the system call is permitted is determined to be permitted by the memory data inspection unit, executes a memory data inspection by the memory data inspection unit, and if the determination as to whether the memory data inspection by the memory data inspection unit is permitted, sets the determination result of the system call restriction control to permitted, and if there is no entry for the permitted system call, if the determination as to whether the argument value of the system call is permitted is determined to be not permitted, or if the computer hardware includes the watchpoint mechanism and the determination as to whether the memory data inspection by the memory data inspection unit is not permitted, sets the determination result of the system call restriction control to not permitted.

16. An information processing device according to claim 5, wherein the system call unit further comprises: a memory data integrity ensuring unit that performs processing to ensure the integrity of the memory data by tracing a pointer address and the data structure of the system call from the memory data address passed by the application to the system call unit; and a memory data permission determination unit that traces the data structure of the system call from the memory data address passed by the application to the system call unit and performs a permission determination for the memory data, wherein the memory data inspection unit performs the memory data integrity ensuring of the memory data integrity ensuring unit, and, if the computer hardware includes the watchpoint mechanism, performs a memory data permission determination of the memory data permission determination unit.

17. An information processing device according to claim 8, wherein the system call restriction control table includes permitted system calls for which the system call unit permits system call invocation, system call argument information indicating information on the data structure of the arguments of the permitted system calls, a permitted set which is information on a data allowable set for each of the system call argument information, and import information for data subject to allowability judgment indicating import information for the memory data for which allowability judgment is made using the permitted set, wherein the import information for data subject to allowability judgment includes information indicating the memory data to be imported, the size of the memory data to be imported, and the order in which import of the memory data was completed, and the watchpoint context table includes a watchpoint identifier indicating a watchpoint provided in the watchpoint mechanism, a thread identifier indicating a thread to which the watchpoint is assigned, a system call identifier indicating a system call issued by the thread to which the watchpoint is assigned, an allowability judgment order number indicating the order in which allowability judgment is made for the data subject to allowability judgment for which the watchpoint is set, a watchpoint register setting value which is information on the register setting value of the watchpoint, and a watchpoint status which is information indicating the usage status of the watchpoint, the watchpoint register setting value includes information on a memory area for monitoring and controlling access to the memory data, and the system call unit further comprises: a memory data integrity ensuring unit that performs processing to ensure the integrity of the memory data by tracing a pointer address and the data structure that traces the data structure of the system call from the memory data address that the application passes to the system call unit; a user memory data fetch unit that traces the data structure of the system call from the memory data address that the application passes to the system call unit and fetches the memory data into a memory managed by the system software; and a user memory data fetch event processing unit that processes events generated in the user memory data fetch unit, and the memory data integrity ensuring unitobtains capture information of the data subject to allowance determination from the system call restriction control table; attempts to secure entries of the watchpoint identifier that are free in the number of entries of the data subject to allowance determination from the watchpoint context table; assigns the secured entries of the watchpoint identifier in the order of completion of data capture of the data subject to allowance determination, and sets entries of the corresponding thread identifier, the allowance determination order number, the system call identifier, and the watchpoint register setting value; if it is not possible to secure entries of the watchpoint identifier in the number of entries of the data subject to allowance determination, sets an event occurrence in the user memory data capture event processing unit after the capture processing of the last data of the data subject to allowance determination to which the entry of the watchpoint identifier is assigned; for each entry of the assigned watchpoint identifier, if a thread belonging to the same process state management data as the thread identified by the thread identifier is being executed in another processing core, sets a watchpoint register of the watchpoint mechanism of the processing core in which the thread belonging to the process state management data is being executed according to the watchpoint register setting value; sets the entry of the watchpoint status in the watchpoint context table to be in use; and assigning an authentication code to each pointer address that can be traced from the memory data address indicated by the system call argument information in the system call restriction control table to the memory data address of the watchpoint register setting value for the memory data in which the watchpoint is set.

18. An information processing device according to claim 15, wherein the system call restriction control table includes permitted system calls for which the system call unit allows system call invocation, system call argument information indicating information on the data structure of the arguments of the permitted system calls, a permitted set which is information on a data allowable set for each of the system call argument information, and import information for data subject to allowability judgment indicating import information for the memory data for which allowability judgment is made using the permitted set, wherein the import information for data subject to allowability judgment includes information indicating the memory data to be imported, the size of the memory data to be imported, and the order in which import of the memory data was completed, and the watchpoint context table includes a watchpoint identifier indicating a watchpoint provided in the watchpoint mechanism, a thread identifier indicating a thread to which the watchpoint is assigned, a system call identifier indicating a system call issued by the thread to which the watchpoint is assigned, an allowability judgment order number indicating the order in which allowability judgment is made for the data subject to allowability judgment for which the watchpoint is set, a watchpoint register setting value which is information on the register setting value of the watchpoint, and a watchpoint status which is information indicating the usage status of the watchpoint, the watchpoint register setting value includes information on a memory area for monitoring and controlling access to the memory data, the system call unit further comprises a memory data permission determination unit that traces the data structure of the system call from the memory data address passed by the application to the system call unit and determines whether the memory data is permitted, the memory data permission determination unit: for each entry of the assigned watchpoint identifier, obtains an permitted set of corresponding memory data from the system call restriction control table; traces from the memory data address of the system call argument information to the memory data address described in the entry of the set watchpoint register setting value while checking whether the assigned authentication code is complete;an information processing device which, if the process of tracing the memory data address while verifying the integrity of the authentication code fails, determines whether the memory data in the memory data address range described in the entry of the set watchpoint register setting value is included in the allowed set, determines whether the memory data is not included in the allowed set, determines whether the memory data is not included in the allowed set, and terminates the processing of the memory data permission determination unit, and determines whether the memory data is included in the allowed set, 19. An information processing device according to claim 15, wherein the system call restriction control table includes permitted system calls for which the system call unit allows system call invocation, system call argument information indicating information on the data structure of the arguments of the permitted system calls, a permitted set which is information on a data allowable set for each of the system call argument information, and import information for data subject to allowability judgment indicating import information for the memory data for which allowability judgment is made using the permitted set, wherein the import information for data subject to allowability judgment includes information indicating the memory data to be imported, the size of the memory data to be imported, and the order in which import of the memory data was completed, and the watchpoint context table includes a watchpoint identifier indicating a watchpoint provided in the watchpoint mechanism, a thread identifier indicating a thread to which the watchpoint is assigned, a system call identifier indicating a system call issued by the thread to which the watchpoint is assigned, an allowability judgment order number indicating the order in which allowability judgment is made for the data subject to allowability judgment for which the watchpoint is set, a watchpoint register setting value which is information on the register setting value of the watchpoint, and a watchpoint status which is information indicating the usage status of the watchpoint, the watchpoint register setting value includes information on a memory area for monitoring and controlling access to the memory data, and the system call unit further comprises: a user memory data fetch unit that traces the data structure of the system call from the memory data address passed by the application to the system call unit and fetches the memory data into a memory managed by the system software; a user memory data fetch event processing unit that processes an event generated in the user memory data fetch unit; and a memory data integrity ensuring unit that traces a pointer address and the data structure that traces the data structure of the system call from the memory data address passed by the application to the system call unit and performs processing to ensure the integrity of the memory data, and the user memory data fetch event processing unitan information processing device that, as a step of post-processing of system call restriction control, obtains an entry of the corresponding watchpoint identifier in the watchpoint context table from the thread identifier of the occurrence of the user memory data import event and the system call identifier, cancels memory data integrity assurance of the memory data integrity assurance unit for each entry of the obtained watchpoint identifier, and performs the memory data inspection on entries of the data subject to permission determination for which permission determination has not been performed.

20. An information processing device according to claim 16, wherein the system call restriction control table includes permitted system calls for which the system call unit allows system call invocation, system call argument information indicating information on the data structure of the arguments of the permitted system calls, a permitted set which is information on a data allowable set for each of the system call argument information, and import information for data subject to allowability judgment indicating import information for the memory data for which allowability judgment is made using the permitted set, wherein the import information for data subject to allowability judgment includes information indicating the memory data to be imported, the size of the memory data to be imported, and the order in which import of the memory data was completed, and the watchpoint context table includes a watchpoint identifier indicating a watchpoint provided in the watchpoint mechanism, a thread identifier indicating a thread to which the watchpoint is assigned, a system call identifier indicating a system call issued by the thread to which the watchpoint is assigned, an allowability judgment order number indicating the order in which allowability judgment is made for the data subject to allowability judgment for which the watchpoint is set, a watchpoint register setting value which is information on the register setting value of the watchpoint, and a watchpoint status which is information indicating the usage status of the watchpoint, the watchpoint register setting value includes information on a memory area that monitors and controls access to the memory data, and the system software comprises: a context management unit that manages processes or threads that indicate a state when a user program including the application is executed on the computer hardware; a scheduler that manages allocation of processes or threads to the computer hardware; thread state management data that holds the state and information of the thread for each thread; and process state management data that holds the state and information of the process for each process and manages the state and information of the process including the thread state management data of the thread managed by the process.an information processing device comprising: container execution environment management data that is maintained for each container execution environment that virtually separates the execution environment of a program, and that manages the data including the process state management data of the process managed by the container execution environment; the watchpoint context table is configured to be linked to the process state management data; the system call restriction control table is configured to be linked to the thread state management data, the process state management data, or the container execution environment management data; and the memory data integrity assurance unit's process of releasing the memory data integrity assurance involves: canceling an authentication code for each pointer address that traces from a memory data address indicated by the system call argument information to a memory data address of the watchpoint setting; canceling the watchpoint setting if a thread that belongs to the same process state management data as a thread identified by the thread identifier is being executed by another computing core; and deleting the entry of the target thread identifier from the entry of the thread identifier and the entry of the allowable judgment order number in the watchpoint context table, and when these entries become empty, making the entry of the watchpoint state empty.

21. An information processing device according to claim 8, wherein the system call restriction control table includes permitted system calls for which the system call unit permits system call invocation, system call argument information indicating information on the data structure of the arguments of the permitted system calls, a permitted set which is information on a data allowable set for each of the system call argument information, and import information for data subject to allowability judgment indicating import information for the memory data for which allowability judgment is made using the permitted set, wherein the import information for data subject to allowability judgment includes information indicating the memory data to be imported, the size of the memory data to be imported, and the order in which import of the memory data was completed, and the watchpoint context table includes a watchpoint identifier indicating a watchpoint provided in the watchpoint mechanism, a thread identifier indicating a thread to which the watchpoint is assigned, a system call identifier indicating a system call issued by the thread to which the watchpoint is assigned, an allowability judgment order number indicating the order in which allowability judgment is made for the data subject to allowability judgment for which the watchpoint is set, a watchpoint register setting value which is information on the register setting value of the watchpoint, and a watchpoint status which is information indicating the usage status of the watchpoint, The watchpoint register setting value includes information on a memory area that monitors and controls access to the memory data, and the context switch process of the context management unit by the scheduler determines whether or not a current execution thread is a target for setting a watchpoint, and if the current execution thread is a target for setting a watchpoint, cancels the setting of a watchpoint indicated by a watchpoint identifier of the watchpoint mechanism corresponding to the processing core that is the target of the context switch, and determines whether or not a next thread to be executed is a target for setting a watchpoint,An information processing device which, if the thread to be executed next is a target for setting a watchpoint, sets a watchpoint indicated by a watchpoint identifier of a watchpoint mechanism corresponding to the processing core to be the target of the context switch according to the entry of the watchpoint register setting value corresponding to the thread identifier, and determines whether the execution thread is a target for setting a watchpoint if the thread belongs to the same process state management data as the thread identified by the thread identifier and the watchpoint state is in use.

22. An information processing device according to claim 13, wherein the system call unit further comprises a memory data integrity ensuring unit that performs processing to ensure the integrity of the memory data by tracing a pointer address that traces the data structure of the system call from the memory data address passed by the application to the system call unit and the data structure, and wherein the processing of the memory data integrity ensuring unit in the information processing device including the breakpoint mechanism in the computer hardware, obtains import information of the data subject to allowable judgment from the system call restriction control table, attempts to secure from the breakpoint context table entries of the breakpoint identifiers that are free for the number of entries of the data subject to allowable judgment, assigns the secured entries of the breakpoint identifiers in the order in which data import of the data subject to allowable judgment is completed, and sets entries of the corresponding thread identifier, the allowable judgment order number, the system call identifier, and the breakpoint register setting value, sets the breakpoint of the local computing core that processes the system call according to the breakpoint register setting value for each assigned entry of the breakpoint identifier, and sets the breakpoint status entry of the breakpoint context table in use.

23. An information processing device according to claim 13, wherein the system call unit further comprises a memory data permission determination unit that traces the data structure of the system call from the memory data address passed by the application to the system call unit and determines whether the memory data is permissible, and wherein the processing of the memory data permission determination unit in the information processing device including the breakpoint mechanism in the computer hardware comprises: obtaining an allowable set of corresponding memory data from the system call restriction control table for each entry of the assigned breakpoint identifier; determining whether the data subject to permission determination corresponding to the breakpoint is included in the obtained allowable set; and if the data subject to permission determination is not included in the allowable set, determining that the memory data permission determination is not permissible and terminating the processing of the memory data permission determination unit.

24. An information processing device according to claim 13, wherein the system call unit further comprises: a memory data integrity ensuring unit that performs processing to ensure the integrity of the memory data by tracing a pointer address that traces the data structure of the system call from the memory data address passed by the application to the system call unit and the data structure; a user memory data import unit that traces the data structure of the system call from the memory data address passed by the application to the system call unit and imports the memory data into a memory managed by the system software; and a user memory data import event processing unit that processes events generated in the user memory data import unit, wherein the processing of the user memory data import event processing unit in the information processing device including the breakpoint mechanism in its computer hardware comprises: acquiring an entry of a corresponding breakpoint identifier in the breakpoint context table based on the thread identifier of the occurrence of the user memory data import event and the system call identifier; performing an authorization decision on the memory data; canceling memory data integrity assurance by the memory data integrity ensuring unit for each entry of the acquired breakpoint identifier; and performing the memory data inspection on entries of the data subject to authorization decision for which authorization decision has not yet been made. Information processing device.

25. An information processing device according to claim 13, wherein the system call unit comprises a memory data integrity assurance unit that performs processing to ensure the integrity of the memory data by tracing a pointer address that traces the data structure of the system call from the memory data address passed by the application to the system call unit and the data structure, and wherein the processing to release the memory data integrity assurance in the information processing device that includes the breakpoint mechanism in its computer hardware comprises deleting the entry of the target thread identifier from the entry of the thread identifier and the entry of the allowable judgment sequence number in the breakpoint context table, and when these entries become empty, making the breakpoint state entry empty.

26. An information processing device according to claim 13, wherein the system software comprises: a context management unit that manages processes or threads that indicate the state when a user program including the application is executed on the computer hardware; a scheduler that manages allocation of processes or threads to the computer hardware; thread state management data that holds the state and information of the thread for each thread; process state management data that holds the state and information of the process for each process and manages the state and information including the thread state management data of the thread managed by the process; and container execution environment management data that holds the state and information of the process for each container execution environment that virtually separates the program execution environment and manages the state and information including the process state management data of the process managed by the container execution environment; the watchpoint context table is configured in association with the process state management data; and the system call restriction control table is configured in association with the thread state management data, the process state management data, or the container execution environment management data; and the context switch processing of the context management unit by the scheduler in an information processing device whose computer hardware includes the breakpoint mechanism determines whether the currently executed thread is a target for setting a breakpoint, If the currently executing thread is a target for setting a breakpoint, cancel the setting of the breakpoint indicated by the breakpoint identifier of the breakpoint mechanism corresponding to the processing core to be the context switch target; determine whether the next thread to be executed is a target for setting a breakpoint; if the next thread to be executed is a target for setting a breakpoint, set the breakpoint indicated by the breakpoint identifier of the breakpoint mechanism corresponding to the processing core to be the context switch target in accordance with the entry of the breakpoint register setting value corresponding to the thread identifier;The information processing device, wherein the determination of whether the execution thread is a target for setting a breakpoint is made by determining that the execution thread is a target for setting a breakpoint if the execution thread is a thread identified by a thread identifier in the breakpoint context table and its breakpoint state is in use.

27. An information processing method in which system software runs on computer hardware including an arithmetic unit and a main memory, wherein the system software processes system calls issued by applications when they use functions provided by the system software, restricts and controls the execution of the system calls, and inspects memory data corresponding to the system calls by tracing the data structure of the system calls from the memory data addresses passed by the applications to the system software.

Images