393 results about "Operating system kernel" patented technology

The invention discloses a diversified configurable embedded system boot loading method, which supports a multifunctional mode and a quick start mode, and the multifunctional mode comprises four operation stages: (1) executing first relocation, establishing a high-level language operation environment, and operating a hardware debugging user interface in a context without a system memory; (2) carrying out system memory initialization and secondary relocation, and moving an operating environment to a system memory; (3) starting the kernel of the mini operating system, wherein various advanced characteristics are supported in the starting stage; and (4) loading and starting the target operating system. And directly loading the real-time application after hardware initialization is completed in the quick start mode. According to the method, the running defects of a traditional boot loader are overcome, an independent debugging stage independent of a memory is provided to complete diagnosis and testing of hardware, the application requirements of different scenes are met through dynamic configuration, and the application prospect is wide. In addition, the invention also discloses a system boot loading device and a storage medium.

The invention provides an operating system kernel fuzz testing method, device and equipment, and relates to the technical field of kernel fuzz testing. The method comprises the following steps: acquiring initial input, and splitting the initial input to generate an input set; performing a fuzzy test on the input set and obtaining a fuzzy test result; storing the fuzzy test result into a key component inference file to generate a key component inference table; and generating a seed selection strategy in the seed bank in combination with the key component inference table so as to guide seed variation selection. By identifying and utilizing key components in a system calling sequence, the coverage rate of the fuzzy test is improved. And establishing a corresponding relationship between the key component in the system call sequence and the basic block of the corresponding path, so as to better mine potential security vulnerabilities. Different variation strategies are executed according to selection of variation points, so that an existing fuzzy testing method is effectively improved, and the vulnerability mining efficiency and quality are improved.

The invention discloses an intelligent resource scheduling method and system based on task characteristics and system state perception, and relates to an operating system kernel optimization technology. According to the method, resource demand types, importance labels and time sensitivity of tasks are captured in real time through an eBPF technology, system bottlenecks are recognized by combining / proc and sysfs file system data, a dynamic scheduling strategy is generated by adopting an improved Q-Learning model, and resource allocation is executed through a schemed * function and a cgroup v2 interface. The problems that a traditional scheduler is poor in self-adaptive capacity and resources are mismatched are solved, the actually-measured resource utilization rate is increased to 85%-92%, and the key task delay standard reaching rate gt is achieved; the method is suitable for edge computing, cloud servers and other high-concurrency scenes.

The invention provides an NPU instruction level context switching method and device, and relates to the technical field of data processing.The method comprises the steps that when a context switching instruction is received, a non-refresh instruction is forbidden, it is waited for completion of an instruction being executed, and context data is stored in a main storage module; after completion, recovering the context switching related instruction of the NPU module, and executing the target task; and after the target task is executed, recovering the context data to the NPU module, and recovering the execution of the non-refresh instruction. According to the method, optimization is carried out aiming at the problem that an existing NPU architecture generally can only support limited preemption at an algorithm boundary or a specific context switching point and even cannot preemption, so that a high-priority task must wait for a low-priority task to be completed, and remarkable priority inversion and / or key inversion are / is caused. A full-stack solution from a system on chip to an instruction set architecture and then to an operating system kernel is provided, and preemption of an NPU instruction level is achieved.

The invention discloses a data packet analysis method and device based on eBPF and electronic equipment. Relates to the field of cloud computing, and the method comprises the steps that a to-be-analyzed data packet captured by an eBPF kernel mode program from an operating system kernel is acquired based on an extended Berkley data packet filter eBPF user mode program, the eBPF user mode program is a program running in a user space of an operating system, and the eBPF kernel mode program is a program running in a kernel space of the operating system; determining a target analytic function; a target analytic function on a function calculation platform is called through the flow entry function, and the function calculation platform is a service system for operating the function according to needs; and based on the target analysis function, performing analysis processing on the to-be-analyzed data packet to obtain an analysis result of the to-be-analyzed data packet. According to the method and the device, the problem of limited processing capability of an eBPF flow analysis system on a single node in related technologies is solved.

Radio-frequency identification (RFID) tag readers or sensors interrogate and locate RFID tags in stores, warehouses, and other environments. Unfortunately, these sensors are vulnerable to intrusions, including attacks that can expose any computer network to which the sensors are coupled. Attacks like these can be prevented using a secure booting process for distributing and loading an operating system and / or other software onto each sensor. When the sensor first boots up, it validates a pair of locally stored binary files, e.g., using a pair of locally stored digital keys. Once booted, it establishes a secure connection to a controller, then downloads, validates, and executes a binary file from the controller. Executing the binary file from the controller loads an operating system kernel into the sensor's memory for secure operation.

The invention relates to a compilation verification system generation method, a driver compilation verification method, a driver compilation verification system, a driver compilation verification device, a driver compilation verification device, equipment, a medium and a product. The method comprises the following steps: generating each operating system container mirror image based on each target operating system required to be supported by each driver; obtaining a kernel file required for compiling a driving program according to the kernel version used by each target operating system; generating a container compiling environment corresponding to each operating system container mirror image based on each tool chain required for compiling each driving program; determining a written automatic verification program which is used for verifying each drive program by using each kernel version and each tool chain based on each kernel file in a container compiling environment corresponding to each operating system container mirror image; and obtaining a compiling verification system based on the operating system container mirror image, the kernel file, the container compiling environment and the automatic verification program. By adopting the method, the driver can be automatically verified to adapt to different operating systems, kernel versions and compiling tool chain environments.

The invention relates to the technical field of cloud computing, in particular to a method and a system for realizing ARP (Address Resolution Protocol) attack prevention of a credential operating system without occupying CPU (Central Processing Unit) resources, which comprises the following steps of: directly taking over an RX direction data packet of a network card by utilizing an XDP (Extensible Data Processing) technology of an operating system kernel so as to filter the network data packet before a network protocol stack of the operating system kernel; a control interface is added, is used for controlling opening and closing of an ARP protection function and is responsible for issuing and deleting rules, and meanwhile, a time parameter T and the maximum message number Max within T time are configured; compared with the traditional ARP anti-attack technology, the method and the system for realizing the ARP anti-attack of the credential operation system without occupying the CPU resource have the beneficial effects that the ARP message is directly filtered at a network card drive inlet, so that the impact of the ARP attack message on the CPU is reduced; the operating system has an ARP anti-attack function, does not depend on a third-party application, and is safe and reliable; the self-adaptive ARP filtering technology can intelligently adjust an ARP blacklist, and when an attack source returns to normal, ARP learning can be automatically recovered.

The invention relates to an operating system startup exception processing method and device, equipment, a medium and a program. The method comprises the steps that when an operating system is started, a loading program is guided to load an external initramfs file into a memory, and an initial address of the external initramfs file is transmitted to a kernel of the operating system; performing Hash verification on the external initramfs file by executing the Hash verification function to obtain a Hash value of the external initramfs file; the operating system kernel decompresses the external initramfs file into a root file system according to the initial address; and when it is determined that the external initramfs file cannot be normally decompressed, determining a decompression failure reason according to a comparison result of the hash value of the external initramfs file and an expected hash value. And reporting the decompression failure problem to the corresponding processing object according to the decompression failure reason. By adopting the method, the decompression failure reason can be quickly and accurately positioned, the decompression failure problem can be pointedly processed, and resource waste is avoided.

The invention relates to a multi-master election method and device based on an OpenHarmony soft bus, and the method comprises the steps: constructing six efficiency indexes according to the networking characteristics of the soft bus; operating system kernel state extraction: increasing a subsystem in an operating system layer, expanding system capability, obtaining index data of each device in a network in real time, storing the index data in a distributed database, and extracting required data from the distributed database by a multi-main election component to calculate and lift the device; performing analytic hierarchy process index weight construction and election formula derivation: establishing an efficiency index score system through an analytic hierarchy process, and calculating the weight of each index at the level to which the index belongs; and after the weights are determined, performing corresponding fuzzy judgment on each index by using a fuzzy comprehensive judgment method from the bottom-layer index, and finally obtaining a judgment score. According to the invention, the problem that the traditional open-source soft bus solves the problem that the single-center networking survivability of the traditional soft bus is insufficient is solved.

The invention relates to the technical field of cloud computing networks, and provides a traffic speed limiting system, a traffic speed limiting method and a traffic speed limiting device. The system comprises a network element agent unit, a monitoring unit, a speed limiting configuration unit, a program loading unit, a speed limiting execution tool and a filter agent unit. When the monitoring unit monitors that the life cycle or the bandwidth configuration strategy of the network element agent unit is changed, the speed-limiting configuration unit is triggered to obtain a bandwidth speed-limiting execution mode and a bandwidth information configuration file according to the bandwidth configuration strategy; the program loading unit updates ip address bandwidth mapping data in the filter speed limiting program file through the speed limiting execution tool and the bandwidth information configuration file; and the program loading unit also acquires and loads a filter speed limiting program file to an operating system kernel, so that a speed limiting execution tool realizes flow speed limiting according to ip mapping data and bandwidth mapping data in the file and a bandwidth speed limiting execution mode. By adopting the system, the expandability can be improved.

The invention provides an automatic test generation platform and method for an operating system kernel derived function. The method comprises the following steps: (1) intelligent symbol extraction and analysis; (2) generating an LLM-driven test code; (3) performing automatic compiling and virtualization testing; and (4) intelligent error diagnosis and repair. According to the method, the test coverage degree is greatly improved, through the multi-level symbol context extraction technology, single function information is extracted, the dependency relationship of related functions in the same element is analyzed, a function call graph and data flow analysis are constructed, rich context information is provided for LLM, and the problem that traditional manual test case writing is incomplete in coverage is solved.

The invention discloses a trusted execution environment construction method, system, equipment and medium for electric power intelligent equipment, and relates to the technical field of electric power intelligent equipment monitoring, and the method comprises the following steps: carrying out Hash measurement on a to-be-detected area in an operating system kernel, carrying out comparison based on a preset reference value, and monitoring the consistency of kernel static data and codes; performing list management and integrity verification on the system kernel module, and identifying illegal loading, unloading or tampering behaviors; monitoring a kernel module event, sensing the change of the life cycle of the module and dynamically triggering a verification mechanism; performing Hash verification on an execution file of the specified user space process, and identifying process-level illegal replacement or injection behaviors; and updating the trusted measurement database based on a detection result, and executing log recording, alarming and blocking strategy response. The method does not depend on a chip, a virtualization platform or hardware extension, realizes security monitoring only through a software means, and is suitable for an embedded terminal with limited resources.

Described is improved resource utilization for multithreading. A first run-time stack is constructed for a first tasklet by allocating a contiguous block of memory between starting and ending memory addresses in a stack pool. The first tasklet executes using a first portion of the contiguous block of memory, up to an intermediate memory address, prior to being preempted by a second tasklet. A second run-time stack is constructed in the stack pool by allocating a second starting memory address, before the ending memory address of the first run-time stack. The second tasklet executes from the second starting memory address, without overlapping the first portion of memory used to execute the first tasklet prior to preemption. Memory addresses associated with the second run-time stack are freed after the second tasklet terminates. Execution of the first tasklet resumes, using memory addresses previously associated with the first run-time stack prior to being preempted.

The embodiment of the invention discloses a multi-level safety protection system and method based on an electric power internet of things operating system. The system comprises a security module, a firmware integrity verification module, a kernel protection module and a file encryption module. The security module is used for performing security protection on security startup, isolation, intelligence and network in the electric power internet of things operation system; the firmware integrity verification module is used for performing integrity check on firmware of the electric power Internet of Things operating system and protecting a kernel, a memory, process management and files of the electric power Internet of Things operating system at the same time; and thus, protection in the starting and running processes of the electric power internet-of-things operation system is facilitated. The security protection system is established on the underlying security of the electric power Internet of Things operating system, is beneficial to the construction of an omnibearing protection mechanism of the electric power Internet of Things operating system, and prevents the electric power Internet of Things operating system from being attacked and data from being stolen.

The invention discloses a kernel probe generation method and device, computer equipment and a storage medium, and relates to the technical field of operating system kernel monitoring, and the kernel probe generation method comprises the steps of obtaining a target metadata file corresponding to a current operating system kernel in response to a kernel probe generation request; determining a target declarative strategy file; and determining a target program logic file corresponding to the target declarative strategy file, and generating a probe code according to the target program logic file and the target metadata file to obtain a kernel probe program. The probe program source code adaptive to the current kernel version can be dynamically generated in combination with the target metadata file and the target declarative strategy file, kernel probe development logic and underlying kernel knowledge can be decoupled through the source code generation function, and developers do not need to deeply understand kernel internal data structures and version differences; the development threshold is lower, a specific operating system or probe type is supported, and a universal Linux kernel and multiple probe types are also supported.

The invention discloses a method and a device for preventing files of a linux file system from being deleted, and relates to the technical field of cloud computing. Comprising the steps that 1, based on a linux operating system, an anti-deletion configuration file is created, the configuration file is loaded into an operating system kernel, configuration information is recorded through the configuration file, each item configuration information comprises a matching rule, each matching rule comprises a file path or a regular expression, a protection strategy and priority information of the rule, and the file path or the regular expression is matched with the protection strategy; checking grammar and validity of the matching rules and whether path and priority conflicts exist among the matching rules, and adding the matching rules checked to be correct into a rule set; 2, monitoring and intercepting any request for trying to delete the file, analyzing the path of the file requested to be deleted, reading the rule set, matching the path of the file requested to be deleted with the path of the file in the matching rule according to the priority from high to low, if the matching succeeds, executing the protection strategy, otherwise, allowing the operating system to continue to execute the original deletion operation, and otherwise, executing the original deletion operation. And 3, displaying a deletion request for notifying the user of needing protection intervention, sending out warning information, and recording the behavior of trying to delete the protected file each time.

Methods and apparatus for real-time security monitoring on a computing device are presented. A system may define privileges to access hardware interfaces for each process of a plurality of processes executing on a computing device. The privileges may be defined in a privileged operating system level that controls root access to an operating system. In response to a determination that a process is attempting to access a hardware interface, the system may determine whether the process is privileged to access the hardware interface by checking the privileges. In response to determining that the process is not privileged to access the hardware interface, the intrusion detection agent may terminate the process.

The embodiment of the invention provides a fault processing method and device, a storage medium and a program product. In the fault processing method, when a processor core in the multi-core processor system has a target fault event, an operating system kernel can call target firmware to send an event notification signal to a target processor core, so that the target processor core enters an interruption state and is switched to a kernel state. Thereafter, a target callback function corresponding to the target fault event may be executed on the target processor core to save execution context data prior to entering the interrupt. Wherein the priority of the interrupt corresponding to the event notification signal sent by the target firmware is higher than that of the interrupt managed by the kernel of the operating system, so that the event notification signal is not shielded by the interrupt managed by the kernel of the operating system, and the event notification signal has a certain forcing characteristic; the process that the target processor core stores the execution context data before entering the interrupt is not interfered by an interrupt signal managed by an operating system kernel.

The invention discloses a self-adaptive CPU (central processing unit) priority scheduling method based on near-end strategy optimization, which comprises the following steps of: firstly, establishing a task scheduling model in a simulation environment, performing matrix processing on a current task queue state and a task characteristic into an environment state for input, and extracting a task sequence time sequence characteristic by introducing a gating circulation unit; and respectively outputting task priority strategy distribution and state value estimation by using a dual-network architecture of PPO. In the training process, a course learning mechanism is adopted to gradually transit from a short task load scene to a complex mixed load. During operation, the trained scheduling agent is deployed to an operating system kernel scheduler, the priority of each task is output in real time according to the current state, and a rapid scheduling decision is realized by means of a priority heap. Through a multi-target reward function, the intelligent agent is guided to optimize the system throughput, the task average response time and the hunger prevention index at the same time, and extreme unfair scheduling is avoided. Experiments show that the method shows relatively high performance, stability and robustness in heterogeneous task, high concurrency and long-tail load scenes, and the system resource utilization rate and the user experience are effectively improved.

The invention relates to the technical field of software testing, discloses a fuzzy testing method for an operating system kernel, and solves the problem that effective isolation of a test and efficient recognition and verification of vulnerabilities are difficult to ensure when an existing fuzzy testing method for the operating system kernel is implemented in a virtualization environment. According to the method, improvement is carried out according to the problem that hypervisor and fuzzy testing are not combined at present, a Hypervisor technology and an N-prediction model are combined, the purpose of improving safety testing of a Guest OS kernel is achieved, parallel management is carried out on a plurality of Guest OS instances through a Hypervisor layer, the generation process of a test case is optimized through the N-prediction model, and therefore the safety testing efficiency of the Guest OS kernel is improved. The N-prediction model predicts the next system call by considering the historical system call sequence on the basis of Markov hypothesis, so that the test case with more trigger vulnerabilities is generated, the fuzzy test efficiency is improved, the unknown vulnerability can be found according to different fuzzy test results of guest os kernel, and the safety and reliability are improved.

The invention discloses a trusted startup design method of a server, and belongs to the technical field of information security and trusted computing, after the server is powered up, a trusted root CPU core is started preferentially, a trusted startup program is operated, and a security environment is initialized; integrity measurement and verification are conducted on the BIOS, and after verification is passed, other CPU cores are released, and the BIOS is operated; the service CPU core loads a bootstrap program GRUB and submits the bootstrap program GRUB to the trusted root CPU core for verification; then loading an operating system kernel image and executing hash measurement, and calculating a path entropy value in combination with control flow information in a kernel initialization stage; performing segmentation comparison on the memory image and the disk mirror image, and calculating a mapping consistency coefficient; if the verification is passed, continuing to start the operating system; according to the method, the tampered component in the system startup chain can be effectively prevented from being loaded and operated, and the startup safety and the overall credibility of the server are enhanced.

The invention discloses an eBPF-based non-intrusive application runtime protection method and system, and the method comprises the steps: firstly collecting BTF information of a target operating system, generating an eBPF kernel program adaptive to a local kernel version according to the BTF information, and loading the eBPF kernel program to an LSM control point of an operating system kernel; generating legal behavior description configuration according to known operation information of the protected application, and distributing the legal behavior description configuration to a corresponding storage mechanism of an eBPF Map in a kernel; when a protected application initiates a system call, an eBPF kernel program mounted on a corresponding LSM control point intercepts and queries legal behavior description configuration in an eBPF Map, if the system call is matched with the legal behavior description configuration, execution is allowed, and if the system call is not matched with the legal behavior description configuration, the call is blocked, so that the application is effectively protected during running, and the method has the non-invasive characteristic. Application codes are prevented from being modified; the kernel is adapted based on BTF information, so that the program stability and compatibility are guaranteed; illegal calling is effectively prevented through a legal behavior description mechanism, and a reliable environment is provided for application running.

Examples relate to a method, a computer program, an apparatus, and a computer system for launching at least one boot loader. A computer-implemented method for launching at least one boot loader comprises launching (310) an emulation environment boot loader, wherein the emulation environment boot loader comprises an operating system kernel that is launched as part of the emulation environment boot loader, hosting (320), by the operating system kernel, an UEFI emulation environment, and launching (330, 340), inside the UEFI emulation environment, at least one subsequent boot loader.

The invention discloses an operating system security control method and system, and the method comprises the steps: capturing all host behaviors in real time in an operating system kernel layer, carrying out the analysis and learning, and constructing a host behavior model through employing the analysis and learning result of the host behaviors; if a program is started or operated at the current moment, capturing a corresponding host behavior at a kernel layer of an operating system, verifying the host behavior at the current moment by using a host behavior model, if the verification is passed, allowing the host behavior at the current moment, and if the verification is not passed, stopping the host behavior at the current moment so as to realize mandatory access control on the host behavior; and if the blocked host behavior meets the preset judgment condition, updating the host behavior model by using the blocked host behavior. According to the method, the host behavior model is used as the security baseline of the host system, zero-trust mandatory access control is performed on all host behaviors in the kernel layer of the operating system, a zero-trust security kernel of the operating system is formed, and all-around protection is provided for the security of the host system.

The invention relates to the field of system optimization, and discloses a Linux-based domestic operating system kernel cutting optimization system, which comprises a hardware baseline identification module used for acquiring a processor architecture, peripheral and bus topology, storage and network resources and firmware capability of target equipment and generating hardware baseline description; the scene portrait construction module is used for statically and dynamically observing a target application and acquiring operation portrait data including system calling, driving access and interruption events to form a scene portrait; a dependency analysis module; a multi-target constraint solving module; configuring a synthesis and construction module; and a verification and difference feedback module. According to the method, portrait analysis is carried out on calling of a target application, driving access and interruption events, a trigger threshold value is set, dependency solving is executed in a high touch module range, scene-driven cutting decision is achieved, the dependency closure calculation range is made to be consistent with an actual operation behavior, redundancy and invalid dependency are reduced, and cutting precision and kernel construction efficiency are improved.

The invention relates to the field of operating systems, in particular to an AI server operating system fault detection and recovery method and device. The method mainly comprises the steps that a hard disk file system serves as a guiding mode when the operating system is started, a first heartbeat packet is interacted between a monitoring management module and a hard disk monitoring module in the hard disk file system, and the starting state of the operating system is obtained according to the first heartbeat packet; a second heartbeat packet interaction is established between the monitoring management module and the BIOS, the monitoring management module feeds back the starting state to the BIOS through the second heartbeat packet, when starting fails, the BIOS switches the guiding mode to the memory file system, and the operating system is started through a system root file pre-stored in the memory file system. According to the method, the influence of two fatal server operating system faults, namely incapability of normally starting an operating system kernel and incapability of normally loading a root file system, can be effectively reduced, and the loss caused by the starting fault of the server is avoided.

The invention relates to the technical field of computers and provides a method for kernel mode flow control unloading, computer equipment and a medium. Kernel mode flow control is realized, message forwarding and hardware unloading kernel mode flow control are realized through cooperation of the kernel mode flow control data path module and the virtual switch of the user space, the pressure of the central processing unit is released, the flow table processing efficiency is improved, and the flow table processing efficiency is improved by expanding and optimizing the message. According to the method, the forwarding information is added to support kernel mode flow control unloading, so that a kernel protocol interface and a kernel protocol stack of an operating system can be called for processing, and the kernel mode flow control unloading is supported on the basis of supporting the kernel mode flow control unloading; the corresponding relation between the virtual network interface and the virtual instance device and the corresponding relation between the virtual instance device and the representative device can be flexibly adjusted, and therefore the requirement of a user for customizing input and output resources is met.

The invention discloses a heap ejection attack defense method and system based on eBPF and memory detection, and belongs to the technical field of system security. The method comprises the following steps: detecting space memory allocation of an operating system compiled with an eBPF program; establishing an abnormal distribution detection model based on the normal behavior; judging whether the memory allocation request is normal or not by using an abnormal allocation detection model; continuously monitoring a subsequent system calling condition of the abnormal memory allocation request, and judging whether a calling chain required by a malicious behavior is executed or not; and establishing service safeguard measures to ensure normal and stable operation of the operating system. According to the method, the non-invasive eBPF program is added on the operating system, and the dynamic programming characteristic of the eBPF kernel is utilized, so that the modification of kernel codes and user program codes is avoided, and the implementation is more flexible; the method is effective for operating system kernels of different versions, non-intrusive defense addition is achieved for firmware, the kernel does not need to be recompiled, and the system calling parameter monitoring and data obtaining capacity is provided.

The containerization system architecture comprises a privilege-level operating system kernel, a resource management mechanism, a security isolation mechanism, a container task real-time performance guarantee mechanism, an equipment management distribution mechanism and a communication mechanism between containers, wherein the resource management mechanism, the security isolation mechanism, the container task real-time performance guarantee mechanism and the equipment management distribution mechanism are required by containerization; the containers running at the non-privilege level comprise application containers and system service containers, and the application containers comprise real-time containers and non-real-time containers; and the container manager running at the non-privilege level provides the functions of container deployment, container arrangement, health monitoring and performance monitoring. The problem that the current domestic Quhua embedded real-time operating system lacks native containerization capability is solved, the lightweight embedded real-time operating system is used for expansion to realize security isolation between containers, the priority of task keys and the strong real-time performance of the key tasks are ensured, and the security isolation between the containers is realized. And the operation deployment requirements on the embedded containerized application in the security key field are met.