35 results about "Operating system kernel" patented technology

The application relates to a basic input / output system customization method and device, and the method comprises the following steps: based on an open source computer operating system kernel and a basic input / output system shell environment, generating a flash read / write tool associated with a flash EPROM; based on the flash read / write tool, writing basic input / output system customization information into the flash EPROM; obtaining the basic input / output system customization information of the flash EPROM, and realizing basic input / output system customization based on the basic input / output system customization information. The method can realize the requirement of basic input / output system customization, improve the compatibility of basic input / output system code, effectively improve production efficiency, simplify operation process, and optimize the production mode of customized products.

This invention relates to a method for cross-version binary compatibility of Linux kernel modules, belonging to the field of computer operating system kernels. It includes the following steps: During the compilation phase, the compiler identifies specific keywords (__kabi_reloc_member, __kabi_check_member, __kabi_sizeof) and records instruction offsets, type identifiers, member variable name offsets, and relocation types, generating a .kabi_relocs segment. During the loading phase, the loader parses the .kabi_relocs segment, combines it with module BTF and kernel BTF information, and dynamically repairs instructions based on the relocation type. This invention achieves "compile once, run anywhere" binary compatibility for kernel modules, with the repair operation completed at load time, having no impact on runtime performance.

The electronic device includes a storage unit and a processor. The storage unit stores the operating system kernel partition of the operating system. The processor is used to: verify whether the tested portion of the operating system kernel partition is secure; if the tested portion of the operating system kernel partition is secure, start the application layer of the operating system; verify whether the remaining portions of the operating system kernel partition are secure; and if the remaining portions of the operating system kernel partition are insecure, issue a warning message. Compared to performing a security check on all partitions of the operating system before starting the application layer of the operating system, the secure boot method of this invention can reduce boot time while ensuring boot security.

The application discloses a slow disk simulation method and device, equipment and medium, apply in hard disk fault simulation technical field, including: when the target function starts to execute, jump to the preset hook function through the preset jump instruction in the target function;The target function is the function of handling IO request in the block layer of the operating system kernel;The IO request is the IO request for the hard disk;The preset hook function is used to intercept the IO request, and the preset logic is used for delay injection. In this way, the function of handling IO request in the block layer of the operating system kernel is selected as the target function, the preset jump instruction and the hook function, the interception and delay injection of the IO request are realized, the slow disk simulation can be carried out for each type of hard disk, so as to meet the test demand of the slow disk detection mechanism.

This invention provides a method and computing system capable of enhancing memory protection related to the operating system kernel, thereby ensuring system security. The computing system provided by this invention may include: a processor configured to execute a guest virtual machine (VM), wherein an operating system (OS) runs on the guest VM, and an application (APP) runs on the OS. The kernel of the OS includes: a protection service module configured to receive at least one virtual address and first size information sent by a client of the APP; and a memory management unit (MMU) manager. The computing system further includes a virtual machine manager configured to receive the at least one virtual address and the first size information sent by the protection service module. The computing system also includes a host VM, which includes: a protection manager configured to receive and obtain a physical address array and second size information based on the at least one virtual address and the first size information to protect memory allocated by the kernel of the OS.

The application discloses a forwarding network packet system for network simulation, which comprises a user state device binding module, a user state queue control module and a kernel module, wherein the user state queue control module runs in the user program space in the form of a library, the kernel module runs in the operating system kernel space, and the kernel module assists the user state device binding module and the user state queue control module to complete the request of the user simulation program. The application can enable the user state simulation program to capture, process and forward network packets at a high throughput, and expand the application scenario of the user state simulation.

This invention discloses a method for runtime verification and safety recovery of control logic in embedded real-time systems, relating to the fields of embedded real-time control and functional safety technology. This invention constructs an independent safety monitoring layer outside the operating system kernel, defines runtime contracts containing safety invariance and timing logic constraints for critical control tasks, and performs real-time contract verification through periodic data collection. When a contract violation is detected, a layered recovery mechanism is initiated according to fault levels, including output clamping, task rollback and restart, and algorithm degradation switching. A memory protection unit is used to achieve spatiotemporal isolation protection for tasks. This invention achieves non-intrusive real-time monitoring and hierarchical safety recovery of critical control tasks, improving the functional safety and operational stability of embedded real-time systems. The monitoring overhead is controllable and does not affect real-time system scheduling, making it widely applicable to safety-critical scenarios such as vehicle control and industrial robots.

This application provides a container management system, method, and electronic device, relating to the field of operating systems. It effectively prevents container escape attacks and improves container security and isolation. The container management system is applied to a container runtime, which runs within an operating system and manages containers. The container management system includes a first module. The first module is used to intercept system calls from internal processes of containers, whereby these system calls request functions provided by the operating system kernel. The first module is also used to reject system calls when they do not conform to a pre-set security policy.

This invention discloses a secure encryption method for the operating system kernel based on the AES algorithm, relating to the fields of operating system security and data encryption technology. The method comprises the following steps: S1, traversing and scanning the data in the operating system kernel, identifying sensitive data, and classifying it according to its sensitivity level; S2, generating an encryption master key and hierarchical subkeys based on the AES algorithm; S3, encrypting data of different sensitivity levels using AES encryption algorithms with different rounds and encryption modes; S4, dynamically updating the key and encrypting and storing the updated key in the kernel secure storage area; S5, adding a checksum to the encrypted sensitive data and verifying data integrity; S6, reading the corresponding key and decrypting the data to complete data access. This invention significantly improves key security and data integrity, effectively balances encryption efficiency and system performance, has strong adaptability and high practicality, and is easy to promote and apply.

This application discloses a method, apparatus, and medium for implementing secure socket communication within the operating system kernel, belonging to the field of computer systems and network communication technology. This method registers a new secure socket type at the socket layer of the operating system kernel and associates it with a customized set of operation functions. Applications only need to create sockets of this type and inject cryptographic parameters through standard system calls to establish a connection, thereby obtaining transparent, end-to-end automatic encrypted communication capabilities. During transmission, data is encrypted in kernel mode by calling the native crypto subsystem API through a rewritten send function and an authentication tag is attached. During reception, the rewritten receive function automatically performs decryption and integrity verification. This scheme avoids reliance on large external security libraries, improves security and performance, and decentralizes encryption / decryption, resource management, and other processes to the kernel mode, providing upper-layer applications with easy-to-use, lightweight, high-performance, and highly secure kernel-level transparent secure communication.

This application provides a memory testing method, apparatus, workstation, and storage medium, relating to the field of testing technology. The method includes: displaying a task settings interface during normal operating system operation; determining that the slot identifier displayed by the user based on the task settings interface is the slot to be tested in the test task, and determining the number of tests set by the user for the test task; sending the identifier of the slot to be tested to the BIOS firmware through the operating system kernel driver, so that the BIOS firmware disables the non-test slot; in response to the BIOS firmware disabling the non-test slot, running a specified test script; after the specified test script finishes running, checking whether the number of runs of the specified test script has reached the number of tests for the test task; if not, returning to the step of running the specified test script. This solution enables memory testing of memory modules inserted in specific slots without repeatedly inserting and removing memory modules.

This invention relates to a zero-copy message queue communication method based on interrupt-driven direct access, belonging to the field of data communication technology. It solves the problems of multiple copies and high latency in data transfer between existing interrupt service routines and application tasks. The method includes: an application task registering at least one buffer with the operating system kernel; the kernel binding the buffer to a peripheral device's DMA channel; when the peripheral device writes data to the bound buffer via the DMA channel, an interrupt service routine is triggered; the interrupt service routine reads the buffer's lifetime state and generates a descriptor, which is then submitted to a preset queue; the application task retrieves the descriptor from the queue, updates the corresponding buffer's lifetime state based on the descriptor, and accesses the buffer to read data; after completing data reading, the application task releases the corresponding buffer and updates its lifetime state again. This achieves secure, efficient, and low-latency zero-copy data communication.

This invention discloses an artificial intelligence (AI) secure operation system and method based on a hardware unidirectional data channel and a network-free kernel. The system includes a data access unit, an isolated AI computing unit, a hardware unidirectional data channel, and a security management terminal. The hardware unidirectional data channel enables unidirectional data transmission from the data access unit to the isolated AI computing unit at the physical layer. The isolated AI computing unit runs an operating system kernel stripped of general network communication protocol stacks, preventing processes running within it from actively establishing external network connections. By combining a hardware-level unidirectional transmission structure with kernel-level network capability limitations, an AI operating environment with unidirectional data input is constructed. This invention also supports collaborative computing with remote computing nodes through a controlled encrypted tunnel under the control of the security management terminal, and can be used in high-security AI deployment scenarios such as finance, government affairs, and critical infrastructure.

This invention provides a robustness testing method and system for the kernel interface of an airborne real-time operating system. It employs a multi-dimensional equivalence class partitioning model for parameter classification, systematically enumerating six categories—legal values, boundary values, illegal values, null pointers, extreme values, and permission exceptions—based on two dimensions: data type and semantic role. This avoids the problem of overlooking exception categories in manual, experience-based design. Orthogonal lists are used for parameter combination, ensuring that any equivalence class combination between any two parameters is tested at least once. At the test execution level, four mechanisms are deployed: watchdog deadlock detection, memory sentinel out-of-bounds detection, kernel panic callback capture, and non-volatile progress marker restart detection, making result determination independent of the API return value itself. The structured test report generated by this invention includes coverage statistics, detailed abnormal test cases, and defect location information, serving as objective evidence of DO-178C robustness testing activities and meeting the airworthiness certification requirements for test sufficiency and traceability.

Embodiments of the present specification provide an inter-process communication method, apparatus, device, storage medium and program product. In the method, a first process sends a message transmission request to an operating system kernel based on a first handle, the message transmission request containing a to-be-transmitted message and a first identifier of a second process; in response to the message transmission request, the operating system kernel finds a corresponding kernel object according to the first handle, the kernel object being created by a third process requesting the operating system kernel, the kernel object containing record items corresponding to a plurality of processes respectively that have obtained handles of the kernel object, the plurality of processes including the first process and the second process, and the record items being used to locate message queues associated with the corresponding processes; the operating system kernel finds a first record item corresponding to the second process in the kernel object according to the first identifier, locates a first message queue associated with the second process, and writes the to-be-transmitted message into the first message queue; and the second process obtains the to-be-transmitted message in the second message queue.

The application relates to an eBPF-based kernel soft lock monitoring and dynamic optimization method and electronic equipment, and belongs to the technical field of operating systems, and solves the problem that in the prior art, a system is prone to permanent CPU freezing when encountering a spin exception and it is difficult to locate the fault cause. The method comprises the following steps: implanting a soft lock information collection function in an operating system kernel, and mounting an eBPF program constructed based on an eBPF mechanism to an entry point of the soft lock information collection function to form a monitoring hook; when a soft lock event occurs in the kernel, the soft lock information collection function is called to trigger the monitoring hook to execute the eBPF program; the eBPF program collects on-site information of the soft lock event, and transmits the on-site information to a user state through an eBPF mapping; and a user state program receives and analyzes the on-site information, and dynamically adjusts a kernel scheduling mode according to an analysis result. Soft lock monitoring and dynamic adjustment are realized.

This invention discloses a configuration management system for microservice architectures, including a configuration storage center, a policy engine server, a configuration client, a system call interceptor, an immutable audit chain module, and an intelligent rollback controller. The policy engine server dynamically calculates the set of affected microservice instances based on service tag rules and generates a configuration change instruction set. The configuration client is deployed in the operating system kernel space and writes configuration data to a shared memory mapping table. The system call interceptor, based on eBPF technology, intercepts configuration read system calls from microservice processes, returns the latest configuration from shared memory, and achieves real-time effectiveness with zero restart. The immutable audit chain module records configuration change metadata based on a blockchain, forming a tamper-proof audit trail. The intelligent rollback controller monitors service metrics in real time and automatically triggers an atomic rollback when an anomaly in the configuration change is detected. This solves the problems of delayed effectiveness, lack of fine-grained binding, weak auditing capabilities, and delayed rollback in existing configuration management systems.

The application provides a method and medium for interface conversion from a VxWorks system to an embedded Linux system, which comprises: constructing a compatible layer in a user state, rewriting key system function APIs of the VxWorks, such as task management, message queue, semaphore and watchdog, and calling Linux native system functions or implementing corresponding logic by itself in the internal, and finally compiling the implementation code into a static library or a dynamic library. An application program only needs to link the library and include the corresponding header file, so as to be compiled and run in the embedded Linux system without modifying the core source code. The application realizes seamless transplantation in the user state without modifying the operating system kernel and configuration, significantly reduces the transplantation cost and system stability risk, and is suitable for various deployed Linux environments.

This invention discloses a startup optimization method for a domestic operating system based on a dynamic loading mechanism, comprising the following steps: module-level trimming of the operating system kernel; using the graphical configuration interface provided by Linux itself to perform overall trimming of functional modules, determining the configuration items of the minimum operating system kernel under the dynamic loading mechanism; designing a dynamic loading method for target modules and interrupt service routines, downloading modules not found in the loaded module chain to the local machine through a communication mechanism; completing the dynamic linking operation after the target file is read into memory using dependency analysis, symbol resolution, and relocation methods for the target module; and designing a dynamic unloading method for specified modules, reclaiming the storage space allocated to the module in the operating system and canceling its external references, thus achieving the reverse operation of dynamic linking. This invention can clearly define the coupled data and behaviors that need to be loaded during module startup and runtime in the operating system, shortening startup time.

The invention discloses a vehicle-based intrusion detection method, device and system and a storage medium, and the method comprises the steps: capturing log data of a target system event based on an eBPF program running in a vehicle operation system kernel, and constructing N to-be-detected sequences based on the captured log data; processing the N to-be-detected sequences based on a preset attack discrimination model deployed in the vehicle to obtain an initial type corresponding to each to-be-detected sequence; all the M to-be-detected sequences of which the initial types are abnormal types are uploaded to a cloud end, and known attack type identification is performed on the M to-be-detected sequences through the cloud end; k to-be-detected sequences are screened out from the to-be-detected sequences of which the initial types are normal types, the K to-be-detected sequences are uploaded to a cloud end, unknown attack type identification is carried out on the K to-be-detected sequences through the cloud end, and N, M and K are positive integers. According to the scheme, vehicle intrusion detection can be comprehensively and accurately realized.

The application provides a kind of fuzz testing method and device for operating system kernel data competition, belong to computer software testing technical field.Method includes: with the operating system to be tested as target kernel, generate the kernel image of the target kernel;Single-thread fuzz testing is carried out on the kernel image, and single-thread execution result is obtained;According to the single-thread execution result, obtain basic corpus;According to the basic corpus, concurrent fuzz testing is carried out on the kernel image, and concurrent execution result is obtained;According to the concurrent execution result, determine concurrent corpus, and the race adjacent access pair is included in the concurrent corpus;According to the race adjacent access pair, obtain the data competition test result of the target kernel.Can improve the efficiency and accuracy of operating system kernel data competition test, enhance the reliability of test result.

This invention discloses a global register activity analysis and context switching optimization method for atomic task flows, belonging to the fields of embedded system software optimization, compiler backend technology, and real-time operating system kernel design. The method first transforms the directed acyclic graph describing the task execution logic into a linear execution sequence, and then calculates the active interval (the time span from generation to last use) of each data variable by traversing this sequence. Subsequently, using a zero-copy register forwarding algorithm, by detecting data dependencies between adjacent tasks, physical register safety gaps, and interface alignment conditions, the physical registers carrying the data are locked and redundant memory loading instructions are eliminated during the code generation stage. Finally, by calculating the intersection of the set of registers actually modified by the task flow and the set of registers saved by the callers according to the target architecture ABI specification, a minimum context switching set (Cmin) code is dynamically generated, saving only the necessary registers.

An operating system state root cause inference method, device, equipment, medium and product are provided. The operating system state root cause inference method comprises: obtaining a structured event with a predefined format in an operating system kernel; determining whether the operating system is abnormally stopped; in response to determining that the operating system is abnormally stopped, obtaining, by a user state service, state information of the operating system based on the structured event obtained in an operating system running cycle before abnormal stop through a predetermined state machine; and obtaining, by the user state service, an abnormal stop root cause based on the state information of the operating system through the predetermined state machine. Through the present disclosure, the structured degree and machine analyzability of operating system abnormal stop analysis can be significantly improved, different fault types can be more accurately distinguished, kernel invasiveness and maintenance costs can be reduced, the implementability of rule iteration and product deployment can be improved, and automatic inference and large-scale review can be realized.

This disclosure provides an AI identity identification and access control method and system. The method includes: responding to a system call received by the operating system kernel, obtaining the AI ​​identity of the current process initiating the system call as a first AI identity; determining a target entity and its AI identity based on the type of the system call, wherein the AI ​​identity of the target entity is used as a second AI identity; performing an access control check in a kernel event handling path based on the first AI identity and the second AI identity to determine the current process's permission to execute the system call on the target entity, and generating an access control check result; allowing the system call to continue execution when the access control check result is passed, and preventing the system call from executing when the access control check result is failed.

The application provides a firmware-based operating system kernel running integrity verification method and device, the method comprises the following steps: the kernel calls the first runtime service of the firmware, and creates the benchmark value of the key data based on the first runtime service; the kernel calls the second runtime service of the firmware, and closes the benchmark value creation of the firmware based on the second runtime service; the kernel calls the third runtime service of the firmware at a fixed time, sends the integrity verification request to the firmware, and the firmware verifies the integrity of the operating system kernel running based on the integrity verification request and the benchmark value of the integrity verification. The application divides the server into the firmware and the kernel, provides the runtime service of the kernel data integrity verification through the firmware, and the kernel data verification logic runs in the firmware space and is independent of the kernel space, so that the verification logic in the firmware cannot be hijacked after the kernel is maliciously attacked, therefore, the verification process is safer, and the verification result is more reliable.

The application discloses a context-aware dependency-guided kernel fuzzing test case mutation method and system, and belongs to the technical field of software security and operating system kernel testing. The method comprises the following steps: dynamically collecting and minimizing a high-potential system call sequence set as a training set; modeling the dependency relationship contained in the training set based on a neural network language model, and using the language model to realize context-aware dependency-guided mutation in the mutation stage, so as to help selecting a system call suitable for the current context and establishing an effective state path; alternately switching between exploration and utilization stages, dynamically scheduling mutation operations through an upper bound confidence algorithm to balance the diversity and efficiency of the test, and avoiding falling into a local optimum; and repeating the above steps until the fuzzing test is completed. The application can improve the quality of test cases, trigger the deep code logic of the kernel, and optimize the coverage rate and the efficiency of vulnerability mining.

The application discloses a trusted boot method and system based on a trusted dual architecture, relates to the technical field of industrial control safety, and comprises the following steps: obtaining a hardware layer, an operating system layer and an application layer of a PLC system, encapsulating an image file, designing a key of the image file, and burning the key and the image file into a storage position corresponding to the PLC system; after the PLC system is powered on, an operating system kernel calls an on-chip Boot Loader and a reference value in ROM data in a trusted CPU, integrity verification is sequentially performed on each system boot component, integrity verification of an application program is performed by the system boot component, and based on the integrity verification, it is judged whether the trusted boot of the PLC system is completed or an alarm prompt is sent. Through the trusted dual architecture CPU, the application overcomes the defect that a trusted computing module in a previous architecture is subordinate to a traditional computing module, improves the trustworthiness and security of core components in a starting stage, and enhances the robustness and trusted starting performance of the system.

This application discloses an operating system update method, apparatus, device, and storage medium for implementing operating system kernel patching without rebooting. The method includes: when executing a target function in an operating system image, reading the jump address corresponding to the target function; reading the target value corresponding to the jump address of the target function in the jump address table; if the target value is null, continuing to execute the target function; if the target value is the address of a patch function, executing the patch function in the space corresponding to the patch function address in the patch function partition.