Secure Batch System Calls with Kernel-Generated AST Compilation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In microkernel architectures, frequent context switching due to multiple system calls deteriorates operating system performance, and existing batch system call implementations are vulnerable to malicious code insertion, compromising security.
Innovation Solution
Compile source code of batch system calls into abstract syntax tree (AST) data, load it to a user-mode virtual address space, and have the kernel generate and store binary code in a kernel-mode space, making it difficult to insert malicious data into the binary code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If binary code for batch system call is registered with the kernel, then the batch system call can be executed, but malicious code can be inserted into the binary code, compromising security
Solution Approach 1:
The patent introduces an intermediary compilation process where source code is compiled into binary code at runtime by the kernel rather than being directly registered. This intermediary step (compilation) acts as a mediator between the source code and the executable binary code, preventing direct insertion of malicious code into pre-compiled binary while maintaining the ability to execute batch system calls securely
Solution Approach 2:
The patent performs preliminary compilation of source code into binary code within the kernel at runtime before execution. This preliminary action ensures that the binary code is generated fresh each time, preventing reuse of maliciously modified binary code while maintaining execution efficiency through caching of compiled results
2Productivity
If multiple system calls are packaged into a batch system call, then the number of IPCs is reduced and performance is improved, but the complexity of implementing and managing batch system calls increases
Solution Approach 1:
The patent enables the batch system call mechanism to be self-configuring and self-managing. The kernel automatically handles the compilation of source code into binary code, the registration of compiled batch system calls, and the management of execution contexts. This self-service approach reduces the complexity burden on external systems while maintaining high performance through automated optimization
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This application discloses a method and a related apparatus for implementing a batch system call. The method includes: loading an executable program to a user-mode virtual address space, where the executable program is obtained by compiling source code of the batch system call, and includes abstract syntax tree AST data of the batch system call; and invoking a first instruction to invoke a kernel to generate, based on the AST data in the user-mode virtual address space, binary code that is used to implement the batch system call. Because there is difficulty in inserting malicious data into such a data structure as the AST, it is difficult to insert malicious code into the binary code of the batch system call, so as to avoid an error or an excessively long delay caused by the malicious code when the kernel runs the binary code of the batch system call, thereby improving security of the batch system call.