WO2005029328A1

WO2005029328A1 - Operating system and recording medium containing the same

Info

Publication number: WO2005029328A1
Application number: PCT/JP2004/013643
Authority: WO
Inventors: Kiyoto Yui
Original assignee: Denki Hompo Ltd.
Priority date: 2003-09-18
Filing date: 2004-09-17
Publication date: 2005-03-31
Also published as: JPWO2005029328A1

Abstract

[PROBLEMS] To provide an operating system capable of suppressing a computer virus and an unauthorized access utilizing the buffer overrun phenomenon which is said to be a cause of generation of a security hole, and a recording medium containing the operating system. [MEANS FOR SOLVING THE PROBLEMS] An operating system (100) provides an API (application program interface) or a system call to a program. The operating system (100) includes address acquisition means (5) for reading a storage address of the program in the memory device before executing the API or the system call requested from the program. When the program which has requested the API is defined to be a primary program and secondary to n-degree (n is an integer not smaller than 2) program as a call source of the primary program are defined to successively form call hierarchies if the primary program is a subroutine, the address acquisition means (5) acquires the storage address of the primary program and the storage address of the secondary to n-degree program.

Description

Specification

Operating system and recording medium recording the same

Technical field

The present invention relates to a highly secure operating system that is not easily infected by a computer virus, and a recording medium that records the operating system.

Background art

[0002] With the widespread use of the Internet, many computer systems for corporate and personal use have been connected to networks and exchanged data with each other.

However, malicious network users from outside connect to computer systems, and computer systems are frequently rewritten without the knowledge of the system administrator. In addition, there are many problems that malicious execution data (programs) called so-called computer viruses are written to the system, and these are serious social problems.

The actions of a computer system or a malicious network connection are described in Non-Patent Documents 13 and 13, respectively.

Non-Patent Document 1: "Nodoka-I 'Programming Taizen", UNYUN

Non-Patent Document 2: “OPERATING SYSTEM Internals and DesignJ, William Stallings, Ph. D.

Non-Patent Document 3: "Intel Architecture Optimization Manual", Disclosure of Intel Corporation of the United States

Problems to be solved by the invention

[0003] The above-mentioned act by a malicious network connection person is performed using a security hole existing in a computer system. This security hole is a security hole for unauthorized access through the Internet and for the destruction and modification of computer systems by Computer Innores.

At present, there are many security holes in computer systems around the world, and as mentioned above, unauthorized access and computer viruses using these holes are a social problem. It has become.

[0004] It is said that one of the causes of the generation of the security hole is due to the nofao-barran phenomenon. Explaining the buffer overrun phenomenon, for example, in a software for sending an e-mail, it is assumed that the maximum number of characters of an e-mail address that can be input to a destination is 50 characters.

Here, if an e-mail address with a length of 1000 characters is specified as the destination e-mail address, the data is written beyond the data storage area of 950 characters exceeding 50 characters (assumed, Computer control has gone bankrupt. Such a phenomenon is called a buffer overrun phenomenon.

[0005] Further, a detailed description will be given of the phenomenon of no-four-bar-run. FIG. 1 is a diagram schematically illustrating a configuration of a memory device (also referred to simply as a memory) used when executing an application program (hereinafter simply referred to as a program) on a general computer.

[0006] In the memory configuration of FIG. 1, a program is stored in an area All. Then, areas A12, A13, and A14 are secured as areas used for program data processing. Area A12 is used to read and write data used in the entire program. The area A13 is used when it is necessary to secure a timely data area in executing the program, and the area in the memory expands and contracts during the execution of the program. The area A14 is a special memory area called a stack memory, which is used to manage the execution of a small, structured program called a subroutine that constitutes a program, and to manage data temporarily used by the subroutine. Area.

The subroutine is defined as follows in this document.

A subroutine is defined as a program that stores the start address of the next program to be executed after the subroutine has been executed in advance in the stack memory and executes it. The subroutine call indicates that this subroutine is called, that is, executed.

[0007] FIG. 2 schematically shows the operation of the stack memory in the area A14 together with the sample program. The sample program is described in C language. The sample program is configured to call a subroutine (child program) named test on the 12th line of the program and execute it. At the time of execution of the subroutine, four pieces of data called arguments are passed. That is, its arguments are four, 'Τ', Έ ',' S, and 'T. These data are written to the areas # 21, # 22, # 23, and # 24 on the stack memory.

[0008] At the time of execution of the sample program, after the argument is written to the stack memory, the control shifts to a subroutine "test". At this time, the address data indicating the 13th line of the program is stored in the area A25 of the stack memory so that the control returns to the 13th line after the execution of the subroutine is completed.

[0009] Then, in the execution of the subroutine "test" starting from the 14th line of the program, first, initialization is performed on the 14th and 16th lines of the program. Then, on line 17, the value 'A,' is assigned to the variable s. This value is written to area A26 of the stack memory.

[0010] Then, on the 18th line of the program, the memory area where the variable s exists is deliberately designated as an address, and 100 characters of zero (0) are written from there to the memory. That is, when this is executed, all contents of 100 characters are overwritten with zeros, including the areas A21-A26, and the program flow is destroyed.

[0011] That is, in the 19th line of the program, the program returns to the address of the 13th line of the caller, which is originally stored in the area A25. Has been written to zero, and the program will also try to run at zero. As a result, a failure occurs in the computer.

[0012] As described above, the phenomenon of illegal writing beyond the originally set memory area is called buffer overrun. Note that such vulnerabilities exist in current CPUs (central processing units), and computer viruses and unauthorized access act on computer systems by utilizing the above-mentioned phenomena. Also, in the case of actual computer virus or unauthorized access, when overwriting the memory, write a convenient memory address to itself, and encourage the control of the program to be transferred here, so that the illegal operation is performed . [0013] An unauthorized access user exploits the buffer overrun, writes his own unauthorized program on the stack memory, and executes the program to take control of the system. In other words, an unauthorized program on the stack memory requests and executes an API (application program interface) or system call from the operating system (OS) for the purpose of performing an illegal act.

The present invention has been made under the circumstances described above, and it is possible to suppress computer viruses and unauthorized access using a no-fuzzy-barran phenomenon, which is said to be a cause of a security hole. It is intended to provide an operating system and a recording medium on which the operating system is recorded.

Means for solving the problem

[0015] In order to solve the above-mentioned problem, an operating system according to the present invention includes an API (Application Program Interface) or an API requested by a program in an operating system that provides a system call to the program. Or, before execution of a system call, an address acquisition means for reading the storage address of the program on the memory device is provided, and the program requesting the API is set as the primary program. If the primary program is a subroutine, the If it is defined that up to the secondary-n-th order (n is an integer equal to or greater than 2) program that forms the call source forms a call hierarchy in order, the address acquisition means determines the storage address of the primary program, the secondary primary The feature is that the storage addresses up to the nth program are obtained respectively. To.

[0016] Further, an address comparison determining means for determining whether or not the address force obtained by the address obtaining means and indicating a proper position on the memory device by comparing the address with a reference address, Reference address detection means for detecting a predetermined address on the memory device as the comparison reference address.

According to such a configuration, before executing the API requested by the program, the storage address of the program on the memory device is acquired, and whether or not the address indicates the proper position is determined. By comparing and determining, it is possible to determine whether the program is appropriate or incorrect.

As a result, if the program that requested the API is determined to be appropriate, execute the API. If it is determined that the program is invalid, the program can be interrupted. Therefore, according to the operating system of the present invention, when an unauthorized access using the buffer overrun phenomenon occurs, it can be suppressed and the computer system can be protected.

The invention's effect

According to the present invention, there is provided an operating system capable of suppressing a computer virus and unauthorized access using a buffer overrun phenomenon which is said to be a cause of a security hole, and a recording medium on which the operating system is recorded. be able to.

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments according to the present invention will be described. The operating system (hereinafter, referred to as an OS) according to the present invention can suitably function in a hardware such as a personal computer system having a CPU, a storage device, and the like.

[0020] The CPU can be applied to all CPUs provided with a stack register (stack memory dedicated register). In the following description, IA32 (Intel 32-bit microprocessor) is used as an example. Will be described.

FIG. 3 shows a schematic configuration diagram of the register set 200 included in the IA32. In the following description, the stack memory is managed by the register device R11 (32-bit ESP register) and operated by the register device R12 (32-bit EBP register) in FIG.

[0021] In Fig. 3, EIP is a program counter (indicating the address of the memory of the program that the CPU wants to execute) in 32-bit representation. Each register is a general-purpose register.

FIG. 4 shows a schematic configuration of an OS according to the present invention. Generally, the OS provides an API (Application Program Interface) for programs represented by application programs. The API provides functions for reading and writing data files and controlling peripheral devices such as a mouse. That is, the application program can use various functions provided by the OS, such as reading and writing files, by executing the API provided by the OS. Also, APIs may not be available in the system Also known as

The OSIOO shown in FIG. 4 includes an OS main unit 1 that provides an API for controlling the peripheral device 20, an API entrance 2 serving as an API request window from a program (main routine or subroutine) 10, and a storage device 20. And a file management system 3 for managing data to be recorded in the file. The above configuration is the same as the general OS configuration. The OS 100 further includes an address comparison determination unit 4 between the OS main body 1 and the API entrance 2. Furthermore, there are provided address acquisition means 5 for providing the address for storing the program to the address comparison / judgment means 4 and reference address detection means 6 for providing the address comparison / judgment means 4 with an address to be compared with. .

[0024] The API entrance 2 is an entrance of an API request generated at the time of execution of a program, and the OS 100 accepts this part. As with a general OS, there are many types of APIs provided by OS 100. When an API execution request is generated from a program 10 (main routine or subroutine), it is accepted collectively at API entrance 2, Passes control to the process corresponding to the requested API.

The address acquisition means 5 has a function of acquiring the storage address of the program (main routine or subroutine) that called the API in the memory area.

Sequential processing type computers use a method in which the execution of all programs is specified by a memory address. In other words, the program of the subroutine requesting the API is the primary program, the caller of the primary program is the secondary program, the caller of the secondary program is the tertiary program, and the nth order (in this case, (n is an integer greater than or equal to 4) If you define up to the program, the (n-1) next program saves the address of the nth program to be executed after returning to the API after executing the API. The address acquisition means 5 functions to read this address from the memory device.

[0026] The reference address detection means 6 obtains, as a comparison reference address, an address on the OS for determining an area in which a program is allowed to be stored and an area in which the program is allowed to be stored. Here, FIG. 5 shows an example of a memory configuration used when executing the program 10 in a computer system equipped with the OS 100.

As a specific example of obtaining the comparison reference address, FIG. There is a method of acquiring a start address A40 and an end address A41 indicating an area for storing the data. This method is a logically complete embodiment.

However, in many cases, an area for storing a program in an actual OS is often divided into a plurality of memory areas and stored. In that case, it is necessary to check the start address and the end address for each storage area of the program, which is troublesome.

[0028] The addresses acquired by the reference address detection means 6 as the comparison reference addresses are not limited to the proper start address and end address of the program storage area. That is, the reference address detection means 6 can set a desired address in the memory area as the comparison reference address.

Therefore, in the present embodiment, a method of obtaining the upper and lower limits (start address and end address) of the stack area as comparison reference addresses will be described as a simple example in order to facilitate understanding of the present invention. This is because the majority of programs that perform unauthorized access using the no-fault balun store the program itself in the stack area due to the nature of the program.

In the memory configuration of FIG. 5, among the memory areas allocated by the OS 100 to the program 10, the upper limit of the stack area (the Z end address in the direction of address 0) is an address indicated by reference sign A37, and the lower limit (the start address) is This is the address indicated by reference numeral A38.

That is, the reference address detection means 6 acquires the addresses indicated by the reference signs A37 and A38.

Further, the address comparison determination means 4 shown in FIG. 4 compares the program storage address acquired by the address acquisition means 5 with the comparison reference address acquired by the reference address acquisition means 6, and issues a program requesting an API. (Main routine or subroutine) is a malicious program. Specifically, it is determined whether or not the address strength of the program storage area acquired by the address acquisition means 5 is between the upper limit A37 and the lower limit A38 of the stack area.

That is, when a malicious program is parasitized in a computer by utilizing the over-the-top run, the storage area of the malicious program is usually the used area A34 in the stack area in the memory configuration of FIG. Therefore, if the address acquisition means 5 acquires the address strength of the program storage area between the upper limit A37 and the lower limit A38 of the stack area, Is determined to be a malicious program.

In this case, the address comparison determination means 4 notifies the OS main body 1 that the malicious program has become parasitic. The OS body 1 interrupts the API request, forcibly terminates the program, and notifies the system administrator of a warning by e-mail or the like.

If it is determined as a result of the determination by the address comparison determining means 4 that the program requesting the API is normal, the requested API is executed.

Next, the operation of the OS 100 when a program requests an API will be described with reference to the flowchart of FIG.

When an API request occurs in the program 10 (main routine or subroutine), the address acquisition means 5 acquires the storage address of the program that requested the API in the memory (Step Sl in FIG. 6).

Assuming that the program that has requested the API is a primary program, the address to be acquired is an address indicating the next position of the part that requested the API in the primary program. In other words, it is the address that indicates the position where the primary program is returned after executing the API and continues. Specifically, for example, the address is acquired from the area A51 in the configuration example of the stack memory in FIG.

The reference address detection means 6 checks the memory area allocated to the program 10 by the OS 100, and acquires the address of the area as a comparison reference address if the program must not exist (step S2).

As described above, when an overrun occurs, it is in the stack area that a malicious program parasitizes. For this reason, the reference address detecting means 6 acquires the upper limit (end address) A37 and the lower limit (start address) A38 of the stack area, and sets the area between them as the area where the program must not exist.

Next, the program storage address acquired by the address acquisition means 5 is compared with the comparison reference address detected by the reference address detection means 6 in the address comparison determination means 4 (step S3). . That is, it is determined whether the program storage address obtained by the address obtaining means 5 is an incorrect address.

[0037] Specifically, the program storage address acquired by the address acquisition means 5 is referred to as the reference address. If the address is within the address area detected by the software detection means 6, the program 10 is determined to be invalid, and if it is outside the area, the program 10 is determined to be appropriate. Also, since the prerequisite API request may be the OS itself, it is also determined whether the caller's address is within the OS management area. If it is within the OS management area, it is determined that appropriate processing has been performed!

[0038] In step S3, if it is determined that the program requesting the API is illegal, an e-mail is sent to the system administrator to that effect, the API request is interrupted, and the program Is forcibly terminated (step S7).

[0039] On the other hand, if it is determined in step S3 that the program requesting the API is normal, the address acquisition means 5 further stores the storage address of the parent program of the program requesting the API (with the address of the caller). The reference address detection means 6 detects the start address and end address of the program area A31 and sets them as comparison reference addresses. Then, the address comparison determination means 4 determines whether or not the storage address of the parent program of the program that has requested the API is in the program area A31 (step S4).

This processing is performed because there is a possibility that the API will be executed via the program of the malicious program shared library.

[0040] In step S4, if the caller address is outside the program area A31, it is regarded as the address of the shared library, and the address of the caller's parent program (return address to the parent program) is obtained. (Step S5), and the process returns to step S3.

In this way, in the loop processing of steps S3 to S5, if the program requesting the API is defined as the primary program, a call hierarchy is sequentially formed starting with the secondary program that is the caller (parent program) of the primary program n The storage address up to the next program is judged to be appropriate.

Here, a specific example of the processing in step S5 will be described. For example, the API execution source program is the primary program, the primary program caller is the secondary program, the secondary program caller is the tertiary program, and the tertiary program caller is the quaternary program. Areas A54, A57, and A510 in the stack memory shown in Fig. 7 have secondary and quaternary programs respectively. The return address to the RAM, that is, the program storage address is stored.

Therefore, the address acquisition means 5 sequentially acquires the storage address of the desired program from the areas A54, A57, and A510 for each loop processing.

Here, a method of obtaining each return address will be described in detail with reference to FIGS. 7 and 8.

FIG. 8 is a diagram showing a basic configuration of a subroutine program in IA32. First, FIG. 8 will be described. The first and second lines of the subroutine program P1 in FIG. 8 are fixedly present at the beginning of the subroutine, and the fourth and fifth lines are fixedly present at the end of the subroutine.

The first line is an instruction to store the contents of the EBP register (value indicating the data start area of the parent program) in the stack. The values of the data start area of the parent program shown in areas A53, A56, and A59 in FIG. 7 are written by this procedure.

The second line is an instruction to copy the contents of the ESP register to the EBP register. The ESP register always points to the unused top zero in the stack area. After this instruction, the EBP register is used to refer to the work data area of the program. The areas A52, A55, and A58 corresponding to the programs 13 and 13 indicate the start position of the work data area of the program as the contents of the EBP register at the time of executing each program.

The third line is a subroutine body. In FIG. 8, the force shown only in the third row is actually shown in multiple rows.

The fourth line is a procedure for ending the subroutine. Lea v _e command is IA32 specific CPU instructions in each program 1 one 3, copies the value of the EBP register ESP register, stack memory force also read the value of the area A53, A56, A59 to EBP register. The value of the ESP register is subtracted to open areas A53, A56, and A59.

The fifth line is a command to return to the parent program. When this is done, the subroutine program transfers control to the corresponding return address, shown in areas A51, A54, A57, and A510, respectively. At the same time, the contents of the ESP register are subtracted to free up the area.

The iret instruction may be used instead of the ret instruction. That is, the subroutine The call has a call instruction and an int instruction in IA32. It is promised that the call instruction returns with the ret instruction, and the int instruction returns with the iret instruction.

Assuming the basic configuration of the subroutine program P1 in FIG. 8, the return address of each program can be obtained as follows.

In FIG. 7, the return address to the API execution source program 1 is at the top of the stack area on the zero side. It can be obtained mechanically according to the contents of the ESP register at that location. In other words, since the ESP register always indicates the unused top of zero, area A51 can be obtained as an area adjacent to the area indicated by the ESP register value.

[0047] The API usually uses an int instruction among the subroutine call instructions described above. The value shown in area A51 is the return address to program 1 written to the stack area by the int instruction. In the area A51, return information and various types of return information regarding the API execution source program are written according to the specification of the int instruction. That is, only the return address can be mechanically acquired from here.

Further, as described above, in the first line of FIG. 8, each of the programs 13 is a value of the EBP register of the calling program (parent program) (indicating the data start area of the parent program). Value) are stored in areas A53, A56, and A59. The area A53 indicates the next area on the zero side adjacent to the area A56. The area A56 indicates the next area on the zero side adjacent to the area A59. Therefore, in each of the programs 13, the data area of the parent program can be acquired in a formula based on a potato.

[0049] The return address to program 2-4 is always adjacent to areas A53, A56, and A59, that is, the upper address side of the address indicating the start of the data area of the parent program.

. As a result, the return address of the program 2-4 can be mechanically calculated based on the address indicating the start of the data area of the parent program.

On the other hand, in step S4 of FIG. 6, when the caller address is within the program area A31, the requested API is executed (step S6), and the control returns to the caller who has requested the execution of the API. To return.

In step S4, the address of the caller and the address of the shared library area A39 The reason why the address is not directly compared is that the storage area A39 of the shared library dynamically changes, so that it is difficult to obtain the address.

As described above, a series of operations in OS 100 are performed. When only the storage address of the program that directly calls the API is determined, the flow chart of FIG. 6 omits steps S4 and S5 of FIG. 6, as shown in the flow chart of FIG. Is simplified.

According to the above-described embodiment, before executing the requested API, the storage address of the program on the memory device is obtained, and the execution address indicates the proper position. By comparing and judging whether the program is correct or not, it is possible to judge whether the program is appropriate or not.

As a result, if it is determined that the program requesting the API is appropriate, the API is executed, and if it is determined that the program is invalid, the program can be interrupted. Therefore, according to the operating system of the present invention, when an unauthorized access using the buffer overrun phenomenon occurs, it can be suppressed and the computer system can be protected.

Brief Description of Drawings

[FIG. 1] FIG. 1 is a diagram schematically showing a configuration of a memory device used when a general computer executes a program.

FIG. 2 is a diagram schematically showing the functions of a sample program and a stack memory.

[FIG. 3] FIG. 3 is a schematic configuration diagram of a register set of an IA32 CPU of Intel Corporation in the United States.

FIG. 4 is an example of a schematic configuration of an operating system according to the present invention.

FIG. 5 is an example of a memory configuration used to execute a program in a computer system equipped with the operating system of FIG. 3.

FIG. 6 is a flowchart showing an operation of the operating system when an API is requested from a program.

FIG. 7 is a diagram schematically showing an example of a data configuration stored in a stack memory.

FIG. 8 is a diagram for explaining a basic configuration of a subroutine program.

[Figure 9] Figure 9 shows the operating system when an API is requested from a program. It is a flowchart which shows the other form of operation | movement.

Claims

The scope of the claims

[1] In operating systems that provide APIs (application program interfaces) or system calls to programs,

An address acquisition unit for reading a storage address of the program on a memory device before executing the API or the system call for which the program capability is also required;

If the program requesting the API is the primary program, and the primary program is a subroutine, the call hierarchy of the secondary-n-th order (n is an integer of 2 or more) programs that call the primary program will be If we define it as forming,

The operating system according to claim 1, wherein said address acquiring means acquires a storage address of a primary program and a storage address up to a secondary-n-th order program.

[2] address comparison determining means for determining whether or not the address force obtained by the address obtaining means indicates a proper position on the memory device by comparing the address with a reference address,

2. The operating system according to claim 1, further comprising: a reference address detection unit that detects a predetermined address on a memory device as the comparison reference address.

[3] The reference address detection means has a function of detecting an address of each area constituting a memory area allocated to a program, and setting an address of each area as the comparison reference address. The operating system according to claim 2, wherein

[4] The reference address detection means detects a start address and an end address for storing a program in a memory area allocated to a program, and sets the start address and the end address as the comparison reference address. 3. The operating system according to claim 2, wherein:

[5] The reference address detection means acquires a start address and an end address for a stack memory from a memory area allocated to a program, and sets the start address and the end address as the comparison reference address. The operating system according to claim 2, characterized in that:

[6] The method according to claims 2 to 5, wherein whether or not the AP requested by the program is capable of executing a system call is determined based on the result of the determination by the address comparison determining means. , The operating system listed in the miscellaneous.

[7] When it is determined that the execution of an AP or a system call requested by the program is to be stopped based on the determination result of the address comparison determination unit,

7. The operating system according to claim 6, wherein the execution of the API or the system call is stopped, and an e-mail as an alert is transmitted to a system administrator.

[8] A computer-readable recording medium recording the operating system according to any one of claims 1 to 7.