CN112114964A - Application security kernel access method suitable for embedded system - Google Patents
Application security kernel access method suitable for embedded system Download PDFInfo
- Publication number
- CN112114964A CN112114964A CN202010958726.1A CN202010958726A CN112114964A CN 112114964 A CN112114964 A CN 112114964A CN 202010958726 A CN202010958726 A CN 202010958726A CN 112114964 A CN112114964 A CN 112114964A
- Authority
- CN
- China
- Prior art keywords
- memory
- memory space
- kernel
- user mode
- data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 24
- 238000010586 diagram Methods 0.000 description 5
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F12/00—Accessing, addressing or allocating within memory systems or architectures
- G06F12/14—Protection against unauthorised use of memory or access to memory
- G06F12/1458—Protection against unauthorised use of memory or access to memory by checking the subject access rights
- G06F12/1491—Protection against unauthorised use of memory or access to memory by checking the subject access rights in a hierarchical protection system, e.g. privilege levels, memory rings
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/46—Multiprogramming arrangements
- G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
- G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
- G06F9/5011—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals
- G06F9/5016—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals the resource being the memory
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/46—Multiprogramming arrangements
- G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
- G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
- G06F9/5011—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals
- G06F9/5022—Mechanisms to release resources
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computer Security & Cryptography (AREA)
- Storage Device Security (AREA)
Abstract
The invention provides a method for accessing a kernel safely by application, which is suitable for an embedded system and is used for solving the problem of disordered memory space data of a user mode program caused by writing out an out-of-range state in a memory space of the user mode program by a kernel or a driver. The method mainly comprises the following steps: a memory applied by the user mode program; flag of the memory tail part applied by the user mode program; a memory for system state program application; and a memory tail flag applied by the system state program. By adopting the application security kernel access method applicable to the embedded system, the memory space applied by the user mode small program in the dynamic memory heap can not be written out of bounds by the kernel or the driver to cause subsequent data to be incorrect, the reliability of the use of the user mode program memory and the data correctness of the embedded software system application are improved, and the data security of the whole system is improved.
Description
Technical Field
The disclosure relates to the field of embedded systems and the field of real-time operating systems, in particular to a method for accessing a kernel by application security, which is suitable for an embedded system.
Background
On a traditional embedded real-time operating system, an operating system kernel and a user mode program memory space can be mutually accessed and read and written, the memory space of the user mode program is easily out of bounds by kernel or drive writing, and subsequent data is covered by wrong data, so that the user mode program generates disorder when transmitting data, and a safe and feasible method is needed to avoid the problem as much as possible. This design concept puts higher demands on developers.
However, the memory space is continuously distributed, when data writing is out of range, the memory space is unknown to the user mode program, once the data writing is out of range, the current data is incomplete, and the subsequent data is disordered, so that when the user mode program applies for the memory space, a flag bit is added at the tail, meanwhile, a temporary memory space with the same size needs to be applied in the system mode program, after the data writing is finished, whether the flag bit is damaged is judged, the data is not carried to the user mode program if the flag bit is damaged, and the memory space is released in time, so that the problem of safely and reliably avoiding the data writing out of range can be achieved.
Disclosure of Invention
The technical problem to be solved by the invention is to provide an application security access kernel method suitable for an embedded system, so as to solve the problem that a system mode program writes out the boundary of a user mode program memory space.
The invention provides a method for realizing application security access kernel suitable for an embedded system, which comprises the following steps:
the memory is used for storing data required by the user mode program;
the flag at the tail of the memory applied by the user mode program is used for detecting whether the data has writing boundary crossing;
the memory applied by the system state program is used for temporarily storing data required by the user state;
and the memory tail flag is applied by the system state program and is used for detecting whether the data has a write-crossing boundary.
Furthermore, the memory applied by the user mode program is arranged on the RAM in the embedded chip and used for storing data required by the user mode program.
Further, the flag applied for the memory tail by the user mode program is distributed behind the memory space applied for the user mode program, and the memory space and the flag are spliced into a larger memory space.
Furthermore, the memory applied by the system mode program needs to be consistent in size when the memory space applied by the user mode program needs to be the same, so that the memory plays a role of temporarily storing data, and the memory space needs to be released in time after the memory is used.
Further, the memory tail flag applied by the system state program is consistent with the flag at the tail of the memory space of the user state program, after the data is written, it needs to be judged whether the flag is damaged, if the flag is complete, it indicates that the data is not written out, at this time, the part of data can be carried into the user state program, if the flag is damaged, the carrying is not performed, it is ensured that the data in the memory space required by the user state program is intact and cannot be written out, at this time, the part of the memory space of the system state program needs to be released in time, of course, after the data is carried out under the condition that the flag is not damaged, the temporary memory space in the system state needs to be released in time, and it is ensured that the part of the memory in the system is not occupied all the time.
Drawings
In order to more clearly illustrate the technical solution of the present invention, the drawings needed in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present disclosure, and therefore should not be considered as a limitation of the present invention, and those skilled in the art can also obtain the drawings related to the present disclosure from the drawings without creative efforts.
Fig. 1 is a framework diagram of a method for accessing a kernel by application security applicable to an embedded system according to an embodiment of the present invention.
Fig. 2 is a general flowchart illustrating a process of implementing a method for securely accessing a kernel of an application for an embedded system according to an embodiment of the present invention.
Fig. 3 is a schematic diagram illustrating a relationship between a memory space of a user mode program and a temporary memory space of a system mode program according to an embodiment of the present invention.
FIG. 4 is a diagram illustrating data distribution of RAM and ROM in a chip according to an embodiment of the present invention.
Detailed Description
The technical solutions in the present invention will be described clearly and completely with reference to the accompanying drawings, and it is obvious that the described embodiments are only some embodiments of the present invention, not all embodiments. The embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Thus, the following detailed description of the embodiments of the present invention, presented in the figures, is not intended to limit the scope of the invention, as claimed, but is merely representative of selected embodiments of the invention. All the embodiments obtained by the person skilled in the art without any inventive step are within the scope of the present invention.
The embodiment of the invention provides a description of an application security access kernel method applicable to an embedded system, and as shown in fig. 1, the method is composed of a memory 11 applied by a user mode program, a flag12 at the tail of the memory applied by the user mode program, a memory 13 applied by a system mode program, and a flag14 at the tail of the memory applied by the system mode program.
The memory 11 is used for storing code data of the small program;
a flag12 at the end of the memory requested by the user mode program, for storing stack data of the applet and global variables assigned with initial values;
the memory 13 applied by the system state program is used for temporarily storing data required by the user state;
and the memory tail flag14 applied by the system state program is used for detecting whether the data has a write-out border.
Fig. 2 is a general flowchart illustrating a process of implementing a method for securely accessing a kernel of an application for an embedded system according to an embodiment of the present invention. The flow starts at step S201.
In step S201, the user mode program applies for a memory space during the operation process.
In step S202, a flag is added at the tail of the user mode program after the user mode program applies for the memory space, a byte alignment operation is required after the addition, and a new continuous memory space is formed with the flag after the alignment.
In step S203, the system will apply for the memory size according to the user mode program, temporarily apply for the memory with the same size, and also need to add a flag bit flag at the tail, and finally need to perform byte alignment operation.
In step S204, the driver or system writes data.
In step S205, after the data writing is completed, it is determined whether the flag at the tail of the internal memory space of the block is damaged.
In step S206, if the flag is intact, it indicates that the write data operation of the driver or the system is not out of range, the data may be transferred to the user mode program space, and finally the temporary memory space of the system mode program is released.
In step S207, whether the flag bit is damaged or not, the temporary memory space is required to be released, and if the flag is damaged, it indicates that the data writing is out of bounds, and at this time, the data in the temporary space cannot be carried to the user mode space.
FIG. 3 is a diagram illustrating the data layout of the memory and the MPU protection setting during the applet running process according to an embodiment of the present invention. The flow starts at step S301.
In step S301, it is shown that the user mode program applies for a block of memory space;
in step S302, it is shown that a flag is added to the tail of the memory space applied by the user mode program, and an alignment operation is performed;
in step S303, it is shown that the temporary memory space and size applied in the system state program, after adding the flag and performing byte alignment, need to be consistent with the memory space size in the user state program; the driver or the kernel program can fill data in the driver or the kernel program;
in step S304, it is shown that a flag is added at the tail of the memory space applied by the system state program, byte alignment is required after the flag is added, after the driver or the kernel writes data into the memory space, it is necessary to timely determine whether the flag at the tail is damaged, if the flag is intact, it indicates that the data in the temporary memory space is intact and is not completely written through by the driver or the kernel, and the integrity of the data is not affected, at this time, the data may be carried into the memory space of the user state program, and the temporary memory space applied in the system state program is timely released.
In step S305, another block memory space for the user mode program application is shown;
in step S306, it is shown that a flag is added to the tail of the memory space applied by the user mode program, and an alignment operation is performed;
in step S307, it is shown that the temporary memory space and size applied in the system state program, after adding flag and performing byte alignment, need to be consistent with the memory space size in the user state program; the driver or the kernel program can fill data in the driver or the kernel program;
in step S308, it is shown that a flag added at the tail of the memory space applied by the system mode program is added, byte alignment needs to be performed after the flag is added, after the driver or the kernel writes data into the memory space, it needs to be determined in time whether the flag at the tail is corrupted, if the flag is corrupted, it indicates that the data in the memory space is written out of bounds, or called as write-through, further it can be understood that the data is incomplete, and a part of the data behind the part of the memory space is written and covered, at this time, the data in the temporary memory space in the system mode program cannot be carried into the memory space of the user mode program, and a log is output from the kernel to indicate that the flag is corrupted, and the temporary memory space is released in time.
Fig. 4 is a schematic diagram of storage area data arrangement and MPU protection setting after parameter sections are spliced according to an embodiment of the present invention. The flow starts at step S401.
In step S401, it is shown that after the system is running, the user mode program applies for the memory space in the heap space of the system;
in step S402, it is shown that a flag is added at the end of the memory space in step S401, and byte alignment is required;
in step S403, it is shown that in the system operation process, the size of the temporary memory space applied by the system state program in the system heap space is consistent with the size of the memory space applied by the user state program after the flag bit is added and the byte is aligned;
in step S404, it is shown that a flag is added at the end of the temporary memory space of the system-state program application, and after the flag is added, byte alignment needs to be performed on the whole memory space.
In step S405, it is shown that, under the condition that the flag bit flag is not damaged after the driver or the kernel writes data, the data is carried to the memory space applied by the user mode program, and the temporary space is released in time.
Claims (5)
1. A kernel method for safely accessing an application of an embedded system is characterized in that a memory space applied by a user mode small program in a dynamic memory stack cannot be subjected to kernel or drive writing out to exceed the boundary, so that subsequent data are incorrect, the use reliability of the user mode program memory and the data correctness of the application of the embedded software system are improved, and the data safety of the whole system is improved.
2. The method for accessing the kernel safely for the application of the embedded system according to claim 1, wherein: the memory space applied by the user mode applet in the dynamic memory heap may be a segment of memory pool, a memory block, or a variable.
3. The method for accessing the kernel safely for the application of the embedded system according to claim 1, wherein: a flag bit flag needs to be added to the tail of a memory space applied by a user mode applet in a dynamic memory heap, and the size of the whole memory space comprises the flag bit.
4. The method for accessing the kernel safely for the application of the embedded system according to claim 1, wherein: in order to ensure that the memory space applied by the user mode applet in the dynamic memory heap is not written out by a kernel or a driver to cause incorrect subsequent data, the system mode applet also needs to apply the memory space with the same size as the memory space of the user mode, and a flag bit flag is added at the tail part of the system mode applet.
5. The method for accessing the kernel safely for the application of the embedded system according to claim 1, wherein: the memory space of the system state is only a temporarily used space, and after the kernel or the driver writes the data into the memory space, whether the flag bit of the tail part is intact needs to be judged, the data can be carried to the user state program if the flag bit is intact, and then the memory space of the system state is released.
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2020108265129 | 2020-08-17 | ||
| CN202010826512 | 2020-08-17 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112114964A true CN112114964A (en) | 2020-12-22 |
Family
ID=73803142
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010958726.1A Pending CN112114964A (en) | 2020-08-17 | 2020-09-11 | Application security kernel access method suitable for embedded system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112114964A (en) |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101145129A (en) * | 2007-07-18 | 2008-03-19 | 中兴通讯股份有限公司 | Embedded system memory write-overflow detection method and system |
| CN104090848A (en) * | 2014-07-16 | 2014-10-08 | 云南大学 | Memory management method and device for periodic large big data processing |
| CN105183382A (en) * | 2015-09-09 | 2015-12-23 | 浪潮(北京)电子信息产业有限公司 | Data block protection method and device |
| CN109547566A (en) * | 2018-12-25 | 2019-03-29 | 华南理工大学 | A kind of multithreading upload optimization method distributed based on memory |
| CN110413521A (en) * | 2019-07-24 | 2019-11-05 | 杭州迪普信息技术有限公司 | A kind of the write-overflow detection method and device of heap memory |
| CN110515751A (en) * | 2018-05-22 | 2019-11-29 | 中车株洲电力机车研究所有限公司 | A kind of method and system of load operating VxWorks real-time guard process |
| CN110569037A (en) * | 2019-09-06 | 2019-12-13 | 北京小米移动软件有限公司 | Data writing method and device |
| CN110674050A (en) * | 2019-10-08 | 2020-01-10 | 腾讯科技（深圳）有限公司 | Memory out-of-range detection method and device, electronic equipment and computer storage medium |
-
2020
- 2020-09-11 CN CN202010958726.1A patent/CN112114964A/en active Pending
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101145129A (en) * | 2007-07-18 | 2008-03-19 | 中兴通讯股份有限公司 | Embedded system memory write-overflow detection method and system |
| CN104090848A (en) * | 2014-07-16 | 2014-10-08 | 云南大学 | Memory management method and device for periodic large big data processing |
| CN105183382A (en) * | 2015-09-09 | 2015-12-23 | 浪潮(北京)电子信息产业有限公司 | Data block protection method and device |
| CN110515751A (en) * | 2018-05-22 | 2019-11-29 | 中车株洲电力机车研究所有限公司 | A kind of method and system of load operating VxWorks real-time guard process |
| CN109547566A (en) * | 2018-12-25 | 2019-03-29 | 华南理工大学 | A kind of multithreading upload optimization method distributed based on memory |
| CN110413521A (en) * | 2019-07-24 | 2019-11-05 | 杭州迪普信息技术有限公司 | A kind of the write-overflow detection method and device of heap memory |
| CN110569037A (en) * | 2019-09-06 | 2019-12-13 | 北京小米移动软件有限公司 | Data writing method and device |
| CN110674050A (en) * | 2019-10-08 | 2020-01-10 | 腾讯科技（深圳）有限公司 | Memory out-of-range detection method and device, electronic equipment and computer storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20110029726A1 (en) | Data updating method, memory system and memory device | |
| KR100316981B1 (en) | Microcomputer provided with flash memory and method of storing program into flash memory | |
| CN107357666A (en) | A kind of multi-core parallel concurrent system processing method based on hardware protection | |
| EP3242214B1 (en) | Method and device for protecting information of mcu chip | |
| WO2023092942A1 (en) | Data storage method and apparatus, and electronic device and readable storage medium | |
| CN110147354B (en) | Batch data editing method, device, computer equipment and storage medium | |
| CN112114964A (en) | Application security kernel access method suitable for embedded system | |
| CN116991326A (en) | Block data protection method, device, equipment and storage medium | |
| CN110647764B (en) | Protection method and system for user-mode nonvolatile memory file system | |
| CN107422987B (en) | Method and device for storing data in nonvolatile memory | |
| CN113836600B (en) | Embedded Flash error writing protection method | |
| CN113094107B (en) | Data protection method, device, equipment and computer storage medium | |
| CN103136234A (en) | Data processing method and data processing device | |
| CN105138378A (en) | BIOS flash method and electronic device | |
| CN110825714A (en) | File storage control method and device, file storage device and electronic device | |
| CN111552650A (en) | Data storage method and device, storage medium and data storage equipment | |
| CN111176572B (en) | Method, device, equipment and medium for protecting stored data | |
| CN113126927B (en) | Data deleting method and related device | |
| JPS58211254A (en) | Accumulated program controlling system | |
| CN112540732B (en) | Data processing method and related product | |
| CN112905112B (en) | Data processing method and system of embedded equipment | |
| CN110515751A (en) | A kind of method and system of load operating VxWorks real-time guard process | |
| KR100526547B1 (en) | Method for managing nand flash memory in terminal including dual dhip | |
| CN114637626B (en) | Method, device and equipment for reducing read-write errors of EEPROM (electrically erasable programmable read-only memory) data and readable storage medium | |
| CN117591036B (en) | Bit occupation data filling method and system based on firmware and chip microkernel |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20201222 |
|
| RJ01 | Rejection of invention patent application after publication |