JPH064356A - Abnormal operation detecting system for software - Google Patents

Abstract

PURPOSE:To detect the abnormality of a software without previously calculating an expected value by holding the result of first performing arithmetic for abnormality detection as the expected value and performing comparison with the held expected value in the following arithmetic. CONSTITUTION:The calculation start address of an entry and the number of calculated bytes are extracted and while regarding the contents from a designated memory address as data, the total sum is calculated (step 101.) When the total sum is completely calculated, the contents of a flag is referred to. When the flag is '0,' it is judged that an expected value storage area is empty, the calculated result is written in the expected value storage area, and arithmetic is performed concerning the next entry (steps 102, 103 and 101.) On the other hand, when the flag is '1,' it is judged that the expected value is already written in the expected value storage area, and the calculated result is compared with the value in the expected value storage area (104.) When those values are different as the compared result, abnormal processing is performed.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for detecting an abnormal operation of software, and in particular, it detects an abnormality by performing an operation on a fixed data content area and comparing the result with an expected value. In the method, it relates to a software abnormal operation detection method that does not require prior expected value calculation.

[0002]

2. Description of the Related Art Conventionally, in software operating on an embedded device such as a communication adapter, the following method is generally used to ensure that the software is operating normally. .

(1) Watchdog timer system In this watchdog timer system, for example, software is created so that a certain memory area is set to "1" within a fixed time. Then, if an interrupt is generated at a fixed time interval slightly larger than this time interval and the memory is "1", it is determined that the software is operating normally, and the content of the memory is "0". Return to. When the memory is “0”, it is considered that an abnormality has occurred in the software operation.

(2) Content fixed part arithmetic (checksum) system This checksum system is a part where the value does not change even during software operation when the processor is in the idle state (there is no work to be executed). For example, the sum of the parts storing the instruction codes executed by the processor is calculated. Then, the value is compared with the correct value stored in advance, and if the values are equal, it is determined that the software is operating normally. On the other hand, if the values are different, it cannot be rewritten due to abnormal operation of the software. It is determined that the memory area has been rewritten.

Both software abnormal operation detection methods are
They may be used alone or in combination.

[0006]

In the conventional method of performing calculation on the area where the contents do not change, it is necessary to calculate the expected value (normal value) in advance and hold it in the software. However, with this method, the expected value must be calculated and stored each time the software is changed. In particular, in the case where a plurality of areas in which the contents do not change are scattered in the software, it may be necessary to create dedicated software in order to perform calculations on them. Even if the dedicated software is created, the dedicated software also has to be changed each time the range of the area where the content does not change is changed due to the change of the software.

The present invention was devised to solve the above-mentioned problems, and the software is operated by performing an operation on an area where the contents of the software do not change and comparing the result with an expected value. It is an object of the present invention to provide a detection method capable of detecting an abnormality of software without previously calculating an expected value in the method of detecting an abnormal operation.

[0008]

In order to achieve the above object, the method of detecting abnormal operation of software according to the present invention performs an operation on a region of computer software whose contents do not change even while the software is being executed. , In the method of detecting abnormal operation of software by comparing the result with the expected value, the result of the first operation for detecting the abnormality is retained as the expected value, It is provided with means for detecting an abnormal operation of software by making a comparison.

[0009]

[Function] When a module for performing an operation on a portion whose value does not change in software is first executed, a numerical value obtained as a result of the operation is set as an expected value, and thereafter, that value is compared with the operation result. To detect abnormal operation of software. Therefore, it is not necessary to calculate the expected value in advance.

[0010]

Embodiments of the present invention will be described below with reference to the accompanying drawings.

An embodiment of the present invention will be described with reference to FIGS. In this example, the sum of the content fixed parts is obtained as the calculation method.

First, a table as shown in FIG. 1 is created on the memory. One entry is prepared for each area in the software where the contents do not change.
As a matter of course, when there are four or more areas whose contents do not change, the number of entries becomes four or more.

Each entry (1, 2, 3 in the figure) is composed of a calculation start address 11, a calculation byte number 12, a flag 13, and an expected value storage area 14. The flag 13 has an initial value “0”, and the expected value storage area 14 is initially empty.

The calculation module for detecting an abnormality is shown in FIG.
Perform the operation shown in. When the processor enters the idle state, the table is sequentially referred to from entry 1 and processing is performed.

First, the calculation start address 11 of the entry
Then, the calculated number of bytes 12 (a, b, c) is taken out, the contents are regarded as data from the designated memory address, and the total sum is calculated (step 101).

After the calculation of the sum is completed, the contents of the flag 13 are referred to. When the flag 13 is "0", it is determined that the expected value storage area 14 is empty, the calculation result is written in the expected value storage area 14, and the calculation for the next entry is performed (steps 102, 103, 101). .

On the other hand, when the flag 13 is "1", it is determined that the expected value is already written in the expected value storage area 14, and the calculation result and the value in the expected value storage area 14 are calculated. The comparison is made (step 104).

If the results of the comparison are equal, step 101
Return to and check for the next entry. On the other hand, as a result of the comparison, if they are different from each other, it is determined that an area that should not be changed due to abnormal operation of software is rewritten (step 105), and the abnormal processing is performed.

In this example, the detection operation has been described with the flow chart, but the same operation can be realized by hardware.

[0020]

As described above, according to the present invention,
In a method that detects an abnormal operation of software by calculating the value that does not change in the software and comparing the result with the expected value, the software does not need to calculate the expected value in advance. Since it is possible to detect the abnormal operation of the, it is possible to recalculate the expected value when modifying the software and to calculate the expected value for each area when there are multiple areas where the contents do not change in the software. It can be omitted.

[Brief description of drawings]

FIG. 1 is a diagram showing a table structure in a memory used for detecting an abnormal operation according to an embodiment of the present invention.

FIG. 2 is a diagram showing a procedure for detecting an abnormal operation in one embodiment of the present invention.

[Explanation of symbols]

 1, 2 and 3 entries 11 calculation start address 12 calculation byte number 13 flag 14 expected value storage area

Claims (1)

[Claims] 1. A method of detecting an abnormal operation of software by performing an operation on an area of the computer software, the content of which does not change even during execution of the software, and comparing the result with an expected value. Is stored as an expected value for the first time, and in subsequent calculations it is compared with the held expected value to detect abnormal operation of the software. Abnormal motion detection method for wear.