JPWO2017042860A1 - Execution control device, execution control method, and execution control program - Google Patents

Abstract

The execution control device (100) includes a determination unit (120) and a control unit (130). The determination unit (120) is the same as the allocation-destination user who started the process to which the memory area allocated to be operated by the issued memory operation system call is issued. It is determined whether or not. The memory operation system call is a system call issued for operating a memory area among system calls issued from the process activated by the user to the operating system. The control unit (130) stops the execution of the memory operation system call that is determined by the determination unit (120) that the issuing user is different from the assigned user.

Description

  The present invention relates to an execution control device, an execution control method, and an execution control program.

  In recent years, a service called cloud, which provides computer resources on the premise of Internet connection, has been widely used. Service forms include SaaS (Software as a Service) that provides the web application itself, PaaS (Platform as a Service) that provides the application development platform, and IaaS (Infrastructure · Service) that provides the virtual machine. as, a, Service, etc.) are known.

  Usually, a contract regarding billing, service reliability, security, etc., called SLA (Service / Level / Agreement), is made between the cloud vendor and the customer. However, the existence of a malicious administrator cannot be completely denied. An administrator is a super user who has all privileges on the system. Therefore, even if the confidentiality of the customer storage data or memory data is guaranteed in the contract, the data may be stolen or falsified by a malicious administrator.

  The virtual machine provided by IaaS is merely an application program for the operating system on which the virtual machine operates. Therefore, if it is a super user of the operating system, it is possible to acquire data in a memory area used by the virtual machine.

  Patent Document 1 discloses a technique for verifying whether an application program has an authority to receive a service of the system call when a system call is issued from the application program to an operating system.

JP 2006-331137 A

  Prior art cannot cope with the presence of malicious administrators. Even in the technique described in Patent Document 1, the possibility that a superuser can access all the resources of the system is not excluded.

  An object of the present invention is to provide a system in which even a super user cannot access data in a memory area to be protected.

An execution control apparatus according to an aspect of the present invention includes:
Of the system calls issued to the operating system from the process started by the user, the issuer user who started the process that issued the memory operation system call, which is a system call issued for the operation of the memory area, A determination unit for determining whether or not the same allocation destination user that started the allocation destination process of the memory area operated by the issued memory operation system call;
A control unit that stops execution of the memory operation system call that is determined by the determination unit to be different from the allocation destination user.

  In the present invention, if the user who started the process that issued the system call issued for the operation of the memory area is not the same as the user who started the process to which the memory area is allocated, the system call is executed. Not. Therefore, according to the present invention, it is possible to provide a system in which even a super user cannot access data in a memory area to be protected.

FIG. 2 is a block diagram showing a configuration of an execution control apparatus according to the first embodiment. 5 is a flowchart showing an operation of the execution control apparatus according to the first embodiment. FIG. 4 is a block diagram showing a configuration of an execution control apparatus according to a second embodiment. FIG. 9 is a diagram illustrating an example of mounting a virtual memory according to the second embodiment. FIG. 10 is a diagram showing a configuration example of a page table entry according to the second embodiment. 10 is a flowchart showing the operation of the execution control apparatus according to the second embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In addition, the same code | symbol is attached | subjected to the part which is the same or it corresponds in each figure. In the description of the embodiments, the description of the same or corresponding parts will be omitted or simplified as appropriate.

Embodiment 1 FIG.
The configuration of the apparatus according to the present embodiment, the operation of the apparatus according to the present embodiment, and the effects of the present embodiment will be described in order.

*** Explanation of configuration ***
With reference to FIG. 1, the structure of the execution control apparatus 100 which is an apparatus according to the present embodiment will be described.

  The execution control apparatus 100 includes a providing unit 110, a determination unit 120, and a control unit 130.

  In the present embodiment, the execution control apparatus 100 is a computer. Specifically, the execution control apparatus 100 is a host computer that provides IaaS. The functions of the providing unit 110, the determining unit 120, and the control unit 130 are realized by software.

  The execution control device 100 includes hardware such as a processor 101, an MMU 102 (Memory / Management / Unit), a TLB 103 (Translation / Lookaside / Buffer), a memory controller 104, a memory 105, an auxiliary storage device 106, and a communication device 107. The processor 101 is connected to other hardware via a signal line, and controls these other hardware.

  The processor 101 is an integrated circuit (IC) that performs processing. Specifically, the processor 101 is a CPU (Central Processing Unit).

  The MMU 102 is an IC that converts a virtual address that is an address of a virtual memory and a physical address that is an address of the memory 105.

  The TLB 103 is a buffer memory that temporarily stores mapping information between virtual addresses and physical addresses.

  The memory controller 104 is an IC that manages the flow of data written to the memory 105 by the processor 101 and the flow of data read from the memory 105 by the processor 101.

  The memory 105 is a main memory, that is, a physical memory. Specifically, the memory 105 is a RAM (Random Access Memory).

  The auxiliary storage device 106 is a storage device that at least partially functions as a virtual memory. Specifically, the auxiliary storage device 106 is a flash memory or an HDD (Hard Disk Drive).

  The communication device 107 includes a receiver that receives data and a transmitter that transmits data. Specifically, the communication device 107 is a communication chip or a NIC (Network, Interface, Card).

  The execution control apparatus 100 may include at least one of an input device and a display as hardware.

  The input device is used to input data to the memory 105 from the outside. Specifically, the input device is a mouse, a keyboard, or a touch panel.

  The display is used to display data stored in the memory 105. Specifically, the display is an LCD (Liquid / Crystal / Display).

  The auxiliary storage device 106 stores a program group. The program group includes programs that realize the functions of the providing unit 110. This program is loaded into the memory 105, read into the processor 101, and executed by the processor 101. The program group also includes an operating system that realizes the functions of the determination unit 120 and the control unit 130. At least a part of the operating system is loaded into the memory 105, and the processor 101 executes a program that realizes the function of the providing unit 110 while executing the operating system.

  A general user of the operating system, that is, a non-super user, can trace the virtual memory area of his / her process, but cannot trace the virtual memory area of another user's process. Non-super users can share a virtual memory area between their own processes, but share a virtual memory area between their own process and another user's process or between other user's processes. I can't. A virtual machine running on an IaaS host operating system is also such a non-superuser process.

  Conventionally, a super user is allowed to trace the virtual memory area of any process, and is allowed to share the virtual memory area between any processes. However, this would allow an IaaS host operating system administrator to observe the memory data of any virtual machine running on the host operating system.

  As will be described later, in this embodiment, even a super user is prohibited from tracing the virtual memory area of another user's process, and the virtual memory area may be shared between processes of other users. It is forbidden. Therefore, it is possible to protect the memory data of the virtual machine running on the IaaS host operating system from a malicious administrator.

  In order for a process to trace the virtual memory area of the process or to share the virtual memory area with other processes of the same user as that process, it is necessary to change the data managed by the operating system. Become. In the processor 101, an execution mode called a protected mode can be set so that data managed by the operating system is not destroyed by an application program executed as a process. By setting the protected mode, the virtual address space in which the operating system operates and the virtual address space in which the application program operates are clearly distinguished. For this reason, there is provided a means for the application program to access the space of the operating system in the protected mode called system call.

  Application program that runs as a general user process can issue a system call to trace the virtual memory area of the process, and share the virtual memory area with other processes of the same user as that process Various functions of the operating system can be used.

  Note that the execution control apparatus 100 may include only one processor 101 or may include a plurality of processors 101. A plurality of processors 101 may execute the program group in cooperation.

  Information, data, signal values, and variable values indicating the processing results of the providing unit 110, the determining unit 120, and the control unit 130 are the auxiliary storage device 106, the memory 105, or a register or cache memory in the processor 101. Is remembered.

  The program group may be stored in a portable recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, and a DVD (Digital Versatile Disc).

  The processor 101, the MMU 102, the TLB 103, the memory controller 104, and the memory 105 are collectively referred to as a “processing circuit”. That is, the functions of “units” such as the providing unit 110, the determination unit 120, and the control unit 130 are realized by a processing circuit.

  “Part” may be read as “step” or “procedure” or “processing”.

*** Explanation of operation ***
The operation of the execution control apparatus 100 will be described with reference to FIG. The operation of the execution control apparatus 100 corresponds to the execution control method according to the present embodiment. The operation of the execution control apparatus 100 corresponds to the processing procedure of the execution control program according to the present embodiment.

  The processing from step S11 to step S15 is performed when at least the providing unit 110 provides a service that allows a user to use a virtual machine that operates as a process. In the present embodiment, providing section 110 provides IaaS as such a service. Specifically, the providing unit 110 operates the virtual machine on the operating system using the processor 101. The providing unit 110 transmits / receives data via the Internet using the communication device 107 to allow the user to use an operating virtual machine.

  In step S11, determination unit 120 waits until it detects the issuance of a system call. Specifically, the determination unit 120 is activated when an interrupt occurs in the processor 101 by issuing a system call. The determination unit 120 detects that a system call has been issued by being activated. Further, the determination unit 120 acquires from the register of the processor 101 at least the number of the issued system call, the argument of the system call, and the identifier of the user who started the process that issued the system call.

  When the issue of the system call is detected by the determination unit 120, the flow proceeds to step S12.

  In step S12, the determination unit 120 determines whether or not the system call whose issue is detected in step S11 is a memory operation system call. The memory operation system call is a system call issued for operating a memory area among system calls issued from the process activated by the user to the operating system. Specifically, the determination unit 120 compares the system call number acquired in step S11 with the memory operation system call number, and outputs the comparison result as a Boolean value. Assuming that the Boolean value indicating that the numbers match is “1”, when “1” is output, the determination unit 120 determines that the issued system call is a memory operation system call. It will be. On the other hand, when “0” is output, the determination unit 120 determines that the issued system call is not a memory operation system call.

  If the determination unit 120 determines that the issued system call is a memory operation system call, the flow proceeds to step S13. Otherwise, the flow proceeds to step S14.

  In step S <b> 13, the determination unit 120 determines that the issuer user who started the process that issued the memory operation system call has started the allocation process for the memory area that is operated by the issued memory operation system call. To determine if they are the same. Specifically, the determination unit 120 acquires the virtual address of the memory area operated by the memory operation system call from the argument of the system call acquired in step S11. The TLB 103 stores an identifier of an allocation destination process for each virtual address space as a part of the mapping information described above. The determination unit 120 uses the processor 101 to acquire the process identifier stored in the TLB 103 as an assignment destination identifier of the virtual address space including the acquired virtual address. The determination unit 120 identifies the identifier of the assignment destination user who is the user who started the process from the acquired process identifier. The determination unit 120 compares the identifier of the user acquired in step S11, that is, the identifier of the issuer user with the identifier of the specified assignment destination user, and outputs the comparison result as a Boolean value. If the Boolean value indicating that the identifiers match is “1”, when “1” is output, the determining unit 120 determines that the issuing user is the same as the assigned user. become. On the other hand, when “0” is output, the determination unit 120 determines that the issuer user is different from the assignment destination user.

  If the determination unit 120 determines that the issuer user is the same as the assignment destination user, the flow proceeds to step S14. Otherwise, the flow proceeds to step S15.

  In step S14, the control unit 130 performs normal processing. Specifically, the control unit 130 causes the processor to execute a system call determined by the determination unit 120 as not being a memory operation system call. The control unit 130 also causes the processor 101 to execute a memory operation system call that is determined by the determination unit 120 that the issuer user is the same as the assignment destination user. That is, the control unit 130 stops the execution of the memory operation system call that is determined by the determination unit 120 that the issuer user is different from the assignment destination user.

  In step S15, the control unit 130 performs error processing. Specifically, the control unit 130 determines whether the issuer user is different from the assigned user by the determination unit 120 even if the issuer user is a super user who has administrator authority of the operating system. Is not executed by the processor 101. In the present embodiment, the control unit 130 forcibly terminates the process of issuing the memory operation system call that is determined by the determining unit 120 that the issuing user is different from the assigned user. In other words, the control unit 130 deletes the process of the memory operation system call issuer that is determined by the determination unit 120 that the issuer user is different from the assigned user.

*** Explanation of the effect of the embodiment ***
In this embodiment, if the user who started the process that issued the system call issued for the operation of the memory area is not the same as the user who started the process to which the memory area is allocated, the system call Is not executed. For this reason, according to the present embodiment, it is possible to provide a system in which even a super user cannot access data in a memory area to be protected.

  In the present embodiment, it is possible not only to prevent unauthorized access to the memory area by a user other than the user to whom the memory area is allocated, but also to prevent access by the malicious super user to the memory area. Therefore, it is possible to provide a highly secure service. Since operations such as tracing and sharing of the memory area by the user to which the memory area is allocated are normally performed, the convenience of the service is maintained.

  In the present embodiment, in the authority check during the processing of system calls related to memory management such as memory area tracing and sharing, the logic to make the super user “authorized” is excluded, and thus the memory data of the virtual machine is malicious. Can be protected from certain superusers.

  Note that the determination unit 120 determines whether or not the issuer user is the same as the assignment destination user in step S13 only when the issue of the memory operation system call for the memory area assigned to the virtual machine is detected in step S11. May be. Even in that case, at least data in the memory area used by the virtual machine can be protected.

*** Other configurations ***
The execution control apparatus 100 is not limited to a host computer that provides IaaS by executing a virtual machine as a process, and may be a computer that executes an arbitrary process. That is, as a modification of the present embodiment, a configuration in which the execution control apparatus 100 does not include the providing unit 110 may be employed.

Embodiment 2. FIG.
In the first embodiment, access to a memory area used by a virtual machine is controlled by a user account managed by the operating system. That is, the first embodiment protects the virtual machine memory data using a user management mechanism.

  A general web server can be accessed by anyone with an Internet connection. Therefore, in the web service, the authority level in the operating system that is granted to the user is extremely limited. For this reason, a web service provided by a bank or the like provides a means for securely accessing an account system in response to a user request. Specifically, a strict authentication mechanism using a hash code for a random number in addition to a software keyboard or password is provided.

  Also in the present embodiment, an authentication mechanism for performing process authentication is provided as means for securely accessing a memory area used by a virtual machine. A mechanism for using the authentication mechanism is introduced into the memory management mechanism. In other words, the present embodiment protects memory data of a virtual machine using an authentication mechanism and a memory management mechanism.

  The configuration of the apparatus according to the present embodiment, the operation of the apparatus according to the present embodiment, and the effects of the present embodiment will be described in order. Differences from the first embodiment will be mainly described.

*** Explanation of configuration ***
With reference to FIG. 3, the configuration of execution control apparatus 100, which is an apparatus according to the present embodiment, will be described.

  As in the first embodiment, the execution control apparatus 100 includes a providing unit 110, a determination unit 120, and a control unit 130. The execution control apparatus 100 further includes a storage unit 140, a management unit 150, and an authentication unit 160 in the present embodiment. Note that the execution control apparatus 100 may not include the determination unit 120.

  The storage unit 140 is realized by the TLB 103.

  The management unit 150 is realized by the MMU 102.

  The function of the authentication unit 160 is realized by software. Specifically, the function of the authentication unit 160 is realized by the operating system in the same manner as the function of the control unit 130.

  A virtual memory implementation example will be described with reference to FIG.

  Once the state of the processor 101 enters the protected mode, the processor 101 executes the operating system and application program using the virtual address 200 of the virtual memory.

  The virtual address 200 is an address used for the processor 101 to execute an instruction, refer to data, and update data on the virtual memory. The virtual address 200 includes an index 201 to the page directory table 210, an index 202 to the page table 220, and an offset 203. In this example, the index 201 to the page directory table 210 is 10 bits, the index 202 to the page table 220 is 10 bits, and the offset 203 is 12 bits. That is, the virtual address 200 is 32 bits.

  The page directory table 210 stores an array of page directory entries 211 (PDE).

  The page table 220 stores an array of page table entries 221 (PTE). The page table entry 221 corresponds to mapping information between the virtual address 200 and the physical address 300 output to the memory bus.

  By operating the control register 230 (CR3) of the processor 101, the state of the processor 101 shifts to the protected mode. Once the state of the processor 101 transitions, the operating system refers to the page directory table 210 and the page table 220 based on the virtual address 200.

  The MMU 102 handles the mapping between the virtual address 200 and the physical address 300. In recent CPUs with L1 to L3 caches, memory access is a very large performance penalty. The same applies to the MMU 102. Therefore, the page table entry 221 that is mapping information between the virtual address 200 and the physical address 300 is cached in the TLB 103.

  Now that the CPU clock has reached several gigahertz, memory access has also become as fast as 1 nanosecond or less, but the performance penalty for cache misses is very large. The same applies to TLB 103 cache misses. Since the TLB 103 and the CPU cache correspond to the relationship between the address of the memory 105 and its contents, both are implemented in hardware.

  A configuration example of the page table entry 221 will be described with reference to FIG.

  The page table entry 221 has the same configuration as that of the prior art except that one bit among the bits 9 to 11 that are conventionally “Ignored” is the Inhibit flag 222. The Inhibit flag 222 is a flag indicating whether or not the conversion from the virtual address 200 to the physical address 300 is prohibited. In this example, the bit 11 is the Inhibit flag 222, but other bits may be the Inhibit flag 222.

  If the Inhibit flag 222 is on, the MMU 102 notifies the processor 101 of an exception when mapping the virtual address 200 to the physical address 300. The operating system turns on the Inhibit flag 222 when a new memory area is secured.

*** Explanation of operation ***
The operation of the execution control apparatus 100 will be described with reference to FIG. The operation of the execution control apparatus 100 corresponds to the execution control method according to the present embodiment. The operation of the execution control apparatus 100 corresponds to the processing procedure of the execution control program according to the present embodiment.

  As described above, the TLB 103, that is, the storage unit 140 stores the page table entry 221 for each page that is a memory area of the virtual memory. The page table entry 221 for each page includes an Inhibit flag 222 indicating whether or not conversion to an address of a physical memory corresponding to each page is prohibited. That is, each page table entry 221 includes an Inhibit flag 222 indicating whether or not the conversion from the virtual address 200 to the physical address 300 is prohibited.

  When one page is assigned to one process, the MMU 102, that is, the management unit 150 writes the page table entry 221 of the one page in the storage unit 140. The page table entry 221 of the one page includes an Inhibit flag 222 indicating that the conversion to the address of the physical memory corresponding to the one page is prohibited. That is, when a new page table entry 221 is written in the storage unit 140, the management unit 150 turns on the Inhibit flag 222 included in the page table entry 221.

  The management unit 150 is requested to access the virtual memory, and the Inhibit flag 222 of the page table entry 221 of the request destination page for which the access is requested is prohibited from being converted into the address of the physical memory corresponding to the request destination page. If so, exception processing as shown in FIG. 6 is started. That is, when the conversion from the virtual address 200 to the physical address 300 is requested, the management unit 150 refers to the Inhibit flag 222 of the page table entry 221 specified from the virtual address 200. Then, if the Inhibit flag 222 is on, the management unit 150 starts exception processing. On the other hand, if the Inhibit flag 222 is off, the management unit 150 converts the virtual address 200 to the physical address 300 and updates the page table entry 221 of the requested page. Specifically, the management unit 150 updates a flag indicating whether or not the request destination page is accessed, which is included in the page table entry 221 of the request destination page.

  In steps S21 to S23, the authentication unit 160 authenticates the process to which the request destination page is assigned. Specifically, in step S21, the authentication unit 160 acquires a hash key and authentication data held by a process in which an exception has occurred. In step S22, the authentication unit 160 calculates a hash value of the authentication data acquired in step S21. In step S23, the authentication unit 160 compares the hash value calculated in step S22 with the hash key acquired in step S21. If the hash value and the hash key match, the authentication unit 160 has succeeded in authentication, and the flow proceeds to step S24. On the other hand, if the hash value and the hash key do not match, authentication by the authentication unit 160 has failed, and the flow proceeds to step S25.

  In step S24, the control unit 130 updates the Inhibit flag 222 of the page table entry 221 of the request destination page. Specifically, the control unit 130 updates the Inhibit flag 222 of the page table entry 221 of the request destination page to an Inhibit flag 222 indicating that conversion to an address of the physical memory corresponding to the request destination page is permitted. That is, the control unit 130 turns off the Inhibit flag 222 of the page table entry 221 of the requested page. Thereafter, the exception processing ends, and the management unit 150 converts the virtual address 200 to the physical address 300, and updates the page table entry 221 of the requested page. Specifically, the management unit 150 updates a flag indicating whether or not the request destination page is accessed, which is included in the page table entry 221 of the request destination page.

  In step S25, the control unit 130 determines that the process in which the exception has occurred has performed unauthorized access, and forcibly terminates the process. That is, the control unit 130 deletes the process for which the authentication by the authentication unit 160 has failed.

*** Explanation of the effect of the embodiment ***
In the present embodiment, the authentication unit 160 authenticates the process to which the memory area of the virtual memory is allocated. The management unit 150 stops the conversion from the address of the memory area assigned to the process for which the authentication by the authentication unit 160 has failed to the address of the physical memory. Therefore, according to the present embodiment, it is possible to provide a system that securely accesses data in a memory area to be protected.

  In the present embodiment, the default setting of the Inhibit flag 222 of the page table entry 221 written to the storage unit 140 by the management unit 150 is on. The control unit 130 updates only the Inhibit flag 222 of the page table entry 221 of the page assigned to the process successfully authenticated by the authentication unit 160 among the page table entries 221 written by the management unit 150. For this reason, when the exception processing ends abnormally, the Inhibit flag 222 remains on, and the data of the requested page is reliably protected.

  In this embodiment, when the memory area is traced or shared, a plurality of TLB entries are registered in the same data. In either case, if any process performs a memory space release, it performs a shoot down of the appropriate TLB entry and maintains its consistency.

  This embodiment can also be applied to an SMP (Symmetric MultiProcessor) type system. In the optimization design of the system, a coarse-grained implementation in which TLB shoot down of all the processors 101 is performed when a certain processor 101 changes the page table 220 may be adopted. Alternatively, an implementation in which TLB shoot down of each processor 101 is performed in units of TLB entries may be employed. These implementations are selected based on the total performance target of the system, and do not exclude application of the present embodiment.

  As mentioned above, although embodiment of this invention was described, you may implement combining some of these embodiment. Alternatively, any one or some of these embodiments may be partially implemented. Specifically, any one of those described as “parts” in the description of these embodiments may be employed, or some arbitrary combinations may be employed. In addition, this invention is not limited to these embodiment, A various change is possible as needed.

  100 execution control device, 101 processor, 102 MMU, 103 TLB, 104 memory controller, 105 memory, 106 auxiliary storage device, 107 communication device, 110 providing unit, 120 determination unit, 130 control unit, 140 storage unit, 150 management unit, 160 authentication unit, 200 virtual address, 201 index, 202 index, 203 offset, 210 page directory table, 211 page directory entry, 220 page table, 221 page table entry, 222 Inhibit flag, 230 control register, 300 physical address.

Claims (10)

Of the system calls issued to the operating system from the process started by the user, the issuer user who started the process that issued the memory operation system call, which is a system call issued for the operation of the memory area, A determination unit for determining whether or not the same allocation destination user that started the allocation destination process of the memory area operated by the issued memory operation system call;
An execution control apparatus comprising: a control unit that cancels execution of the memory operation system call that is determined by the determination unit to be different from the issuer user.   The control unit causes the processor to execute a memory operation system call that is determined by the determination unit to be the same as the issuer user, and the issuer user has administrator authority of the operating system. The execution control device according to claim 1, wherein even if the user is a super user, the processor does not cause the processor to execute a memory operation system call that is determined by the determination unit to be different from the assignment destination user.   The execution control device according to claim 1, wherein the control unit deletes a process of a memory operation system call issuer that is determined by the determination unit to be different from the assignment destination user. A provision unit that provides a service that allows a user to use a virtual machine that operates as a process;
The determination unit determines whether or not the issuer user is the same as the assignment destination user when detecting the issuance of a memory operation system call to a memory area assigned to the virtual machine. The execution control device according to any one of the above. An authentication unit for authenticating a process to which a memory area of virtual memory is allocated;
5. The execution control device according to claim 1, further comprising: a management unit that stops conversion from an address of a memory area allocated to a process in which authentication by the authentication unit has failed to an address of a physical memory. . A storage unit that stores a page table entry including a flag indicating whether or not conversion to a corresponding physical memory address is prohibited for each page that is a memory area of the virtual memory;
A flag indicating that, when one page is allocated to one process, the management unit prohibits conversion to an address of the physical memory corresponding to the one page as a page table entry of the one page. A page table entry including
The execution control device according to claim 5, wherein the control unit updates a flag of a page table entry of a page assigned to a process successfully authenticated by the authentication unit among the page table entries written by the management unit. . The management unit is requested to access the virtual memory, and conversion to an address of the physical memory corresponding to the requested page is prohibited by a flag of a page table entry of the requested page requested to be accessed. If it is, start exception handling,
The authentication unit authenticates a process to which the request destination page is allocated as the exception processing,
The control unit permits the conversion of the flag of the page table entry of the request destination page to the address of the physical memory corresponding to the request destination page when the authentication unit succeeds as the exception processing The execution control device according to claim 6, wherein the execution control device is updated to a flag indicating that the operation is to be performed.   The execution control apparatus according to claim 6 or 7, wherein the control unit deletes a process for which authentication by the authentication unit has failed. Issuance by which the computer started the process that issued the memory operation system call, which is a system call issued for the operation of the memory area, among the system calls issued to the operating system from the process started by the user Determine whether the original user is the same as the allocated user who started the allocated process of the memory area operated by the issued memory operation system call,
An execution control method for canceling execution of a memory operation system call in which the computer determines that the issuing user is different from the assigned user. On the computer,
Of the system calls issued to the operating system from the process started by the user, the issuer user who started the process that issued the memory operation system call, which is a system call issued for the operation of the memory area, A process for determining whether the allocation destination user who started the allocation process of the memory area operated by the issued memory operation system call is the same as the allocation destination user,
An execution control program for executing a process of canceling execution of a memory operation system call that is determined that the issuing user is different from the assigned user.

Images