TWI830522B - Method for enhancing memory protection and computing system - Google Patents

Abstract

A computing system, comprising: a processor, arranged to execute: a guest virtual machine (VM), an operating system (OS) runs on the guest VM, an application (APP) runs on the OS, and a kernel of the OS comprises: a protection service module, arranged to receive at least one virtual address and a first size information; and a memory management unit (MMU) manager; and the computing system further comprises a hypervisor, arranged to receive the at least one virtual address and the first size information sent by the protection service module; and the computing system further comprises a primary VM, comprising: a protection manager, arranged to: obtain a physical address array and a second size information corresponding to the physical address array according to the at least one virtual address and the first size information and protect a memory allocated by the kernel of the OS.

Description

Method and computing system capable of enhancing memory protection

The present invention relates to the technical field of memory protection, and further relates to a method and a computing system that can enhance memory protection related to the operating system kernel.

For the traditional Android high-end operating system (Operating System, OS) that uses a single operating system (such as Linux) as the kernel (kernel), resources (such as memory allocated by the Linux kernel, where Linux can be targeted at applications (APPs), Drivers and services in use control the protection of this memory (memory) by the Linux kernel or a Trusted Execution Environment (Trusted Execution Environment, TEE). When the Linux kernel implements resource protection, due to the vulnerability of the Linux kernel, it can easily become a springboard for attackers, causing resource protection to fail. In addition, when resource protection is implemented by TEE, although TEE may have higher security, TEE may have limited resources and high overhead, which is not conducive to functional development. Therefore, there is an urgent need for a new system to protect memory allocated by the operating system kernel that does not reduce kernel performance and does not increase cost.

The present invention provides a method and a computing system that can enhance memory protection related to the operating system kernel and ensure the security of the system.

In one embodiment, a computing system provided by the present invention may include: a processor configured to execute a guest virtual machine (VM), wherein an operating system (OS) runs on the guest VM, and an application program (APP) Run on the OS, wherein the kernel of the OS includes: a protection service module configured to receive at least one virtual address and first size information sent by the client of the APP; and a memory management unit (MMU) manager, configured to configured to manage the MMU; the computing system also includes a virtual machine manager configured to receive the at least one virtual address and the first size information sent by the protection service module; the computing system also includes a main VM, the main VM includes : a protection manager configured to receive the at least one virtual address and the first size information sent by the virtual machine manager, and obtain the physical address array and the physical address corresponding to the at least one virtual address and the first size information. Second size information of the array, and protecting the memory allocated by the kernel of the OS based on the physical address array and the second size information.

In one embodiment, the present invention provides a method for enhancing memory protection, which is implemented in a computing system including a processor. The method includes: running an operating system (OS) on a guest virtual machine (VM); An application program (APP) is run on the OS; the virtual machine manager receives at least one virtual address and first size information sent by the client of the APP; the main VM receives the at least one virtual address and the first size information sent by the virtual machine manager The first size information; the host VM obtains the physical address array and the second size information corresponding to the physical address array according to the at least one virtual address and the first size information, and obtains the physical address array and the second size information according to the physical address array and the second size information. Information protects memory allocated by the OS's kernel.

10: Electronic equipment

12: Processor

14:Storage device

16:Hardware circuit

20,30,40:System

200, 300, 400: Guest virtual machine

202,302,402:Application

204,304,404:Client

206,306,406: Protection service module

208,308,408:MMU manager

209,322,409: Logical to physical address mapping table

210,310,410: memory

220,320,420:Virtual machine manager

240,340,440: Primary virtual machine

242,342,442: Protection Manager

244,344:MMU integrity protection module

309: Virtual logical to physical address mapping table

321: Virtual logical to physical address mapping table manager

444:MMU Integrity Monitor

Figure 1 shows a diagram of an electronic device 10 according to one embodiment of the present invention.

Figure 2 illustrates a system 20 capable of enhancing memory protection associated with the kernel of an operating system in accordance with an embodiment of the present invention.

Figure 3 illustrates a system 30 capable of enhancing memory protection associated with an operating system kernel according to another embodiment of the present invention.

Figure 4 illustrates a system 40 capable of enhancing memory protection associated with an operating system kernel according to another embodiment of the present invention.

The following description is provided to illustrate the general principles of the invention and should not be construed as limiting. The scope of the invention can best be determined by reference to the appended claims.

Figure 1 shows a diagram of an electronic device 10 according to one embodiment of the present invention. By way of example and not limitation, the electronic device 10 may be a portable device, such as a smartphone or a tablet. Electronic device 10 may include a processor 12, a storage device 14, and hardware circuitry 16. Processor 12 may be a single-core processor or a multi-core processor. Storage device 14 is a computer-readable medium for storing computer program code PROG. The processor 12 is equipped with software execution capabilities. The computer program code PROG may include a plurality of software modules. Thus, when loaded and executed by processor 12, computer program code PROG instructs processor 12 to perform the specified functions of the software module. The electronic device 10 may be considered a computer system using a computer program product including a computer-readable medium containing computer program code. The hardware circuit 16 is pure hardware, which may only consist of logic gates, and can perform specified functions without software execution. The system proposed by the present invention for enhancing memory protection associated with the kernel of an operating system (OS) may be located on the electronic device 10 . For example, the system may include software-based functions implemented by computer program code PROG running on processor 12 and hardware-based functions implemented by hardware circuitry 16 body functions.

Figure 2 illustrates a system 20 capable of enhancing memory protection associated with the kernel of an operating system in accordance with an embodiment of the present invention. System 20 may include a processor (eg, processor 12 shown in Figure 1). The processor may be configured to execute software modules, including a guest virtual machine (VM) 200 , a virtual machine manager (hypervisor) 220 , and a host VM 240 . Android can run on the guest VM 200 (ie, the operating system of the guest VM 200 is Android), the application (APP) 202 can run on Android, and the kernel of Android can be Linux (for brevity, the following is labeled "Linux" kernel"). To enhance protection of memory 210 allocated by the Linux kernel (eg, the Linux kernel may control memory for APPs, drivers, and services in use), the client 204 of the APP 202 may send at least one virtual address to the Linux kernel. , VA) and the first size information SIZE_1 corresponding to the at least one virtual address VA, where the at least one virtual address VA may represent the virtual address of the memory 210 , and the first size information SIZE_1 may represent the size of the memory 210 .

The Linux kernel may include a protection service module 206 and a Memory Management Unit (MMU) manager 208 . The protection service module 206 may be configured to receive at least one virtual address VA and first size information SIZE_1 sent by the client 204 of the APP 202 for protecting the memory 210 . MMU manager 208 may be configured to manage MMUs (not shown in Figure 1). In this embodiment, the MMU manager 208 may include at least one logical-to-Physical (L2P) address mapping table 209 (labeled "L2P table" in FIG. 2 ), and the MMU manager 208 may be Configured to convert at least one virtual address VA into at least one physical address according to at least one L2P address mapping table 209 to generate a physical address array PA_ARRAY and second size information SIZE_2 corresponding to the physical address array PA_ARRAY, where the second size information SIZE_2 may represent The size of the physical address array PA_ARRAY. Virtual machine manager 220 may be configured to receive the at least one virtual address VA and first size information SIZE_1.

The main VM 240 may include a protection manager 242, where the protection manager 242 may be configured to: receive at least one virtual address VA and first size information SIZE_1 sent by the virtual machine manager 220; The information SIZE_1 obtains the physical address array PA_ARRAY and the second size information SIZE_2 from the MMU manager 208; the memory 210 is protected according to the physical address array PA_ARRAY and the second size information SIZE_2. Additionally, the master VM 240 may further include an MMU integrity protection module 244. MMU integrity protection module 244 may be configured to protect at least one L2P address mapping table 209 (labeled "Protect" in Figure 2).

Consider the case where the main VM 240 only includes the protection manager 242 and receives the physical address array PA_ARRAY and the second size information SIZE_2 from the virtual machine manager 220 (eg, referred to as "case 1"), that is, the protection service module 206 At least one virtual address VA and the first size information SIZE_1 obtain the physical address array PA_ARRAY and the second size information SIZE_2 from the MMU manager 208, and send the physical address array PA_ARRAY and the second size information SIZE_2 to the protection management through the virtual machine manager 220 Device 242. In this case (ie, case 1), the credibility of the physical address array PA_ARRAY obtained from the MMU manager 208 cannot be determined in terms of security, and the physical address array PA_ARRAY obtained through the virtual machine manager 220 During the process of being transmitted to the protection manager 242, the obtained physical address array PA_ARRAY may be tampered with or attacked (for example, an attacker may use a fake protection service module to attack the system 20). In terms of performance, transferring the physical address array PA_ARRAY to the protection manager 242 through the virtual machine manager 220 may degrade the performance of the system 20 . For example, to protect a memory of 32 megabytes (MB), a physical address array of 34 kilobytes (KB) needs to be transferred.

Compared with this situation (ie, situation 1), in the system 20 of FIG. 2, at least one virtual address VA and the first size information SIZE_1 are transferred from the Linux kernel to the protection manager 242 through the virtual machine manager 220, it is possible to The system 20 is prevented from being tampered with or attacked during the process of transmitting at least one virtual address VA and the first size information SIZE_1 to the protection manager 242 through the virtual machine manager 220 . The MMU integrity protection module 244 may be configured to ensure the credibility of at least one virtual address VA and the first size information SIZE_1 by protecting at least one L2P address mapping table 209 . Ultimately, the system 20 shown in Figure 2 is much more secure than this scenario (ie, Scenario 1). In addition, the protection manager 242 may directly obtain the physical address array PA_ARRAY and the second size information SIZE_2 from the MMU manager 208 according to the at least one virtual address VA and the first size information SIZE_1 sent by the virtual machine manager 220 , thereby improving the system 20 performance.

However, protecting at least one L2P address mapping table 209 may reduce the performance of the Linux kernel. Additionally, a write mechanism for at least one L2P address mapping table 209 may be provided to the MMU manager 208 by the MMU integrity protection module 244, where the high overhead of the write mechanism may affect the performance of the MMU. In order to solve the aforementioned problem, at least one virtual L2P address mapping table can be provided to the MMU manager. Please refer to FIG. 3 , which illustrates a system 30 capable of enhancing memory protection related to the operating system kernel according to another embodiment of the present invention. System 30 may include a processor (eg, processor 12 shown in Figure 1). The processor may be configured to execute software modules, including a guest VM 300, a virtual machine manager 320, and a main VM 340, where Android may run on the guest VM 300 (ie, the operating system of the guest VM 300 is Android), and the APP 302 may Runs on Android, and Android's kernel is probably Linux. To protect memory 310 allocated by the Linux kernel (e.g., the Linux kernel may control memory for APPs, drivers, and services in use), the client 304 of the APP 302 may send to the Linux kernel at least one virtual address VA and a link to the at least one virtual address VA. First size information SIZE_1 corresponding to one virtual address VA, where at least one virtual address VA can represent the virtual address of the memory 310, and the first size information SIZE_1 It can represent the size of memory 310.

The Linux kernel may include a protection services module 306 and an MMU manager 308. The protection service module 306 may be configured to receive at least one virtual address VA and first size information SIZE_1 sent by the client 304 of the APP 302 for protecting the memory 310 . MMU manager 308 may be configured to manage MMUs (not shown in Figure 3). The virtual machine manager 320 may be configured to receive at least one virtual address VA and first size information SIZE_1 sent by the protection service module 206 . In addition, the virtual machine manager 320 may include a virtual L2P address mapping table manager 321, wherein the virtual L2P address mapping table manager 321 may be configured to: receive at least one L2P address mapping table 322 (labeled "L2P table" in FIG. 3 "), convert at least one virtual address VA into at least one physical address according to at least one L2P address mapping table 322 to generate the physical address array PA_ARRAY and the second size information SIZE_2 corresponding to the physical address array PA_ARRAY, and provide at least one virtual L2P address The mapping table 309 (labeled "vL2P table" in Figure 3) is provided to the MMU manager 308, in which the second size information SIZE_2 may represent the size of the physical address array PA_ARRAY.

The main VM 340 may include a protection manager 342, where the protection manager 342 may be configured to: receive at least one virtual address VA and first size information SIZE_1 sent by the virtual machine manager 320; Information SIZE_1, obtains the physical address array PA_ARRAY and the second size information SIZE_2 from the virtual L2P address mapping table manager 321; and protects the memory 310 according to the physical address array PA_ARRAY and the second size information SIZE_2. In addition, the host VM 340 may also include an MMU integrity protection module 344. In this embodiment, the MMU integrity protection module 344 may be configured to protect the virtual L2P address mapping table manager 321 (labeled "protect" in Figure 3).

Compared to the system 20 shown in Figure 2, the system 30 shown in Figure 3 does not require MMU integrity The protection module 344 provides the MMU manager 308 with a writing mechanism of at least one L2P mapping table, thereby preventing the high overhead of the writing mechanism from affecting the performance of the MMU. In addition, the MMU integrity protection module 344 protects not the at least one L2P address mapping table, but the virtual L2P address mapping table manager 321. In this way, the Linux kernel performance degradation caused by protecting at least one L2P address mapping table can be improved.

Figure 4 illustrates a system 40 capable of enhancing memory protection associated with an operating system kernel according to another embodiment of the present invention. System 40 may include a processor (eg, processor 12 shown in Figure 1). The processor may be configured to execute software modules, including a guest VM 400, a virtual machine manager 420, and a main VM 440, where Android may run on the guest VM 400 (ie, the operating system of the guest VM 400 is Android), and the APP 402 may Runs on Android, and Android's kernel may be Linux. To protect memory 410 allocated by the Linux kernel (e.g., the Linux kernel may control memory for APPs, drivers, and services in use), the client 404 of the APP 402 may send at least one virtual address VA to the Linux kernel and communicate with at least one The first size information SIZE_1 corresponding to the virtual address VA, where at least one virtual address VA can represent the virtual address of the memory 410, and the first size information SIZE_1 can represent the size of the memory 410.

The Linux kernel may include a protection services module 406 and an MMU manager 408. The protection service module 406 may be configured to receive at least one virtual address VA and first size information SIZE_1 sent by the client 404 of the APP 402 for protecting the memory 410 . MMU manager 408 may be configured to manage MMUs (not shown in Figure 4). In this embodiment, the MMU manager 408 may include at least one L2P address mapping table 409 (labeled "L2P table" in FIG. 4 ), and may convert at least one virtual address VA to At least one physical address is used to generate the physical address array PA_ARRAY and second size information SIZE_2 corresponding to the physical address array PA_ARRAY, where the second size information SIZE_2 may represent the size of the physical address array PA_ARRAY. Virtual Machine Manager 420 It may be configured to receive at least one virtual address VA and first size information SIZE_1 sent by the protection service module 406 .

The main VM 440 may include a protection manager 442, where the protection manager 442 may be configured to: receive at least one virtual address VA and first size information SIZE_1 sent by the virtual machine manager 420; and according to the at least one virtual address VA and the first size The information SIZE_1 obtains the physical address array PA_ARRAY and the second size information SIZE_2 from the MMU manager 408; the memory 410 is protected according to the physical address array PA_ARRAY and the second size information SIZE_2. The difference between the system 20 shown in FIG. 2 and the system 40 shown in FIG. 4 is that instead of the MMU integrity protection module, the main VM 440 may also include an MMU integrity monitor 444. MMU manager 408 may register with virtual machine manager 420 (labeled "Register" in Figure 4). The virtual machine manager 420 may also be configured to send a monitoring signal MS to the master VM 440 (more specifically, the MMU integrity monitor 444) for monitoring the MMU manager 408.

In this embodiment, MMU 408 is legal for system 40 and MMU integrity monitor 444 may be configured to monitor based on monitoring signals MS sent by virtual machine manager 420 (labeled "Monitor" in Figure 4 ) access (eg, read or write) to the at least one L2P address mapping table 409 to determine whether the access to the at least one L2P address mapping table 409 is illegal for the system 40 . In response to the access to the at least one L2P address mapping table 409 being illegal for the system 40 , the MMU integrity monitor 444 may be further configured to prevent the protection manager 442 from protecting the Linux kernel allocated memory 410 . The system 40 shown in Figure 4 has better Linux kernel performance than the system 20 shown in Figure 2 . However, a system 40 monitored using an MMU manager 408 is no more secure than a system 20 protected using an MMU manager 208, and one must ensure that the MMU manager 408 is legitimate for the system 40.

In some embodiments, there is no need to ensure that MMU manager 408 is legal to system 40 of. Regardless of whether the MMU manager 408 is legal for the system 40 , the MMU integrity monitor 444 may be configured to monitor the resources of the MMU manager 408 to determine whether the resources of the MMU manager 408 are illegal for the system 40 . In response to the resource of MMU manager 408 being illegal for system 40 , MMU integrity monitor 444 may be further configured to prevent protection manager 442 from protecting memory 410 .

In summary, since the protection manager 242/442 directly obtains the physical address array PA_ARRAY and the second size information SIZE_1 from the MMU manager 208/408 based on at least one virtual address VA and the first size information SIZE_1 sent by the virtual machine manager 220/420 Size information SIZE_2 can improve system performance by 20/40. Furthermore, the system 20/40 can be prevented from being tampered with or attacked during the transmission of at least one virtual address VA and the first size information SIZE_1 through the virtual machine manager 220/420 to the protection manager 242/442, and can be protected or monitored by At least one L2P address mapping ensures the credibility of at least one virtual address VA and the first size information SIZE_1. As a result, 20/40 security of the system can be guaranteed.

The above are only preferred embodiments of the present invention, and all equivalent changes and modifications made in accordance with the patentable scope of the present invention shall fall within the scope of the present invention.

20:System

200:Guest virtual machine

202:Application

204:Client

206: Protection service module

208:MMU Manager

209: Logical to physical address mapping table

210:Memory

220:Virtual machine manager

240: Primary virtual machine

242: Protection Manager

244:MMU integrity protection module

Claims (11)

A computing system includes: a processor configured to execute a guest virtual machine, wherein an operating system runs on the guest virtual machine, and an application program runs on the operating system, wherein the kernel of the operating system includes: a protection service module , configured to receive at least one virtual address and first size information sent by the client of the application; and a memory management unit manager configured to manage the memory management unit; the computing system also includes a virtual machine manager, Configured to receive the at least one virtual address and the first size information sent by the protection service module; the computing system also includes a main virtual machine, the main virtual machine includes: a protection manager configured to receive the virtual machine management The at least one virtual address and the first size information sent by the processor, the physical address array and the second size information corresponding to the physical address array are obtained according to the at least one virtual address and the first size information, and according to the physical address array and the second size information protects the memory allocated by the kernel of the operating system; wherein the memory management unit manager includes at least one logical-to-physical address mapping table, and the memory management unit manager is configured to operate according to the at least A logical to physical address mapping table converts the at least one virtual address into the at least one physical address to generate the physical address array and the second size information; wherein the main virtual machine further includes: a memory management unit integrity protection module , configured to protect the at least one logical-to-physical address mapping table. The computing system of claim 1, wherein the protection manager is configured to retrieve data from the memory The volume management unit manager obtains the physical address array and the second size information. The computing system of claim 1, wherein the virtual machine manager includes a virtual logical to physical address mapping table manager, wherein the virtual logical to physical address mapping table manager is configured to: receive at least one logical to physical address mapping table, convert the at least one virtual address to the at least one physical address according to the at least one logical to physical address mapping table to generate the physical address array and the second size information, and provide at least one virtual logical to physical address mapping table to the memory snap-in manager. The computing system of claim 3, wherein the protection manager is configured to obtain the physical address array and the second size information from the virtual logical to physical address mapping table according to the at least one virtual address and the first size information. . The computing system of claim 3, wherein the main virtual machine further includes: a memory management unit integrity protection module configured to protect the virtual logical to physical address mapping table manager. The computing system of claim 1, wherein the protection manager is configured to obtain the physical address and the second size information according to the at least one virtual address and the first size information, and the memory management unit manager is registered to the virtual machine manager, and the virtual machine manager is further configured to send a monitoring signal to the primary virtual machine. The computing system of claim 6, wherein the memory management unit manager is valid for the system, the memory management unit manager includes at least one logical to physical address mapping table, the memory management unit manager is configured to convert the at least one virtual address to at least one physical address according to the at least one logical to physical address mapping table to generate the physical address array and the second size information, and the The main virtual machine further includes: a memory management unit integrity monitor configured to monitor access to the at least one logical to physical address mapping table according to the monitoring signal sent by the virtual machine manager to determine whether the at least one logical to physical address mapping table Whether the access to the physical address mapping table is illegal for the system. The computing system of claim 7, wherein in response to the access to the at least one logical-to-physical address mapping table being illegal for the system, the memory management unit integrity monitor is further configured to prevent the protection management The device protects the memory allocated by the operating system's kernel. The computing system of claim 6, wherein the main virtual machine further includes: a memory management unit integrity monitor configured to monitor resources of the memory management unit manager to determine whether the memory management unit manager The resource is illegal for the system. The computing system of claim 9, wherein in response to the memory management unit manager's resource being illegal for the system, the memory management unit integrity monitor is further configured to prevent the protection manager from protecting the operation. This memory is allocated by the system's kernel. A method capable of enhancing memory protection, implemented in a computing system including a processor, the method includes: running an operating system on a guest virtual machine; running an application program on the operating system; and receiving the application by a virtual machine manager The client of the program sends at least one virtual address and the a size information; the main virtual machine receives the at least one virtual address and the first size information sent by the virtual machine manager; and the main virtual machine obtains a physical address array according to the at least one virtual address and the first size information and second size information corresponding to the physical address array, and protecting the memory allocated by the kernel of the operating system according to the physical address array and the second size information; wherein the method also includes: The memory management unit manager converts the at least one virtual address into the at least one physical address according to at least one logical to physical address mapping table to generate the physical address array and the second size information, wherein the at least one logical to physical address mapping table The address mapping table is protected by the master virtual machine.