WO2014044152A1 - Method and apparatus for encryption - Google Patents

Method and apparatus for encryption Download PDF

Info

Publication number
WO2014044152A1
WO2014044152A1 PCT/CN2013/083469 CN2013083469W WO2014044152A1 WO 2014044152 A1 WO2014044152 A1 WO 2014044152A1 CN 2013083469 W CN2013083469 W CN 2013083469W WO 2014044152 A1 WO2014044152 A1 WO 2014044152A1
Authority
WO
WIPO (PCT)
Prior art keywords
encryption
operating system
computation
virtual
encryption computation
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2013/083469
Other languages
French (fr)
Inventor
Liang Cao
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Priority to BR112015001950A priority Critical patent/BR112015001950A2/en
Priority to US14/082,715 priority patent/US9122894B2/en
Publication of WO2014044152A1 publication Critical patent/WO2014044152A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode

Definitions

  • the present invention relates to the field of computers, and more particularly to method and apparatus for encryption and a non-transitory computer-readable medium that stores instructions to perform encryption.
  • each type of software has some key data that needs to be protected, such as the sequence number, user name and password of the software.
  • the data protection is generally implemented through complex data conversion or through dongle of various types of hardware.
  • a cracker may track and recover the algorithmic logic through a software debugging technology, or directly intercept the original assembly code in the software to directly recover the data encryption process.
  • the cost is high and the usability is low; the computing capability of the dongle is limited, and the processing speed is low when large- volume and high-intensity encryption is implemented; the dongle product is relatively independent, and once the dongle of a certain brand is cracked (that is, the dongle is disabled), all types of software that employ the dongle of this brand are at risk; and the encryption algorithm of the dongle cannot be flexibly controlled, and cannot be flexibly changed after being selected.
  • One of objectives of the present invention is to provide an encryption method and an encryption apparatus, and a non-transitory computer-readable medium that stores instructions to perform encryption, which cannot be cracked, and overcome the defects of high hardware encryption cost and low computing speed.
  • the encryption method includes loading a virtual system driver module in a host operating system and constructing a virtual operating system, where the virtual operating system includes a micro-kernel; preparing and providing context of a processor and a memory page table by the virtual system driver for the micro-kernel, and mapping, in the memory page table, original data and a physical address of a buffer area that receives data after encryption computation is completed; and completing the encryption computation in the virtual operating system and saving the computation result in the buffer area.
  • the encryption apparatus includes a virtual operating system and a driver module.
  • the virtual operating system includes a micro-kernel, configured to run an assembly instruction sequence.
  • the driver module is configured to prepare and provide context of a processor and a memory page table for the micro-kernel, and mapping, in the memory page table, original data and a physical address of a buffer area that receives data after encryption computation is completed.
  • the virtual operating system further includes: an encryption process manager, configured to control the micro-kernel to complete the encryption computation according to the original data and saving the encryption computation result in the buffer area.
  • non-transitory computer-readable medium storing instructions which, when executed by one or more processors, cause the foregoing disclosed apparatus to perform the foregoing disclosed method for performing encryption.
  • the encryption computation is completed in the virtual operating system, and since the context of the CPU in the virtual operating system is completely different from that of a real CPU, a conventional hardware tracking and debugging technology, such as a trap flag (TF) in a DR0-DR7 register or a flag register, is completely invalid in the virtual operating system, thereby ensuring that the encryption computation process in the virtual operating system cannot be interrupted, so as to prevent a cracker from cracking an encryption algorithm by using the hardware tracking and debugging technology. Besides, there is no need to adopt a dedicated hardware encryption apparatus, thereby reducing the cost.
  • TF trap flag
  • FIG. 1 is a flow chart of an encryption method according to one embodiment of the invention.
  • FIG. 2 is a schematic diagram of page table mapping in the encryption method according to the embodiment of the invention shown in FIG. 1.
  • FIG. 3 is a structural block diagram of an encryption apparatus according to one embodiment of the invention.
  • DETAILED DESCRIPTION OF THE INVENTION The following description is merely illustrative in nature and is in no way intended to limit the disclosure, its application, or uses. The broad teachings of the disclosure can be implemented in a variety of forms. Therefore, while this disclosure includes particular examples, the true scope of the disclosure should not be so limited since other
  • the phrase "at least one of A, B, and C" should be construed to mean a logical (A or B or C), using a non-exclusive logical OR. It should be understood that one or more steps within a method may be executed in different order (or concurrently) without altering the principles of the present disclosure.
  • module may refer to, be part of, or include an Application Specific Integrated Circuit (ASIC); an electronic circuit; a combinational logic circuit; a field programmable gate array (FPGA); a processor (shared, dedicated, or group) that executes code; other suitable hardware components that provide the described functionality; or a combination of some or all of the above, such as in a system-on-chip.
  • ASIC Application Specific Integrated Circuit
  • FPGA field programmable gate array
  • processor shared, dedicated, or group
  • the term module may include memory (shared, dedicated, or group) that stores code executed by the processor.
  • code may include software, firmware, and/or microcode, and may refer to programs, routines, functions, classes, and/or objects.
  • shared means that some or all code from multiple modules may be executed using a single (shared) processor. In addition, some or all code from multiple modules may be stored by a single (shared) memory.
  • group means that some or all code from a single module may be executed using a group of processors. In addition, some or all code from a single module may be stored using a group of memories.
  • the systems and methods described herein may be implemented by one or more computer programs executed by one or more processors.
  • the computer programs include processor-executable instructions that are stored on a non-transitory tangible computer readable medium.
  • the computer programs may also include stored data.
  • Non- limiting examples of the non-transitory tangible computer readable medium are nonvolatile memory, magnetic storage, and optical storage.
  • this invention in one aspect, relates to method and apparatus for performing encryption, and a non-transitory
  • FIG. 1 a flow chart of an encryption method is shown according to one embodiment of the invention. The method includes, among other things, the following steps.
  • step SI 10 Loading a virtual system driver in a host operating system and constructing a virtual operating system, where the virtual operating system includes a micro-kernel.
  • the host operating system refers to any operating system that can be installed and run in a computer or a similar computing apparatus such as a smartphone or a tablet computer, or the like.
  • the virtual system driver is running in the host operating system and is invoked by protected software.
  • the protected software sends an encryption computation request to the virtual system driver and provides original data thereto.
  • the virtual system driver may construct a virtual operating system after receiving the encryption computation request, and provide the original data to the virtual operating system.
  • the micro-kernel serves as an independent processor (CPU) for a program running in the virtual operating system, and is configured to run an assembly instruction set, so as to complete encryption computation.
  • the instruction set that can be run by the micro-kernel may be reduced relative to a real CPU, as long as the instruction set satisfies the requirement for the encryption computation.
  • the micro-kernel directly sends the instruction to the real CPU for execution and does not perform operations such as instruction conversion and translation, and saves, in a specific memory area, the execution result of the real CPU as the computation result of the program running in the virtual operating system.
  • the virtual system driver prepares context of a processor and a memory page table for the micro-kernel, and maps, in the memory page table, original data and a physical address of a buffer area that receives data after encryption computation is completed.
  • FIG. 2 shows a schematic diagram of a physical memory space according to one embodiment of the invention.
  • a first area 101 is configured to storing original data requiring for encryption computation; and a second area 102 is a buffer area configured to storing data after the encryption computation is completed.
  • the program running in the operating system directly operates data in a virtual memory space, and mapping between the virtual memory space and the physical memory space is implemented through a page table of the operating system.
  • mapping toward the same physical memory space is required to be implemented in page tables of the host operating system and the virtual operating system respectively.
  • data written into the first area 101 becomes a data source of an encryption program in the virtual operating system.
  • step SI 30 Completing the encryption computation in the virtual operating system and saving the computation result in the buffer area.
  • interrupt may be first terminated, for example, an interrupt flag bit of a flag register is set to 0, to shield the micro-kernel from responding to an external interrupt request.
  • the encryption program may successfully access, through the page table, the original data stored in the first area 101 of the physical memory, and adopt a built-in encryption algorithm to complete the encryption computation. After the computation is completed, the result is saved in the second area 102 of the physical memory. Correspondingly, in the host operating system, the data after the encryption computation is completed may be accessed through the page table.
  • the original data provided by the protected software may be pure data or a combination of codes and data, which is generally configured to decryption.
  • the original data When the provided original data is a combination of codes and data, the original data needs to be decrypted according to a predetermined algorithm to obtain the real original data, for example, a built-in password of compression software, such as 7z, is adopted for decompression; the codes are extracted from the real original data; and the extracted codes are run to complete the encryption computation.
  • a built-in password of compression software such as 7z
  • the virtual system driver may return the data resulted from the encryption computation to the protected software.
  • the encryption computation is completed in the virtual operating system, and since the context of the CPU in the virtual operating system is completely different from that of a real CPU, a conventional hardware tracking and debugging technology, such as a TF in a DR0-DR7 register or a flag register, is completely invalid in the virtual operating system, thereby ensuring that the encryption computation process in the virtual operating system cannot be interrupted, so as to prevent a cracker from cracking an encryption algorithm by using the hardware tracking and debugging technology.
  • a conventional hardware tracking and debugging technology such as a TF in a DR0-DR7 register or a flag register
  • a memory address (logic address) in the host operating system is invalid to the virtual operating system, so a CC breakpoint is generally invalid to the virtual operating system.
  • the CC breakpoint refers to, for example, an INT3 instruction, and with a machine code being CC, the CC breakpoint is also called a CC instruction.
  • a debugger captures the exception and stops at the breakpoint, to recover the instruction at the breakpoint to the original instruction.
  • some other instructions may be used to replace the INT3 instruction to trigger an exception.
  • the cracker is capable of maliciously forging a CC breakpoint, for example, in the foregoing situation that the original data includes codes, a maliciously forged CC breakpoint may exist in the codes.
  • the above problem may be solved by returning to the host operating system when detecting a soft interrupt (the CC breakpoint belongs to the soft interrupt). It can be understood that, although the interrupt is implemented, the encryption computation process is ended without being completed, and in this case, even if data is obtained, the obtained data is invalid intermediate data, and cannot be configured to cracking the encryption algorithm.
  • the encryption apparatus includes a host operating system 210 and a virtual operating system 220.
  • the host operating system 210 includes a virtual system driver module 211 and protected software 212.
  • the virtual operating system 220 includes a micro-kernel 221 and an encryption process manager 222.
  • the host operating system 210 refers to any operating system that can be installed and run in a computer or a similar computing apparatus such as a smartphone or a tablet computer, or the like.
  • the virtual system driver module 211 is running in the host operating system and is invoked by the protected software; in other words, the protected software 212 sends an encryption computation request to the virtual system driver module 211 and provides original data thereto.
  • the virtual system driver module 211 may construct the virtual operating system 220 after receiving the encryption computation request, and provide the original data to the virtual operating system 220.
  • the micro-kernel 221 serves as an independent processor (CPU) for a program running in the virtual operating system 210, and is configured to run an assembly instruction set, so as to complete encryption computation.
  • the instruction set that can be run by the micro-kernel 221 may be reduced relative to a real CPU, as long as the instruction set satisfies the requirement for the encryption computation.
  • the micro-kernel 221 directly sends the instruction to the real CPU for execution and does not perform operations such as instruction conversion and translation, and saves, in a specific memory area, the execution result of the real CPU as the computation result of the encryption computation program running in the virtual operating system 220.
  • the virtual system driver module 211 prepares context of a processor and a memory page table for the micro-kernel 221, and maps, in the memory page table, original data and a physical address of a buffer area that receives data after encryption computation is completed.
  • a first area 101 is configured to storing original data requiring for encryption computation; and a second area 102 is a buffer area configured to storing data after the encryption computation is completed.
  • the program running in the operating system directly operates data in a virtual memory space, and mapping between the virtual memory space and the physical memory space is implemented through a page table of the operating system.
  • mapping toward the same physical memory space is required to be implemented in page tables of the host operating system 210 and the virtual operating system 220 respectively.
  • data written into the first area 101 becomes a data source of an encryption program in the virtual operating system 220.
  • the encryption process manager 222 may first terminate interrupt of the virtual operating system, for example, an interrupt flag bit of a flag register is set to 0, to shield the micro-kernel from responding to an external interrupt request.
  • the encryption program may successfully access, through the page table, the original data stored in the first area 101 of the physical memory, and adopt a built-in encryption algorithm to complete the encryption computation. After the computation is completed, the result is saved in the second area 102 of the physical memory. Correspondingly, in the host operating system 210, the data after the encryption computation is completed may be accessed through the page table.
  • the original data provided by the protected software 212 may be pure data or a combination of codes and data, which is generally configured to decryption.
  • the original data When the provided original data is a combination of codes and data, the original data needs to be decrypted according to a predetermined algorithm to obtain the real original data, for example, a built-in password of compression software, such as 7z, is adopted for decompression; the codes are extracted from the real original data; and the extracted codes are run to complete the encryption computation.
  • a built-in password of compression software such as 7z
  • the virtual system driver module 211 may return the data resulted from the encryption computation to the protected software 212.
  • the encryption computation is completed in the virtual operating system 220, and since the context of the CPU in the virtual operating system is completely different from that of a real CPU, a conventional hardware tracking and debugging technology, such as a TF in a DR0-DR7 register or a flag register, is completely invalid in the virtual operating system, thereby ensuring that the encryption computation process in the virtual operating system 220 cannot be interrupted, so as to prevent a cracker from cracking an encryption algorithm by using the hardware tracking and debugging technology.
  • a conventional hardware tracking and debugging technology such as a TF in a DR0-DR7 register or a flag register
  • a memory address (logic address) in the host operating system 210 is invalid to the virtual operating system 220, so a CC breakpoint is generally invalid to the virtual operating system 220.
  • the CC breakpoint refers to, for example, an INT3 instruction, and with a machine code being CC, the CC breakpoint is also called a CC instruction.
  • a debugger captures the exception and stops at the breakpoint, to recover the instruction at the breakpoint to the original instruction.
  • some other instructions may be used to replace the INT3 instruction to trigger an exception.
  • the cracker is capable of maliciously forging a CC breakpoint, for example, in the foregoing situation that the original data includes codes, a maliciously forged CC breakpoint may exist in the codes.
  • the encryption process manager 222 may return to the host operating system when detecting a soft interrupt (the CC breakpoint belongs to the soft interrupt). It can be understood that, although the interrupt is implemented, the encryption computation process is ended without being completed, and in this case, even if data is obtained, the obtained data is invalid intermediate data, and cannot be configured to cracking the encryption algorithm.
  • yet another aspect of the present invention provides a computer readable storage medium which stores computer executable instructions.
  • the computer executable instructions enable a computer or a similar computing apparatus to complete various operations in the encryption method.
  • the storage medium includes, but not limited to, a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), random memory (RAM), flash dive, or the likes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Storage Device Security (AREA)
  • Memory System Of A Hierarchy Structure (AREA)

Description

METHOD AND APPARATUS FOR ENCRYPTION
CROSS-REFERENCE TO RELATED APPLICATION This application claims the priority to Chinese Patent Application No.
201210347705.1, filed September 19, 2012 in the State Intellectual Property Office of P.R. China, which is hereby incorporated herein in its entirety by reference.
FIELD OF THE INVENTION
The present invention relates to the field of computers, and more particularly to method and apparatus for encryption and a non-transitory computer-readable medium that stores instructions to perform encryption.
BACKGROUND OF THE INVENTION
No matter for the purpose of anti-piracy or user data protection, each type of software has some key data that needs to be protected, such as the sequence number, user name and password of the software. At present, the data protection is generally implemented through complex data conversion or through dongle of various types of hardware.
In the protection manner by using a complex algorithm, a cracker may track and recover the algorithmic logic through a software debugging technology, or directly intercept the original assembly code in the software to directly recover the data encryption process.
In the protection manner by using dongle, the cost is high and the usability is low; the computing capability of the dongle is limited, and the processing speed is low when large- volume and high-intensity encryption is implemented; the dongle product is relatively independent, and once the dongle of a certain brand is cracked (that is, the dongle is disabled), all types of software that employ the dongle of this brand are at risk; and the encryption algorithm of the dongle cannot be flexibly controlled, and cannot be flexibly changed after being selected.
Therefore, a heretofore unaddressed need exists in the art to address the
aforementioned deficiencies and inadequacies.
SUMMARY OF THE INVENTION
One of objectives of the present invention is to provide an encryption method and an encryption apparatus, and a non-transitory computer-readable medium that stores instructions to perform encryption, which cannot be cracked, and overcome the defects of high hardware encryption cost and low computing speed.
In one aspect of the invention, the encryption method includes loading a virtual system driver module in a host operating system and constructing a virtual operating system, where the virtual operating system includes a micro-kernel; preparing and providing context of a processor and a memory page table by the virtual system driver for the micro-kernel, and mapping, in the memory page table, original data and a physical address of a buffer area that receives data after encryption computation is completed; and completing the encryption computation in the virtual operating system and saving the computation result in the buffer area.
In another aspect of the invention, the encryption apparatus includes a virtual operating system and a driver module. The virtual operating system includes a micro-kernel, configured to run an assembly instruction sequence. The driver module is configured to prepare and provide context of a processor and a memory page table for the micro-kernel, and mapping, in the memory page table, original data and a physical address of a buffer area that receives data after encryption computation is completed. The virtual operating system further includes: an encryption process manager, configured to control the micro-kernel to complete the encryption computation according to the original data and saving the encryption computation result in the buffer area.
In yet another aspect of the present invention, the non-transitory computer-readable medium storing instructions which, when executed by one or more processors, cause the foregoing disclosed apparatus to perform the foregoing disclosed method for performing encryption.
In the encryption method and apparatus, the encryption computation is completed in the virtual operating system, and since the context of the CPU in the virtual operating system is completely different from that of a real CPU, a conventional hardware tracking and debugging technology, such as a trap flag (TF) in a DR0-DR7 register or a flag register, is completely invalid in the virtual operating system, thereby ensuring that the encryption computation process in the virtual operating system cannot be interrupted, so as to prevent a cracker from cracking an encryption algorithm by using the hardware tracking and debugging technology. Besides, there is no need to adopt a dedicated hardware encryption apparatus, thereby reducing the cost.
These and other aspects of the present invention will become apparent from the following description of the preferred embodiment taken in conjunction with the following drawings, although variations and modifications therein may be affected without departing from the spirit and scope of the novel concepts of the present invention.
BRIEF DESCRIPTION OF THE DRAWINGS
The accompanying drawings illustrate one or more embodiments of the invention and, together with the written description, serve to explain the principles of the invention. Wherever possible, the same reference numbers are used throughout the drawings to refer to the same or like elements of an embodiment. The drawings do not limit the present invention to the specific embodiments disclosed and described herein. The drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the invention.
FIG. 1 is a flow chart of an encryption method according to one embodiment of the invention.
FIG. 2 is a schematic diagram of page table mapping in the encryption method according to the embodiment of the invention shown in FIG. 1.
FIG. 3 is a structural block diagram of an encryption apparatus according to one embodiment of the invention. DETAILED DESCRIPTION OF THE INVENTION The following description is merely illustrative in nature and is in no way intended to limit the disclosure, its application, or uses. The broad teachings of the disclosure can be implemented in a variety of forms. Therefore, while this disclosure includes particular examples, the true scope of the disclosure should not be so limited since other
modifications will become apparent upon a study of the drawings, the specification, and the following claims. For purposes of clarity, the same reference numbers will be used in the drawings to identify similar elements.
The terms used in this specification generally have their ordinary meanings in the art, within the context of the disclosure, and in the specific context where each term is used. Certain terms that are used to describe the disclosure are discussed below, or elsewhere in the specification, to provide additional guidance to the practitioner regarding the description of the disclosure. The use of examples anywhere in this specification, including examples of any terms discussed herein, is illustrative only, and in no way limits the scope and meaning of the disclosure or of any exemplified term. Likewise, the disclosure is not limited to various embodiments given in this specification.
As used in the description herein and throughout the claims that follow, the meaning of "a", "an", and "the" includes plural reference unless the context clearly dictates otherwise. Also, as used in the description herein and throughout the claims that follow, the meaning of "in" includes "in" and "on" unless the context clearly dictates otherwise.
As used herein, the terms "comprising," "including," "having," "containing," "involving," and the like are to be understood to be open-ended, i.e., to mean including but not limited to.
As used herein, the phrase "at least one of A, B, and C" should be construed to mean a logical (A or B or C), using a non-exclusive logical OR. It should be understood that one or more steps within a method may be executed in different order (or concurrently) without altering the principles of the present disclosure.
As used herein, the term "module" may refer to, be part of, or include an Application Specific Integrated Circuit (ASIC); an electronic circuit; a combinational logic circuit; a field programmable gate array (FPGA); a processor (shared, dedicated, or group) that executes code; other suitable hardware components that provide the described functionality; or a combination of some or all of the above, such as in a system-on-chip. The term module may include memory (shared, dedicated, or group) that stores code executed by the processor.
The term "code", as used herein, may include software, firmware, and/or microcode, and may refer to programs, routines, functions, classes, and/or objects. The term "shared", as used herein, means that some or all code from multiple modules may be executed using a single (shared) processor. In addition, some or all code from multiple modules may be stored by a single (shared) memory. The term "group", as used herein, means that some or all code from a single module may be executed using a group of processors. In addition, some or all code from a single module may be stored using a group of memories.
The systems and methods described herein may be implemented by one or more computer programs executed by one or more processors. The computer programs include processor-executable instructions that are stored on a non-transitory tangible computer readable medium. The computer programs may also include stored data. Non- limiting examples of the non-transitory tangible computer readable medium are nonvolatile memory, magnetic storage, and optical storage.
The description will be made as to the embodiments of the present invention in conjunction with the accompanying drawings in FIGS. 1-3. It should be understood that specific embodiments described herein are merely intended to explain the present invention, but not intended to limit the present invention. In accordance with the purposes of this invention, as embodied and broadly described herein, this invention, in one aspect, relates to method and apparatus for performing encryption, and a non-transitory
computer-readable medium storing instructions which, when executed by one or more processors, cause the apparatus to perform the method for performing encryption.
Referring to FIG. 1 , a flow chart of an encryption method is shown according to one embodiment of the invention. The method includes, among other things, the following steps.
At step SI 10: Loading a virtual system driver in a host operating system and constructing a virtual operating system, where the virtual operating system includes a micro-kernel.
The host operating system refers to any operating system that can be installed and run in a computer or a similar computing apparatus such as a smartphone or a tablet computer, or the like.
The virtual system driver is running in the host operating system and is invoked by protected software. In other words, the protected software sends an encryption computation request to the virtual system driver and provides original data thereto. The virtual system driver may construct a virtual operating system after receiving the encryption computation request, and provide the original data to the virtual operating system.
The micro-kernel serves as an independent processor (CPU) for a program running in the virtual operating system, and is configured to run an assembly instruction set, so as to complete encryption computation. However, the instruction set that can be run by the micro-kernel may be reduced relative to a real CPU, as long as the instruction set satisfies the requirement for the encryption computation. In the actual implementation, the micro-kernel directly sends the instruction to the real CPU for execution and does not perform operations such as instruction conversion and translation, and saves, in a specific memory area, the execution result of the real CPU as the computation result of the program running in the virtual operating system.
At step SI 20: The virtual system driver prepares context of a processor and a memory page table for the micro-kernel, and maps, in the memory page table, original data and a physical address of a buffer area that receives data after encryption computation is completed.
It can be understood that, for a CPU, regardless of being a real CPU or a virtual CPU, to enable the CPU to perform computation, context of the CPU (values of a register in the CPU) needs to be prepared for the CPU, and codes (instruction sequences) and data (operation targets of the instruction sequences) are prepared in the memory. The CPU executes the instruction sequences one by one, and continuously operates the data, so as to complete the data computing process.
FIG. 2 shows a schematic diagram of a physical memory space according to one embodiment of the invention. A first area 101 is configured to storing original data requiring for encryption computation; and a second area 102 is a buffer area configured to storing data after the encryption computation is completed. However, the program running in the operating system directly operates data in a virtual memory space, and mapping between the virtual memory space and the physical memory space is implemented through a page table of the operating system.
In view of the above, if data exchange needs to be directly performed between the host operating system and the virtual operating system through a physical memory, mapping toward the same physical memory space is required to be implemented in page tables of the host operating system and the virtual operating system respectively. In this case, data written into the first area 101 becomes a data source of an encryption program in the virtual operating system.
At step SI 30: Completing the encryption computation in the virtual operating system and saving the computation result in the buffer area.
After the encryption process proceeds to the virtual operating system, interrupt may be first terminated, for example, an interrupt flag bit of a flag register is set to 0, to shield the micro-kernel from responding to an external interrupt request.
In the virtual operating system, the encryption program may successfully access, through the page table, the original data stored in the first area 101 of the physical memory, and adopt a built-in encryption algorithm to complete the encryption computation. After the computation is completed, the result is saved in the second area 102 of the physical memory. Correspondingly, in the host operating system, the data after the encryption computation is completed may be accessed through the page table.
The original data provided by the protected software may be pure data or a combination of codes and data, which is generally configured to decryption.
When the provided original data is pure data, an encryption algorithm is adopted to perform encryption computation.
When the provided original data is a combination of codes and data, the original data needs to be decrypted according to a predetermined algorithm to obtain the real original data, for example, a built-in password of compression software, such as 7z, is adopted for decompression; the codes are extracted from the real original data; and the extracted codes are run to complete the encryption computation.
After the encryption computation is completed, the virtual system driver may return the data resulted from the encryption computation to the protected software.
In the encryption method of this embodiment, the encryption computation is completed in the virtual operating system, and since the context of the CPU in the virtual operating system is completely different from that of a real CPU, a conventional hardware tracking and debugging technology, such as a TF in a DR0-DR7 register or a flag register, is completely invalid in the virtual operating system, thereby ensuring that the encryption computation process in the virtual operating system cannot be interrupted, so as to prevent a cracker from cracking an encryption algorithm by using the hardware tracking and debugging technology.
Furthermore, as a brand-new page table is used in the virtual operating system, a memory address (logic address) in the host operating system is invalid to the virtual operating system, so a CC breakpoint is generally invalid to the virtual operating system. It can be understood that, the CC breakpoint refers to, for example, an INT3 instruction, and with a machine code being CC, the CC breakpoint is also called a CC instruction. When a debugged process executes the INT3 instruction to cause an exception, a debugger captures the exception and stops at the breakpoint, to recover the instruction at the breakpoint to the original instruction. Definitely, if the debugger is written by a user, some other instructions may be used to replace the INT3 instruction to trigger an exception.
It can be understood that, the cracker is capable of maliciously forging a CC breakpoint, for example, in the foregoing situation that the original data includes codes, a maliciously forged CC breakpoint may exist in the codes. The above problem may be solved by returning to the host operating system when detecting a soft interrupt (the CC breakpoint belongs to the soft interrupt). It can be understood that, although the interrupt is implemented, the encryption computation process is ended without being completed, and in this case, even if data is obtained, the obtained data is invalid intermediate data, and cannot be configured to cracking the encryption algorithm.
Referring to FIG. 3, an encryption apparatus is shown according to one embodiment of the invention. The encryption apparatus includes a host operating system 210 and a virtual operating system 220. The host operating system 210 includes a virtual system driver module 211 and protected software 212. The virtual operating system 220 includes a micro-kernel 221 and an encryption process manager 222.
The host operating system 210 refers to any operating system that can be installed and run in a computer or a similar computing apparatus such as a smartphone or a tablet computer, or the like.
The virtual system driver module 211 is running in the host operating system and is invoked by the protected software; in other words, the protected software 212 sends an encryption computation request to the virtual system driver module 211 and provides original data thereto. The virtual system driver module 211 may construct the virtual operating system 220 after receiving the encryption computation request, and provide the original data to the virtual operating system 220.
The micro-kernel 221 serves as an independent processor (CPU) for a program running in the virtual operating system 210, and is configured to run an assembly instruction set, so as to complete encryption computation. However, the instruction set that can be run by the micro-kernel 221 may be reduced relative to a real CPU, as long as the instruction set satisfies the requirement for the encryption computation. In the actual implementation, the micro-kernel 221 directly sends the instruction to the real CPU for execution and does not perform operations such as instruction conversion and translation, and saves, in a specific memory area, the execution result of the real CPU as the computation result of the encryption computation program running in the virtual operating system 220.
The virtual system driver module 211 prepares context of a processor and a memory page table for the micro-kernel 221, and maps, in the memory page table, original data and a physical address of a buffer area that receives data after encryption computation is completed.
For a CPU, no matter being a real CPU or a virtual CPU, to enable the CPU to perform computation, context of the CPU (values of a register in the CPU) needs to be prepared for the CPU, and codes (instruction sequences) and data (operation targets of the instruction sequences) are prepared in the memory. The CPU executes the instruction sequences one by one, and continuously operates the data, so as to complete the data computing process.
As shown in FIG. 2, in the physical memory space, a first area 101 is configured to storing original data requiring for encryption computation; and a second area 102 is a buffer area configured to storing data after the encryption computation is completed.
However, the program running in the operating system directly operates data in a virtual memory space, and mapping between the virtual memory space and the physical memory space is implemented through a page table of the operating system.
In view of the above, if data exchange needs to be directly performed between the host operating system 210 and the virtual operating system 220 through a physical memory, mapping toward the same physical memory space is required to be implemented in page tables of the host operating system 210 and the virtual operating system 220 respectively. In this case, data written into the first area 101 becomes a data source of an encryption program in the virtual operating system 220.
After the encryption process proceeds to the virtual operating system 220, the encryption process manager 222 may first terminate interrupt of the virtual operating system, for example, an interrupt flag bit of a flag register is set to 0, to shield the micro-kernel from responding to an external interrupt request.
In the virtual operating system 220, the encryption program may successfully access, through the page table, the original data stored in the first area 101 of the physical memory, and adopt a built-in encryption algorithm to complete the encryption computation. After the computation is completed, the result is saved in the second area 102 of the physical memory. Correspondingly, in the host operating system 210, the data after the encryption computation is completed may be accessed through the page table.
The original data provided by the protected software 212 may be pure data or a combination of codes and data, which is generally configured to decryption.
When the provided original data is pure data, an encryption algorithm is adopted to perform encryption computation.
When the provided original data is a combination of codes and data, the original data needs to be decrypted according to a predetermined algorithm to obtain the real original data, for example, a built-in password of compression software, such as 7z, is adopted for decompression; the codes are extracted from the real original data; and the extracted codes are run to complete the encryption computation.
After the encryption computation is completed, the virtual system driver module 211 may return the data resulted from the encryption computation to the protected software 212.
In the encryption apparatus of this embodiment, the encryption computation is completed in the virtual operating system 220, and since the context of the CPU in the virtual operating system is completely different from that of a real CPU, a conventional hardware tracking and debugging technology, such as a TF in a DR0-DR7 register or a flag register, is completely invalid in the virtual operating system, thereby ensuring that the encryption computation process in the virtual operating system 220 cannot be interrupted, so as to prevent a cracker from cracking an encryption algorithm by using the hardware tracking and debugging technology.
Furthermore, as a brand-new page table is used in the virtual operating system 220, a memory address (logic address) in the host operating system 210 is invalid to the virtual operating system 220, so a CC breakpoint is generally invalid to the virtual operating system 220. It can be understood that, the CC breakpoint refers to, for example, an INT3 instruction, and with a machine code being CC, the CC breakpoint is also called a CC instruction. When a debugged process executes the INT3 instruction to cause an exception, a debugger captures the exception and stops at the breakpoint, to recover the instruction at the breakpoint to the original instruction. Definitely, if the debugger is written by a user, some other instructions may be used to replace the INT3 instruction to trigger an exception.
However, it can be understood that, the cracker is capable of maliciously forging a CC breakpoint, for example, in the foregoing situation that the original data includes codes, a maliciously forged CC breakpoint may exist in the codes. To solve the above problem, the encryption process manager 222 may return to the host operating system when detecting a soft interrupt (the CC breakpoint belongs to the soft interrupt). It can be understood that, although the interrupt is implemented, the encryption computation process is ended without being completed, and in this case, even if data is obtained, the obtained data is invalid intermediate data, and cannot be configured to cracking the encryption algorithm.
In addition, yet another aspect of the present invention provides a computer readable storage medium which stores computer executable instructions. The computer executable instructions enable a computer or a similar computing apparatus to complete various operations in the encryption method. The storage medium includes, but not limited to, a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), random memory (RAM), flash dive, or the likes.
The foregoing description of the exemplary embodiments of the invention has been presented only for the purposes of illustration and description and is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Many modifications and variations are possible in light of the above teaching.
The embodiments were chosen and described in order to explain the principles of the invention and their practical application so as to activate others skilled in the art to utilize the invention and various embodiments and with various modifications as are suited to the particular use contemplated. Alternative embodiments will become apparent to those skilled in the art to which the present invention pertains without departing from its spirit and scope. Accordingly, the scope of the present invention is defined by the appended claims rather than the foregoing description and the exemplary embodiments described therein.

Claims

CLAIMS What is claimed is:
1. A method for encryption, comprising:
loading a virtual system driver module in a host operating system and constructing a virtual operating system, wherein the virtual operating system comprises a micro-kernel;
preparing and providing context of a processor and a memory page table by the virtual system driver for the micro-kernel, and mapping, in the memory page table, original data and a physical address of a buffer area that receives data after encryption computation is completed; and
completing the encryption computation in the virtual operating system and saving the computation result in the buffer area.
2. The method according to claim 1, wherein the virtual operating system further comprises an encryption process manager, and wherein the method further comprises:
ending the encryption computation after the encryption process manager detects a soft interrupt signal and returning to the host operating system.
3. The method according to claim 1, wherein the step of completing the encryption computation in the virtual operating system comprises:
decrypting, according to a predetermined algorithm, the data on which the encryption computation needs to be performed, to obtain the original data;
extracting codes from the original data; and
running the extracted codes to complete the encryption computation.
4. The method according to claim 1, further comprising:
receiving an encryption computation request from protected software before the virtual system driver prepares the memory page table; and returning the encryption computation result to the protected software after the encryption computation is completed.
5. The method according to claim 1, further comprising:
shutting down the response of the micro-kernel to an external interrupt request before the encryption computation is completed in the virtual operating system.
6. An apparatus for encryption, comprising:
a virtual operating system; and
a driver module,
wherein the virtual operating system comprises a micro-kernel, configured to run an assembly instruction sequence;
the driver module is configured to prepare and provide context of a processor and a memory page table for the micro-kernel, and map, in the memory page table, original data and a physical address of a buffer area that receives data after encryption computation is completed; and
the virtual operating system further comprises an encryption process manager, configured to control the micro-kernel to complete the encryption computation according to the original data and saving the encryption computation result in the buffer area.
7. The apparatus according to claim 6, wherein the encryption process manager is further configured to end the encryption computation after detecting a soft interrupt signal and return to the host operating system.
8. The apparatus according to claim 6, wherein the micro-kernel, when completing the encryption computation in the virtual operating system, is further configured to: decrypt, according to a predetermined algorithm, the data on which the encryption computation needs to be performed, to obtain the original data;
extract codes from the original data; and
run the extracted codes to complete the encryption computation.
9. The apparatus according to claim 6, wherein the driver module is further configured to:
receive an encryption computation request from protected software before preparing the memory page table; and
return the encryption computation result to the protected software after the virtual operating system completes the encryption computation.
10. The apparatus according to claim 6, wherein the encryption process manager is further configured to shut down the response of the micro-kernel to an external interrupt request before the encryption computation is completed in the virtual operating system.
11. A non-transitory computer-readable medium storing instructions which, when
executed by one or more processors, cause an apparatus to perform a method for performing encryption, the method comprising:
loading a virtual system driver module in a host operating system and constructing a virtual operating system, wherein the virtual operating system comprises a micro-kernel;
preparing and providing context of a processor and a memory page table by the virtual system driver for the micro-kernel, and mapping, in the memory page table, original data and a physical address of a buffer area that receives data after encryption computation is completed; and
completing the encryption computation in the virtual operating system and saving the computation result in the buffer area. The non-transitory computer-readable medium according to claim 1 , wherein the virtual operating system further comprises an encryption process manager, and wherein the method further comprises:
ending the encryption computation after the encryption process manager detects a soft interrupt signal and returning to the host operating system.
The non-transitory computer-readable medium according to claim 1 , wherein the step of completing the encryption computation in the virtual operating system comprises:
decrypting, according to a predetermined algorithm, the data on which the encryption computation needs to be performed, to obtain the original data;
extracting codes from the original data; and
running the extracted codes to complete the encryption computation.
The non-transitory computer-readable medium according to claim 1 , wherein the method further comprises:
receiving an encryption computation request from protected software before the virtual system driver prepares the memory page table; and
returning the encryption computation result to the protected software after the encryption computation is completed.
The non-transitory computer-readable medium according to claim 1 , wherein the method further comprises:
shutting down the response of the micro-kernel to an external interrupt request before the encryption computation is completed in the virtual operating system.
PCT/CN2013/083469 2012-09-19 2013-09-13 Method and apparatus for encryption Ceased WO2014044152A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
BR112015001950A BR112015001950A2 (en) 2012-09-19 2013-09-13 encryption method, and encryption apparatus
US14/082,715 US9122894B2 (en) 2012-09-19 2013-11-18 Method and apparatus for encryption

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201210347705.1 2012-09-19
CN201210347705.1A CN103679060B (en) 2012-09-19 2012-09-19 Encryption method and encryption device

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/082,715 Continuation US9122894B2 (en) 2012-09-19 2013-11-18 Method and apparatus for encryption

Publications (1)

Publication Number Publication Date
WO2014044152A1 true WO2014044152A1 (en) 2014-03-27

Family

ID=50316567

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/083469 Ceased WO2014044152A1 (en) 2012-09-19 2013-09-13 Method and apparatus for encryption

Country Status (4)

Country Link
US (1) US9122894B2 (en)
CN (1) CN103679060B (en)
BR (1) BR112015001950A2 (en)
WO (1) WO2014044152A1 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113656229A (en) * 2021-08-17 2021-11-16 中金金融认证中心有限公司 Method and device for detecting computer system password module and storage medium

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104573556A (en) * 2015-01-19 2015-04-29 浪潮集团有限公司 Encrypting method based on virtual system
CN106156229A (en) * 2015-04-27 2016-11-23 宇龙计算机通信科技(深圳)有限公司 The processing method of file, device and terminal in a kind of multiple operating system terminal
CN107688745B (en) * 2016-08-04 2020-10-30 阿里巴巴集团控股有限公司 Method for processing and generating kernel image, kernel initialization method, apparatus and device
CN107563228B (en) * 2017-08-03 2021-04-20 海光信息技术股份有限公司 A method of encrypting and decrypting memory data
CN109543460B (en) * 2018-11-29 2021-02-23 北京元心科技有限公司 Method, device and electronic device for encrypting and decrypting data based on microkernel
CN111124956B (en) * 2019-11-22 2023-03-07 海光信息技术股份有限公司 A container protection method, processor, operating system and computer equipment
CN111246466B (en) * 2019-12-31 2021-06-15 北京元心科技有限公司 Encrypted communication method and system for Arm architecture application processor

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101071463A (en) * 2007-06-08 2007-11-14 北京飞天诚信科技有限公司 Method and device for virtulizing personal office environment
US20080201129A1 (en) * 2001-09-25 2008-08-21 Norman Asa Simulated computer system for monitoring of software performance
CN101290569A (en) * 2008-05-06 2008-10-22 国网南京自动化研究院 A Method of Parallel Data Processing Using Multiple Encryption Chips

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CA2496664C (en) * 2002-08-23 2015-02-17 Exit-Cube, Inc. Encrypting operating system
US20070174429A1 (en) * 2006-01-24 2007-07-26 Citrix Systems, Inc. Methods and servers for establishing a connection between a client system and a virtual machine hosting a requested computing environment
US7797748B2 (en) * 2007-12-12 2010-09-14 Vmware, Inc. On-access anti-virus mechanism for virtual machine architecture

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080201129A1 (en) * 2001-09-25 2008-08-21 Norman Asa Simulated computer system for monitoring of software performance
CN101071463A (en) * 2007-06-08 2007-11-14 北京飞天诚信科技有限公司 Method and device for virtulizing personal office environment
CN101290569A (en) * 2008-05-06 2008-10-22 国网南京自动化研究院 A Method of Parallel Data Processing Using Multiple Encryption Chips

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113656229A (en) * 2021-08-17 2021-11-16 中金金融认证中心有限公司 Method and device for detecting computer system password module and storage medium
CN113656229B (en) * 2021-08-17 2024-02-20 中金金融认证中心有限公司 Method, device and storage medium for detecting cryptographic module of computer system

Also Published As

Publication number Publication date
BR112015001950A2 (en) 2019-10-15
US20140095893A1 (en) 2014-04-03
CN103679060B (en) 2018-03-27
CN103679060A (en) 2014-03-26
US9122894B2 (en) 2015-09-01

Similar Documents

Publication Publication Date Title
US9122894B2 (en) Method and apparatus for encryption
EP3716081B1 (en) Memory protection with hidden inline metadata
EP3757803B1 (en) Memory protection with hidden inline metadata to indicate data type
EP3798856B1 (en) Secure address translation services using message authentication codes and invalidation tracking
US10114643B2 (en) Techniques for detecting return-oriented programming
US10152602B2 (en) Protecting state information for virtual machines
US9639671B2 (en) Secure execution of encrypted program instructions
US10296246B2 (en) Integrity protection for system management mode
US10067710B2 (en) Detecting buffer overflows in general-purpose GPU applications
US9760374B2 (en) Stack pointer and memory access alignment control
KR102584506B1 (en) State information protection for virtual machines
US9176821B2 (en) Watchpoint support system for functional simulator
US9639477B2 (en) Memory corruption prevention system
US11210393B2 (en) Context data control
CN106295322B (en) A kind of hardware protection device for buffer overflow attack
US9990494B2 (en) Techniques for enabling co-existence of multiple security measures
EP3246821B1 (en) Semiconductor device and its memory access control method

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13839266

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112015001950

Country of ref document: BR

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 29/07/2015)

122 Ep: pct application non-entry in european phase

Ref document number: 13839266

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 112015001950

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20150128

ENPC Correction to former announcement of entry into national phase, pct application did not enter into the national phase

Ref country code: BR

Free format text: ANULADA A PUBLICACAO CODIGO 1.3 NA RPI NO 2426 DE 04/07/2017 POR TER SIDO INDEVIDA.

REG Reference to national code

Ref country code: BR

Ref legal event code: B01E

Ref document number: 112015001950

Country of ref document: BR

Kind code of ref document: A2

Free format text: APRESENTAR A TRADUCAO SIMPLES DA FOLHA DE ROSTO DA CERTIDAO DE DEPOSITO DA PRIORIDADE CN 201210347705.1 DE 19/09/2012 OU DECLARACAO CONTENDO, OBRIGATORIAMENTE, TODOS OS DADOS IDENTIFICADORES DESTA (DEPOSITANTE(S), INVENTOR(ES), NUMERO DE REGISTRO, DATA DE DEPOSITO E TITULO), CONFORME O PARAGRAFO UNICO DO ART. 25 DA RESOLUCAO 77/2013, UMA VEZ QUE NAO FOI POSSIVEL DETERMINAR O(S) TITULAR(ES) DA CITADA PRIORIDADE, NEM SEUS INVENTORES, INFORMACAO NECESSARIA PARA O EXAME.

ENP Entry into the national phase

Ref document number: 112015001950

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20150128