WO2017133442A1

WO2017133442A1 - Real-time measurement method and device

Info

Publication number: WO2017133442A1
Application number: PCT/CN2017/071397
Authority: WO
Inventors: 崔云峰; 刘�东; 王继刚
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-02-05
Filing date: 2017-01-17
Publication date: 2017-08-10
Also published as: CN107045605A

Abstract

A real-time measurement method and device, comprising: a real-time measurement device monitors an operation on a monitored area in real time (S101), wherein the monitored area is a storage address corresponding to sensitive information, and the sensitive information is predefined information that needs to be measured; when detecting that a sensitive operation for the monitored area is initiated on the monitored area, the real-time measurement device determines whether the sensitive operation is legitimate (S102), if it is legitimate, allows the operation to be performed (S103), and if it is not legitimate, stops the operation (S104). Whenever an operation is initiated on a monitored area, the legitimacy of the operation is determined, and real-time measurement is implemented by determining the legitimacy of a sensitive operation, thereby solving the problem of TOCTOU attack risks in the prior art, and achieving the effect of reducing the TOCTOU attack risks.

Description

Real-time measuring method and device

Technical field

The present invention relates to the field of IT (Information Technology) and information security, and in particular, to a real-time measurement method and apparatus.

Background technique

Embedded systems are widely used in communications, industrial control, transportation and other industries, but for traditional IT systems, the processor performance of embedded systems is generally lower than the processor performance of servers and PCs (personal computers), and embedded The system is often in an unattended state. Unlike the IT system, which has a special administrator role and can often maintain or upgrade the system security continuously, the security problems in the embedded system cannot copy the anti-virus software used by the IT system. Thoughts such as continuous update of patches need to consider the active security mechanism suitable for embedded systems to achieve security automation.

In the prior art, the trusted computing utilizes the TPM/TCM trusted chip to perform integrity measurement on the operating system and the business system step by step at startup, which can ensure that the system is trusted and has not been tampered with when the system is started. Based on this, IBM developed IMA/PRIMA to use the Linux-based LSM (Linux Security Module) hook mechanism to measure the integrity of the subject, object or mandatory access control policy of the current function in the process of file reading and writing and key function invocation. To ensure that the system is trusted and not tampered with. With this dynamic integrity measurement method, the measurement timing depends on the Linux LSM registration hook function point, and the measurement timing is completely dependent on whether the LSM hook is complete. In the specific execution, the timing of the dynamic measurement is derived from a fixed event, or a periodic timing metric, or determined by the user or an external system, so that there is a risk of a TOCTOU (Time of check, Time of use) attack, that is, System integrity is not attacked when measured, but is attacked by hacker code when it is used.

Summary of the invention

The main technical problem to be solved by the present invention is to provide a metric method and apparatus to avoid the problem of the risk of TOCTOU attack caused by the inability to measure in real time in the prior art.

To solve the above problems, the present invention provides a real-time measurement method, including:

Monitoring the operation on the monitored area in real time; the monitored area is a storage address corresponding to the sensitive information, and the sensitive information is a predefined information that needs to be measured;

Determining whether the sensitive operation is legal when monitoring the sensitive operation initiated on the monitored area for the monitored area;

If the result of the determination is that the sensitive operation is legal, the sensitive operation is allowed to continue;

If the result of the determination is that the sensitive operation is illegal, the sensitive operation is prevented from continuing.

In an embodiment of the present invention, before monitoring the operation on the monitored area in real time, the method further includes: determining sensitive information, determining whether the sensitive information has been created in the system, and if yes, reading the corresponding information of the sensitive information. The address is stored and the storage address is set as the monitored area.

In an embodiment of the present invention, determining whether the operation is legal comprises: determining whether the sensitive operation is legal comprises: determining the sensitivity by determining whether the sensitive operation or the subject performing the sensitive operation satisfies a corresponding metric rule Whether the operation is legal, if it is satisfied, the sensitive operation is legal; if not, the sensitive operation is illegal.

In an embodiment of the invention, the sensitive information includes stack, heap, process, and kernel key data;

When the sensitive information is a stack, the metric rule includes: a current operation address belongs to a valid range of the stack, a body accessing the stack is an owner of the stack, and the stack conforms to an application binary interface specification convention. ;

When the sensitive information is a heap, the metric rule includes: the current operation address does not belong to the free heap space range, the current operation interval does not span different heap space objects, and the current operation thread is a legal thread;

When the sensitive information is a process, the metric rule includes: the code segment corresponding to the current process can be operated, and the stack interval of the current process is executable;

When the sensitive information is kernel critical data, the metric rule includes: the access thread of the key data belongs to a legal thread, and the address of the program that performs the operation belongs to a legally trusted code interval.

In an embodiment of the invention, when the sensitive operation is illegal, the user is notified.

In an embodiment of the present invention, after detecting the sensitive operation initiated on the monitored area for the monitored area, before determining whether the sensitive operation is legal, the method further includes: generating an abnormality, so that the sensitive operation process is interrupted.

In an embodiment of the present invention, when the sensitive operation is illegal, if the sensitive operation is in the kernel state, the system abnormal interface is invoked to trigger the system abnormality; if the sensitive operation is in the user state, the system is no longer The execution of the operation allocates resources.

In an embodiment of the present invention, monitoring the operation on the monitored area in real time includes: monitoring the operation of the memory in real time through the memory management unit, and determining whether the operation is a sensitive operation initiated by the monitored area.

The invention also provides a real-time measuring device, comprising:

The monitoring module is configured to monitor the operation on the monitored area in real time, where the monitored area is a storage address corresponding to the sensitive information, and the sensitive information is a predefined information that needs to be measured;

a judging module: configured to determine whether the sensitive operation is legal when monitoring a sensitive operation initiated on the monitored area for the monitored area;

a first execution module: configured to allow the sensitive operation to continue when the judgment result is that the sensitive operation is legal;

The second execution module is configured to determine that the sensitive operation is illegal, and prevent the sensitive operation from continuing.

In an embodiment of the invention, the device further includes a setting module for monitoring the monitored area in real time. Before the operation, the sensitive information is determined, and it is determined whether the sensitive information has been created in the system, and if so, the storage address corresponding to the sensitive information is read, and the storage address is set as the monitored area.

In an embodiment of the invention, the apparatus further includes a notification module, configured to notify the user when the sensitive operation is illegal.

In an embodiment of the present invention, the device further includes an abnormality generating module, configured to generate an abnormality after determining whether the sensitive operation is legal after detecting the sensitive operation initiated on the monitored area on the monitored area, so that The sensitive operation process is interrupted.

In an embodiment of the invention, the monitoring module includes a memory management unit, and the memory management unit monitors the operation of the memory in real time, and determines whether the operation is a sensitive operation initiated by the monitored area.

The present invention provides a real-time metric method and apparatus. The real-time metric device monitors operations on a monitored area in real time. The monitored area is a storage address corresponding to sensitive information, and the sensitive information is Defined information that needs to be measured; when it is detected that there is a sensitive operation on the monitored area for the monitored area, it is judged whether the operation is legal, if it is legal, it is allowed to continue, and if it is not legal, it is prevented from continuing. run. Whenever there is a sensitive operation on the monitored area for the monitored area, it will judge whether the operation is legal or not, and realize the real-time measurement by judging the legality of the sensitive operation; without waiting for a fixed time or fixed period to pass Judging the legality of the data, solving the problem of the TOCTOU attack risk in the prior art, and achieving the effect of reducing the TOCTOU attack risk.

DRAWINGS

1 is a flowchart of implementing a real-time metric method according to Embodiment 1 of the present invention;

2 is a flowchart of setting a monitored area in a real-time metric method according to Embodiment 1 of the present invention;

FIG. 3 is a schematic structural diagram of a real-time metric apparatus according to Embodiment 1 of the present invention.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings.

Embodiment 1:

This embodiment provides a real-time metric method, which is particularly applicable to, but not limited to, an embedded system. Compared with the prior art, the method has the advantage of avoiding the risk of TOCTOU attack. Referring to FIG. 1, the method includes:

S101: real-time monitoring operation on the monitored area;

S102: When monitoring the sensitive operation initiated on the monitored area for the monitored area, determining whether the sensitive operation is legal, if yes, executing S103, otherwise, executing S104;

S103: Allow the sensitive operation to continue to execute;

S104: Prevent the sensitive operation from continuing.

Before performing step S101, it is usually necessary to set a monitored area corresponding to the sensitive information. In a specific implementation, a database is usually set, and if a sensitive letter is detected in the process of setting the monitored area. The information is being created by the system. At this time, the running address of the sensitive information is calculated, and the running address is set as the monitored area; and the corresponding relationship is stored in a database, and the database is specifically used for storing information related to sensitive information. The database can be stored using data structures such as arrays, linked lists, and trees, and can be retrieved accordingly. Usually, the sensitive information is determined by the user, and the objects that are relatively high in security or vulnerable to attack are determined as sensitive information according to the comprehensive consideration of the demand and the actual use scenario. Therefore, in fact, the monitored area is the storage address corresponding to the sensitive information, and the sensitive information is the predefined information that needs to be measured. For the specific setting process of setting the monitored area, please refer to FIG. 2, including:

S201: determining sensitive information;

S202: determining whether the sensitive information has been created in the system, and if so, executing S203; otherwise, executing S204;

S203: Read an address corresponding to the sensitive information, and set the address as a monitored area;

S204: End the setting of the monitored area.

After the monitored area is set, S101 is executed to monitor the operation on the monitored area in real time. When monitoring the sensitive operation initiated by the monitored area on the monitored area, it is necessary to determine whether the sensitive operation is legal or not. At that time, the sensitive operation is allowed to continue, otherwise the sensitive operation is prevented from continuing. After monitoring the sensitive operation initiated on the monitored area for the monitored area, before determining whether the sensitive operation is legal, an abnormality is usually generated to interrupt the ongoing operation, so as to take different measures according to the judgment result.

In a specific embodiment, determining whether the sensitive operation is legal may be implemented by determining whether the sensitive operation or the execution subject of the sensitive operation satisfies the metric rule, and is legal when satisfied, otherwise illegal. About metrics are set based on sensitive information and its operational privileges. Depending on the actual situation, sensitive information usually includes stack, heap, process, and kernel critical data. When the sensitive information is a stack, the metric rule includes: the current operation address belongs to the valid range of the stack, the body accessing the stack is the owner of the stack, and the stack conforms to the application binary interface specification; when the sensitive information is a heap, The metric rule includes: the current operation address does not belong to the free heap space range, the current operation interval must not span different heap space objects, and the current operation thread is a legal thread; when the sensitive information is a process, the metric rule includes: the code segment corresponding to the current process It can be operated and the stack interval of the current process can be executed; when the sensitive information is the kernel key data, the metric rule includes: the access thread of the key data belongs to the legal thread, and the address of the program that performs the operation belongs to the legally trusted code interval. The "sensitive operation" in this embodiment generally includes "reading", "writing" or "execution". When making a judgment, the subject of the sensitive operation or the sensitive operation should simultaneously satisfy all corresponding metric rules, for example, when the sensitive information is The corresponding sensitive operation of the heap is read. At this time, to determine whether the sensitive operation of reading the heap is legal, it is necessary to determine whether the current access address does not belong to the free heap space range, and also to determine whether the function access interval does not span different heap spaces. The object, but also to determine whether the current access thread is a legitimate thread; when the above several judgment results are "yes", then it is proved that the "read" sensitive operation on the "heap" is legal, allowing the "heap" "Perform "read" sensitive operation; but if any of the above judgment results is "No", that is, the measurement is not satisfied Rules, at which point the organization will "read" sensitive operations on the "heap".

After it is determined that a sensitive operation is illegal, it is necessary to prevent the sensitive operation from continuing. A common method is to determine whether the sensitive operation is in the kernel state or the user state, and if it is in the kernel state, the system is called. The exception interface triggers a system exception, and if it is in user mode, the system suspends the program that performs the sensitive operation and does not allocate resources for the execution of the sensitive operation. When the sensitive operation is prevented from continuing, the user is also notified that the notification may be in the form of a prompt box or in other ways.

If the user feels that there is no need to measure again, the metric can be canceled, or the sensitive information is detected to have died. The metric is automatically canceled in the system. It is only necessary to remove sensitive information, monitored areas, and corresponding metrics from the data. In the case of a metric that the user voluntarily cancels, sensitive actions that were previously blocked can now be allowed to execute after the metric is canceled.

In a specific embodiment, the operation on the monitored area can be monitored in real time through the memory management unit. Real-time monitoring of operations on the monitored area includes: monitoring the operation of the memory in real time through the memory management unit, and determining whether the operation is a sensitive operation initiated for the monitored area. The memory management unit is located inside the CPU and is used to manage the hardware of the virtual address and physical memory. The user first sets sensitive information and determines the monitored area and the corresponding metrics. Save the set data information to the database. The memory management unit monitors the sensitive operations on the monitored area in the database. When any program (including legitimate programs and hacker programs) accesses the monitored device, the memory management unit will An exception is generated and the current access site (including the current access address, current program address register, current stack frame register, etc.) is automatically saved. Due to the properties of the memory management unit, the memory management unit management on the market is usually managed by paging. When the program accesses sensitive information, the memory management unit can obtain a monitoring page, and the monitoring page is sensitive to the program. The address that the information uses when performing actual sensitive operations. Compare the control page with the address of the monitored area to see if it is consistent. If it is inconsistent, it may be an error such as an address error during the running of the program. In this case, it only needs to be processed according to the exception handling rule originally set by the sensitive operating system. If it is consistent, it proves that the current program access may indeed be sensitive information. As it has been said that the memory management unit is concerned only with the address, and is managed by paging, there may be sensitive information on one page, and there may be non-sensitive information. So it depends on whether sensitive information is sensitive to the program. If not, then the object accessed by the program is not private information, then the sensitive operation is allowed to continue; if so, the program needs to be targeted to the privacy according to the metrics. The sensitive operation performed by the information is measured. The specific measurement process includes whether the sensitive operation or the subject performing the sensitive operation satisfies the corresponding metric rule. When it is satisfied, the metric is passed to prove that it is legal; if not, then It is not legal.

The real-time measurement method in this embodiment will be described below with several specific examples:

Example 1: When the private information is a stack. The user first sets the sensitive information, that is, the stack of the thread or process; then adds the stack and its address and the corresponding metrics to the database; since it is necessary to see whether the sensitive operation for the private information satisfies the metric rule, It is also necessary to obtain some metric benchmark values, because the stack metric rule requires that the current sensitive operation address belongs to the valid range of the stack, the body accessing the stack is the owner of the stack, and the stack conforms to the application binary interface specification convention, so Need to get the thread or process of the stack The stack corresponds to the thread or the effective code segment interval of the process; and in the memory management unit, the sensitive operation access permission of the page table corresponding to the corresponding address space is canceled, and the sensitive operation on the address corresponding to the stack is monitored.

If the hacker attempts to launch an illegal tampering attack on the stack from the outside, the control process or the execution process is destroyed. Since the memory management unit has monitored the sensitive operation of the stack in real time, the sensitive operation for the stack is monitored by the memory management unit and an exception is generated; the real-time metric module matches the previously acquired monitoring address of the stack with the dynamic metric monitoring page. The stack is found and confirmed to be currently being sensitively operated; then the sensitive operation is measured according to the metric rule corresponding to the stack, including: confirming whether the current access address belongs to the valid range of the current stack frame, and whether the body of the access stack frame is a stack. Whether the owner, the current stack frame conforms to the stack frame structure specified by the ABI. Since the hacker access thread is not the owner thread of the stack at this time, it does not comply with the second rule constraint. At this time, the exception processing module performs subsequent processing: first, the user is notified by a signal or the like; secondly, because the user is currently in the user state, the running flag of the thread is modified, and the illegal access thread that has been attacked is suspended.

Example 2: When the privacy information is kernel critical data. The core of a sensitive operating system is the foundation of the entire system, especially the key data of the kernel is the basis of security.

The user first sets the sensitive information, that is, the key data of the kernel, such as the thread control block of all threads of the system; then adds the stack and its address and corresponding metrics to the database; because of the subsequent need to look at sensitive operations for the private information Whether the metric rule is met, so some metric values need to be obtained at this time, because the metric rule for the kernel key data is that the access thread that requires the key data belongs to the legal thread, and the current program address belongs to the legally trusted code interval, so it is also required to obtain The legal access thread group and the legal access code interval of the critical data of the kernel; and the sensitive operation access authority corresponding to the page table of the corresponding address space is canceled in the memory management unit, and the sensitive operation on the address corresponding to the key data of the kernel is monitored.

When the hacker tries to insert the external kernel module, the thread control block is accessed in the kernel module to achieve the purpose of controlling the thread execution. Since the memory management unit has real-time monitoring of sensitive operations on the critical data of the kernel, the sensitive operation of the critical data of the kernel is monitored and generated by the memory management unit; the real-time metric module is based on the address and dynamics of the key data of the kernel acquired before. The monitoring page of the metric is matched, the key data of the kernel is found and the current sensitive operation is confirmed; then the sensitive operation is measured according to the metric rule corresponding to the key data of the kernel, including: whether the access thread of the key data is a legal thread, Whether the current program address belongs to a legally trusted code interval. Since the program address is the module address and not within the kernel image code interval, the second rule constraint is not met. At this time, the exception processing module performs subsequent processing: first, the user is notified by a signal or the like; secondly, because the current state is in the kernel state, the system exception interface is directly called to suspend the current access context.

The present embodiment further provides a real-time metric device 3, including a monitoring module 31 for real-time monitoring of operations on a monitored area, where the monitored area is a storage address corresponding to sensitive information, and the sensitive information is a predefined metric that needs to be measured. The determining module 32 is configured to determine whether the sensitive operation is legal when the sensitive operation initiated on the monitored area is detected on the monitored area, and the first executing module 33 is configured to: when the determination result is that the sensitive operation is legal Allowing the sensitive operation to continue; the second execution module 34 is configured to determine that the result is The sensitive operation is illegal, preventing the sensitive operation from continuing. In a specific embodiment, the real-time metrology device 3 further includes a setting module 35, configured to determine sensitive information and determine whether the sensitive information has been created in the system before real-time monitoring of operations on the monitored area, and if And reading the storage address corresponding to the sensitive information, and setting the storage address as the monitored area; the real-time measuring device 3 further includes a notification module 36, configured to notify the user when the sensitive operation is illegal The real-time metric device 3 further includes an abnormality generating module 37, configured to generate an abnormality after determining whether the sensitive operation is legal after detecting the sensitive operation initiated on the monitored area on the monitored area, so that the sensitive The operation was interrupted. In a specific implementation manner of the present invention, the monitoring module is a memory management unit, and the memory management unit monitors the operation of the memory in real time and determines whether the operation is a sensitive operation initiated by the monitored area.

In a specific implementation manner, when the first execution module 33 allows the sensitive operation to continue to execute, first set a single step register of the CPU or insert a breakpoint instruction at the next instruction to restore the permission setting of the relevant sensitive operation on the monitored area, allowing The corresponding sensitive operation is executed; after the exception returns, the program continues to execute, and a single-step exception or a breakpoint exception occurs in the next instruction, and the behavior permission flag of the corresponding page table is re-cancelled in the single-step exception or the breakpoint exception, and the single-step is cancelled. Register the flag or restore the original instruction at the breakpoint.

In a specific implementation, the second execution module 34 determines whether the illegal access is in the kernel state or the user state, and if the abnormal access occurs in the kernel state, the system abnormal interface is invoked to trigger the system exception; if the abnormal access occurs in the user state Set the running flag of the user state thread and suspend the illegal access thread.

With the solution in this embodiment, the real-time metric device monitors the operation on the monitored area in real time, the monitored area is a storage address corresponding to the sensitive information, and the sensitive information is a predefined information that needs to be measured; When monitoring the sensitive operation initiated on the monitored area for the monitored area, it is determined whether the sensitive operation is legal. If it is legal, it is allowed to continue execution, and if it is not legal, it is prevented from continuing to run. Whenever there is sensitive operation on the monitored area, it will judge whether the sensitive operation is legal, avoid the TOCTO attack, and reduce the risk of TOCTOU attack. On the other hand, the solution in this embodiment determines the legality of the sensitive operation on the monitored area according to the metric rule, and the whole process is performed in real time when the program is executed. Therefore, when performing the measurement, only relevant information required for the measurement needs to be obtained. There is no need to obtain all the information of the entire software, so compared with the prior art, it has the advantages of small performance overhead and short time.

Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in a storage medium (ROM/RAM, diskette, optical disk) by a computing device, and in some cases The steps shown or described may be performed in an order different than that herein, or they may be separately fabricated into individual integrated circuit modules, or a plurality of the modules or steps may be implemented as a single integrated circuit module. Therefore, the invention is not limited to any particular combination of hardware and software.

Industrial applicability

The invention relates to the field of information technology and information security, and solves the problem that the TOCTOU attack wind exists in the prior art. The problem of risk has reached the effect of reducing the risk of TOCTOU attack.

The above is a further detailed description of the present invention in connection with the specific embodiments, and the specific embodiments of the present invention are not limited to the description. It will be apparent to those skilled in the art that the present invention may be made without departing from the spirit and scope of the invention.

Claims

A real-time measurement method that includes:

Monitoring the operation on the monitored area in real time; the monitored area is a storage address corresponding to the sensitive information, and the sensitive information is a predefined information that needs to be measured;

Determining whether the sensitive operation is legal when monitoring the sensitive operation initiated on the monitored area for the monitored area;

If the result of the determination is that the sensitive operation is legal, the sensitive operation is allowed to continue;

If the result of the determination is that the sensitive operation is illegal, the sensitive operation is prevented from continuing.
The real-time metric method according to claim 1, wherein before monitoring the operation on the monitored area in real time, the method further comprises: determining sensitive information, and determining whether the sensitive information has been created in the system, and if so, reading the location The storage address corresponding to the sensitive information is set, and the storage address is set as the monitored area.
The real-time metric method according to claim 1, wherein determining whether the sensitive operation is legal comprises: determining whether the sensitive operation is legal by determining whether the sensitive operation or the subject performing the sensitive operation satisfies a corresponding metric rule If satisfied, the sensitive operation is legal; if not, the sensitive operation is illegal.
The real-time metric method of claim 3, wherein the sensitive information comprises stack, heap, process, and kernel key data;

When the sensitive information is a stack, the metric rule includes: a current operation address belongs to a valid range of the stack, a body accessing the stack is an owner of the stack, and the stack conforms to an application binary interface specification convention. ;

When the sensitive information is a heap, the metric rule includes: the current operation address does not belong to the free heap space range, the current operation interval does not span different heap space objects, and the current operation thread is a legal thread;

When the sensitive information is a process, the metric rule includes: the code segment corresponding to the current process can be operated, and the stack interval of the current process is executable;

When the sensitive information is kernel critical data, the metric rule includes: the access thread of the key data belongs to a legal thread, and the address of the program that performs the operation belongs to a legally trusted code interval.
The real-time metric method of claim 1, wherein the user is notified when the sensitive operation is illegal.
The real-time metric method according to claim 1, wherein after detecting the sensitive operation initiated on the monitored area for the monitored area, determining whether the sensitive operation is legal or not further comprises: generating an abnormality to make the sensitive The operation was interrupted.
The real-time metric method according to claim 1, wherein when the sensitive operation is illegal, if the sensitive operation is in a kernel state, the system abnormal interface is invoked to trigger a system abnormality; if the sensitive operation is in a user state, The system no longer allocates resources for the execution of the operation.
The real-time metric method according to any one of claims 1 to 7, wherein real-time monitoring of the operation on the monitored area comprises: monitoring the operation of the memory in real time through the memory management unit, and determining whether the operation is for the monitored area Sensitive actions initiated.
An implementation metric device comprising:

The monitoring module is configured to monitor the operation on the monitored area in real time, where the monitored area is a storage address corresponding to the sensitive information, and the sensitive information is a predefined information that needs to be measured;

The judging module is configured to determine whether the sensitive operation is legal when monitoring the sensitive operation initiated on the monitored area for the monitored area;

a first execution module, configured to allow the sensitive operation to continue when the determination result is that the sensitive operation is legal;

The second execution module is configured to determine that the sensitive operation is illegal, and prevent the sensitive operation from continuing.
The real-time metrology apparatus according to claim 9, further comprising a setting module configured to determine sensitive information before the operation on the monitored area is monitored in real time, and to determine whether the sensitive information has been created in the system, and if so, Reading a storage address corresponding to the sensitive information, and setting the storage address as a monitored area.
The real-time metrology apparatus of claim 9, further comprising a notification module configured to notify the user when the sensitive operation is illegal.
The real-time metrology apparatus according to claim 9, further comprising an abnormality generating module configured to generate an abnormality after determining whether the sensitive operation is legal after monitoring the sensitive operation initiated on the monitored area for the monitored area, so that The sensitive operation process is interrupted.
The real-time metrology device according to any one of claims 9 to 12, wherein the monitoring module comprises a memory management unit, and the memory management unit monitors the operation of the memory in real time and determines whether the operation is initiated for the monitored area. Sensitive operation.