WO2022001944A1 - Linux内核的修改方法、终端设备和存储介质 - Google Patents

Linux内核的修改方法、终端设备和存储介质 Download PDF

Info

Publication number
WO2022001944A1
WO2022001944A1 PCT/CN2021/102714 CN2021102714W WO2022001944A1 WO 2022001944 A1 WO2022001944 A1 WO 2022001944A1 CN 2021102714 W CN2021102714 W CN 2021102714W WO 2022001944 A1 WO2022001944 A1 WO 2022001944A1
Authority
WO
WIPO (PCT)
Prior art keywords
digital signature
signature
linux kernel
coded data
binary coded
Prior art date
Application number
PCT/CN2021/102714
Other languages
English (en)
French (fr)
Inventor
董梦龙
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2022001944A1 publication Critical patent/WO2022001944A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the embodiments of the present application relate to the field of communications, and in particular, to a method for modifying a Linux kernel, a terminal device, and a storage medium.
  • the currently commonly used methods for dynamically modifying the Linux kernel are: compiling the extended Berkeley Package Filter (eBPF) bytecode used to modify the Linux kernel, inserting the eBPF bytecode into the Linux kernel in user mode, and executing eBPF bytecode modifies the Linux kernel.
  • eBPF extended Berkeley Package Filter
  • Embodiments of the present application provide a method for modifying a Linux kernel, including: obtaining binary encoded data for modifying the Linux kernel; digitally signing the binary encoded data to obtain the signed binary encoded data; The data is loaded into the Linux kernel; the digital signature in the signed binary coded data is checked for security, and the result of the security check is obtained; if the result of the security check is passed, the binary coded data is executed on the Linux kernel. Revise.
  • Embodiments of the present application further provide a terminal device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by at least one processor.
  • One processor executes to enable at least one processor to execute the above-mentioned modification method of the Linux kernel.
  • Embodiments of the present application also provide a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the above-mentioned modification method of the Linux kernel is implemented.
  • FIG. 1 is a flowchart of a method for modifying a Linux kernel provided according to a first embodiment of the present application
  • FIG. 2 is a flowchart of a method for modifying a Linux kernel provided according to a second embodiment of the present application
  • FIG. 3 is a comparison diagram before and after the eBPF bytecode is digitally signed in the modification method of the Linux kernel provided by the second embodiment shown in FIG. 2 of the present application;
  • FIG. 4 is a flowchart of a method for modifying a Linux kernel provided according to a third embodiment of the present application.
  • FIG. 5 is a comparison diagram before and after the eBPF bytecode is digitally signed in the modification method of the Linux kernel provided by the third embodiment shown in FIG. 4 of the present application;
  • FIG. 6 is a schematic structural diagram of a terminal device provided according to a fourth embodiment of the present application.
  • Linux plays a pivotal role in all walks of life.
  • the Linux system is divided into kernel mode and user mode: the kernel mode runs the Linux kernel, and the user mode runs the application program. There is a certain isolation between the two, and the user program cannot affect the running process of the kernel.
  • the commonly used methods for dynamically modifying the Linux kernel are: compiling the eBPF bytecode used to modify the Linux kernel, inserting the eBPF bytecode into the Linux kernel in user mode, and executing the eBPF bytecode to modify the Linux kernel.
  • the purpose of the embodiments of the present application is to provide a method, terminal device and storage medium for modifying the Linux kernel, which can improve the security and reliability of modifying the Linux kernel.
  • the first embodiment of the present application relates to a method for modifying a Linux kernel, the process of which is shown in FIG. 1 , including:
  • Step 101 obtaining binary coded data for modifying the Linux kernel.
  • Step 102 digitally sign the binary coded data, and obtain the signed binary coded data.
  • Step 103 Load the signed binary encoded data into the Linux kernel.
  • Step 104 Perform security verification on the digital signature in the signed binary coded data to obtain a security verification result.
  • Step 105 if the result of the security check is that the check is passed, execute the binary coded data to modify the Linux kernel.
  • the embodiment of the present application can sign the binary coded data for modifying the Linux kernel, so that after it is loaded into the Linux kernel, security verification can be performed according to the digital signature information first, and after the verification is passed After that, use the binary encoded data to modify the Linux kernel.
  • the invention solves the problem that the binary coded data can be arbitrarily tampered with in the process of modifying the Linux kernel by using the binary coded data, resulting in low security and reliability of modifying the Linux kernel. Since the security verification can be performed according to the digital signature, it is safer and more reliable to modify the Linux kernel by using the technical solution provided by the embodiments of the present application.
  • the second embodiment of the present application relates to a method for modifying a Linux kernel, and its process is shown in Figure 2, including:
  • Step 201 obtaining binary coded data for modifying the Linux kernel.
  • the binary coded data may be specifically eBPF byte code for description.
  • the binary coded data may also be other forms of coded data, which will not be described in detail here.
  • Step 202 using a preset signature algorithm to calculate the binary encoded data to obtain the content of the digital signature.
  • the signature algorithm may specifically be a hash algorithm, such as a SHA algorithm, etc.
  • the content of the digital signature obtained in step 202 is specifically the HASH value of the eBPF bytecode.
  • Step 203 using a preset key algorithm to obtain the encrypted private key.
  • the key algorithm may specifically be an asymmetric encryption algorithm, and this embodiment does not specifically illustrate the asymmetric encryption algorithm.
  • any asymmetric encryption algorithm may be used in step 203 Calculate the encryption private key.
  • Step 204 Encrypt the digital signature content by using the encrypted private key to obtain a digital signature.
  • Step 205 adding the digital signature to a preset signature position in the binary coded data to obtain the signed binary coded data.
  • the signature position may specifically be the eBPF byte terminal or tail.
  • the length of the signature position is preset. of.
  • the signature position is the eBPF byte terminal, and its length is L1.
  • Step 206 Load the signed binary encoded data into the Linux kernel.
  • Step 207 Obtain the digital signature from the signature location.
  • step 207 may obtain an eBPF bytecode with a length of L1 from the header of the signed eBPF bytecode as a digital signature.
  • Step 208 obtaining the encryption public key according to the key algorithm.
  • the key algorithm used in step 208 is the same as the key algorithm used in step 203 .
  • Step 209 Decrypt the digital signature by using the encryption public key to obtain the content of the digital signature.
  • the content of the digital signature obtained in step 209 is specifically a HASH value.
  • the content of the digital signature obtained in step 209 is HASH1 as an example for description.
  • Step 210 using a signature algorithm to calculate the binary coded data to obtain the detection content of the digital signature.
  • the signature algorithm used in step 210 is the same as the signature algorithm used in step 202, and both are hash algorithms.
  • the digital signature detection content is HASH2 as an example for description.
  • Step 211 Obtain a security verification result according to the relationship between the digital signature content and the digital signature detection content.
  • the security verification result is that the verification is passed; otherwise, the security verification result is that the verification fails.
  • Step 212 if the result of the security check is that the check is passed, execute the binary coded data to modify the Linux kernel.
  • the eBPF bytecode may be directly discarded, and further, an alarm message may be issued to indicate that a network attack has occurred and the Linux kernel has failed to be modified.
  • the third embodiment of the present application relates to a method for modifying a Linux kernel, and its process is shown in Figure 4, including:
  • Step 401 Acquire binary coded data for modifying the Linux kernel.
  • the binary coded data may be specifically eBPF byte code for description.
  • the binary coded data may also be other forms of coded data, which will not be described in detail here.
  • Step 402 using a preset signature algorithm to calculate the binary encoded data to obtain the content of the digital signature.
  • the signature algorithm may specifically be a hash algorithm, such as a SHA algorithm, etc.
  • the content of the digital signature obtained in step 402 is specifically the HASH value of the eBPF bytecode.
  • Step 403 using a preset key algorithm to obtain the encrypted private key.
  • the key algorithm may specifically be an asymmetric encryption algorithm, and this embodiment does not specifically illustrate the asymmetric encryption algorithm.
  • any asymmetric encryption algorithm may be used in step 403 Calculate the encryption private key.
  • Step 404 Encrypt the content of the digital signature by using the encrypted private key to obtain a digital signature.
  • Step 405 Obtain signature identification information.
  • the signature identification information is mainly used to identify the digital signature.
  • the signature identification information may be preset or dynamically generated according to preset rules. Of course, it may also be obtained in other ways. Each case will not be described in detail here. This embodiment is described by taking an example that the signature identification information is a preset 64-bit "0xff00ff00ff00ff00".
  • Step 406 adding the signature identification information before the digital signature to generate a target digital signature.
  • the length of the signature identification information is preset in order to facilitate searching, and the specific form of adding the signature identification information to the digital signature in step 306 may be as shown in FIG. 5 , where the length of the signature identification information is L2.
  • Step 407 Add the target digital signature to a preset signature position in the binary coded data to obtain the signed binary coded data.
  • the signature position may specifically be the eBPF byte terminal or tail.
  • the length of the signature position is preset. of.
  • the signature position is the eBPF byte terminal, and its length is L1.
  • Step 408 Load the signed binary encoded data into the Linux kernel.
  • Step 409 Obtain a digital signature from the target in the signature location.
  • step 409 may obtain an eBPF bytecode with a length of L1+L2 from the header of the signed eBPF bytecode as the target digital signature.
  • Step 410 Detect whether the target digital signature contains signature identification information, and obtain a detection result.
  • Step 411 if the detection result is that the signature identification information is included, obtain the encryption public key according to the key algorithm.
  • the key algorithm used in step 411 is the same as the key algorithm used in step 403 .
  • Step 412 Decrypt the digital signature by using the encryption public key to obtain the content of the digital signature.
  • the content of the digital signature obtained in step 412 is specifically a HASH value.
  • the content of the digital signature obtained in step 412 is HASH1 as an example for description.
  • Step 413 using a signature algorithm to calculate the binary coded data to obtain the detection content of the digital signature.
  • the signature algorithm used in step 412 is the same as the signature algorithm used in step 402, and both are hash algorithms.
  • the digital signature detection content is HASH2 as an example for description.
  • Step 414 Obtain a security verification result according to the relationship between the digital signature content and the digital signature detection content.
  • the security verification result is that the verification is passed; otherwise, the security verification result is that the verification fails.
  • Step 415 if the result of the security check is that the check is passed, execute the binary coded data to modify the Linux kernel.
  • the eBPF bytecode may be directly discarded, and further, an alarm message may be issued to indicate that a network attack has occurred and the Linux kernel has failed to be modified.
  • the digital signature is obtained from the binary coded data, so that the digital signature and the binary coded data are established. Close association, if the binary encoded data is maliciously tampered with, the digital signature detection content obtained in the Linux kernel will be different from the digital signature, so that it can more accurately and effectively determine that the binary encoded data has been maliciously tampered with, and further improve It improves the security and reliability of modifications to the Linux kernel.
  • the fourth embodiment of the present application relates to a terminal device, as shown in FIG. 6 , comprising: at least one processor 601; and a memory 602 connected in communication with the at least one processor 601; Instructions executed by the processor, the instructions are executed by at least one processor 601, so that the at least one processor 601 can execute the information processing methods of the first to fifth embodiments of the present application.
  • the memory and the processor are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors and various circuits of the memory.
  • the bus may also connect together various other circuits, such as peripherals, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein.
  • the bus interface provides the interface between the bus and the transceiver.
  • a transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing a means for communicating with various other devices over a transmission medium.
  • the data processed by the processor is transmitted on the wireless medium through the antenna, and further, the antenna also receives the data and transmits the data to the processor.
  • the processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Instead, memory may be used to store data used by the processor in performing operations.
  • the fifth embodiment of the present application relates to a computer-readable storage medium storing a computer program.
  • the above method embodiments are implemented when the computer program is executed by the processor.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Storage Device Security (AREA)

Abstract

本申请实施例涉及通信领域，公开了一种Linux内核的修改方法、终端设备和存储介质。Linux内核的修改方法包括：获取用于修改Linux内核的二进制编码数据；对二进制编码数据进行数字签名，获取签名后的二进制编码数据；将签名后的二进制编码数据加载到Linux内核中；对签名后的二进制编码数据中的数字签名进行安全性校验，获取安全性校验结果；如果安全性校验结果为校验通过，执行二进制编码数据对Linux内核进行修改。

Description

Linux内核的修改方法、终端设备和存储介质
交叉引用
本申请基于申请号为“202010599448.5”、申请日为2020年06月28日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本申请实施例涉及通信领域，特别涉及一种Linux内核的修改方法、终端设备和存储介质。
背景技术
目前常用的动态修改Linux内核的方法主要是：编译用于修改Linux内核的扩展伯克利包过滤器(extended Berkeley Package Filter，eBPF)字节码，在用户态将eBPF字节码插入到Linux内核，执行eBPF字节码修改Linux内核。
然而发明人发现：网络黑客很容易通过篡改eBPF字节码的方式，将恶意eBPF字节码注入到Linux内核，从而造成修改Linux内核的安全性和可靠性较低的问题。
发明内容
本申请的实施方式提供了一种Linux内核的修改方法，包括：获取用于修改Linux内核的二进制编码数据；对二进制编码数据进行数字签名，获取签名后的二进制编码数据；将签名后的二进制编码数据加载到Linux内核中；对签名后的二进制编码数据中的数字签名进行安全性校验，获取安全性校验结果；如果安全性校验结果为校验通过，执行二进制编码数据对Linux内核进行修改。
本申请的实施方式还提供了一种终端设备，包括：至少一个处理器；以及，与至少一个处理器通信连接的存储器；其中，存储器存储有可被至少一个处理器执行的指令，指令被至少一个处理器执行，以使至少一个处理器能够执行上述Linux内核的修改方法。
本申请的实施方式还提供了一种计算机可读存储介质，存储有计算机程序，计算机程序被处理器执行时实现上述Linux内核的修改方法。
附图说明
一个或多个实施例通过与之对应的附图中的图片进行示例性说明，这些示例性说明并不构成对实施例的限定。
图1是根据本申请的第一实施方式提供的Linux内核的修改方法流程图；
图2是根据本申请的第二实施方式提供的Linux内核的修改方法流程图；
图3是根据本申请的图2所示的第二实施方式提供的Linux内核的修改方法中eBPF字节码进行数字签名前后的对比图；
图4是根据本申请的第三实施方式提供的Linux内核的修改方法流程图；
图5是根据本申请的图4所示的第三实施方式提供的Linux内核的修改方法中eBPF字节码进行数字签名前后的对比图；
图6是根据本申请的第四实施方式提供的终端设备的结构示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的各实施方式进行详细的阐述。然而，本领域的普通技术人员可以理解，在本申请各实施方式中，为了使读者更好地理解本申请而提出了许多技术细节。但是，即使没有这些技术细节和基于以下各实施方式的种种变化和修改，也可以实现本申请所要求保护的技术方案。以下各个实施例的划分是为了描述方便，不应对本申请的具体实现方式构成任何限定，各个实施例在不矛盾的前提下可以相互结合相互引用。
Linux作为目前使用最为广泛的操作系统之一，其在各行各业发挥着举足轻重的作用。Linux系统在运行时，分为内核态和用户态：内核态运行着Linux内核，用户态运行着应用程序，两者存在一定的隔离，用户程序无法影响内核的运行过程。
对于Linux内核的修改，一般情况下需要重新编译内核，并重新启动系统。然而，在一些生产环境中，业务场景不允许进行系统的重启，这就要求能够在系统运行中修改Linux内核。目前，常用的动态修改Linux内核的方法主要是：编译用于修改Linux内核的eBPF字节码，在用户态将eBPF字节码插入到Linux内核，执行eBPF字节码修改Linux内核。
然而发明人发现：网络黑客很容易通过篡改eBPF字节码的方式，将恶意eBPF字节码注入到Linux内核，从而造成修改Linux内核的安全性和可靠性较低的问题。
本申请实施方式的目的在于提供一种Linux内核的修改方法、终端设备和存储介质，能够提高修改Linux内核的安全性和可靠性。
本申请的第一实施方式涉及一种Linux内核的修改方法，其流程如图1所示，包括：
步骤101，获取用于修改Linux内核的二进制编码数据。
步骤102，对二进制编码数据进行数字签名，获取签名后的二进制编码数据。
步骤103，将签名后的二进制编码数据加载到Linux内核中。
步骤104，对签名后的二进制编码数据中的数字签名进行安全性校验，获取安全性校验结果。
步骤105，如果安全性校验结果为校验通过，执行二进制编码数据对Linux内核进行修改。
本申请实施方式相对于相关技术而言，能够对用于修改Linux内核的二进制编码数据进行签名，使得将其加载到Linux内核后，可以先根据数字签名信息进行安全性校验，在校验通过之后，再采用该二进制编码数据对Linux内核进行修改。解决了相关技术采用二进制编码数据对Linux内核进行修改的过程中，可以任意篡改二进制编码数据，造成修改Linux内核的安全性和可靠性较低的问题。由于可以根据数字签名进行安全性校验，使得采用本申请实施方式提供的技术方案对Linux内核进行修改更安全、可靠。
本申请的第二实施方式涉及一种Linux内核的修改方法，其流程如图2所示，包括：
步骤201，获取用于修改Linux内核的二进制编码数据。
本实施方式以二进制编码数据具体可以为eBPF字节码进行说明，在实际的使用过程中，二进制编码数据还可以为其他形式的编码数据，此处不做一一赘述。
步骤202，采用预先设置的签名算法对二进制编码数据进行计算，获取数字签名内容。
在本实施方式中，签名算法具体可以为哈希算法，如SHA算法等，此时，步骤202获取的数字签名内容具体为eBPF字节码的HASH值。
步骤203，采用预先设置的密钥算法获取加密私钥。
在本实施方式中，密钥算法具体可以为非对称加密算法，而本实施方式不对非对称加密算法进行具体的举例说明，在实际的使用过程中，步骤203可以使用任意一种非对称加密算法计算加密私钥。
步骤204，采用加密私钥对数字签名内容进行加密，获取数字签名。
步骤205，将数字签名添加到二进制编码数据中预先设置的签名位置中，获取签名后的二进制编码数据。
为了使后续步骤进行安全性校验时，能够快速准确地查找到数字签名，在本实施方式中，签名位置具体可以为eBPF字节码头部或者尾部，更进一步地，签名位置的长度是预先设置的。例如：如图3所示，签名位置为eBPF字节码头部，其长度为L1，将数字签名添加到该签名位置后，数字签名和eBPF字节码生成签名后的eBPF字节码。
步骤206，将签名后的二进制编码数据加载到Linux内核中。
步骤207，从签名位置中获取数字签名。
例如：如图3所示，步骤207可以从签名后的eBPF字节码的头部获取长度为L1的eBPF字节码作为数字签名。
步骤208，根据密钥算法获取加密公钥。
在本实施方式中，步骤208所使用的密钥算法与步骤203使用的密钥算法相同。
步骤209，采用加密公钥对数字签名进行解密，获取数字签名内容。
根据步骤202所述的技术特征可知，步骤209获取的数字签名内容具体为HASH值，为了便于理解，此处以步骤209获取的数字签名内容是HASH1为例进行说明。
步骤210，采用签名算法对二进制编码数据进行计算，获取数字签名检测内容。
在本实施方式中，步骤210采用的签名算法与步骤202采用的签名算法相同，均为哈希算法，为了便于理解，此处以数字签名检测内容是HASH2为例进行说明。
步骤211，根据数字签名内容和数字签名检测内容的关系，获取安全性校验结果。
具体地，如果数字签名内容和数字签名检测内容相同，即HASH1＝HASH2，则安全性校验结果为校验通过，否则，安全性校验结果为校验失败。
步骤212，如果安全性校验结果为校验通过，执行二进制编码数据对Linux内核进行修改。
需要说明的是，在本实施方式中，如果安全校验失败，可以直接丢弃eBPF字节码，进一步地，还可以发出报警信息，提示遭到网络攻击，Linux内核修改失败。
本申请的第三实施方式涉及一种Linux内核的修改方法，其流程如图4所示，包括：
步骤401，获取用于修改Linux内核的二进制编码数据。
本实施方式以二进制编码数据具体可以为eBPF字节码进行说明，在实际的使用过程中，二进制编码数据还可以为其他形式的编码数据，此处不做一一赘述。
步骤402，采用预先设置的签名算法对二进制编码数据进行计算，获取数字签名内容。
在本实施方式中，签名算法具体可以为哈希算法，如SHA算法等，此时，步骤402获取的数字签名内容具体为eBPF字节码的HASH值。
步骤403，采用预先设置的密钥算法获取加密私钥。
在本实施方式中，密钥算法具体可以为非对称加密算法，而本实施方式不对非对称加密算法进行具体的举例说明，在实际的使用过程中，步骤403可以使用任意一种非对称加密算法计算加密私钥。
步骤404，采用加密私钥对数字签名内容进行加密，获取数字签名。
步骤405，获取签名标识信息。
在本实施方式中，签名标识信息主要用于对数字签名进行标识，该签名标识信息可以是预先设置的，也可以是按照预先设置的规则动态生成的，当然，还可以为其他方式获取的，此处不对每种情况进行一一赘述。本实施方式以签名标识信息是预先设置的64位的“0xff00ff00ff00ff00”为例进行说明。
步骤406，将签名标识信息添加在数字签名之前，生成目标数字签名。
为了便于查找签名标识信息的长度是预先设置的，步骤306将签名标识信息添加到数字签名之前的具体形式可以如图5所示，其中，签名标识信息的长度为L2。
步骤407，将目标数字签名添加到二进制编码数据中预先设置的签名位置中，获取签名后的二进制编码数据。
为了使后续步骤进行安全性校验时，能够快速准确地查找到数字签名，在本实施方式中，签名位置具体可以为eBPF字节码头部或者尾部，更进一步地，签名位置的长度是预先设置的。例如：如图5所示，签名位置为eBPF字节码头部，其长度为L1，将目标数字签名添加到该签名位置后，目标数字签名和eBPF字节码生成签名后的eBPF字节码。
步骤408，将签名后的二进制编码数据加载到Linux内核中。
步骤409，从签名位置中目标获取数字签名。
例如：如图5所示，步骤409可以从签名后的eBPF字节码的头部获取长度为L1+L2的eBPF字节码作为目标数字签名。
步骤410，检测目标数字签名是否包含签名标识信息，获取检测结果。
具体地，例如：如图5所示，从目标数字签名中获取头部长度为L2的eBPF字节码，判断该eBPF字节码是否为“0xff00ff00ff00ff00”，如果是，则检测结果为目标数字签名中包含签名标识信息，否则不包含签名标识信息。
步骤411，如果检测结果为包含签名标识信息，根据密钥算法获取加密公钥。
在本实施方式中，步骤411所使用的密钥算法与步骤403使用的密钥算法相同。
步骤412，采用加密公钥对数字签名进行解密，获取数字签名内容。
根据步骤402所述的技术特征可知，步骤412获取的数字签名内容具体为HASH值，为了便于理解，此处以步骤412获取的数字签名内容是HASH1为例进行说明。
步骤413，采用签名算法对二进制编码数据进行计算，获取数字签名检测内容。
在本实施方式中，步骤412采用的签名算法与步骤402采用的签名算法相同，均为哈希算法，为了便于理解，此处以数字签名检测内容是HASH2为例进行说明。
步骤414，根据数字签名内容和数字签名检测内容的关系，获取安全性校验结果。
具体地，如果数字签名内容和数字签名检测内容相同，即HASH1＝HASH2，则安全性校验结果为校验通过，否则，安全性校验结果为校验失败。
步骤415，如果安全性校验结果为校验通过，执行二进制编码数据对Linux内核进行修改。
需要说明的是，在本实施方式中，如果安全校验失败，可以直接丢弃eBPF字节码，进一步地，还可以发出报警信息，提示遭到网络攻击，Linux内核修改失败。
以上第二和第三实施方式相对于相关技术而言，在达到第一实施方式带来的有益效果的基础上，数字签名是根据二进制编码数据获得的，从而将数字签名与二进制编码数据建立了紧密的关联关系，如果二进制编码数据被恶意篡改，则会导致在Linux内核中获取的数字签名检测内容与数字签名不相同，从而更准确有效地判断出二进制编码数据已经遭到恶意篡改，进一步提高了对Linux内核进行修改的安全性和可靠性。
本申请第四实施方式涉及一种终端设备，如图6所示，包括：至少一个处理器601；以及，与至少一个处理器601通信连接的存储器602；其中，存储器602存储有可被至少一个处理器执行的指令，指令被至少一个处理器601执行，以使至少一个处理器601能够执行本申请第一至五实施方式的信息处理方法。
其中，存储器和处理器采用总线方式连接，总线可以包括任意数量的互联的总线和桥，总线将一个或多个处理器和存储器的各种电路连接在一起。总线还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路连接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口在总线和收发机之间提供接口。收发机可以是一个元件，也可以是多个元件，比如多个接收器和发送器，提供用于在传输介质上与各种其他装置通信的单元。经处理器处理的数据通过天线在无线介质上进行传输，进一步，天线还接收数据并将数据传送给处理器。
处理器负责管理总线和通常的处理，还可以提供各种功能，包括定时，外围接口，电压调节、电源管理以及其他控制功能。而存储器可以被用于存储处理器在执行操作时所使用的数据。
本申请第五实施方式涉及一种计算机可读存储介质，存储有计算机程序。计算机程序被处理器执行时实现上述方法实施例。
即，本领域技术人员可以理解，实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域的普通技术人员可以理解，上述各实施方式是实现本申请的具体实施例，而在实际应用中，可以在形式上和细节上对其作各种改变，而不偏离本申请的精神和范围。

Claims (10)

  1. 一种Linux内核的修改方法，包括：
    获取用于修改Linux内核的二进制编码数据；
    对所述二进制编码数据进行数字签名，获取签名后的二进制编码数据；
    将所述签名后的二进制编码数据加载到所述Linux内核中；
    对签名后的二进制编码数据中的所述数字签名进行安全性校验，获取安全性校验结果；
    如果所述安全性校验结果为校验通过，执行所述二进制编码数据对所述Linux内核进行修改。
  2. 根据权利要求1所述的方法，其中，所述对所述二进制编码数据进行数字签名，获取签名后的二进制编码数据包括：
    采用预先设置的签名算法对所述二进制编码数据进行计算，获取数字签名内容；
    采用预先设置的密钥算法获取加密私钥；
    采用所述加密私钥对所述数字签名内容进行加密，获取所述数字签名；
    将所述数字签名添加到所述二进制编码数据中预先设置的签名位置中，获取签名后的二进制编码数据。
  3. 根据权利要求2所述的方法，其中，所述对签名后的二进制编码数据中的所述数字签名进行安全性校验，获取安全性校验结果包括：
    从所述签名位置中获取所述数字签名；
    根据所述密钥算法获取加密公钥；
    采用所述加密公钥对所述数字签名进行解密，获取所述数字签名内容；
    采用所述签名算法对所述二进制编码数据进行计算，获取数字签名检测内容；
    根据所述数字签名内容和所述数字签名检测内容的关系，获取安全性校验结果。
  4. 根据权利要求2-3中任意一项所述的方法，其中，所述采用所述加密私钥对所述数字签名内容进行加密，获取所述数字签名之后，所述将所述数字签名添加到所述二进制码数据中预先设置的签名位置中，获取签名后的二进制编码数据之前，还包括：
    获取签名标识信息；
    将所述签名标识信息添加在所述数字签名之前，生成目标数字签名；
    所述将所述数字签名添加到所述二进制码数据中预先设置的签名位置中，获取签名后的二进制编码数据包括：
    将所述目标数字签名添加到所述二进制码数据中预先设置的签名位置中，获取签名后的二进制编码数据。
  5. 根据权利要求3所述的方法，其中，所述对签名后的二进制编码数据中的所述数字签名进行安全性校验，获取安全性校验结果包括：
    从所述签名位置中获取所述目标数字签名；
    检测所述目标数字签名是否包含所述签名标识信息，获取检测结果；
    如果检测结果为包含所述签名标识信息，根据所述密钥算法获取加密公钥；
    采用所述加密公钥对所述数字签名进行解密，获取所述数字签名内容；
    采用所述签名算法对所述二进制编码数据进行计算，获取数字签名检测内容；
    根据所述数字签名内容和所述数字签名检测内容的关系，获取安全性校验结果。
  6. 根据权利要求2-5中任意一项所述的方法，其中，所述密钥算法为非对称加密算法。
  7. 根据权利要求2-5中任意一项所述的方法，其中，所述签名算法为哈希算法。
  8. 根据权利要求2-5中任意一项所述的方法，其中，所述签名位置为所述二进制编码数据的头部或者尾部。
  9. 一种终端设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如权利要求1-8中任意一项所述的Linux内核的修改方法。
  10. 一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1-8中任意一项所述的Linux内核的修改方法。
PCT/CN2021/102714 2020-06-28 2021-06-28 Linux内核的修改方法、终端设备和存储介质 WO2022001944A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010599448.5A CN113849859A (zh) 2020-06-28 2020-06-28 Linux内核的修改方法、终端设备和存储介质
CN202010599448.5 2020-06-28

Publications (1)

Publication Number Publication Date
WO2022001944A1 true WO2022001944A1 (zh) 2022-01-06

Family

ID=78972535

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/102714 WO2022001944A1 (zh) 2020-06-28 2021-06-28 Linux内核的修改方法、终端设备和存储介质

Country Status (2)

Country Link
CN (1) CN113849859A (zh)
WO (1) WO2022001944A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114726633B (zh) * 2022-04-14 2023-10-03 中国电信股份有限公司 流量数据处理方法及装置、存储介质及电子设备
CN115495746B (zh) * 2022-11-16 2023-03-21 安超云软件有限公司 一种基于eBPF的安全防护方法、系统及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102024123A (zh) * 2010-12-20 2011-04-20 北京世纪互联工程技术服务有限公司 一种云计算中虚拟机镜像导入方法及装置
CN105787352A (zh) * 2014-12-18 2016-07-20 中兴通讯股份有限公司 一种可执行模块的提供、加载方法及终端
CN106503589A (zh) * 2016-10-26 2017-03-15 北京瑞卓喜投科技发展有限公司 区块链交易信息正确性的校验方法、装置及系统
US20190163502A1 (en) * 2017-11-29 2019-05-30 Forcepoint Llc Method for securely configuring an information system

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102024123A (zh) * 2010-12-20 2011-04-20 北京世纪互联工程技术服务有限公司 一种云计算中虚拟机镜像导入方法及装置
CN105787352A (zh) * 2014-12-18 2016-07-20 中兴通讯股份有限公司 一种可执行模块的提供、加载方法及终端
CN106503589A (zh) * 2016-10-26 2017-03-15 北京瑞卓喜投科技发展有限公司 区块链交易信息正确性的校验方法、装置及系统
US20190163502A1 (en) * 2017-11-29 2019-05-30 Forcepoint Llc Method for securely configuring an information system

Also Published As

Publication number Publication date
CN113849859A (zh) 2021-12-28

Similar Documents

Publication Publication Date Title
US11218325B2 (en) Asset management method and apparatus, and electronic device
US10073916B2 (en) Method and system for facilitating terminal identifiers
US8161285B2 (en) Protocol-Independent remote attestation and sealing
US20170134162A1 (en) System and process for verifying digital media content authenticity
WO2022001944A1 (zh) Linux内核的修改方法、终端设备和存储介质
US20130081144A1 (en) Storage device and writing device
EP3270318B1 (en) Dynamic security module terminal device and method for operating same
US8176555B1 (en) Systems and methods for detecting malicious processes by analyzing process names and process characteristics
EP3313041B1 (en) Application download method and device
US11664970B2 (en) Providing access to a hardware resource based on a canary value
WO2021073247A1 (zh) 基于quic传输协议的通信方法和系统
US9268941B1 (en) Method for secure software resume from low power mode
WO2015196946A1 (zh) 一种JavaCard应用功能扩展的实现方法
CN112583805A (zh) 基于区块链的数据处理方法、装置、电子设备及存储介质
WO2023147744A1 (zh) 密钥状态检测方法、装置、设备及介质
CN111400771A (zh) 目标分区的校验方法及装置、存储介质、计算机设备
CN114978649B (zh) 基于大数据的信息安全保护方法、装置、设备及介质
US12003370B2 (en) Dynamic internet of things device records for use in validating communications from internet of things devices subject to data drift
CN111625846B (zh) 一种移动终端设备的系统状态记录方法
US20240031166A1 (en) Web-side data signature method and apparatus and computer device
US11799857B2 (en) Software posture for zero trust access
CN114398678A (zh) 电子文件防篡改的登记验证方法、装置、电子设备及介质
US20230259606A1 (en) Asset Access Control Method, Apparatus, Device, and Medium
CN111241005A (zh) 一种基于键值对的安全分区存储方法及系统
CN110874225A (zh) 一种数据校验方法、装置、嵌入式设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21831974

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 15.05.2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21831974

Country of ref document: EP

Kind code of ref document: A1