Process memory protecting method based on auxiliary virtualization technology for hardware

Abstract

The invention provides a process memory safety protecting method based on auxiliary virtualization for hardware. The method comprises the following steps: 1, loading a process memory monitoring module; step 2, informing the monitoring module during the starting of a protected process; step 3, creating an encrypted copy for a protected internal memory space of the protected process; step 4, realizing internal memory virtualization to a virtual machine system by using a shadow page table mechanism; step 5: acquiring rewritten operation and page fault abnormality of a CR3 register. The process memory safety protecting method provided by the invention has the advantages as follows: the monitoring module working at a Root stage is created to monitor page directories, page tables and modification of a page directory register in all processes so as to prevent any process except the protected process from visiting data in the memory space of the protected process, when the protected process is switched to a core state, a page in a user-mode space is replaced so as to prevent codes in a kernel mode from injection attacks, and a data execution prevention technology is used for setting the page of the data area of the protected process to be non-executable. Therefore, codes in the user mode are prevented from injection attacks.

Description

technical field [0001] The invention relates to a memory safety protection method, in particular to a memory safety protection method based on hardware-assisted virtualization technology for effectively protecting the memory safety of a protected process accessing confidential files. Background technique [0002] Computer security services include three aspects: confidentiality, integrity, and availability. Among them, confidentiality refers to the hiding of information or resources to prevent access by unauthorized users. Integrity refers to the trustworthiness of data or resources, that is, information cannot be modified without authorization. Integrity mainly includes two aspects: data integrity and software integrity. Data integrity means that the data stored in the computer system or the data in transmission on the network will not be illegally tampered with or accidentally destroyed, ensuring the integrity of the data as a whole. Integrity; and software integrity ref...

AI Technical Summary

Problems solved by technology

[0003] There are two security issues involved in the processing of confidential information in the computer: the first point is the security issue stored in the external storage device; the second point is the security issue loaded into the memory

For example, the SP3 model proposes the concept of a protection domain. By setting the access rights of the protection domain to specified physical pages and combining encryption technology, the memory of the protected application is protected. The problem with this method is: the process can run Temporarily attach the thread it is in to the target process by means of dynamic attachment, then the current thread has full access to the memory space of the target process

The Cherub model provides protection by dynamically encrypting and decrypting its memory pages during the running of the application. Although this method can protect the application memory, the overhead of dynamic encryption and decryption will have a certain impact on system performance.

Images