CN106845238A - A kind of cloud host operating system reinforcement means - Google Patents

Abstract

The invention provides a kind of cloud host operating system reinforcement means, comprise the following steps：1）Chock code is inserted in the module of operating system, chock code can be triggered and be absorbed in SMM SMM actions；2）After triggering, CPU is switched under SMM SMM, and detection module is verified to operating system integrality, and detection Malware is distorted to operating system.The method of the program is verified under SMM SMM mode to operating system important module, and method of calibration is realized based on HASH methods, and corresponding Hash numerical value deposits in system management ram（System Management RAM,SMRAM）In space, because client's domain system software can not usually access the spatial data, therefore scan module and hash file storehouse are transparent to upper strata operating system, possess greater security.

Description

A cloud host operating system reinforcement method

technical field

The invention relates to a method for strengthening the operating system of a cloud host.

Background technique

In the prior art, the known technology is that System Management Mode (System Management Mode, SMM) is the execution mode that Intel introduced into the x86 architecture after the 386SL. It is one of the four operating modes of the CPU, and the other three are real mode, protected mode, v86 mode. SMM can only be entered through a System Management Interrupt (SMI), and can only be exited by executing an RSM instruction. The SMM mode is transparent to the operating system. In other words, the operating system does not know when the system enters the SMM mode, nor can it perceive that the SMM mode has been executed.

With the continuous upgrading of Internet bandwidth, the application of cloud computing in daily life has become quite popular. Computer security issues, such as viruses, Trojan horses, etc. leading to data leakage and data tampering, have also become more serious. In the above background, solving the security issues facing the operating system and ensuring the security of the cloud client system has become an important key technical point of computer security.

Contents of the invention

The purpose of the present invention is to provide a technical solution for the existing deficiencies in the prior art. The method of the solution is to verify the important modules of the operating system under the system management mode SMM mode, and the verification method is realized based on the HASH method , and the corresponding Hash value is stored in the system management RAM (SMRAM) space. Since the client domain system software generally cannot access the data in this space, the scanning module and the Hash file library are transparent to the upper operating system and have higher safety.

This scheme is realized by following technical measure: 1. a kind of cloud host operating system reinforcement method, it is characterized in that comprising the steps:

1) Insert the wedge code into the module of the operating system, and the wedge code will trigger the action of falling into the system management mode SMM;

2) After triggering, the CPU switches to the system management mode SMM, and the execution program entry address will be different every time it enters SMM. The detection module verifies the integrity of the operating system and detects the tampering of the operating system by malicious software.

The verification is implemented using the HASH algorithm.

The HASH value corresponding to the HASH algorithm is stored in the space of the system management memory SMRAM.

The HASH value is encrypted by the TPM chip.

Create a whitelist for HASH values in the system management mode SMM, so that the HASH algorithm can be executed normally.

The white list includes special software and the data structure of the operating system, the special software includes anti-virus software, and the data structure includes a GDT table and a driver.

The location of the wedge code insertion is selected to be the entry location of the kernel code pointed to by the sysenter and syscall instructions.

The beneficial effect of this scheme can be known according to the narration to above-mentioned scheme, because insert wedge code in the key module of operating system in this scheme, this code can trigger and fall into SMM action, after triggering successfully, CPU will switch under the SMM mode, At this time, the detection module verifies the integrity of the operating system to detect tampering of the operating system by malicious software. Wedge code insertion position, the entry position of the kernel code pointed to by the sysenter and syscall instructions is selected here. Everything is masked in SMM mode, including all interrupts. The programs executed in the SMM mode are called SMM handlers, and all SMM handlers can only run in the space of System Management RAM (SMRAM). The operating system cannot access this space, and malware and viruses generally cannot access this space, so the scanning module has a strong isolation type, and the SMM processing program can access the entire memory space; each time after entering SMM, the execution program entry address is not will be the same, making it more difficult to trace SMM execution.

The Hash value is encrypted by the TPM chip. Even if a third party can obtain these values, decryption and modification of these data will have higher complexity. Encryption and decryption operations based on the TPM chip reduce the CPU's calculation task load and save system resources, reducing the time interval between each inspection execution

This solution is based on the whitelist method to verify the Hash value. Adding to the whitelist mainly includes the main data structure of the operating system and some special application software. The important data structure of the operating system includes GDT tables, drivers, etc.; the special application software mainly includes special programs such as anti-virus software. This solution is also suitable for verifying the integrity of the operating system running in the physical machine, and can also verify the integrity of the operating system running in the virtual domain. The method can not only verify the integrity of the operating system running in the virtual domain, but also can verify the integrity of the important data structure of the hypervisor layer, and provide a more complete data verification function for the cloud computing environment.

It can be seen that, compared with the prior art, the present invention has outstanding substantive features and remarkable progress, and the beneficial effects of its implementation are also obvious.

detailed description

In order to clearly illustrate the technical features of the solution, the solution will be described below through a specific implementation manner.

The cloud host operating system reinforcement method in this solution includes the following steps:

1) Insert the wedge code into the module of the operating system, and the wedge code will trigger the action of falling into the system management mode SMM;

2) After triggering, the CPU switches to the system management mode SMM, and the execution program entry address will be different every time it enters SMM. The detection module verifies the integrity of the operating system and detects the tampering of the operating system by malicious software.

The verification is implemented using the HASH algorithm, the HASH value corresponding to the HASH algorithm is stored in the space of the system management memory SMRAM, the HASH value is encrypted by the TPM chip, and a white list is established for the HASH value in the system management mode SMM, so that The HASH algorithm is normally executed, and the white list includes special software and the data structure of the operating system. The special software includes antivirus software, and the data structure includes a GDT table and a driver.

The location of the wedge code insertion is selected to be the entry location of the kernel code pointed to by the sysenter and syscall instructions.

The present invention is not limited to the above-mentioned specific implementation methods, and changes, modifications, additions or substitutions made by those skilled in the art within the essential scope of the present invention should also fall within the protection scope of the present invention.

Claims (7)

1. A cloud host operating system reinforcement method is characterized in that comprising the steps: 1) Insert the wedge code into the module of the operating system, and the wedge code will trigger the action of falling into the system management mode SMM; 2) After triggering, the CPU switches to the system management mode SMM, and the execution program entry address will be different every time it enters SMM. The detection module verifies the integrity of the operating system and detects the tampering of the operating system by malicious software. 2. The cloud host operating system reinforcement method according to claim 1, characterized in that: the verification is implemented using a HASH algorithm. 3. The cloud host operating system reinforcement method according to claim 2, characterized in that: the HASH value corresponding to the HASH algorithm is stored in the space of the system management memory SMRAM. 4. The cloud host operating system reinforcement method according to claim 3, characterized in that: the HASH numerical type is encrypted by the TPM chip. 5. The cloud host operating system reinforcement method according to claim 4, characterized in that: in the system management mode SMM, a whitelist is established for HASH values, so that the HASH algorithm can be executed normally. 6. The cloud host operating system reinforcement method according to claim 4, characterized in that: the white list includes special software and the data structure of the operating system, the special software includes antivirus software, and the data structure includes a GDT table, driver. 7. The cloud host operating system reinforcement method according to claim 1, characterized in that: the position for inserting the wedge code is selected to be the entry position of the kernel code pointed to by the sysenter and syscall instructions.