Processor checking method, checking device and checking system

Patent metadata

Field	Value
Publication number	US-11062020-B2
Application number	US-201916250126-A
Country	US
Kind code	B2
Filing date	Jan 17, 2019
Priority date	Feb 9, 2018
Publication date	Jul 13, 2021
Grant date	Jul 13, 2021

Abstract

The present disclosure provides a processor checking method, a checking device and a checking system. The method includes acquiring an access record to a memory by a processor during a running process, the access record includes a read operation information and a corresponding time information, determining whether there is a read operation information corresponding to a high access authority in the access record, and when there is a read operation information corresponding to a high access authority, determining whether the read operation information corresponding to the high access authority belongs to an unauthorized operation. According to embodiments of the present disclosure, the behavior of the processor reading data from the memory is checked and analyzed, thereby preventing the security problems caused by malicious use of unauthorized reading operation.

First claim

What is claimed is:

1. A processor checking method, comprising:
acquiring an access record of a processor to a memory during a running process, wherein the access record comprises] at least one read operation information and corresponding time information;
acquiring an information of an address space corresponding to a high access authority;
determining whether there is a first read operation information falling in the address space corresponding to the high access authority according to address items of respective read operation information in the access record; and
when there is the first read operation information corresponding to the high access authority, determining whether the first read operation information corresponding to the high access authority belongs to an unauthorized operation.

2. The method according to claim 1 , wherein, determining whether the first read operation information corresponding to the high access authority belongs to the unauthorized operation comprises:
setting a time window according to a time information of the first read operation information corresponding to the high access authority; and
determining whether an access authority of the processor is a high access authority within the time window.

3. The method according to claim 2 , wherein, determining whether the access authority of the processor is the high access authority within the time window comprises:
determining whether there is a record of the high access authority in an access authority record of the processor within the time window.

4. The method according to claim 2 , wherein, a length of the time window is greater than a sum of a prefetch time difference and a time overhead of reading data from the memory.

5. The method according to claim 1 ,
wherein, when the processor comprises a multi-core processor, the access record further comprises an identifier of a processor core to which the at least one read operation information belongs.

6. The method according to claim 1 , wherein, when determining that the first read operation information corresponding to the high access authority belongs to the unauthorized operation, the method further comprises:
saving an information corresponding to the unauthorized operation and sending a security alert to a user.

7. The method according to claim 1 , wherein, the method further comprises:
utilizing an input and output recorder to record access operations of the processor to the memory during the running process, wherein the input and output recorder is between the processor and the memory,
wherein the acquiring an access record of the processor to the memory during the running process comprises reading the access record from the input and output recorder.

8. A processor checking device, comprising:
one or more checking processors; and
a memory, configured to store one or more programs,
wherein the one or more programs, when executed by the one or more checking processors, cause the one or more checking processors to perform processor checking operations comprising:
acquiring an access record of a processor to a memory during a running process, wherein the access record comprises at least one read operation information and corresponding time information;
acquiring an information of an address space corresponding to a high access authority;
determining whether there is a first read operation information falling in the address space corresponding to the high access authority according to address items of respective read operation information in the access record; and
determining whether the first read operation information corresponding to the high access authority belongs to an unauthorized operation, when there is the first read operation information corresponding to the high access authority.

9. The checking device according to claim 8 , wherein, the one or more programs, when executed by the one or more checking processors, further cause the one or more checking processors to perform processor checking operations comprising:
setting a time window according to a time information of the first read operation information corresponding to the high access authority; and
determining whether an access authority of the processor is a high access authority within the time window.

10. The checking device according to claim 9 , wherein, the one or more programs, when executed by the one or more checking processors, further cause the one or more checking processors to perform processor checking operations comprising: determining whether there is a record of the high access authority in an access authority record of the processor within the time window.

11. The checking device according to claim 9 , wherein, a length of the time window is greater than a sum of a prefetch time difference and a time overhead of reading data from the memory.

12. The checking device according to claim 8 , wherein, when the processor comprises a multi-core processor, the access record further comprises an identifier of a processor core to which the at least one read operation information belongs.

13. The checking device according to claim 8 , the one or more programs, when executed by the one or more checking processors, further cause the one or more checking processors to perform processor checking operations comprising:
saving an information corresponding to the unauthorized operation and sending a security alert to user.

14. The checking device according to claim 8 , the one or more programs, when executed by the one or more checking processors, further cause the one or more checking processors to perform processor checking operations comprising:
utilizing an input and output recorder to record access operations of the processor to the memory during the running process, wherein the input and output recorder is between the processor and the memory; and
wherein the acquiring an access record of the processor to the memory during the running process comprises reading the access record from the input and output recorder.

15. A non-transitory computer-readable storage medium storing instructions capable of executing processor checking operations comprising:
acquiring an access record of a processor to a memory during a running process, wherein the access record comprises at least one read operation information and corresponding time information;
acquiring an information of an address space corresponding to a high access authority;
determining whether there is a first read operation information falling in the address space corresponding to the high access authority according to address items of respective read operation information in the access record; and
when there is the first read operation information corresponding to the high access authority, determining whether the first read operation information corresponding to the high access authority belongs to an unauthorized operation.

Assignees

• Univ Tsinghua

Inventors

• Liu Leibo
• Luo Ao
• Yin Shouyi
• Wei Shaojun

Classifications

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• G06F21/71 Primary

  to assure secure computing or processing of information · CPC title