Checking method, checking device and checking system for processor

• US 10,642,981 B2
• Filed: 02/13/2018
• Issued: 05/05/2020
• Est. Priority Date: 02/20/2017
• Status: Active Grant

• Current Assignee: Wuxi Research Institute of Applied Technologies Tsinghua University
• Original Assignee: Wuxi Research Institute of Applied Technologies Tsinghua University
• Inventors: Liu, Leibo, Luo, Ao, Wei, Shaojun
• Primary Examiner(s): Schmidt, Kari L
• Application Number:
  US15/895,992
• Publication Number:
  US 20180239899A1
• Time in Patent Office: 812 Days
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A checking method for a processor is provided. The checking method first determines whether a checked processor satisfies a security-sensitive condition including one or more of security-sensitive instruction, processor running mode, security-sensitive input/output operation, security-sensitive application, and user-defined security level. Then, the checking method checks the checked processor according to a determination result, which further includes: when the checked processor satisfies the security-sensitive condition, checking the checked processor according to a first checking mode; and when the checked processor does not satisfy the security-sensitive condition, checking the checked processor according to a second checking mode; wherein for the same running process of the checked processor, a total checking length of the first checking mode is longer than that of the second checking mode. Also provided is a checking device for a processor and a checking system for a processor.

Claims

1. A checking method for a checked processor, comprising:

determining, by a checking processor, whether the checked processor satisfies a security-sensitive condition including one or more of security-sensitive instruction, processor running mode, security-sensitive input/output operation, security-sensitive application, and user-defined security level, wherein the processor running mode includes an authority level of the checked processor in runtime; and

checking, by the checking processor, the checked processor according to the determination result during at least a part of one running process of the checked processor, wherein checking the checked processor further comprises;

when the checked processor satisfies the security-sensitive condition, checking the checked processor according to a first checking mode during at least a first part of said one running process based on a total checking length of the first checking mode; and

when the checked processor does not satisfy the security-sensitive condition, checking the checked processor according to a second checking mode during at least a second part of said one running process based on a total checking length of the second checking mode;

wherein for said one running process of the checked processor, the total checking length of the first checking mode is longer than the total checking length of the second checking mode, and the longer the total checking length is, the greater a corresponding checking coverage of the total checking length is, wherein checking the checked processor according to the first checking mode comprises prolonging a checking length of a check of the checked processor by the checking processor, increasing the number of checks of the checked processor during said one running process of the checked processor by the checking processor, or both.

2. The checking method of claim 1, wherein, for said one running process of the checked processor, the total checking length of the first checking mode being longer than the total checking length of the second checking mode comprises:

for said one running process of the checked processor, the length of at least one check of the first checking mode being longer than that of the second checking mode; and

/or

for said one running process of the checked processor, the number of checks of the first checking mode being longer than that of the second checking mode.

3. The checking method of claim 1, wherein, when the security-sensitive condition comprises security-sensitive instruction, said determining whether the checked processor satisfies security-sensitive condition comprises:

determining whether the frequency of the security-sensitive instruction executed by the checked processor so far is equal to or longer than a preset threshold.

4. The checking method of claim 1, wherein, when the security-sensitive condition comprises security-sensitive input/output operation, said determining whether the checked processor satisfies security-sensitive condition comprises:

determining whether the frequency of the security-sensitive input/output operation executed by the checked processor so far is equal to or longer than a preset threshold.

5. The checking method of claim 1, wherein, when the security-sensitive condition comprises processor running mode, said determining whether the checked processor satisfies security-sensitive condition comprises:

determining whether the checked processor is currently running in the processor running mode.

6. The checking method of claim 1, wherein, when the security-sensitive condition comprises security-sensitive application, said determining whether the checked processor satisfies security-sensitive condition comprises:

determining whether the security-sensitive application is currently running on the checked processor.

7. The checking method of claim 1, wherein, when the security-sensitive condition comprises user-defined security level, said determining whether the checked processor satisfies security-sensitive condition comprises:

determining whether the current security level of the checked processor belongs to the user-defined security level.

8. The checking method of claim 1, wherein, before determining whether the checked processor satisfies security-sensitive condition, the method further comprises:

acquiring instruction stream output by the checked processor;

said determining whether the checked processor satisfies security-sensitive condition comprises;

determining whether the checked processor satisfies security-sensitive condition according to the distribution characteristic of the security-sensitive instruction in the instruction stream.

9. The checking method of claim 1, further comprising:

generating an interference signal in the checked processor when the checked processor is not being checked, so that a Trojan perceptible state in the checked processor not being checked is consistent with a Trojan perceptible state in the checked processor being checked.

10. A checking system, comprising:

a checking processor;

an input/output recorder;

a non-transitory computer readable storage medium stored with programs which, when executed by the checking processor, cause the checking processor to perform operations comprising;

determining, by the checking processor, whether a checked processor satisfies a security-sensitive condition including one or more of security-sensitive instruction, processor running mode, security-sensitive input/output operation, security-sensitive application, and user-defined security level, wherein the processor running mode includes an authority level of the checked processor in runtime; and

checking, by the checking processor, the checked processor according to the determination result during at least a part of one running process of the checked processor, wherein checking the checked processor further comprises;

when the checked processor satisfies the security-sensitive condition, checking the checked processor according to a first checking mode during at least a first part of said one running process based on a total checking length of the first checking mode; and

when the checked processor does not satisfy the security-sensitive condition, checking the checked processor according to a second checking mode during at least a second part of said one running process based on a total checking length of the second checking mode;

wherein for said one running process of the checked processor, the total checking length of the first checking mode is longer than the total checking length of the second checking mode, and the longer the total checking length is, the greater a corresponding checking coverage of the total checking length is, wherein checking the checked processor according to the first checking mode comprises prolonging a checking length of a check of the checked processor by the checking processor, increasing the number of checks of the checked processor during said one running process of the checked processor by the checking processor, or both.

11. The checking system of claim 10, wherein, for said one running process of the checked processor, the total checking length of the first checking mode being longer than the total checking length of the second checking mode comprises:

for said one running process of the checked processor, the length of at least one check of the first checking mode being longer than that of the second checking mode; and

/or

for said one running process of the checked processor, the number of checks of the first checking mode being longer than that of the second checking mode.

12. The checking system of claim 10, wherein, said determining whether a checked processor satisfies a security-sensitive condition comprises:

determining whether the frequency of the security-sensitive instruction executed by the checked processor so far is equal to or longer than a preset threshold.

13. The checking system of claim 10, wherein, said determining whether a checked processor satisfies a security-sensitive condition comprises:

determining whether the frequency of the security-sensitive input/output operation executed by the checked processor so far is equal to or longer than a preset threshold.

14. The checking system of claim 10, wherein, said determining whether a checked processor satisfies a security-sensitive condition comprises:

determining whether the checked processor is currently running in the processor running mode.

15. The checking system of claim 10, wherein, said determining whether a checked processor satisfies a security-sensitive condition comprises:

determining whether the security-sensitive application is currently running on the checked processor.

16. The checking system of claim 10, wherein, said determining whether a checked processor satisfies a security-sensitive condition comprises:

determining whether the current security level of the checked processor belongs to the user-defined security level.

17. The checking system of claim 10, the operations performed by the checking processor further comprise:

acquiring instruction stream output by the checked processor;

said determining whether the checked processor satisfies security-sensitive condition comprises;

determining whether the checked processor satisfies security-sensitive condition according to the distribution characteristic of the security-sensitive instruction in the instruction stream.

18. The checking system of claim 10, the operations performed by the checking processor further comprise:

generating an interference signal in the checked processor when the checked processor is not being checked, so that a Trojan perceptible state in the checked processor not being checked is consistent with a Trojan perceptible state in the checked processor being checked.