Information-processing device, information-processing method, and recording medium that block intrusion of malicious program to kernel
OwnerJunko Suginakainventor
Life of this patent
Estimating the term…
Abstract
An information processing device (1) includes: a Syscall instruction monitoring part (313) configured to monitor at least an instruction to pass processing to a kernel (35) of an OS among instructions issued to a CPU (11); and an exclusive loader (201) configured to load a monitoring software (31) functioning as the Syscall instruction monitoring part (313) at region A in a RAM (30), the monitoring software set at ring 0 that is higher than ring (2) set for the kernel (35) of the OS. Even when an access is tried to a resource by executing a malicious program, the access can be detected and intrusion of the malicious program to the kernel can be blocked.
Claims7
An information processing device that blocks intrusion of a malicious program to a kernel, the information processing device comprising:
- a main memory configured to store a monitoring software, the monitoring software having a privilege level set higher than a privilege level of a kernel of an OS;
- a loader configured to load the monitoring software at a predetermined region of the main memory during starting after loading BIOS;
- a secondary loader included in the monitoring software loaded by the loader, the secondary loader being configured to load the kernel of the OS after loading the monitoring software;
- and
- a processor configured to communicate with the main memory and perform operation based on the monitoring software, wherein:
- the processor monitors at least a Syscall instruction to pass processing to the kernel of the OS among instructions issued to the processor, and monitors, as a privilege level fault, an access to request for rewriting a Disable bit to which a hook condition for hooking issuance of the Syscall instruction is set, the Disable bit being one register in a Model Specific Register in a chip set, and prevents rewriting;
- and
- the processor is configured to set the hook condition to the Disable bit of the one register by detecting an access to request for rewriting the hook condition as a general protection exception fault by an interrupt handler and correcting the hook condition with respect to the Disable bit of the one register every time issuance of the access to request for rewriting is detected as the general protection exception fault.
A method of processing information, the method blocking intrusion of a malicious program to a kernel, the method comprising:
- loading a monitoring software at a predetermined region of a main memory of a processor after loading BIOS, the monitoring software having a privilege level set higher than a privilege level of a kernel of an OS, the monitoring software then loading the kernel of the OS;
- and
- causing the processor to perform monitoring operations by the monitoring software including:
- monitoring at least a Syscall instruction to pass processing to the kernel of the OS among instructions issued to the processor, and monitoring, as a privilege level fault, an access to request for rewriting a Disable bit of one register in a Model Specific Register to which a hook condition for hooking issuance of the Syscall instruction is set, the Model Specific Register being in a chip set, and prevents rewriting;
- and
- setting the hook condition to the Disable bit of the one register by detecting an access to request for rewriting the hook condition as a general protection exception fault by an interrupt handler and correcting the hook condition with respect to the Disable bit of the one register every time issuance of the access to request for rewriting is detected as the general protection exception fault.
Dependencies are inferred from the claim text.