公开(公告)号：US20190294798A1

公开(公告)日：2019-09-26

申请号：US16109870

申请日：2018-08-23

Applicant: HUAZHONG UNIVERSITY OF SCIENCE AND TECHNOLOGY

Inventor： Hai JIN ,  Weiqi Dai ,  Jun Deng ,  Deqing Zou

IPC: G06F21/57 ,  G06F21/53 ,  G06F21/44 ,  G06F21/62 ,  H04L29/06 ,  G06F9/54

Abstract: The present invention provides a TrustZone-based security isolation system for shared library, the system at least comprising: a sandbox creator, a library controller, and an interceptor, the sandbox creator, in a normal world, dynamically creating a sandbox isolated from a Rich OS, the interceptor, intercepting corresponding system-calling information and/or Android framework APIs by means of inter-process stack inspection, the library controller, performing analysis based on the intercepted system-calling information and/or Android framework APIs, redirecting a library function to the sandbox, and switching calling states of the library function in the sandbox as well as setting up a library authority. The present invention has good versatility, low cost and high security. It realizes isolation of the library without increasing the trusted bases in the Secure World of the TrustZone, effectively reducing the risk of being attacked.

公开(公告)号：US10754953B2

公开(公告)日：2020-08-25

申请号：US16109870

申请日：2018-08-23

Applicant: HUAZHONG UNIVERSITY OF SCIENCE AND TECHNOLOGY

Inventor： Hai Jin ,  Weiqi Dai ,  Jun Deng ,  Deqing Zou

IPC: G06F21/57 ,  G06F9/54 ,  G06F21/44 ,  G06F21/53 ,  G06F21/62 ,  H04L29/06

Abstract: The present invention provides a TrustZone-based security isolation system for shared library, the system at least comprising: a sandbox creator, a library controller, and an interceptor, the sandbox creator, in a normal world, dynamically creating a sandbox isolated from a Rich OS, the interceptor, intercepting corresponding system-calling information and/or Android framework APIs by means of inter-process stack inspection, the library controller, performing analysis based on the intercepted system-calling information and/or Android framework APIs, redirecting a library function to the sandbox, and switching calling states of the library function in the sandbox as well as setting up a library authority. The present invention has good versatility, low cost and high security. It realizes isolation of the library without increasing the trusted bases in the Secure World of the TrustZone, effectively reducing the risk of being attacked.