WO2007022686A1 - System and method for isolating operating system - Google Patents

Abstract

A system and method for performing isolation of the operating system. The system includes a primary OS (operating system) module, at least a secondary OS module including any modify information of the primary OS module by the user, a system isolation module, and an access and control module of the external memory recording the unshared disk space of the primary/secondary OS module. The secondary OS module is booted and/or installed, the unshared space and blank space of the primary/secondary OS module are specified and/or modified by the system isolation module according to the user’s instructions, and the access of read from or write to the disk by the primary/secondary OS is monitored. The different OS environments may be found without occupying more disk spaces by the system and method for performing isolation of the operating system of the invention. The OS may be isolated, the redundancy of the system may be reduced, the security and the reliability of the system may be increased, and the information of user under different secondary OS may be protected according to the invention.

Description

 System and method for realizing operating system isolation

 The present invention relates to a system and method for implementing operating system isolation, and more particularly to a system and method for completely isolating storage space in an operating system, and belongs to the field of computer operating systems and computer security. Background technique

 The computer operating system is the most important system in a computer, it is used to manage computer hardware devices, and provides an operating environment for various application software. Therefore, the reliability and security of the operating system is very important.

 Today, more and more applications are deployed in a single operating system environment, making the user computing environment complex and more difficult to manage and maintain. More importantly: Today, with the proliferation of viruses and software, such a complex computing environment has undoubtedly made various computer security protection technologies full of vulnerabilities.

 For home users: The role of computers in family life is increasingly important, with users performing various applications on the computer, such as games, entertainment, surfing the Internet, watching movies, processing images, videos, and even conducting electronic transactions on the Internet. These applications are simply installed into a single operating system environment, making the application environment extremely complex, directly causing system overload and instability, frequent downtime, and data loss. Although it is possible to install multiple operating systems in a computer to implement different applications, this in turn causes management complexity and waste of computing resources. On the other hand, home users generally lack the knowledge and experience of computer maintenance and security, which makes home computers exposed to the network unprotected, often attacked by viruses and hackers, when users are infected with viruses and spyware. When computers play games and surf the Internet, they are attacked by hackers and cause personal privacy to be compromised. What's more serious is: If you use such an environment to conduct electronic transactions on the Internet, it will give hackers the ability to steal 4 account accounts. In addition, for home computer applications, multi-users are already a common phenomenon. Although the current operating system supports multi-user functions, this multi-user function does not really isolate the software environment and data environment of different users. When a user environment is destroyed, the direct consequence is that the entire computer operating system environment is caused. collapse. All in all, for home users, what they need most is a multi-application, multi-user isolated and computer with independent security defenses, which simplifies computer maintenance and improves computer security.

For enterprise computer users: In order to maintain market competitiveness, the corporate IT department must Always meet the growing demand for advanced information technology and IT services, while controlling the frequency of computer failures, reducing maintenance costs and impacts, and continuously improving the security of enterprise information to reduce IT infrastructure. Overall cost. This puts higher demands on the manageability and security of the computer. In an enterprise IT environment, applications deployed in a single computer environment are becoming more and more complex, directly reducing the stability and reliability of the computer, thereby increasing the frequency of computer failures, increasing IT management costs and causing serious as a result of. On the other hand, enterprises need to isolate the enterprise IT application environment from the employee's private environment, so as to avoid corporate information leakage and improve the security of the enterprise's IT system.

 For government computer users: In government departments that pay special attention to IT security, the isolation of intranets and extranets is a basic requirement for IT applications. At present, the government departments use the one-person dual-machine or hardware isolation to isolate the internal network and the external network, thus ensuring the security of the government information system. But either method requires a higher IT investment, but also increases the difficulty and complexity of IT management, and lacks good application scalability.

 For educational computer users: In the education industry, in order to meet different teaching purposes, IT administrators need to frequently distribute new operating systems and software for computers. In addition, the software system of the computer is often destroyed. IT administrators need to quickly repair the operating system and application environment in order not to affect the teaching. This greatly increases the complexity and difficulty of computer management, and places high demands on the efficiency of computer management.

 In summary, in IT applications, computer manageability, maintainability, and computer security issues have caused huge time and economic costs for computer consumers and enterprises; while the prior art is solving computer security. There are flaws in terms of sex and reliability, as well as protection of user privacy. Therefore, a technical solution is needed to install application software for application purposes in an isolated operating system environment to ensure the security and reliability of the application software. It also protects user data and privacy through an isolated operating system, and the solution does not take up too much disk space and does not require additional hardware investment. Summary of the invention

 The object of the present invention is to form one or more isolated operating system operating environments by intercepting disk read/write operations and mapping read/write operations to the disk into one or more non-overlapping disk spaces. .

To achieve the above objective, the present invention provides a system for implementing operating system isolation, including: a parent operating system module, the parent operating system module including an operating system kernel, Providing a software program for completing the basic functions necessary for the operating system; the parent operating system module reads and accesses the exclusive disk space and the disk blank space;

 At least one sub-operating system module, including any modification information made by the user to the parent operating system module; interacting with the parent operating system module to perform read access to the exclusive disk space of the parent operating system module; The guest operating system module has read/write access to its exclusive disk space and disk blank space;

 a system isolation module, the system isolation module interacts with the parent operating system module, and is configured to guide and/or establish a child operating system module according to a user instruction, and specify and/or modify the exclusive use of the parent/child operating system module. Disk space and disk blank space; the system isolation module further interacts with the parent/child operating system module to monitor read/write access of the parent/child operating system module to the disk; and an external access control module And interacting with the system isolation module to record exclusive disk space of the parent/child operating system module.

 To achieve the above object, the present invention also provides a method for implementing operating system isolation, including the following steps:

 Step 1. The system isolation module monitors the read/write access of the current sub-operating system module to the disk. Step 2. If it is a read access, the system isolation module returns the parent operating system module and/or the current sub-operation according to the record of the external access control module. The system module exclusively enjoys the data in the disk space;

 Step 3. If it is a write access, the system isolation module writes the exclusive disk space or the disk blank space of the current guest operating system module according to the record of the external access control module, and modifies the record of the external access control module.

 Therefore, the present invention has the following advantages:

 The system and method for implementing operating system isolation according to the present invention can create different and mutually isolated sub-operating system modules based on a single operating system without occupying more disk space, and the user can flexibly select and use;

 2. The system and method for realizing operating system isolation by using the present invention can selectively install application software according to the purpose of creating each sub-operating system module, reduce the number of application software in each operating environment, reduce system redundancy, and increase System security and reliability;

 3. The system and method for implementing operating system isolation using the present invention, the insecure factors of each sub-operating system module do not affect other sub-operating system modules, and increase the security and reliability of the system;

4. The system and method for implementing operating system isolation using the present invention can protect information of users under different sub-operating system modules. The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. DRAWINGS

 1 is a structural diagram of an embodiment of a system for implementing operating system isolation according to the present invention; FIG. 2 is a schematic diagram of an embodiment of an external storage access control module of the system provided by the present invention; FIG. 4 is a schematic diagram of a system for monitoring and intercepting disk I/O access by an isolation module of the system provided by the present invention; FIG.

 5 is a schematic diagram of a system based on a virtual machine computer architecture of the system provided by the present invention; FIG. 6 is a schematic diagram of a system according to still another embodiment of a virtual machine computer architecture provided by the system of the present invention;

 7 is a schematic diagram of a disk space distribution of a system provided by the present invention;

 FIG. 8 is a flow chart of an embodiment of a method for implementing operating system isolation according to the present invention. detailed description

 Embodiments of the system for implementing operating system isolation of the present invention:

 Referring to FIG. 1, the parent operating system module 1, the child operating system module 21, the child operating system module 22, the system isolation module 3, and the external memory access control module 4 are included.

 The parent operating system module 1 may include only one operating system kernel for performing the most basic functions, and the operating system kernel refers to a software program for providing basic functions necessary for the operating system; the operating system kernel that performs the most basic functions may be Linux. Or the kernel of Unix or Windows.

 In addition to including the operating system kernel, the parent operating system module 1 may also include software programs other than the operating system kernel, including applications other than the operating system kernel and the operating system kernel, to provide the basic functions necessary for the operating system and User preset function. For example, if the administrator has Office software in all operating environments, the Office software can be installed in the parent operating system module 1.

The guest operating system modules may be one or more, including any modification information made to the parent operating system module 1. The two operating systems are described as an example. The sub-operating system module 21 installs the Office software, the translation software, and other computing software programs on the basis of the parent operating system module 1 and shields the IE; the sub-operating system module 21 Together with the parent operating system module 1 constitutes a complete office operating system environment, can perform word processing and data calculation, but can not access the Internet; the sub-operating system module 22 is in the parent operating system module 1! ^The game software installed on it Together with the multimedia player software, the same operating system module 1 constitutes a complete entertainment operating system environment, which can play games, watch video files and access the Internet. The number of guest operating system modules is unlimited if the computer's disk space allows.

 The sub-operating system modules 21 and 22 respectively interact with the parent operating system module 1 to perform read access to the data in the exclusive disk space of the parent operating system module 1. The guest operating system modules 21 and 22 each have their own exclusive disk space, which allows read/write access to their exclusive disk space and disk blank space.

 The system isolation module 3 monitors the read/write access of the parent operating system module 1 and the child operating system module 21 or 22 to the disk, and intercepts all write access to the exclusive disk space of the parent operating system module 1.

 As shown in FIG. 2, it is a schematic diagram of an embodiment of an external access control module 4 in a system for implementing operating system isolation provided by the present invention. The external access control module 4 is located in the disk space of the hard disk storage and is composed of a plurality of files. The external access control module 4 includes: a disk bitmap file 41 of the parent operating system module 1, a disk bitmap file 4211 of the guest operating system module 21, a disk bitmap file 4221 of the guest operating system module 22, and a guest operating system. The index file 4212 of the module 21 and the index file 4222 of the guest operating system module 22.

 Embodiments of the present invention that implement operating system isolation based on a conventional computer architecture: As shown in FIG. 3, the architecture of the present invention is based on a conventional computer architecture. Under the traditional computer architecture, the computer system can only run one operating system at a time. The structure is: The lowest level is computer hardware, including CPU, hard disk, memory, graphics card, I/O interface, and so on. The system isolation module 3 can be set in the BIOS in the basic input/output module of the computer, or in the computer expansion firmware interface, EFI; it can be set in the firmware of the hard disk controller (firmware); In the kernel of system module 1 or outside the kernel.

In this embodiment, the system isolation module 3 is disposed in the kernel of the parent operating system module 1. Before the parent operating system module 1 is specified, the user first needs to install an operating system in the computer. In this embodiment, the Windows operating system is taken as an example. Then, the user can perform necessary configuration on the operating system as needed, such as installation and Configure hardware drivers, configure network addresses, adjust Windows desktop resolution, and more. At the same time, software is required in each sub-operating system module, such as some virus protection software and personal firewall, which can be installed as needed. In addition, in the embodiment, the user sets the system isolation module 3 as a driver of the operating system in the operating system kernel. After completing the above preparation work, the user can designate the above operating system as the parent operating system module 1 through the system isolation module 3. After the parent operating system module 1 is specified, the system isolation module 3 simultaneously creates a parent operating system magnetic for the parent operating system module 1 in the external memory access control module 4. Disk bitmap file 41. Thereafter, the system isolation module 3 will monitor and intercept all read/write accesses to the disk, and will not allow any programs and systems to overwrite the programs and data in the parent operating system module 1.

 The parent operating system disk bitmap file 41 of the parent operating system module 1 records the disk storage block status of the parent operating system module 1 for identifying the exclusive disk space of the parent operating system module 1 on the disk; for example, if If a block unit on the disk (for example, a sector is a sector) has valid data of the parent operating system module 1, the location flag corresponding to the parent operating system disk bitmap file 41 is 1. Otherwise marked as 0.

 After the user specifies the parent operating system module 1 through the system isolation module 3, the child operating system modules 21 and 22 can be created by interacting with the parent operating system module 1 through the system isolation module 3 as needed. In this embodiment, the guest operating system module 21 installs the Office software, the translation software, and other computing software programs on the basis of the parent operating system module 1 and shields the IE at the same time; the child operating system module 21 is the same as the parent operating system module 1 Together form a complete office operating system environment, can perform word processing and data calculation, but can not access the Internet; the sub-operating system module 22 is installed on the basis of the parent operating system module 1 game software and multimedia playback software, the same mother operating system Module 1 together form a complete entertainment operating system environment that can play games, watch video files, and access the Internet. The system isolation module 3 simultaneously creates sub-operating system bitmap files 4211 and 4221 for the sub-operating system modules 21 and 22, respectively, in the external storage access control module 4, and simultaneously creates sub-operating system modules 21 and 22 in the external storage access control module 4, respectively. The guest operating system indexes files 4212 and 4222.

 The sub-operating system disk bitmap files 4211 and 4221 record the disk storage block status of the sub-operating system modules 21 and 22 for identifying the exclusive disk space of the sub-operating system modules 21 and 22 on the disk; for example, if on the disk If a block unit (such as a sector, it is a sector) has valid data of the sub-operating system module 21, then the position flag corresponding to the sub-operating system disk bitmap file 4221 is 1, otherwise Is 0.

The sub-operating system index files 4212 and 4222 identify all the call addresses of the data dumped by the system isolation module 3 and the storage addresses after the dump and the corresponding relationship between the two. For example, when the operator rewrites the file ABC of the parent operating system module 1 whose source address is AO in the office environment, the system isolation module 3 intercepts the operation and writes the data rewritten to the file ABC into the sub-operation. The exclusive disk space of the system module 21 or the place where the address in the blank disk space is A1. The system isolation module 3 records in the index file 4212 the target storage address A1 and the source address A0 actually written by the data rewritten by the file ABC. At this point, we refer to the target storage address A1 as the index address of the source address AO. When the data of the file ABC is read again in the guest operating system module 21, the system isolation module 3 checks the index file 4212, reads the data of the address A1, and does not read the data in the AO. After the creation of the sub-operating system modules 21 and 22 is completed, the user can select to launch any of the sub-operating system modules according to their own needs when the computer is started. According to the location of the system isolation module 3, it is different from the startup sequence of the parent operating system module 1:

 When the system isolation module 3 is set in the BIOS or EFI, it is started before the parent operating system module 1. The startup sequence is as follows: The system isolation module 3 starts with the computer hardware, and the system isolation module 3 guides the user to select which operating system environment to enter, for example. The operator chooses the entertainment environment. Then, the system isolation module 3 boots the parent operating system module 1 to start, and loads the child operating system module 22 after the mother operating system module 1 is booted, thereby forming a complete entertainment operating system environment for the user.

 When the system isolation module 3 is set in the firmware program of the hard disk controller, it is started before the parent operating system module 1, and the startup sequence is the same as the startup sequence when the system isolation module 3 is set in the BIOS or EFI. By setting the system isolation module 3 in the firmware program of the hard disk controller, the user can purchase it at the same time as the hard disk controller, avoiding manual installation and simplifying the use of the program.

 When the system isolation module 3 is set in the kernel of the parent operating system module 1 or outside the kernel, it is started simultaneously with the parent operating system module 1, and the startup sequence is: the computer hardware is started, and the mother operating system module 1 and the system isolation module 3 are simultaneously The system is activated, and the user is prompted to select an operating system environment. For example, if the operator selects an office environment, the system isolation module 3 boots and loads the sub-operating system module 21 to form a complete office operating system environment.

 After the computer is started, the parent operating system module 1 and the system isolation module 3 are respectively loaded and run according to the above different situations. In this embodiment, since the system isolation module 3 is disposed in the kernel of the parent operating system module 1, the parent operating system module 1 Start at the same time as system isolation module 3. At the same time, the system isolation module 3 also loads the specified sub-operating system module 21 or 22 according to the user's selection. After that, the user can perform operations such as installing software, modifying configuration, editing files, etc. in the currently loaded parent operating system module 1 and child operating system module 21 or 22. In any case, the system isolation module 3 directly monitors the read and write access to the disk. As long as the access to the read/write disk occurs, it is intercepted by the system isolation module 3, and processed according to different situations to implement the operating system. isolation.

For the system for implementing operating system isolation provided by the present invention, the external access access control module 4 provides the disk bitmap file and the index file, and the system isolation module 3 monitors the read/write access of the mother/child operating system module disk. The flow is shown in Figure 4. If it is found to be a read disk access, the system isolation module 3 first obtains the target address A0 of the read disk from the read disk access caller, and then the system isolation module 3 uses the target address AO to query the currently running sub-operation. The sub-OS index file 4212 or 4222 of the system module 21 or 22, if the AO location in the sub-OS index file 4212 or 4222 has a corresponding index address A1, the system isolation module 3 is located from the disk address A1. Read the data and return it to the caller. Otherwise, system isolation module 3 reads the data from the disk address AO location and returns it to the caller.

 If the system isolation module 3 finds that it is a write disk access, the system isolation module 3 first obtains the target address B0 of the write disk from the write disk access caller, and then the system isolation module 3 queries the currently running guest operating system module 21 using the target address B0. Or the child operating system index file 4212 or 4222 of 22, if the corresponding index address Bl exists in the B0 position in the guest operating system index file 4212 or 4222, the system isolation module 3 writes the data to the B1 position and ends the write access. Otherwise, the system isolation module writes data to the disk blank space, the write address is the index address B2; meanwhile, the system isolation module is in the position indicated by B0 in the guest operating system index file 4212 or 4222 of the guest operating system module 21 or 22. The index address B2 is recorded, and the location indicated by B2 in the guest operating system disk bitmap file 4211 or 4221 of the currently running guest operating system module 21 or 22 is marked as 1, indicating that the data at this location is the guest operating system module 21. Or 22 all, after which system isolation module 3 ends the write access.

 When the user chooses to boot to any of the sub-operating system modules, the interaction between the system isolation module 3 and the external access control module ensures that the user does not see the data in the exclusive disk space of other sub-operating system modules on the disk. . For example, the user selects to boot into the sub-operating system module 21, and the system isolation module 3 only calls the parent operating system disk bitmap file 41, the sub-operating system disk bitmap file 4211, and the sub-operating system index file 4212 from the external storage access control module. For the parent operating system module 1, it can only see and read the contents of its own exclusive disk space. For the guest operating system module 21, it can only see the exclusive disk of the parent operating system module 1. Space and its own exclusive disk space and blank disk space, but can not see the exclusive disk space occupied by other sub-operating system modules, and through the interception of the system isolation module 3, the sub-operating system module 21 is also impossible The data is written to the exclusive disk space of the parent operating system module 1 and the exclusive disk space of the other guest operating system modules. Therefore, by adopting the above principle, it is ensured that the parent operating system module 1 cannot be changed, and each sub-operating system module is isolated from each other, and finally the isolation of the operating system is realized.

In addition, the exclusive disk space of the guest operating system module 21 or 22 can be changed. For example, when the guest operating system module 21 performs a write access and writes data to the disk blank space address A3, the system isolation module 3 performs sub-operations. The corresponding location of the system disk bitmap file 4211 is identified, and the blank disk space becomes the exclusive disk space of the guest operating system module 21. When the guest operating system module 22 performs write access and writes data to the disk blank space A4, the system isolation module 3 identifies the corresponding location of the guest operating system disk bitmap file 4221, and the blank disk space becomes the sub-space. The exclusive disk space of the operating system module 22; when the child operating system module 21 is started, the data of the disk blank space A4 is not read, therefore, the data of the disk blank space A4 is invisible to the guest operating system module 21. .

 The embodiment of the system for implementing operating system isolation in the virtual machine architecture of the present invention:

 Referring to FIG. 5, it is a schematic diagram of implementing operating system isolation in a virtual machine architecture for a system that implements operating system isolation according to the present invention. Under the computer architecture supporting virtual machine technology, the virtual memory management module (Virtual Memory Manager, called VMM) is the core part of the virtual machine technology, running under all other operating systems, and operating system on it. Allocate and coordinate system resources. For example, VMWare's VMWare software, Microsoft's Virtual PC software, and XenSource's Xen software are all software that supports virtual machine technology. Under the action of the VMM, two or more operating systems can be run simultaneously in the same computer system. In this embodiment, only one parent operating system module 1 is taken as an example, wherein the parent operating system module 1 is isolated by the system. Module 3 directs the establishment of two guest operating system modules 21 and 22.

 The system isolation module 3 is located in the VMM and is started simultaneously with the VMM. The startup sequence is: the computer hardware is started; the VMM and the system isolation module 3 are started; the parent operating system module 1 is started; the child operating system modules 21 and 22 are activated according to the user selection or Multiple.

 The System Isolation Module 3 is located in the VMM and is capable of monitoring and/or intercepting read/write access to the disk by all parent/child operating system modules and interacting with the external access control module to isolate the operating system.

 Yet another embodiment of the system for implementing operating system isolation in a virtual machine architecture: Referring to Figure 6, a schematic diagram of yet another embodiment of operating system isolation under a virtual machine architecture is shown. The virtual machine system has a management operating system module or a service operating system module 5 (referred to as a secondary operating system module), and the parent operating system module 1 (also referred to as a primary operating system module) runs simultaneously or before the parent operating system module 1 Run, monitor the state of the parent operating system module 1, and provide a disk access interface for the parent/child operating system module.

 The system isolation module 3 is set in the kernel of the secondary operating system module or outside the kernel, and the startup sequence is: computer hardware startup; VMM startup; secondary operating system module 5 and system isolation module 3 startup; parent operating system module 1 startup; Operating system modules 21 and 22 initiate one or more of them based on user selection.

In the embodiment of the virtual machine architecture of the present invention, the parent operating system module 1 may be more than one. For example, the Windows kernel and the Linux kernel may be simultaneously installed in one computer system, and both of them constitute the parent operating system module 1; Running only one site at the same time under the computer architecture of a non-virtual machine The parent operating system module, that is, running Windows or running Linux; running at least one parent operating system module under the virtual machine's computer architecture, that is, the Windows kernel and the Linux kernel can run simultaneously. In addition, in the non-virtual machine computer architecture, only one of the sub-operating system modules is run at the same time, that is, the sub-operating system module 21 is run or the sub-operating system module 22 is run; and at least one sub-operation is simultaneously run under the computer architecture of the virtual machine. The system module, that is, the sub-operating system modules 21 and 22 can be operated simultaneously.

 Multiple parent operating system modules are set independently of each other, and the system isolation module 3 specifies the exclusive disk space of each parent operating system module and records it in the external access control module 4.

 The embodiment of the present invention for setting up a disk sharing area of the system for operating system isolation: Referring to FIG. 7, a disk sharing area can be set in the disk, and the user can specify whether the child operating system module can access the disk sharing area through the system isolation module, for example, The specified guest operating system module can access the disk shared area, and the specified other guest operating system module cannot access the disk shared area. At the same time, you can also set the access mode of the specified sub-operating system module to the disk sharing area. For example, you can specify that some sub-operating system modules use the read-only mode to access the disk sharing area. Other sub-operating system modules use read/write access. Disk sharing area. In some cases, the disk sharing area enables users to exchange data in two or more guest operating system modules.

 Embodiments of the multi-level sub-operating system of the system for implementing operating system isolation according to the present invention:

 The system for implementing operating system isolation also includes a second generation sub-operating system module, which is established by the system isolation module based on the first generation sub-operating system module; for example, the user can be based on the sub-operating system module of the entertainment environment. Create multiple second-generation guest operating system modules, and install different game software in different second-generation guest operating system modules. At this point, a second-generation sub-operational system module, a generation of sub-operating system modules and a parent operating system module together form a complete operating system specific to a certain gaming environment. No other games will be seen in one of the game environments.

 When a guest operating system is booted to create a second-generation guest operating system, its exclusive disk space is immediately set to be unrewritable by the system isolation module.

 Since the environments formed by different guest operating system modules are isolated from each other, it is possible to construct an operating system environment that is kept secret from each other. For example, a home user can create a sub-operating system module for each family member based on a parent operating system module in a computer to form a respective operating environment; when a family member works in his or her operating environment, it does not affect the other. Human data, as well as free access to files and data in other member operating environments, protects the privacy of family members.

Or, allow government and enterprise users to completely isolate the work environment from the private environment based on a parent operating system module, such as network isolation, network security, etc. for the work environment. Automated management and control. It is possible to create a highly secure sub-operating system module for online transactions and online financial transactions, so that users do not have to trade in other low-security system environments, but instead use it exclusively for online transactions. Sub-operating system modules for transactions and transaction processing, etc.

 Based on the foregoing system for implementing operating system isolation, the present invention also provides a method for implementing operating system isolation. After the installation of the parent operating system module is completed, the system isolation module is installed; the system isolation module establishes a disk bitmap file and an index file, in preparation for Disk read/write is monitored. Referring to FIG. 8, a flowchart of an embodiment of a method provided by the present invention is as follows:

 Step 11: The system isolation module creates a disk bitmap file of the parent operating system module in the external storage access control module, and identifies an exclusive disk space of the parent operating system module, where the disk bitmap file cannot be changed;

 Step 12: The system isolation module boots to establish one or more sub-operating system modules, and creates a disk bitmap file and an index file for each sub-operating system module in the external storage access control module; the disk bitmap file identifies the sub-operating system The exclusive disk space of the module, the index file identifies all the call addresses of the data dumped by the system isolation module and the storage address after the dump and the corresponding relationship between the two; initially, the disk bitmap file Empty with the index file;

 Step 13: The system isolation module identifies the disk blank space according to the disk bitmap file, where the disk blank space is the disk space file of the parent operating system module and the exclusive disk space identified in the disk bitmap file of the guest operating system module. Disk space other than

 Step 14. The system isolation module monitors the disk read/write, and the system isolation module monitors the read/write access of the current sub-operating system module to the disk. If the read access is performed, the system isolation module returns to the parent according to the record of the external access control module. The operating system module and/or the current guest operating system module exclusive data in the disk space; if it is a write access, the system isolation module writes the exclusive disk space or disk blank of the current guest operating system module according to the record of the external access control module. In space, and modify the records of the external access control module.

 The specific steps of step 14 are as follows:

 Step 1401: The system isolation module detects the read/write access of the current sub-operating system module to the disk; Step 1402: The system isolation module determines whether it is a read access or a write access; if it is a read access, step 1403 is performed; otherwise, step 1407 is performed;

 Step 1403, the system isolation module extracts the calling address AO of the read disk data operation initiated by the currently running sub-operating system module;

Step 1404: The system isolation module queries the current sub-operating system module according to the calling address AO. The index file; if the call address AO and its corresponding storage address A1 are recorded in the index file, step 1405 is performed; otherwise, the data requested by the operation is at the location of the call address, and step 1406 is performed;

 Step 1405: The system isolation module reads data from the storage address A1 location and returns the current sub-operating system module to end the read access.

 Step 1406: The system isolation module reads data from the location of the calling address and returns to the current sub-operation system module to end the read access.

 Step 1407, the system isolation module extracts the call address B0 of the write disk data operation initiated by the currently running sub-operating system module;

 Step 1408: The system isolation module queries the index file of the current guest operating system module according to the calling address B0. If the calling address B0 and the corresponding storage address B1 are recorded in the index file, step 1409 is performed; otherwise, step 1410 is performed;

 Step 1409, the system isolation module writes the data to the storage address B1 position, and ends the write access; Step 1410, the system isolation module writes the data to the blank space of the disk, and the write address is the storage address; meanwhile, the system isolation module is in the The calling address location records the storage address in the index file of the operating system module, and marks the corresponding location of the storage address in the currently running sub-operating system module disk bitmap file as having a data state, and ends the write access.

 It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not to be construed as limiting the embodiments of the present invention. The technical solutions of the present invention may be modified or equivalently substituted, and the modified technical solutions may not deviate from the spirit and scope of the technical solutions of the present invention.

Claims

Rights request  A system for implementing operating system isolation, characterized by comprising:  a parent operating system module, wherein the parent operating system module includes a kernel of an operating system for providing a software program that completes basic functions necessary for the operating system; and the parent operating system module performs exclusive disk space and disk blank space Read access  At least one sub-operating system module, including any modification information made by the user to the parent operating system module; interacting with the parent operating system module to perform read access to the exclusive disk space of the parent operating system module; The guest operating system module has read/write access to its exclusive disk space and disk blank space;  a system isolation module, the system isolation module interacts with the parent operating system module, and is configured to guide and/or establish a child operating system module according to a user instruction, and specify and/or modify the exclusive use of the parent/child operating system module. Disk space and disk blank space; the system isolation module further interacts with the parent/child operating system module to monitor read/write access of the parent/child operating system module to the disk; and an external access control module And interacting with the system isolation module to record exclusive disk space of the parent/child operating system module.  2. The system for implementing operating system isolation according to claim 1, wherein the parent operating system module is one or more; the plurality of parent operating system modules are independently set, and each of the system isolation modules specifies each The exclusive disk space of the parent operating system module is recorded in the external memory access control module.  3. The system for implementing operating system isolation according to claim 1, wherein the system isolation module is set in a BIOS or EFI, and is started before the parent operating system module.  4. The system for implementing operating system isolation according to claim 1, wherein the system isolation module is disposed in a firmware program of the hard disk controller, and is started before the parent operating system module.  5. The system for implementing operating system isolation according to claim 1, wherein the system isolation module is disposed in a kernel of the parent operating system module and/or outside the kernel, and the parent operating system module Start at the same time.  6. The system for implementing operating system isolation according to claim 1, further comprising a virtual memory management module, wherein the virtual memory management module runs before the parent/child operating system module; and the system isolation module is set in a virtual state. In the memory management module, it is started simultaneously with the virtual memory management module. 7. The system for implementing operating system isolation according to claim 1, wherein the system further comprises a management operating system module or a service operating system module, the management operating system module or the service operating system module and the parent/child operation. System modules run simultaneously, or, prior to the parent/child operating system mode The block operates and provides a disk access interface for the parent/child operating system module; the system isolation module is disposed in the kernel of the management operating system module or the service operating system module and/or outside the kernel.  8. The system for implementing operating system isolation according to claim 1, wherein the external access control module comprises:  a parent operating system disk bitmap file, configured to record a disk storage block status of the parent operating system module, and identify an exclusive disk space of the parent operating system module on the disk;  a sub-operating system disk bitmap file, configured to record a disk storage block status of the sub-operating system module, and identify an exclusive disk space of the sub-operating system module on the disk;  The sub-operating system index file is used to identify the calling address of all the data dumped by the system isolation module and the storage address after the dump and the corresponding relationship between the two.  The method for implementing operating system isolation according to any one of claims 1-8, comprising the steps of:  Step 1. The system isolation module monitors the read/write access of the current sub-operating system module to the disk. Step 2. If it is a read access, the system isolation module returns the parent operating system module and/or the current sub-operation according to the record of the external access control module. The system module exclusively enjoys the data in the disk space;  Step 3. If it is a write access, the system isolation module writes the exclusive disk space or the disk blank space of the current guest operating system module according to the record of the external access control module, and modifies the record of the external access control module.  10. The method for implementing operating system isolation according to claim 9, wherein the step 1 further comprises the following steps:  Step 11. The system isolation module creates an unchangeable mother operating system disk bitmap file in the external storage access control module, and identifies the exclusive disk space of the parent operating system module.  Step 12: The system isolation module boots to establish one or more sub-operating system modules, and creates a corresponding sub-operating system disk bitmap file and an index file for each sub-operating system module in the external storage access control module; The map file identifies the exclusive disk space of the sub-operating system module, and the index file identifies all the call addresses of the data dumped by the system isolation module, the dumped storage address, and the corresponding relationship between the two;  Step 13: The system isolation module identifies a disk blank space according to the parent operating system disk bitmap file and the sub-operating system disk bitmap file, where the disk blank space is a disk bitmap file and a sub-operation of the parent operating system module. Disk space other than the exclusive disk space identified in the disk bitmap file of the system module. 11. The method of implementing operating system isolation according to claim 9, wherein said method Step 2 is specifically as follows:  Step 201: The system isolation module extracts the read initiated by the currently running sub-operating system module: The address of the alpha disk data operation;  Step 202: The system isolation module queries an index file of the current guest operating system module according to the calling address.  Step 203: If the call address location in the index file records the storage address corresponding to the call address, the system isolation module reads data from the storage address location and returns the data to the current guest operating system module.  Step 204: If the record of the call address location in the index file is empty, it indicates that the data requested by the operation is at the location of the call address, and the system isolation module reads the data from the location of the call address and returns the current sub-operation. System module.  The method for implementing operating system isolation according to claim 9, wherein the step 3 is specifically:  Step 301: The system isolation module extracts a call address of a write operation of the disk data initiated by the currently running guest operating system module.  Step 302: The system isolation module queries the index file of the current sub-operating system module according to the calling address. Step 303: If the location of the calling address in the index file records the storage address corresponding to the calling address, the system isolation module writes the data to the storage address. Location  Step 304: If the call address location record in the index file is empty, the system isolation module writes the data to the disk blank space, where the write address is a storage address; and the system isolation module is in the index file of the guest operating system module. The calling address location records the storage address, and marks the corresponding location of the storage address in the currently running sub-operating system module disk bitmap file as having a data state.