Method and device for setting access rights

Abstract

One or more embodiments of the present specification provide a method and device for setting access rights, including: determining a function call relationship graph of a target system; replacing an original node in the function call relationship graph with two newly created nodes connected by a newly created directed edge, wherein the capacity of the newly created directed edge is set to 1; determining a minimum cut of the function call relationship graph, and determining the function represented by the node connected by the directed edge corresponding to the minimum cut as a level function; setting access rights for a memory where isolated data is located, and setting association for the level function, so that when entering the level function, the memory opens the access rights, and when exiting the level function, the memory closes the access rights.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of computer technology, and more particularly, to a method and device for setting access rights. Background Art

[0002] During the operation of computer system code, it is necessary to access specific data. In order to protect the specific data, it is generally necessary to set the access rights of the memory where the data is located to limit the access of other codes to the data, thereby avoiding data leakage. Therefore, during the operation of a system, it is necessary to judge the function call relationship of the system and find the most suitable function to enable permissions to set data access rights. However, if there are many functions in the system and the calling relationship is complex, it is difficult to manually rely on experience to find the function suitable for enabling permissions, and omissions may occur, thereby increasing the risk factor of data leakage. Summary of the invention

[0003] In view of this, one or more embodiments of the present specification provide a method and device for setting access rights.

[0004] To achieve the above objectives, one or more embodiments of this specification provide the following technical solutions:

[0005] According to a first aspect of one or more embodiments of this specification, a method for setting access rights is provided, including:

[0006] Determine a function call relationship graph of the target system, wherein original nodes in the function call relationship graph correspond to functions in the target system, the original nodes are connected by original directed edges, the original directed edges represent call relationships between functions corresponding to the connected original nodes, and the capacity of the original directed edges is set to be infinite;

[0007] Replacing the original node in the function call relationship graph with two newly created nodes connected by a newly created directed edge, wherein the capacity of the newly created directed edge is set to 1;

[0008] Determine a minimum cut of the function call relationship graph, and determine functions represented by nodes connected by directed edges corresponding to the minimum cut as level functions;

[0009] Access permission is set for the memory where the isolated data is located, and association is set for the level function, so that when entering the level function, the memory opens the access permission, and when exiting the level function, the memory closes the access permission.

[0010] According to a second aspect of one or more embodiments of this specification, a device for setting access rights is provided, including:

[0011] A function call relationship graph determining unit, used to determine a function call relationship graph of a target system, wherein original nodes in the function call relationship graph correspond to functions in the target system, the original nodes are connected by original directed edges, the original directed edges represent the call relationships between functions corresponding to the connected original nodes, and the capacity of the original directed edges is set to be infinite;

[0012] A newly created node replacement unit, used for replacing the original node in the function call relationship graph with two newly created nodes connected by a newly created directed edge, wherein the capacity of the newly created directed edge is set to 1;

[0013] A minimum cut determination unit, used to determine the minimum cut of the function call relationship graph, and determine the function represented by the node connected by the directed edge corresponding to the minimum cut as the level function;

[0014] The access permission setting unit is used to set the access permission for the memory where the isolated data is located, and to set the association for the level function, so that when entering the level function, the memory opens the access permission, and when exiting the level function, the memory closes the access permission.

[0015] According to a third aspect of one or more embodiments of the present specification, there is provided a computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0016] According to a fourth aspect of one or more embodiments of the present specification, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method described in the first aspect are implemented.

[0017] In the technical solution provided in this specification, the call relationship information between each function contained in the automatically generated function call relationship graph (call graph) is used to determine the level function suitable for opening the access rights to the isolated data, and the data to be isolated is isolated, thereby protecting the isolated data. Determining the location of the level function through the automatically generated function call relationship graph instead of manually relying on experience to determine the location suitable for opening the access rights to the isolated data can simplify the permission setting process, avoid omissions caused by relying on manual search for level functions due to complex call relationships, and improve data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1It is a schematic diagram of a device architecture for setting access rights provided by an exemplary embodiment of this specification;

[0019] Figure 2 It is a flowchart of a method for setting access rights provided by an exemplary embodiment of this specification;

[0020] Figure 3 It is a function call relationship diagram of a method for setting access rights provided by an exemplary embodiment of this specification;

[0021] Figure 4 is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of this specification;

[0022] Figure 5 It is a schematic diagram of a device for setting access rights provided by an exemplary embodiment of this specification. DETAILED DESCRIPTION

[0023] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with one or more embodiments of this specification. Instead, they are merely examples of devices and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0024] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0025] In a target system, the calling relationship between functions is often very complicated. When protecting and isolating data, it is necessary to enable access rights to the isolated data at the appropriate location in the target system. According to experience, the level function is the most suitable location in a system to enable the above access rights. This specification provides a method for setting access rights, which uses an automatically generated function call relationship graph to determine the location of the level function and set access rights for the memory where the isolated data is located. When the code enters the level function, the access rights are enabled so that the isolated data can be accessed, and the access rights are closed when exiting the level function. In this specification, the access to the isolated data is controlled by the above method, which improves the security of the isolated data and reduces the risk of leakage of the isolated data.

[0026] Figure 1 This is a schematic diagram of the device architecture for setting access rights shown in this manual. Figure 1 As shown, it may include a server 11 , a network 12 and an electronic device 13 .

[0027] The server 11 may be a physical server including an independent host, or the server 11 may be a virtual server hosted by a host cluster. During operation, the server 11 may be configured with an access permission setting device, which may be implemented in software and / or hardware to provide a setting service for access permissions to the isolated data.

[0028] The electronic device 13 refers to a type of electronic device that can be used by the user. In fact, the user can obviously also use electronic devices such as the following types: mobile phones, tablet devices, laptops, PDAs (Personal Digital Assistants), wearable devices (such as smart glasses, smart watches, etc.), etc., and one or more embodiments of this specification do not limit this. During operation, the electronic device 13 can be used by the user to initiate a setting request for access rights to the isolated data.

[0029] The network 12 for interaction between the electronic device 13 and the server 11 may include various types of wired or wireless networks. In one embodiment, the network 12 may include a public switched telephone network (PSTN) and the Internet.

[0030] Combine the following Figure 2 A method for setting access rights provided in this manual is specifically described. Figure 2 FIG. 1 is a flow chart of a method for setting access rights provided by an exemplary embodiment. Figure 2 As shown, the method mainly includes the following steps:

[0031] S201, determining a function call relationship graph of a target system, wherein original nodes in the function call relationship graph correspond to functions in the target system, the original nodes are connected by original directed edges, the original directed edges represent the call relationships between functions corresponding to the connected original nodes, and the capacity of the original directed edges is set to be infinite.

[0032] Source code analysis of the system is an unavoidable issue during program transplantation and development. For a target system with more complex functions, in order to better analyze the calling relationships between the various functions, technicians generally use function call relationship graphs to graphically display the calling relationships between the various functions in a target system. Representing functions and the calling relationships between functions through graphs can make the calling relationships between various functions in a complex system containing multiple functions more intuitive. In any function call relationship graph, each function is represented in the form of a node, and the calling relationships between various functions are represented in the form of directed edges, with the node representing the referenced function pointing to the node representing the referenced function.

[0033] In an exemplary embodiment of the present specification, the function call relationship graph of the target system can be determined by the following method: first, by parsing the source code of the target system, the functions included in the target system are determined, and then according to the call relationship between the various functions included in the target system, a function call relationship graph for the target system is established. The function call relationship graph can be automatically generated by a tool through a source code file, or can be manually parsed and generated by the source code file of the target system, which is not specifically limited in the present specification.

[0034] In an exemplary embodiment of the present specification, if the target system is a subsystem in an overall system, the source code of the overall system can be manually parsed to determine the code location of the subsystem in the overall system, that is, to determine its code range in the overall system, and then record the relevant information of the code range. The source code file of the overall system and the information used to characterize the code range corresponding to the subsystem in the source code file are input into a relationship determination tool, and the calling relationship is output by the relationship determination tool, and a function call relationship diagram of the subsystem is generated.

[0035] In an exemplary embodiment of the present specification, the relationship determination tool may include: a gcc-python-plugin (GCC-Python plug-in) tool. The gcc-python-plugin tool is an open source software developed by using python (a computer programming language) to simplify the GCC (GNU Compiler Collection, GNU compiler suite) plug-in.

[0036] In the function call relationship graph of the target system, the node representing the function in the target system is called the original node, the directed edge representing the call relationship between the original nodes is called the original directed edge, and the capacity of the original directed edge is set to be infinite. The capacity of the edge represents the maximum flow that can pass through the edge.

[0037] In an exemplary embodiment of this specification, it is assumed that a function call relationship diagram of a target system is as follows: Figure 3 As shown, the target system includes functions a, b, c, d, e, f, g and h. In the function call relationship diagram of the target system, the above functions are represented by original nodes A, B, C, D, E, F, G and H respectively. The functions correspond to the original nodes one by one, and the calling relationship between the functions is as follows: Figure 3 The directed edges in are shown as follows.

[0038] After determining the function call relationship graph of the target system, the function call relationship graph is processed as follows:

[0039] S202: Replace the original node in the function call relationship graph with two newly created nodes connected by a newly created directed edge, and the capacity of the newly created directed edge is set to 1.

[0040] like Figure 3 As shown, taking function a as an example, in the function call relationship diagram in the target system, the original node A representing function a is split into a newly created node A1 and a newly created node A2. There is a newly created directed edge between the newly created node A1 and the newly created node A2, such as Figure 3 As shown in the dashed part. The capacity of all newly created directed edges is set to 1. And the newly created directed edge is pointed from one of the newly created directed edges to another newly created directed edge. The calling relationship outside the newly created node pair is consistent with the calling relationship of the original node before being split, which is equivalent to the original node being replaced as a whole by a newly created node pair and the newly created directed edge connecting the newly created node pair. The replacement process does not affect other calling relationships of the original node in the original function call relationship graph. At this time, the two newly created nodes A1 and A2 connected to the newly created edge have a corresponding relationship with function a.

[0041] Then, for the function call relationship graph after the original nodes are replaced by the newly created nodes, the minimum cut (Min Cut) in the function relationship graph is calculated.

[0042] S203, determining a minimum cut of the function call relationship graph, and determining functions represented by nodes connected by directed edges corresponding to the minimum cut as level functions.

[0043] In an exemplary embodiment of the present specification, the minimum cut of the function call relationship graph can be determined by the Max-flow Min-cut theorem. A cut represents a section or tangent of the function call relationship graph, which divides the function call relationship graph into two subsets respectively including a starting node and an end node. The set of edges intersecting the tangent or section with the function call relationship graph divided by it is called a cut of the image. The minimum cut is the cut with the smallest capacity of the cut edge. In the function call relationship graph, the starting node can be a source point (Source), and the end node can be a sink (Sink). The above-mentioned Max-flow Min-cut theorem is specifically: in a network flow, the value of the maximum flow (Max Flow) is equal to the capacity of the minimum cut. Specifically, the minimum cut of the function call relationship graph can be obtained by the Ford-Fulkerson algorithm based on the Max-flow Min-cut theorem. The Ford-Fulkerson algorithm is a greedy algorithm for calculating the maximum flow in a flow network. It was proposed by LR Ford, Jr and DR Fulkerson, and is therefore called the Ford-Fulkerson algorithm.

[0044] Due to its particularity, the level function is represented by the level node in the function call graph. In a function call graph, if any level node is deleted, the maximum flow of the function graph will be reduced.

[0045] In an exemplary embodiment of the present specification, when the minimum cut is solved by the Ford-Fulkerson algorithm using the maximum flow and minimum cut theorem, determining the minimum cut may include the following steps:

[0046] According to the function call relationship diagram, the interface node corresponding to the interface function and the isolation node corresponding to the isolation function are determined, wherein the interface function is a function called by other functions outside the target system, and the isolation function is a function that directly accesses data in the target system. Of course, the above interface function can also be called by other functions inside the target system, but it does not affect the identity of the function as an interface function. Figure 3 As shown, the interface node representing the interface function is Figure 3 The call relationship graph is determined as original node A, original node B and original node C, and the isolation nodes representing the isolated functions are determined as original node F, original node G and original node H.

[0047] Add source points and sink points in the function call relationship graph. The source points point to each interface node through a directed edge with infinite capacity, and each isolation node points to the sink point through a directed edge with infinite capacity.

[0048] like Figure 3As shown in the figure, the source point points to the interface nodes - original node A, original node B and original node C through directed edges with infinite capacity. When the original nodes A, original node B and original node C in the figure are split, they can be replaced by three pairs of newly created nodes. In the function call relationship graph after replacement, the newly created node pairs are connected internally by newly created edges, and the call relationship outside the newly created nodes is inherited from the original nodes. Figure 3 As shown, before replacing the original node with the newly created node pair, the source node and the sink node can be added to the original function call relationship graph, and then the other nodes in the function call relationship graph except the source node and the sink node are subjected to the split replacement process described above. The order of the processes is not specifically limited in this specification. In this exemplary embodiment, in the function call relationship graph after the original node is split into a pair of newly created nodes, the connection relationship between the source node and the sink node and the interface node and the isolation node is as follows: Figure 3 As shown in the right figure.

[0049] Then, the Ford-Fulkerson algorithm is used to solve the minimum cut of the function call relationship graph containing the source and sink. The function represented by the node connected by the directed edge corresponding to the minimum cut is determined as the barrier function. That is, the Ford-Fulkerson algorithm is used on the source and sink in the function call relationship graph, and the minimum cut of the function call relationship graph is determined based on the output result, and the function represented by the node connected by the directed edge corresponding to the minimum cut is determined as the barrier function. For example, in Figure 3 In the function call relationship diagram shown in FIG. 1 , the minimum cut is the newly created nodes shown in the part circled by the dotted line in the diagram, including: newly created node A1, newly created node A2, newly created node B1, newly created node B2, newly created node C1, newly created node C2, newly created node D1, and newly created node E1. The nodes connected by the directed edges corresponding to the minimum cut are the nodes representing the level functions, that is, the function d represented by the newly created nodes D1 and D2 and the function e represented by the newly created nodes E1 and newly created nodes E2 are the level functions.

[0050] After determining the level function of the target system, you can then set the level function. By modifying the code of the level function and setting the permissions for the memory where the isolation function is located, you can achieve data isolation of the data to be isolated. The specific steps are as follows:

[0051] S204, setting access rights for the memory where the isolated data is located, and setting association for the level function, so that when entering the level function, the memory opens the access rights, and when exiting the level function, the memory closes the access rights.

[0052] Since the isolation function needs to read the data to be isolated, while other functions do not need to read the data, the access rights to the data to be isolated are opened when entering the level function, and the access rights are closed when exiting the level function, so that the data to be isolated has access rights only between level functions, that is, the data to be isolated can be accessed only when specific conditions are met, which reduces the possibility of malicious access to the data to be isolated and improves the security of the data to be isolated.

[0053] In addition, in an exemplary embodiment of the present specification, when setting access rights for the isolated function, a privileged protection key (Protection Key for Supervisor, PKS) can be used to set access rights for the memory where the target data is located. The privileged protection key is a hardware mechanism for controlling access rights to data in kernel mode in combination with page tables under the x86 architecture. Of course, in the method for setting access rights proposed in the present specification, other mechanisms can also be combined to isolate the isolated data, and no specific restrictions are made in this specification.

[0054] Figure 4 This is a schematic diagram of the structure of an electronic device according to an exemplary embodiment of this specification. Figure 4 At the hardware level, the device includes a processor 402, an internal bus 404, a network interface 406, a memory 408 and a non-volatile memory 410. Of course, it may also include hardware required for other services. The processor 402 reads the corresponding computer program from the non-volatile memory 410 into the memory 408 and then runs it, forming a device for setting access rights at the logical level. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0055] Corresponding to the above method embodiment, this specification also provides a device for setting access rights.

[0056] Please refer to Figure 5 , a device for setting access rights, the device may include:

[0057] A function call relationship graph determining unit 510 is used to determine a function call relationship graph of a target system, wherein original nodes in the function call relationship graph correspond to functions in the target system, the original nodes are connected by original directed edges, the original directed edges represent the call relationship between the functions corresponding to the connected original nodes, and the capacity of the original directed edges is set to be infinite;

[0058] A newly created node replacement unit 520, used to replace the original node in the function call relationship graph with two newly created nodes connected by a newly created directed edge, wherein the capacity of the newly created directed edge is set to 1;

[0059] A minimum cut determination unit 530 is used to determine the minimum cut of the function call relationship graph, and determine the function represented by the node connected by the directed edge corresponding to the minimum cut as the level function;

[0060] The access permission setting unit 540 is used to set the access permission for the memory where the isolated data is located, and to set the association for the level function so that when entering the level function, the memory opens the access permission, and when exiting the level function, the memory closes the access permission.

[0061] Optionally, the function call relationship graph determining unit 510 may be specifically used for:

[0062] Determine the functions included in the target system by parsing the source code of the target system;

[0063] A function call relationship graph is established according to the calling relationship between the functions included in the target system.

[0064] Optionally, the function call relationship graph determining unit 510 may also be specifically used for:

[0065] In the case where the target system is a subsystem contained in the overall system, inputting the source code file of the overall system and information used to characterize the code range corresponding to the subsystem in the source code file into a relationship determination tool;

[0066] The calling relationship output by the relationship determination tool is obtained.

[0067] Optionally, the relationship determination tool may include: a gcc-python-plugin tool.

[0068] Optionally, the minimum cut determining unit 530 may be specifically configured to:

[0069] The minimum cut of the function call relationship graph is determined according to the maximum flow and minimum cut theorem.

[0070] Optionally, when the minimum cut is solved by using the Ford-Fulkerson algorithm based on the maximum flow and minimum cut theorem, the access rights setting device further includes:

[0071] A node determination unit 550 is used to determine an interface node corresponding to an interface function and an isolation node corresponding to an isolation function according to the function call relationship graph, wherein the interface function is a function called by other functions outside the target system, and the isolation function is a function that directly accesses data in the target system;

[0072] A source node and sink node adding unit 560, configured to add a source node and a sink node to the function call relationship graph, wherein the source node points to each interface node through a directed edge with infinite capacity, and each isolation node points to the sink node through a directed edge with infinite capacity;

[0073] The minimum cut determination unit 530 may be specifically configured to:

[0074] The Ford-Fulkerson algorithm is used to solve the minimum cut of the function call relationship graph containing the source point and the sink point.

[0075] Optionally, the access permission setting unit 540 may be specifically configured to:

[0076] The privileged protection key is used to set access permissions for the memory where the target data is located.

[0077] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0078] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0079] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0080] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0081] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0082] In one or more embodiments of the present specification, the term "includes", "comprising" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, commodity or device including the element.

[0083] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0084] It should be understood that although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0085] The above description is merely a preferred embodiment of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present specification shall be included in the scope of protection of one or more embodiments of the present specification.

Claims

1. A method for setting access rights, characterized in that: include: Determining a function call relationship graph of a target system, comprising: determining functions included in the target system by parsing source code of the target system, and establishing a function call relationship graph according to the call relationship between the functions included in the target system, wherein original nodes in the function call relationship graph correspond to functions in the target system, the original nodes are connected by original directed edges, the original directed edges represent the call relationship between the functions corresponding to the connected original nodes, and the capacity of the original directed edges is set to be infinite; Replacing the original node in the function call relationship graph with two newly created nodes connected by a newly created directed edge, wherein the capacity of the newly created directed edge is set to 1; According to the maximum flow and minimum cut theorem, the minimum cut of the function call relationship graph is determined, and the functions represented by the nodes connected by the directed edges corresponding to the minimum cut are determined as the level functions; Access permission is set for the memory where the isolated data is located, and association is set for the level function, so that when entering the level function, the memory opens the access permission, and when exiting the level function, the memory closes the access permission.

2. The method according to claim 1, characterized in that Also includes: In the case where the target system is a subsystem contained in the overall system, inputting the source code file of the overall system and information used to characterize the code range corresponding to the subsystem in the source code file into a relationship determination tool; The calling relationship output by the relationship determination tool is obtained.

3. The method according to claim 2, characterized in that The relationship determination tools mentioned include: gcc-python-plugin tool.

4. The method according to claim 1, characterized in that In the case where the minimum cut is solved by the Ford-Fulkerson algorithm using the maximum flow and minimum cut theorem, the method further comprises: Determine, according to the function call relationship graph, an interface node corresponding to an interface function and an isolation node corresponding to an isolation function, wherein the interface function is a function called by other functions outside the target system, and the isolation function is a function that directly accesses data in the target system; Adding a source point and a sink point in the function call relationship graph, wherein the source point points to each interface node through a directed edge with infinite capacity, and each isolation node points to the sink point through a directed edge with infinite capacity; Determining the minimum cut of the function call relationship graph includes: using a Ford-Fulkerson algorithm to solve the minimum cut of the function call relationship graph containing the source point and the sink point.

5. The method according to claim 1, characterized in that The step of setting access permissions for the memory where the data to be isolated is located includes: The privileged protection key is used to set access permissions for the memory where the target data is located.

6. A device for setting access rights, characterized in that: include: A function call relationship graph determination unit, used to determine a function call relationship graph of a target system, comprising: determining functions included in the target system by parsing source code of the target system, and establishing a function call relationship graph according to the call relationship between the functions included in the target system, wherein original nodes in the function call relationship graph correspond to functions in the target system, the original nodes are connected by original directed edges, the original directed edges represent the call relationship between functions corresponding to the connected original nodes, and the capacity of the original directed edges is set to be infinite; A newly created node replacement unit, used for replacing the original node in the function call relationship graph with two newly created nodes connected by a newly created directed edge, wherein the capacity of the newly created directed edge is set to 1; A minimum cut determination unit, configured to determine the minimum cut of the function call relationship graph according to the maximum flow and minimum cut theorem, and determine the function represented by the node connected by the directed edge corresponding to the minimum cut as the level function; The access permission setting unit is used to set the access permission for the memory where the isolated data is located, and to set the association for the level function, so that when entering the level function, the memory opens the access permission, and when exiting the level function, the memory closes the access permission.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 5 are implemented.

Images