Memory control method, device, electronic device and storage medium
By replacing the underlying function with memory mapped functions and preset kernel functions in systems without CR0 registers, the control of memory read and write permissions is solved, and the scope of application is expanded.
Patent Information
- Application Number
- CN202111265941.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-10-28
- Publication Date
- 2025-08-26
- Estimated Expiration
- 2041-10-28
AI Technical Summary
The existing file filtering driver cannot achieve flexible control of memory read and write permissions in systems without CR0 registers, and its scope of application is limited.
By determining the address information of the memory specified data area based on preset kernel symbols, modifying attributes using memory map functions, and replacing the file filter-driven underlying functions through preset kernel functions, controlling memory read and write permissions.
The scope of application of memory read and write permission control is expanded, and it is suitable for ARM, MIPS, x86 and other systems with file filtering functions, without relying on CR0 registers.
Smart Images
Figure CN113946522B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data security technology, and more specifically, to a memory control method, device, electronic device, and storage medium. Background Art
[0002] File filtering is an important part of data security. File filtering protects the security, integrity and tamper-proofing of file resources by monitoring and controlling access rights to data files and directory files in the file system. Existing file filtering drivers need to turn off memory write protection and then hook the underlying system functions to obtain control permissions for file resources in order to perform the operations they need. This method is usually applicable to X86 systems with a CR0 register, and memory write protection is controlled by modifying the CR0 register. The scope of application of this method is limited and cannot be applied to systems that do not have a CR0 register. For example, it is not applicable to systems that do not have a CR0 register, such as ARM (Advanced RISC Machine) and MIPS (Microprocessor without Interlocked Pipelined Stages). Summary of the Invention
[0003] The purpose of the embodiments of the present application is to provide a memory control method, device, electronic device and storage medium, which can control the read and write permissions of the memory in a system with a file filtering function and without a CR0 register.
[0004] In order to achieve the above objectives, the embodiments of the present application are implemented in the following manner:
[0005] In a first aspect, an embodiment of the present application provides a memory control method, the method comprising: determining the address information of a specified data area in the memory of a device kernel based on a preset kernel symbol; modifying the attributes of the specified data area through a memory mapping function according to the address information of the specified data area, wherein the modified attributes of the specified data area are used to control the data read and write permissions of the specified data area; replacing the underlying function corresponding to the file filter driver through a preset kernel function, the preset kernel function is used to control the read and write permissions of the specified data area after the attributes are modified.
[0006] In the above-described embodiment, after calculating the address information of a specified data area in memory, the attributes of the specified data area can be modified using a memory mapping function to implement control over the read and write permissions of the specified data area. Subsequently, the underlying functions corresponding to the file filter driver are replaced with preset kernel functions to control the read and write permissions of the specified data area. This allows control over memory read and write permissions without the need for the CR0 register, thereby expanding the scope of application of memory read and write permission control.
[0007] In combination with the first aspect, in some optional embodiments, based on a preset kernel symbol, the address information of a specified data area in the memory of the device kernel is determined, including: based on the preset kernel symbol, determining the size of a memory page area corresponding to the memory of the device kernel; and determining the address information of the specified data area in the memory according to the size of the memory page area and the first starting identifier of the specified data area.
[0008] In the above embodiment, the size of the memory page area can be calculated using the preset kernel symbol, and then the address information of the specified data area can be determined based on the first starting identifier of the specified data area and the size of the memory page area, which is conducive to the rapid determination of the address information.
[0009] In combination with the first aspect, in some optional embodiments, the preset kernel symbol includes the second starting identifier and the first starting identifier of the code segment in the memory; based on the preset kernel symbol, determining the size of the memory page area corresponding to the memory of the device kernel, including: determining the size of the memory page area according to the address difference between the second starting identifier and the first starting identifier.
[0010] In combination with the first aspect, in some optional implementations, the method further includes: sending the data file to a data leakage protection system before the device kernel operates on the data file, wherein the operation includes accessing the data file or uploading the data file; upon receiving an operation permission command output by the data leakage protection system for the data file, allowing the device kernel to operate the data file; and upon receiving a operation prevention command output by the data leakage protection system for the data file, preventing the device kernel from operating the data file.
[0011] In the above-mentioned implementation manner, the data leakage protection system can be used to perform security detection on the operation of data files, so as to improve the security of the operation of data files.
[0012] In combination with the first aspect, in some optional implementations, the underlying function includes at least one of an Open function, a Close function, a Read function, a Write function, and a Chmod function.
[0013] In the second aspect, an embodiment of the present application also provides a memory control device, which includes: a determination unit, used to determine the address information of a specified data area in the memory of the device kernel based on a preset kernel symbol; a modification unit, used to modify the attributes of the specified data area through a memory mapping function according to the address information of the specified data area, wherein the modified attributes of the specified data area are used to control the data read and write permissions of the specified data area; a control unit, used to replace the underlying function corresponding to the file filter driver through a preset kernel function, and the preset kernel function is used to control the read and write permissions of the specified data area after the attributes are modified.
[0014] In conjunction with the second aspect, in some optional implementations, the determining unit is further configured to:
[0015] Based on the preset kernel symbol, the size of the memory page area corresponding to the memory of the device kernel is determined; according to the size of the memory page area and the first starting identifier of the designated data area, the address information of the designated data area in the memory is determined.
[0016] In combination with the second aspect, in some optional embodiments, the preset kernel symbol includes the second starting identifier and the first starting identifier of the code segment in the memory; the determination unit is also used to: determine the size of the memory page area based on the address difference between the second starting identifier and the first starting identifier.
[0017] In a third aspect, the present application further provides an electronic device, comprising a processor and a memory coupled to each other, wherein the memory stores a computer program, and when the computer program is executed by the processor, the electronic device executes the above method.
[0018] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is run on a computer, the computer executes the above method. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.
[0020] Figure 1 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.
[0021] Figure 2 A flowchart of a memory control method provided in an embodiment of the present application.
[0022] Figure 3 A schematic diagram of the distribution of memory areas provided in an embodiment of the present application.
[0023] Figure 4 A block diagram of a memory control device provided in an embodiment of the present application.
[0024] Icons: 10 - electronic device; 11 - processing module; 12 - storage module; 13 - memory; 200 - memory control device; 210 - determination unit; 220 - modification unit; 230 - control unit. DETAILED DESCRIPTION
[0025] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings. It should be noted that the terms "first", "second", etc. are only used to distinguish and describe, and cannot be understood as indicating or implying relative importance.
[0026] The applicant has discovered that in systems with file filtering capabilities but without the CR0 register, it is often difficult to easily change memory read and write permissions, resulting in an inability to flexibly control memory read and write permissions. In view of the above issues, the applicant has proposed the following embodiments to address them. The following embodiments and features within these embodiments may be combined unless they conflict.
[0027] Please refer to Figure 1 The present application provides an electronic device 10 that can change the read and write permissions of the memory of the electronic device 10 based on the file filtering function without relying on the CR0 register, which is conducive to expanding the scope of application of the memory read and write permission changes.
[0028] In this embodiment, the electronic device 10 may include a processing module 11 and a storage module 12. The storage module 12 stores a computer program, which, when executed by the processing module 11, enables the electronic device 10 to perform the steps of the following method.
[0029] The electronic device 10 may be, but is not limited to, a personal computer, a server, or other devices, which is not specifically limited here.
[0030] It is understandable that Figure 1 The structure shown is only a schematic diagram of the structure of the electronic device 10. The electronic device 10 may also include Figure 1 For example, the electronic device 10 may further include a memory 13 independent of the storage module 12 . Figure 1Each component shown in the figure can be implemented by hardware, software or a combination thereof.
[0031] Please refer to Figure 2 The present application provides a memory control method that can be applied to the electronic device 10 described above, and each step of the method is executed or implemented by the electronic device 10. The method may include the following steps:
[0032] Step S110, determining address information of a designated data area in the memory of the device kernel based on a preset kernel symbol;
[0033] Step S120, modifying the attributes of the designated data area through a memory mapping function according to the address information of the designated data area, wherein the modified attributes of the designated data area are used to control data read and write permissions of the designated data area;
[0034] Step S130: replacing the underlying function corresponding to the file filter driver with a preset kernel function, wherein the preset kernel function is used to control the read and write permissions of the specified data area after the attribute is modified.
[0035] In the above implementation, after calculating the address information of the specified data area in the memory, the memory mapping function can be used to modify the properties of the specified data area to achieve control of the read and write permissions of the specified data area. Then, the preset kernel function is used to replace the underlying function corresponding to the file filter driver to control the read and write permissions of the specified data area. In this way, the control of memory read and write permissions can be achieved without the CR0 register, which is conducive to expanding the scope of application of memory read and write permission control.
[0036] The following are the details of each step of the method:
[0037] In step S110 , the preset kernel symbol can be flexibly determined according to actual conditions, and is an identifier corresponding to the start address or end address of each area in the memory.
[0038] As an optional implementation, step S110 may include: determining the size of the memory page area corresponding to the memory of the device kernel based on the preset kernel symbol; determining the address information of the specified data area in the memory according to the size of the memory page area and the first starting identifier of the specified data area.
[0039] The preset kernel symbol includes the second start identifier and the first start identifier of the code segment in the memory. The step of "determining the size of the memory page region corresponding to the memory of the device kernel based on the preset kernel symbol" may include: determining the size of the memory page region based on the address difference between the second start identifier and the first start identifier.
[0040] For example, please refer to Figure 3 The divided areas in the memory 13 may include, but are not limited to, a ".text" area, a ".data" area, a ".bss" area, etc. Of course, the memory 13 may also include other areas, for example, a shared library area, a stack area, and other areas well known to those skilled in the art.
[0041] in, Figure 3 The Init segment shown may include, but is not limited to, driver code corresponding to areas such as the ".text" area and the ".data" area. The ".text" area is the code segment area, and the ".data" area is the designated data area. The designated data area may include a read-only data area and a read-write data area. The read-only data area can be used to store read-only data, and the read-write data area can be used to store read-write data.
[0042] exist Figure 3 In the kernel, the symbol "_start" refers to the starting mark of memory 13;
[0043] "_stext" refers to the start mark of the ".text" area (referring to the second start mark mentioned above);
[0044] "_init_begin" refers to the identifier of the starting position of the instructions executed by the program in the ".text" area;
[0045] "_etext" refers to the end mark of the ".text" area;
[0046] "_sdata" refers to the start mark of the ".data" area (referring to the first start mark mentioned above);
[0047] "_start_rodata" refers to the starting mark of the read-only data area;
[0048] "_end_rodata" refers to the end mark of the read-only data area;
[0049] "_edata" indicates the end mark of the ".data" area;
[0050] "_bss_start" refers to the starting mark of the ".data" area;
[0051] "_bss_stop" refers to the end mark of the ".data" area;
[0052] "_end" refers to the end mark of the memory.
[0053] It should be noted that Figure 3The kernel symbols pointed by the arrows are exemplary characters. In other implementations, they can be flexibly determined according to actual conditions. In addition, "_etext", "_sdata" and "_start_rodata" all correspond to the same address. "_start", "_stext" and "_init_begin" all correspond to the same address. The memory can also have kernel symbols corresponding to other areas, not limited to Figure 3 Kernel symbols for the region shown.
[0054] A memory page can be understood as a logical storage area in the memory, which is a storage area well known to those skilled in the art. In the memory corresponding to the kernel, there are aligned areas, and the memory page sizes of the two aligned areas are the same. For example, the ".text" area and the ".data" area are aligned areas, and the sizes of the memory pages where the ".text" area and the ".data" area are located are the same. After the kernel of the electronic device 10 is started, in the memory, the parts whose address positions remain unchanged generally include the code area and the read-only data area. That is, the addresses corresponding to the starting identifiers of "_stext" and "_start_rodata" will remain unchanged during the kernel startup process. "_start_rodata" and "_sdata" both refer to the same starting address, so "_start_rodata" can be used as the starting identifier of the ".data" area.
[0055] In addition, the ".text" area is adjacent to the ".data" area. Since the memory page of the ".text" area is the same size as the memory page of the ".data" area, the size of the aligned memory page area can be calculated using the kernel symbol ".text" area start identifier and the ".data" area start identifier.
[0056] In this embodiment, after determining the size of the memory page area, the ending address of the ".data" area can be calculated based on the starting identifier corresponding to "_start_rodata". That is, the memory page after the starting address corresponding to "_start_rodata" is the address range of the ".data" area. In this way, the address information of the specified data area can be obtained. This address information includes the starting address and ending address of the ".data" area.
[0057] In step S120, a memory mapping function may be used to modify the attributes of a specified data area. For example, the memory mapping function may be a kernel function "update_mapping_prot." The kernel function "update_mapping_prot" may implement the function of "modifying data area attributes." The internal implementation of this kernel function relies on the "_create_pgd_mapping()" function. The function of the "_create_pgd_mapping()" function is to create a memory mapping.
[0058] The applicant found that when the "_create_pgd_mapping()" function is used on an existing memory area, it will not recreate the memory area or initialize the data in the memory, but will modify the attribute value set for the memory page. Based on this, we can reset the memory attribute value we want for the specified memory page area.
[0059] In this embodiment, since the memory page of the specified data area exists, the "_create_pgd_mapping()" function does not need to rebuild the memory page. At this time, the "update_mapping_prot" function can modify the memory page attributes according to user needs. In this way, the attributes of the read and write control permissions of the specified data segment can be re-modified.
[0060] In step S130, the preset kernel function can be understood as a function with administrative privileges pre-prepared by the administrator. After the preset kernel function replaces the underlying function corresponding to the file filter driver, the file filter driver will run based on the preset kernel function. At this point, the administrator has absolute control over the file system, allowing real-time monitoring of file system operations and facilitating restrictions on access to and upload of data files (such as documents, images, and spreadsheets).
[0061] For example, the kernel function "_sync_lock_test_and_set" is used to implement a low-level address hook (checked) to replace the low-level functions of the file filter driver. The low-level functions include but are not limited to the Open function, Close function, Read function, Write function, Chmod function, etc., which are functions well known to those skilled in the art.
[0062] Based on the above design, the memory control method can be applied to kernel drivers of system architectures such as x86, ARM and MIPS. It can control memory read and write permissions without using the CR0 register, which is conducive to expanding the scope of application.
[0063] As an optional implementation, the method may further include:
[0064] Before the device kernel operates the data file, sending the data file to a data leakage prevention (DLP) system, wherein the operation includes accessing the data file or uploading the data file;
[0065] When receiving the permission operation command output by the data leakage protection system for the data file, allowing the device kernel to operate the data file;
[0066] When receiving the blocking operation command output by the data leakage protection system for the data file, the device kernel is blocked from operating the data file.
[0067] It is understandable that the functions of the data leakage protection system are well known to those skilled in the art, and can monitor data in use, data in storage, and data in flow, and identify suspicious operations or sensitive data.
[0068] After the electronic device 10 completes the operation corresponding to step S130, the administrator can control the control authority for reading and writing memory. At this time, the electronic device 10 can combine the functions of the data leakage protection system to analyze the access to data files or upload of data files, and then determine whether the access to data files or upload of data files is a legal operation. The method of determining whether it is a legal operation is well known to those skilled in the art and is not specifically limited here. When accessing data files or uploading data files is a legal operation, the kernel is allowed to continue operating. If it is an illegal operation, the kernel operation is prohibited. Among them, the data leakage protection system can be installed locally on the electronic device 10, or it can be installed in a server independent of the electronic device 10.
[0069] Please refer to Figure 4 , an embodiment of the present application further provides a memory control device 200, which can be applied to the above-mentioned electronic device 10 and used to execute each step in the method. The memory control device 200 includes at least one software function module that can be stored in the form of software or firmware in the storage module 12 or solidified in the operating system (OS) of the electronic device 10. The processing module 11 is used to execute the executable modules stored in the storage module 12, such as the software function modules and computer programs included in the memory control device 200.
[0070] The memory control device 200 may include a determination unit 210, a modification unit 220, and a control unit 230. The functions of each unit are as follows:
[0071] A determining unit 210 is configured to determine address information of a designated data area in a memory of a device kernel based on a preset kernel symbol;
[0072] a modification unit 220, configured to modify the attributes of the designated data area through a memory mapping function according to the address information of the designated data area, wherein the modified attributes of the designated data area are used to control data read and write permissions of the designated data area;
[0073] The control unit 230 is used to replace the underlying function corresponding to the file filter driver with a preset kernel function, where the preset kernel function is used to control the read and write permissions of the specified data area after the attributes are modified.
[0074] Optionally, the determination unit 210 is also used to: determine the size of the memory page area corresponding to the memory of the device kernel based on the preset kernel symbol; determine the address information of the specified data area in the memory according to the size of the memory page area and the first starting identifier of the specified data area.
[0075] Optionally, the preset kernel symbol includes a second start identifier and the first start identifier of the code segment in the memory. The determining unit 210 is further configured to determine the size of the memory page area according to an address difference between the second start identifier and the first start identifier.
[0076] Optionally, the memory control device 200 may further include a sending unit that sends the data file to the data leakage protection system before the device kernel operates the data file, wherein the operation includes accessing the data file or uploading the data file. The control unit 230 is further configured to, upon receiving a permission operation command output by the data leakage protection system for the data file, allow the device kernel to operate the data file. The control unit 230 is further configured to, upon receiving a block operation command output by the data leakage protection system for the data file, prevent the device kernel from operating the data file.
[0077] In this embodiment, the processing module 11 can be an integrated circuit chip with signal processing capabilities. The processing module 11 can be a general-purpose processor. For example, the processor can be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application.
[0078] The storage module 12 may be, but is not limited to, a random access memory, a read-only memory, a programmable read-only memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory, etc. In this embodiment, the storage module 12 may be used to store preset kernel functions, preset kernel symbols, etc. Of course, the storage module 12 may also be used to store programs, and the processing module 11 executes the programs after receiving an execution instruction.
[0079] It should be noted that those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the electronic device 10 described above can refer to the corresponding processes of each step in the aforementioned method, and will not be elaborated here.
[0080] The present application also provides a computer-readable storage medium that stores a computer program, which, when executed on a computer, causes the computer to execute the memory control method described in the above embodiment.
[0081] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented through hardware or by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.
[0082] In summary, in this solution, after calculating the address information of a specified data area in memory, the memory mapping function can be used to modify the attributes of the specified data area to achieve control over the read and write permissions of the specified data area. Then, the corresponding underlying function of the file filter driver is replaced with a preset kernel function to control the read and write permissions of the specified data area. In this way, memory read and write permissions can be controlled without the CR0 register, which helps expand the scope of application of memory read and write permission control.
[0083] In the embodiments provided in the present application, it should be understood that the disclosed devices, systems and methods can also be implemented in other ways. The device, system and method embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of code, and a part of the module, program segment or code includes one or more executable instructions for implementing the specified logical function. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart can be implemented by a dedicated hardware-based system that performs the specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions. In addition, the functional modules in the various embodiments of the present application can be integrated together to form an independent part, or each module can exist alone, or two or more modules can be integrated to form an independent part.
[0084] The above description is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, various modifications and variations of the present application are possible. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.
Claims
1. A memory control method, characterized in that: The method comprises: Determine address information of a specified data area in the memory of the device kernel based on a preset kernel symbol; Modifying the attributes of the designated data area through a memory mapping function according to the address information of the designated data area, wherein the modified attributes of the designated data area are used to control data read and write permissions of the designated data area; The underlying function corresponding to the file filter driver is replaced by a preset kernel function; wherein the preset kernel function is a pre-prepared function with management authority, and the preset kernel function is used to control the read and write permissions of the specified data area after the attributes are modified. After the preset kernel function is used to replace the underlying function corresponding to the file filter driver, the file filter driver runs based on the preset kernel function.
2. The method according to claim 1, characterized in that Based on the preset kernel symbols, determine the address information of the specified data area in the device kernel memory, including: Determining a size of a memory page area corresponding to a memory of the device kernel based on the preset kernel symbol; According to the size of the memory page area and the first starting identifier of the designated data area, address information of the designated data area in the memory is determined.
3. The method according to claim 2, characterized in that The preset kernel symbol includes the second starting identifier and the first starting identifier of the code segment in the memory; Determining a size of a memory page area corresponding to a memory of the device kernel based on the preset kernel symbol includes: The size of the memory page area is determined according to the address difference between the second starting identifier and the first starting identifier.
4. The method according to claim 1, wherein The method further comprises: Before the device kernel operates the data file, sending the data file to the data leakage protection system, wherein the operation includes accessing the data file or uploading the data file; When receiving the permission operation command output by the data leakage protection system for the data file, allowing the device kernel to operate the data file; When receiving the blocking operation command output by the data leakage protection system for the data file, the device kernel is blocked from operating the data file.
5. The method according to any one of claims 1 to 4, characterized in that The underlying function includes at least one of an Open function, a Close function, a Read function, a Write function, and a Chmod function.
6. A memory control device, characterized in that: The device comprises: a determining unit, configured to determine address information of a designated data area in a memory of a device kernel based on a preset kernel symbol; a modification unit, configured to modify the attributes of the designated data area through a memory mapping function according to the address information of the designated data area, wherein the modified attributes of the designated data area are used to control data read and write permissions of the designated data area; A control unit is used to replace the underlying function corresponding to the file filter driver with a preset kernel function; wherein the preset kernel function is a pre-prepared function with management authority, and the preset kernel function is used to control the read and write permissions of the specified data area after the attributes are modified. After the preset kernel function is used to replace the underlying function corresponding to the file filter driver, the file filter driver runs based on the preset kernel function.
7. The device according to claim 6, characterized in that The determining unit is further configured to: Determining a size of a memory page area corresponding to a memory of the device kernel based on the preset kernel symbol; According to the size of the memory page area and the first starting identifier of the designated data area, address information of the designated data area in the memory is determined.
8. The device according to claim 7, characterized in that The preset kernel symbol includes the second starting identifier and the first starting identifier of the code segment in the memory; The determining unit is further configured to determine a size of the memory page area according to an address difference between the second starting identifier and the first starting identifier.
9. An electronic device, characterized in that: The electronic device includes a processor and a memory coupled to each other, wherein a computer program is stored in the memory. When the computer program is executed by the processor, the electronic device executes the method according to any one of claims 1 to 5.
10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 5.