A method, system and secure software structure for protecting memory overruns

Abstract

The application is suitable for the field of rail transit, and provides a method and system for preventing memory boundary violation and a safety software structure, wherein a plurality of effective data segments are stored in two memory units in duplicate; a plurality of isolated data segments are stored in the two memory units; the isolated data segments are stored between each two of the effective data segments; when data segments need to be checked, the data segments in the two memory units are both inspected; if the data segments pass the inspection, the data checking is successful. The dual-CPU structure uses a two-out-of-two combination type fault-safety structure, and the common cause failure probability is reduced through dual-CPU comparison. Because different start addresses and different isolated data contents are used in the dual-CPU structure, the common cause failure probability can be further reduced.

Description

Technical Field

[0001] This invention belongs to the field of rail transit, and specifically relates to a method, system, and security software structure for protecting memory from exceeding limits. Background Technology

[0002] The rail transit industry involves passenger transport and is responsible for personnel safety. Functional failures can lead to dangerous accidents. Therefore, functions with significant safety impacts and high failure hazards have safety level requirements, with higher safety levels having stricter requirements. Functional safety does not allow a single fault to cause functional failure; that is, after an error occurs, there must be measures to ensure that the error is identified and dealt with promptly.

[0003] In software design, memory allocation using tools like malloc / new is used to create variables and arrays, providing basic functions such as static data storage and dynamic data retrieval. When hardware memory malfunctions or memory access exceeds limits, these basic data storage and retrieval functions will fail. For software in the rail transit industry involving safety functions, errors in data storage and retrieval can range from affecting train operation efficiency to causing serious accidents and injuries; therefore, protection measures are necessary.

[0004] The 2oo2 combined fault-safe structure is a commonly used safety design structure. Its basic principle is that two sets of circuit designs that can achieve the same function receive input together, process input together, and the outputs of the two sets of circuits together constitute the final output, so as to prevent any single set from failing to output effectively.

[0005] Currently, rail transit systems generally use homogeneous or heterogeneous two-out-of-two techniques to ensure the security of memory access for safety-critical software. When using homogeneous techniques, the cost and complexity are low, but they can only protect against random memory errors and cannot protect against systemic failures such as out-of-bounds errors. When using heterogeneous techniques, they can provide protection against random memory errors and provide a certain degree of protection against systemic failures such as out-of-bounds errors, but the development technology is more complex and costly. Summary of the Invention

[0006] To address the above problems, this invention discloses a method for preventing memory overflow, the method comprising:

[0007] Multiple valid data segments are stored in duplicate in two separate memory units;

[0008] Multiple isolated data segments are stored in two memory units respectively; the isolated data segments are stored between every two valid data segments of the multiple valid data segments;

[0009] When it is necessary to verify a data segment, the data segments in both memory units are checked.

[0010] If the data segment passes the verification, the data verification is successful.

[0011] Furthermore, the specific steps of verifying the data segments in both memory units include:

[0012] Verify the valid data segments;

[0013] If the valid data segment passes the verification, then the isolated data segment is verified.

[0014] If the isolated data segment passes the verification, the valid data is successfully read or the periodic check is successful.

[0015] Furthermore, the phrase "when it is necessary to verify the data segment" specifically refers to: when data reading and / or when the verification period expires.

[0016] Furthermore, the starting addresses for storing the multiple valid data segments in the two memory units are different.

[0017] Furthermore, the isolated data segment has a certain length, and the length of the isolated data segment is different from the length of the valid data segment.

[0018] Furthermore, the storage address of the isolated data segment in the memory unit is contiguous with the storage address of its adjacent valid data segment.

[0019] Furthermore, the lengths and / or contents of the isolated data segments in the two memory units are different.

[0020] Furthermore, the length and content of the isolation data segments following different valid data segments vary.

[0021] Furthermore, the isolated data segment is security-side data.

[0022] Furthermore, the valid data segment includes valid data and a checksum.

[0023] Furthermore, the verification of valid data segments specifically includes:

[0024] Calculate the checksum for the valid data segment;

[0025] Determine whether the calculated checksum is the same as the checksum in the stored valid data segment;

[0026] If the checksums are the same, the valid data segment is consistent with the data saved, and the comparison passes.

[0027] If the check codes are different, the comparison fails and an error message is displayed.

[0028] Furthermore, the verification of the isolated data segments specifically includes:

[0029] The isolated data is compared to determine whether the stored isolated data segment is the same as the original isolated data segment;

[0030] If the stored isolated data segment is the same as the original isolated data segment, the comparison passes;

[0031] If the stored isolated data segment is different from the original isolated data segment, the comparison will fail and an alarm will be triggered.

[0032] In another aspect, the present invention also discloses a system for protecting memory out-of-bounds access, the system comprising:

[0033] The data memory allocation module is used to store multiple valid data segments in duplicate in two memory units; each valid data segment includes valid data and a checksum.

[0034] An isolated memory allocation module is used to store multiple isolated data segments in two memory units respectively; the isolated data segments are stored between every two valid data segments of the multiple valid data segments;

[0035] The data verification module is used to verify the valid data segments in two memory units when data segments need to be checked; if the valid data segments in the two memory units pass the verification, the data verification is successful.

[0036] A memory unit is used to store multiple valid data segments and multiple isolated data segments.

[0037] Furthermore, the data verification module is specifically used for:

[0038] Calculate the checksum for the valid data segment;

[0039] Determine whether the calculated checksum is the same as the checksum in the stored valid data segment;

[0040] If the checksums are the same, the valid data segment is consistent with the data saved, and the comparison passes.

[0041] If the check codes are different, the comparison fails and an error message is displayed.

[0042] Furthermore, the system also includes:

[0043] The isolated data verification module is used to verify the isolated data segments in two memory units if the valid data segment verification passes; if the isolated data segments in two memory units pass the verification, the valid data is successfully read or the periodic verification is successful.

[0044] Furthermore, the isolated data verification module is specifically used for:

[0045] The isolated data is compared to determine whether the stored isolated data segment is the same as the original isolated data segment;

[0046] If the stored isolated data segment is the same as the original isolated data segment, the comparison passes;

[0047] If the stored isolated data segment is different from the original isolated data segment, the comparison will fail and an alarm will be triggered.

[0048] In another aspect, the present invention also discloses a security software structure, the security software structure comprising:

[0049] Two processors, two software modules, and two memory units;

[0050] The two processors are used to execute the memory out-of-bounds protection method described above. The two processors control the operation of two software modules respectively and save data to two memory units.

[0051] Compared with the prior art, the present invention has the following beneficial effects:

[0052] This invention provides a method, system, and security software structure for protecting memory out-of-bounds access. The dual-CPU structure uses a two-out-of-two combined fault-safe structure, reducing the probability of common-cause failures through comparison between the two CPUs. Because the dual-CPU structure uses different starting addresses and different isolated data contents, the probability of common-cause failures can be further reduced. Even if the dual-CPU hardware structure is identical, it does not affect the invention's main technical advantage. When using the same starting address, the starting addresses of the two CPUs are the same, but the isolated data segments require different isolation spaces. Therefore, from the second data segment onwards, the memory usage of the two CPUs is different, which does not affect the effectiveness of the solution. When using different starting addresses, the storage of the first data segment becomes differentiated. When using the same isolated data content, since data verification is required before reading, and the solution achieves memory differentiation, it does not affect the effectiveness of the solution. When using different isolated data content, the data read by the two CPUs in the event of an out-of-bounds access is different, which facilitates software logic design.

[0053] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures pointed out in the description and the drawings. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 A schematic diagram of a two-out-of-two (2oo2) combined fail-safe structure according to an embodiment of the present invention is shown;

[0056] Figure 2 A schematic diagram of the data storage structure according to an embodiment of the present invention is shown. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] Software memory access risks out-of-bounds errors, a major type of software system error with often unpredictable and severe consequences. When this occurs in high-security software, it can alter safety-related data, leading to malfunctions, impacting driving safety, and even endangering lives. Therefore, effective measures are needed to systematically protect against memory access violations and mitigate these risks.

[0059] In rail transit applications, a two-out-of-two approach is commonly used to prevent the impact of memory errors. This involves allocating the same memory in two independent channels for data storage and retrieval, comparing the results from both channels, and considering an error if they are inconsistent. This implementation is called combined fault-safety. Currently, there are two design methods for combined fault-safe multi-channel memory allocation:

[0060] 1) Homogeneous allocation, which means that two independent channels use the same memory allocation layout. This method has good protection against random memory errors, but cannot eliminate errors caused by common factors such as memory out-of-bounds errors. These common factors are generally caused by factors that affect both-channel CPUs in the same way, such as design errors, application environment, and interface errors.

[0061] 2) Completely heterogeneous allocation, which means that the software implementation methods and memory unit allocation methods of two independent channels are completely different. The disadvantage of this method is that the human and time resources for development, testing, verification and confirmation are all doubled, which is costly. It is also difficult to achieve completely different memory unit allocation and data relationships. Incompletely heterogeneous memory use cannot effectively avoid the harm caused by out-of-bounds.

[0062] This invention can achieve or even exceed the protection level against random errors and memory out-of-bounds errors of heterogeneous technologies with relatively low complexity and cost, handle errors in a timely manner, and realize data encapsulation, effectively reducing the impact of out-of-bounds errors on other data, reducing the scope of error impact, and improving the overall software robustness.

[0063] A method for protecting against memory overflow, the method comprising:

[0064] Multiple valid data segments are stored in duplicate in two separate memory units;

[0065] Multiple isolated data segments are stored in two memory units respectively; the isolated data segments are stored between every two valid data segments of the multiple valid data segments;

[0066] When it is necessary to verify a data segment, the data segments in both memory units are checked.

[0067] Specifically, the verification of data segments in both memory units includes:

[0068] Verify the valid data segments;

[0069] If the valid data segment passes the verification, then the isolated data segment is verified.

[0070] If the isolated data segment passes the verification, the valid data is successfully read or the periodic check is successful.

[0071] The multiple valid data segments have different starting addresses in the two memory units; the isolated data segment's storage address in the memory unit is contiguous with the storage address of its adjacent valid data segment; the isolated data segment has a certain length, and its length is different from that of the valid data segment. The length and / or content of the isolated data segments in the two memory units are different; the length and content of the isolated data segments following different valid data segments are different; the isolated data segment is security-side data.

[0072] Specifically, the verification of valid data segments includes:

[0073] Calculate the checksum for the valid data segment;

[0074] Determine whether the calculated checksum is the same as the checksum in the stored valid data segment;

[0075] If the checksums are the same, the valid data segment is consistent with the data saved, and the comparison passes.

[0076] If the check codes are different, the comparison fails and an error message is displayed.

[0077] Specifically, the verification of isolated data segments includes:

[0078] The isolated data is compared to determine whether the stored isolated data segment is the same as the original isolated data segment;

[0079] If the stored isolated data segment is the same as the original isolated data segment, the comparison passes;

[0080] If the stored isolated data segment is different from the original isolated data segment, the comparison will fail and an alarm will be triggered.

[0081] To support the smooth operation of the above method, a system for protecting against memory overflow is designed, the system comprising:

[0082] The data memory allocation module is used to store multiple valid data segments in duplicate in two memory units; each valid data segment includes valid data and a checksum.

[0083] An isolated memory allocation module is used to store multiple isolated data segments in two memory units respectively; the isolated data segments are stored between every two valid data segments of the multiple valid data segments;

[0084] The data verification module is used to verify the data segments in both memory units when data segment verification is required; if the data segment verification passes, the data verification is successful.

[0085] A memory unit is used to store multiple valid data segments and multiple isolated data segments.

[0086] Specifically, the data verification module is used for:

[0087] Calculate the checksum for the valid data segment;

[0088] Determine whether the calculated checksum is the same as the checksum in the stored valid data segment;

[0089] If the checksums are the same, the valid data segment is consistent with the data saved, and the comparison passes.

[0090] If the check codes are different, the comparison fails and an error message is displayed.

[0091] The system also includes an isolated data verification module, which is used to verify the isolated data segments in the two memory units if the valid data segment verification passes; if the isolated data segment verification passes, the valid data is successfully read or the periodic verification is successful.

[0092] Specifically, the isolated data verification module is used for:

[0093] The isolated data is compared to determine whether the stored isolated data segment is the same as the original isolated data segment;

[0094] If the stored isolated data segment is the same as the original isolated data segment, the comparison passes;

[0095] If the stored isolated data segment is different from the original isolated data segment, the comparison will fail and an alarm will be triggered.

[0096] A security software architecture, comprising: two processors, two software modules, and two memory units;

[0097] The two processors are used to execute the above method, and the two processors control the operation of the two software modules respectively, saving the data to the two memory units.

[0098] To better understand the above method, the following description is provided in conjunction with the accompanying drawings and specific embodiments.

[0099] I. Structure

[0100] This invention relates to a method for preventing memory overflow, and the application of this method in the design of security software, the structure of which is as follows: Figure 1 , Figure 1 A schematic diagram of a two-out-of-two (2oo2) combined fail-safe structure according to an embodiment of the present invention is shown. The safety software structure specifically includes CPU-I and CPU-II. Software-I and Software-II are installed in CPU-I and CPU-II respectively. Software-I and Software-II run in CPU-I and CPU-II and store data in memory units.

[0101] Figure 2 A schematic diagram of the data storage structure according to an embodiment of the present invention is shown, wherein,

[0102] Data memory allocation module 1 allocates space for valid data when data needs to be written. The space stores the valid data and its check code.

[0103] The isolated memory allocation module 2 allocates space for isolated data when data needs to be written. The space stores isolated data, which is content that is clearly different from valid data.

[0104] Data verification module 3 calculates a checksum on valid data when data needs to be read and / or the verification period expires, and compares the calculation result with the checksum in the read valid data. The checksum and its calculation method are universal; this patent does not restrict the use of any particular calculation method, such as parity check, CRC16, CRC32, etc.

[0105] The isolation data verification module 4 compares the isolated data to the original isolated data when data needs to be read and / or when the verification period expires. The isolation memory allocation module 2 writes isolated data to the isolated space in the storage space. The isolation data verification module 4 reads this data and compares it to the data originally written by the isolation memory allocation module 2. For example, if the isolation memory allocation module 2 writes 0x00AA, the isolation data verification module 4 should also read 0x00AA. If they are the same, it meets the requirement of "original isolated data"; otherwise, it meets the requirement of "not original isolated data".

[0106] II. Process

[0107] The software workflow is as follows:

[0108] 1-1) Module 1 of the CPU-I software allocates space for valid data 1;

[0109] 1-2) Module 1 of the CPU-II software allocates space for valid data 1. The starting addresses allocated by the two CPUs can be the same or different.

[0110] 2-1) Module 2 of the CPU-I software allocates space for isolated data 1. The isolated data space should be of a certain length to distinguish between valid data and isolated data. The isolated data used is the secure side data. The allocated address is the tail address of the space allocated in step 1-1.

[0111] 2-2) Module 2 of the CPU-II software allocates space for isolated data 1. The isolated data space allocated by CPU-II can be 0 or other values, but the isolated data spaces of CPU-I and CPU-II should be of different lengths. The isolated data used is security side data. The isolated data used by the two CPUs can be the same or different. The allocated addresses are respectively connected to the end address of the space allocated in steps 1-2.

[0112] 3-1) Module 1 of the CPU-I software allocates space for valid data 2, and the allocated address continues the address of the space allocated in step 2-1.

[0113] 3-2) Module 1 of the CPU-II software allocates space for valid data 2, and the allocated address continues the space tail address allocated in step 2-2.

[0114] 4-1) Module 2 of the CPU-I software allocates space for isolated data 2. The isolated data space should be of a certain length to distinguish between valid data and isolated data. The isolated data used is the secure side data. The allocated address is the tail address of the space allocated in step 3-1.

[0115] 4-2) Module 2 of the CPU-II software allocates space for isolated data 2. The isolated data space allocated by CPU-II can be 0 or other values, but the isolated data spaces of CPU-I and CPU-II should be of different lengths. The isolated data used is security side data. The isolated data used by the two CPUs can be the same or different. The length and content of the isolated data after different data segments can be the same or different. The allocated address is connected to the tail address of the space allocated in step 3-2.

[0116] 5-1) Repeat steps 3-1 and 4-1 to allocate the remaining data;

[0117] 5-2) Repeat steps 3-2 and 4-2 to allocate the remaining data;

[0118] 6-1) When it is necessary to read data from valid data 1 and / or when the verification period expires, module 3 of the CPU-I software calculates the check code of the valid data and compares it with the stored check code. If the comparison passes, proceed to step 6-2; otherwise, proceed to step 10.

[0119] 6-2) Module 3 of the CPU-II software calculates the check code for valid data and compares it with the stored check code. If the comparison passes, proceed to step 7-1; otherwise, proceed to step 10.

[0120] 7-1) Module 4 of the CPU-I software compares the isolated data to determine if it is the original isolated data. If the comparison passes, proceed to step 7-2 or step 8; if step 7-2 or step 8 is not required, proceed to step 9; if the comparison fails, proceed to step 10. Step 7-2 may or may not be executed. Whether it is executed depends on whether the isolated data space allocated in step 4-2 is 0. If it is allocated to 0, then the CPU-II has no isolated data space, and there is no need for CPU-II's isolated data check, so step 7-2 does not need to be executed; if the allocated space is not 0, then the isolated data needs to be checked, and step 7-2 needs to be executed.

[0121] 7-2) Module 4 of the CPU-II software compares the isolated data to see if it is the original isolated data. If the comparison passes, proceed to step 8; if step 8 is not required, proceed to step 9; if the comparison fails, proceed to step 10.

[0122] 8) When it is necessary to read data from other data segments and / or when the verification period expires, repeat steps 6-1, 6-2, 7-1, and 7-2 to perform the remaining verification checks.

[0123] 9) Data segment read successful or periodic verification successful;

[0124] 10) Alarm message error.

[0125] In the above workflow, by using the isolation space set in step 2, if an out-of-bounds write occurs, the isolated data will be overwritten, and the error can be detected in step 7-1 or 7-2 of the isolated memory check. Similarly, by using the isolation space set in step 2, if an out-of-bounds read occurs, the read isolated data, being secure data, can be detected. By using the valid data with a checksum in step 6, if the valid data position is overwritten out of bounds, an error can be detected. Furthermore, periodic checks ensure timely error detection, identifying errors before they are used, thus improving error detection efficiency.

[0126] The dual-CPU structure employs a two-out-of-two combined fault-safe structure, reducing the probability of common-cause failures through comparison between the two CPUs. Because the dual-CPU structure uses different starting addresses and different isolated data contents, the probability of common-cause failures can be further reduced. If the dual-CPU hardware structure is identical, it does not affect the most significant technical advantage of this invention. When using the same starting address, the starting addresses of the two CPUs are the same, but because step 2-2 requires the use of different isolation spaces (different isolation data lengths or contents), the memory usage of the two CPUs differs starting from the second data segment, which does not affect the effectiveness of the scheme. Using different starting addresses allows for differentiation in the storage of the first data segment. When using the same isolated data content, because step 6 requires data verification before reading, and the scheme achieves memory differentiation, it does not affect the effectiveness of the scheme. Using different isolated data content ensures that the data read by the two CPUs is different when there is an out-of-bounds error, facilitating software logic design.

[0127] In the above steps, steps 6, 7, and 8 can be executed before or after step 5. That is, different data can be written and then read, or the writing and reading can be performed alternately. The execution order of the above steps is not fixed; it can be changed as needed, and some steps can be repeated multiple times or deleted, etc. There are various possibilities for reorganization among the above steps. Those skilled in the art can change the above order without departing from the protection scope of this invention. In the above steps, "data" is not limited to data segments. If the above design is applied to a constraint compiler, memory heterogeneity of software code can be achieved, thereby improving the memory out-of-bounds detection of code segments.

[0128] Existing solutions have the following problems: 1) Setting up a protected area and an isolation area, read / write operations that cross the boundary of the protected area into the isolation area can be detected, but cross-boundary operations within the protected area cannot be handled; 2) By setting up a special data detection mechanism, illegal data read after crossing the boundary can be detected, but if the data obtained after crossing the boundary is within the legal range, it cannot be detected; 3) The two-out-of-two solution commonly used in the field of rail transit safety, with homogeneous dual CPUs, can improve the probability of boundary crossing detection, but it cannot prevent common cause errors (such as software design defects), which is a recognized problem in the industry; 4) The two-out-of-two solution uses completely heterogeneous dual CPUs, which can solve common cause problems with a certain probability, but the cost of complete heterogeneity is very high. Both the design stage and later maintenance require extremely high costs. At the same time, since memory allocation is uncontrolled, it cannot be proven that complete memory heterogeneity has been achieved.

[0129] This invention designs a unique memory allocation structure and processing flow, achieving heterogeneous memory allocation under a two-out-of-two architecture at a very low cost. For example, if software experiences a memory out-of-bounds read, and the out-of-bounds region is still within the legally accessible range, and the read erroneous data is within the legal value range, the two-out-of-two architecture, due to its design flaws, fails to detect the memory out-of-bounds error and ultimately outputs dangerous data. This example of a fault cannot be resolved by existing technologies. However, the solution described in this invention, by implementing memory heterogeneity, ensures that when an out-of-bounds error occurs, the two CPUs read content from different memory locations, resulting in different data. The two-out-of-two architecture compares the two data points and detects the difference, thus reporting an error and achieving error detection.

[0130] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for preventing memory overflow, characterized in that, The method is applied to a secure software architecture, which includes CPU-1 and CPU-2. Software-1 and Software-2 are installed within CPU-1 and CPU-2 respectively. Software-1 and Software-2 run within CPU-1 and CPU-2, storing data in memory units. The method includes: Multiple valid data segments are stored in duplicate in two memory units, with different starting addresses for each segment in the two memory units; Software-I and Software-II allocate space for the multiple valid data segments respectively. Multiple isolated data segments are stored in two memory units respectively; the isolated data segments are stored between every two valid data segments of the multiple valid data segments, and the length and content of the isolated data segments in the two memory units are different; wherein, Software-I and Software-II allocate space for the multiple isolated data segments respectively; The storage address of the isolated data segment in the memory unit is contiguous with the storage address of the adjacent valid data segment; When data segments need to be verified, Software-I and Software-II respectively check the data segments in the corresponding memory units; the data segments include valid data segments and isolated data segments; If the data segment passes the verification, the data verification is successful.

2. The method for preventing memory overflow according to claim 1, characterized in that, The software-I and software-II respectively examine the data segments in the corresponding memory units, specifically including: Verify the valid data segments; If the valid data segment passes the verification, then the isolated data segment is verified. If the isolated data segment passes the verification, the valid data is successfully read or the periodic check is successful.

3. The method for preventing memory overflow according to claim 1, characterized in that, The phrase "when data segments need to be verified" specifically refers to when data reading and / or the verification period expires.

4. The method for preventing memory overflow according to claim 1, characterized in that, The isolated data segment has a certain length, and the length of the isolated data segment is different from the length of the valid data segment.

5. The method for preventing memory overflow according to claim 1, characterized in that, The length and content of the isolation data segment following different valid data segments are different.

6. The method for protecting memory from exceeding memory limits according to any one of claims 1-5, characterized in that, The isolated data segment is security-side data.

7. The method for preventing memory overflow according to claim 2, characterized in that, The valid data segment includes valid data and a checksum.

8. The method for preventing memory overflow according to claim 7, characterized in that, The verification of valid data segments specifically includes: Calculate the checksum for the valid data segment; Determine whether the calculated checksum is the same as the checksum in the stored valid data segment; If the checksums are the same, the valid data segment is consistent with the data saved, and the comparison passes. If the verification codes are different, the comparison will fail and an error message will be displayed.

9. The method for preventing memory overflow according to claim 8, characterized in that, The specific steps of verifying the isolated data segments include: The isolated data is compared to determine whether the stored isolated data segment is the same as the original isolated data segment; If the stored isolated data segment is the same as the original isolated data segment, the comparison passes; If the stored isolated data segment is different from the original isolated data segment, the comparison will fail and an alarm will be triggered.

10. A system for protecting against memory overflow, characterized in that, The system includes a security software architecture, comprising CPU-I and CPU-II. Software-I and Software-II are installed within CPU-I and CPU-II respectively. Both Software-I and Software-II include a data memory allocation module, an isolation memory allocation module, and a data verification module. Software-I and Software-II run within CPU-I and CPU-II, storing data in memory units. The data memory allocation module is used to store multiple valid data segments in duplicate in corresponding memory units; each valid data segment includes valid data and a check code, and the starting addresses for storing the multiple valid data segments in the two memory units are different; An isolated memory allocation module is used to store multiple isolated data segments in their respective memory units; The isolated data segment is stored between every two valid data segments of the plurality of valid data segments, and the length and content of the isolated data segment in the two memory units are different; The storage address of the isolated data segment in the memory unit is contiguous with the storage address of the adjacent valid data segment; The data verification module is used to verify the data segments in the corresponding memory units when it is necessary to verify the data segments. If the data segment verification passes, the data check is successful; A memory unit is used to store multiple valid data segments and multiple isolated data segments.

11. The system for protecting memory out-of-bounds access according to claim 10, characterized in that, The data verification module is specifically used for: Calculate the checksum for the valid data segment; Determine whether the calculated checksum is the same as the checksum in the stored valid data segment; If the checksums are the same, the valid data segment is consistent with the data saved, and the comparison passes. If the verification codes are different, the comparison will fail and an error message will be displayed.

12. The system for protecting memory out-of-bounds access according to claim 11, characterized in that, The system also includes: The isolated data verification module is used to verify the isolated data segments in two memory units if the valid data segment verification passes; if the isolated data segments in two memory units pass the verification, the valid data is successfully read or the periodic verification is successful.

13. The system for protecting memory out-of-bounds access according to claim 12, characterized in that, The isolated data verification module is specifically used for: The isolated data is compared to determine whether the stored isolated data segment is the same as the original isolated data segment; If the stored isolated data segment is the same as the original isolated data segment, the comparison passes; If the stored isolated data segment is different from the original isolated data segment, the comparison will fail and an alarm will be triggered.

14. A secure software architecture, characterized in that, The security software structure includes: Two processors, two software modules, and two memory units; The two processors are used to execute the method according to any one of claims 1-9, wherein the two processors control the operation of two software modules respectively and save data to two memory units.

Images