Memory protection method of operating system and memory

Abstract

The application relates to the technical field of data processing, in particular to a memory protection method of an operating system and a memory, which comprises the following steps: S1, determining an access permission in advance for a processing thread to be created during the running of an application program in the operating system; S2, constructing a permission mapping table corresponding to a memory region of the processing thread according to the access permission, so as to determine an actually usable memory partition of the processing thread; and S3, running the processing thread, wherein the processing thread only accesses data in the memory partition during the running. The beneficial effect is that the corresponding access permission of the processing thread is configured in advance, and during the running of the processing thread, the memory partition corresponding to a specific data category is configured according to the access permission, and a mapping is established, so that the processing thread only resets the specific area access permission of the permission table corresponding to the partition to which the thread belongs during switching, a better memory protection effect is achieved, power consumption is saved, and real-time performance is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a memory protection method of an operating system and a memory. BACKGROUND

[0002] In an embedded system, memory is used to temporarily store operation data in CPU and data exchanged with external storage such as hard disk. When a corresponding application program needs to be run, the operating system will retrieve corresponding code, data, etc. from the storage and store them in the memory for reading, execution and writing during application running. In order to achieve better safety, stability and reliability of the embedded system, a corresponding memory protection mechanism is usually configured to manage the access and operation permissions of the memory to avoid incorrect access.

[0003] In the prior art, there are many technical solutions for memory protection. For example, Chinese patent CN201811619460.7 discloses a memory access method, a memory access controller and a system on chip. The method comprises: receiving a memory access request from a memory access module via a bus, the memory access request including an identifier of the memory access module and a memory region name to be accessed; detecting and processing the memory access request according to the currently stored memory access request and a predetermined memory access control table, and obtaining an updated stored memory access request according to the detection result; and detecting the updated stored memory access request and transmitting the access result of the memory access request to the corresponding memory access module according to the detection result. The present application can effectively protect the memory and avoid leakage of sensitive information, and can efficiently access the memory.

[0004] However, in actual implementation, the inventors found that this kind of technical solution relies on the software layer to intercept the memory access request and process the data of the specified page, and determines the accessible page before releasing it. The time consumption is large and the real-time performance is affected when the entire memory protection unit is reconfigured during thread switching. SUMMARY

[0005] In view of the above problems in the prior art, the present application provides a memory protection method of an operating system. On the other hand, a memory for implementing the memory protection method is also provided.

[0006] The specific technical solutions are as follows:

[0007] A memory protection method of an operating system, comprising:

[0008] Step S1: For a processing thread to be created during running of an application program in the operating system, the access permission is determined in advance;

[0009] Step S2: constructing a permission mapping table corresponding to memory regions of the processing thread according to the access permission, to determine actual memory partitions available to the processing thread;

[0010] The memory partitions are determined according to data categories of memory data to be accessed by the processing thread, and each of the memory partitions is used to store memory data of one of the data categories;

[0011] Step S3: running the processing thread, wherein the processing thread only accesses data in specific memory partitions according to the permission mapping table during running.

[0012] In another aspect, the step S1 comprises:

[0013] Step S11: obtaining an application to which the processing thread belongs for the processing thread;

[0014] Step S12: obtaining classification information of the application to which the processing thread belongs;

[0015] The classification information comprises: untrusted application and trusted application;

[0016] Step S13: determining the access permission of the processing thread according to the classification information.

[0017] In another aspect, the access permission comprises a plurality of groups of data category permissions, each group of data category permissions corresponding to one data category, and each group of data category permissions further comprising task access permission and interrupt access permission;

[0018] When the processing thread is running through a task, the actual access permission of the processing thread to the memory partition corresponding to each of the data categories is determined based on the task access permission;

[0019] When the processing thread is running through an interrupt, the actual access permission of the processing thread to the memory partition corresponding to each of the data categories is determined based on the interrupt access permission;

[0020] The actual access permission is: no permission, read only, execute, or read and write.

[0021] In another aspect, the data categories comprise: code other than the application to which the processing thread belongs, data other than the application to which the processing thread belongs, private data of the application to which the processing thread belongs, code of the processing thread, data of the processing thread, stack of the processing thread, code of other threads of the application to which the processing thread belongs, data of the other threads, stack of the other threads, and peripheral device interface.

[0022] In another aspect, a plurality of the memory partitions form a memory partition group, and each of the memory partition groups is constructed for memory data of one of the applications.

[0023] In another aspect, the method further comprises, after the step S3:

[0024] Step S4: obtaining a running state of the processing thread, and when the running state is switched, re-determining an access permission of the processing thread and adjusting the memory partitions.

[0025] In another aspect, the step S4 comprises:

[0026] Step S41: obtaining the running state and determining whether a thread switching occurs;

[0027] If yes, go to step S42;

[0028] If no, return to the step S41;

[0029] Step S42: determining an updated application category of the processing thread according to a partition number to be accessed by the processing thread after the thread switching;

[0030] The updated application category comprises: switching from the trusted application to another trusted application, switching from the untrusted application to another untrusted application, switching from the trusted application to the untrusted application, and switching from the untrusted application to the trusted application.

[0031] Step S43: determining a to-be-initialized partition according to the updated application category, and then initializing the to-be-initialized partition to form available memory partitions;

[0032] The processing thread after the thread switching accesses the available memory partitions to obtain memory data.

[0033] In another aspect, the method further comprises, during the step S43:

[0034] Determining whether the processing thread needs to cross the memory partition group, and adjusting the to-be-initialized partition according to a determination result.

[0035] A memory, in which computer instructions are stored, the computer instructions being suitable for being executed in a computer device, and when the computer device executes the computer instructions, the memory protection method described above is executed.

[0036] The technical solution has the following advantages or beneficial effects:

[0037] In view of the problems of large load and poor timeliness of the memory protection mechanism in the prior art, in the scheme, the corresponding access permission is pre-configured around the processing thread to be created by the application program during runtime, and during the runtime of the processing thread, the memory partition corresponding to the specific data category is configured and mapped according to the access permission, so that the processing thread only resets the specific area access permission of the permission table corresponding to the partition to which the thread belongs during switching, thereby achieving a better memory protection effect, saving power consumption and improving real-time performance. BRIEF DESCRIPTION OF DRAWINGS

[0038] Reference will be made to the accompanying drawings to more fully describe embodiments of the present application. However, the accompanying drawings are only used for illustration and explanation, and do not constitute a limitation on the scope of the present application.

[0039] Figure 1 is a whole schematic diagram of the embodiment of the present application;

[0040] Figure 2 is a schematic diagram of step S1 in the embodiment of the present application;

[0041] Figure 3 is a schematic diagram of step S4 in the embodiment of the present application;

[0042] Figure 4 is a schematic diagram of step S4 in the embodiment of the present application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0044] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0045] The present application will be further described below in combination with the accompanying drawings and specific embodiments, but is not limited by the present application.

[0046] The present application includes:

[0047] A memory protection method of an operating system, as shown in Figure 1 , comprising:

[0048] Step S1: For the processing thread to be created by the application program during runtime in the operating system, pre-determine the access permission;

[0049] Step S2: constructing a permission mapping table corresponding to the memory region according to the access permission of the processing thread, to determine the memory partition actually available to the processing thread;

[0050] The memory partition is determined according to the data category of the memory data to be accessed by the processing thread, and each memory partition is used to store memory data of one data category;

[0051] Step S3: running the processing thread, and the processing thread only accesses data in a specific memory partition according to the permission mapping table during running.

[0052] Specifically, to solve the problems of heavy load and poor timeliness of the memory protection mechanism in the prior art, for the processing thread generated by the operating system during running, a corresponding access permission is pre-allocated, which is associated with the data category accessible by the processing thread during running, such as code outside the application, data outside the application, etc. Then, during actual running of the application, according to the data category of the relevant data contained in the application, the physical memory can be divided and configured with multiple memory partitions, each of which is used to store memory data of one data category, such as code, private data, stack, etc. It should be noted that according to the data required for running the application, multiple memory partitions can be established, which correspond to actual physical memory addresses, but not all memory partitions are accessible or operable memory partitions for the current processing thread. After establishing the memory partitions, the memory partitions accessible by the processing thread can be determined based on the access permission configured for the current processing thread, and a corresponding mapping relationship is established to form a permission mapping table. During actual running, the processing thread can only perform specific operations on specific memory partitions through the permission mapping table, such as read-only, execute, write, etc., thereby realizing a more fine-grained memory protection mechanism, which is not easy to cause other data leakage, and when the thread is switched, only the access permission of the specific region of the permission table corresponding to the partition to which the thread belongs is set, and the permission table is calculated when the operating system starts, and the subsequent thread directly reads and uses it when switching.

[0053] In the implementation process, as shown in Figure 2 , step S1 includes:

[0054] Step S11: obtaining the application to which the processing thread belongs for the processing thread;

[0055] Step S12: obtaining the classification information of the application;

[0056] The classification information includes: untrusted application and trusted application;

[0057] Step S13: determining the access permission of the processing thread according to the classification information.

[0058] The access permission includes a plurality of groups of data category permissions, each group of data category permissions corresponding to a data category.

[0059] The data categories include code other than the application, data other than the application, private data of the application, code of a processing thread, data of the processing thread, a stack of the processing thread, code of other threads of the application, data of the other threads, a stack of the other threads, and a peripheral device interface.

[0060] In the operating system, the configuration of the threads is static, and no thread is dynamically created during system operation, so the overall memory layout and thread position are determined. Each processing thread has its own application, which can be divided into untrusted applications and trusted applications according to a predetermined hierarchy. For untrusted applications and trusted applications, the data categories accessible by the processing threads generated by each type of application can be configured, and in the subsequent process of creating memory partitions, corresponding memory partitions are established around the above-mentioned data categories to control the memory data that can be operated by the processing threads.

[0061] It should be noted that the above classification information is only a relatively simple embodiment, and other divisions may also be made during implementation, such as subdividing trusted applications into protected trusted applications and unprotected trusted applications.

[0062] Further, to achieve a more accurate control effect, each group of data category permissions further includes task access permission and interrupt access permission.

[0063] When the processing thread is running through a task, the actual access permission of the processing thread to the memory partition corresponding to each data category is determined based on the task access permission.

[0064] When the processing thread is running through an interrupt, the actual access permission of the processing thread to the memory partition corresponding to each data category is determined based on the interrupt access permission.

[0065] The actual access permission is no permission, read-only, execute-only, or read-write.

[0066] Specifically, considering that during actual system execution, the corresponding application program needs to be started and the processing thread needs to be created through task scheduling (Task) or interrupt triggering (ISR). Therefore, by selecting to further combine the application scenario when creating the process thread to control the access permission when configuring the access permission for each data category, a more accurate configuration effect can be achieved.

[0067] According to the above mechanism, a relatively complete permission configuration table can be formed, as shown in Table 1:

[0068]

[0069] Table 1

[0070] According to the permission configuration table, the access permission of the processing thread to the memory partition of the specific data category can be configured according to the permission configuration table after the memory partition corresponding to the data category is created. Meanwhile, after the memory partition is created, a plurality of memory partitions form a memory partition group, and each memory partition group is respectively constructed for the memory data of an application, so that the processing thread can access the data in the specific memory partition and perform the corresponding operation.

[0071] In one embodiment, as shown in FIG. 4, after step S3, the method further comprises: Figure 3

[0072] Step S4: obtaining the running state of the processing thread, and when the running state is switched, re-determining the access permission of the processing thread and adjusting the memory partition.

[0073] Specifically, considering that the processing thread may be switched in the actual running process, thereby causing the memory management mechanism to fail, in this embodiment, after the mapping relationship between the processing thread and the memory partition is established, the state of the processing thread is further monitored, so as to obtain the running state of the processing thread. When the thread is switched, the corresponding memory partition is re-determined, so as to achieve a better protection effect. At the same time, since the operation process of the thread itself does not need to be identified, the occupation of resources is reduced.

[0074] In one embodiment, as shown in FIG. 4, step S4 comprises: Figure 4

[0075] Step S41: obtaining the running state and determining whether the thread is switched;

[0076] If yes, go to step S42;

[0077] If no, return to step S41;

[0078] Step S42: determining the update application category of the processing thread according to the partition number to be accessed by the processing thread after the thread is switched;

[0079] The update application category comprises: switching from a trusted application to another trusted application, switching from an untrusted application to another untrusted application, switching from a trusted application to an untrusted application, and switching from an untrusted application to a trusted application.

[0080] Step S43: determining the to-be-initialized partition according to the update application category, and then initializing the to-be-initialized partition to form an available memory partition;

[0081] ​​The processing thread after thread switching accesses the available memory partition to obtain memory data.

[0082] Specifically, to achieve better allocation effect, the above-mentioned identification process is also constructed in the embodiment, and the change of the theoretical security level of the processing thread after thread switching is determined according to the partition number that the processing thread needs to access after thread switching, and then the memory region that needs to be initialized, the access permission and the mapping relationship are determined, thereby improving the memory data security in the switching process.

[0083] The above-mentioned identification process is a parallel process performed by the processing thread when the processing thread normally executes corresponding processing, which determines whether a specific initialization operation is needed by monitoring the running state and determining whether thread switching occurs; when there is no thread switching, only the monitoring of the running state is maintained without processing the memory partition until the processing thread exits or is closed.

[0084] In one embodiment, the execution step S43 further includes:

[0085] Determining whether the processing thread needs to cross the memory partition group, and adjusting the partition to be initialized according to the determination result.

[0086] Specifically, in the process of determining the memory partition to be initialized, to achieve better memory security, it is further determined whether the processing thread needs to access the memory partition outside the current memory partition group, and if so, the memory partition to be initialized is increased to improve the security.

[0087] In one embodiment, the memory partition group of a certain application program is sequentially provided with the 1st-13th memory partitions, which are respectively 1, a code start segment; 2, an application code start segment; 3, an application code segment; 4, an application code end segment; 5, a code end segment; 6, a data start segment; 7, a private data start segment; 8, an application private data segment; 9, a thread data start segment; 10, a thread data segment; 11, a thread data end segment; 12, an application data end segment; and 13, an external device segment.

[0088] When thread switching is triggered, the partition numbers before and after switching are identified and classified into the following categories:

[0089] From a trusted application to another trusted application, from an untrusted application to another untrusted application, from a trusted application to an untrusted application, and from an untrusted application to a trusted application.

[0090] Then, it is determined whether the thread switching needs to cross the memory partition group, and finally the memory partition to be initialized is generated.

[0091] For example, when switching from a trusted application to another trusted application:

[0092] If the thread switch needs to cross the partition, then at most the following need to be reinitialized: 9, thread data start segment; 10, thread data segment; 11, thread data end segment;

[0093] If no partition crossing is needed, then only the following needs to be initialized: 10, thread data segment;

[0094] When switching from an untrusted application to another untrusted application:

[0095] If the thread switch needs to cross the partition, then at most the following need to be reinitialized: 4, application code end segment; 5, code end segment; 6, data start segment; 9, thread data start segment; 10, thread data segment; 11, thread data end segment;

[0096] If no partition crossing is needed, then only the following needs to be initialized: 10, thread data segment;

[0097] When switching from a trusted application to an untrusted application, or vice versa, all of the memory partitions 2-11 need to be initialized.

[0098] A memory, in which computer instructions are stored, the computer instructions being adapted to be executed in a computer device, when the computer device executes the computer instructions, the memory protection method described above is executed.

[0099] When the computer device reads the computer instructions, the instructions are usually loaded by the operating system itself, and the processing thread of the application program is controlled, the memory partitions are created, and the like, according to the memory protection method described above.

[0100] The memory can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium includes, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any appropriate combination of the foregoing, such as random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disc read only memory (CD-ROM).

[0101] The processor in the computer reads the computer instructions stored in the memory, so that the processor can execute the functional actions specified in each step or a combination of steps in the flowchart; the device generates the functional actions specified in each block or a combination of blocks in the block diagram.

[0102] It should be understood that a processor in the computer can be implemented as one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general purpose processors, controllers, microcontrollers (MCUs), microprocessors (Microprocessors), or other electronic elements, for executing the aforementioned computer instructions.

[0103] The computer instructions can execute entirely on the user's local computer, partly on the user's local computer, as a stand-alone software package, partly on the user's local computer and partly on the remote computer or entirely on the remote computer or server. It should also be noted that in some alternative embodiments, the functions noted in the flowcharts or blocks can occur out of the order noted in the figures. For example, two blocks shown in succession can in fact be executed substantially concurrently or the blocks can sometimes be executed in the reverse order, depending upon the functionality involved.

[0104] The above merely provides the preferred embodiments of the present application, but does not limit the modes for implementation and the protection scope of the present application. It should be understood by those skilled in the art that any equivalent replacement and obvious change made according to the present application description and drawings should be included in the protection scope of the present application.

Claims

1. A memory protection method for an operating system, characterized in that, include: Step S1: Predetermine access permissions for the processing threads that the application will create during runtime in the operating system; Step S2: Construct an access permission mapping table for the memory region corresponding to the processing thread according to the access permissions, so as to determine the memory partition that the processing thread can actually use; The memory partitions are determined according to the data category of the memory data to be accessed by the processing thread, and each memory partition is used to store memory data of one data category. In step S2, the physical memory is divided to obtain the memory partition when the application is actually running. Step S3: Run the processing thread, which, during runtime, accesses only the data in the specific memory partition according to the permission mapping table; Step S4: Obtain the running status of the processing thread, and when the running status changes, re-determine the access permissions of the processing thread and adjust the memory partition; Step S4 includes: Step S41: Obtain the running status and determine whether a thread switch has occurred; If so, proceed to step S42; If not, return to step S41; Step S42: Determine the update application category of the processing thread according to the partition number that the processing thread needs to access after the thread switch; Step S43: Determine the partition to be initialized according to the updated application category, and then initialize the partition to be initialized to form a usable memory partition; After the thread switch, the processing thread accesses the available memory partition to obtain memory data; In step S43, it is determined whether the processing thread before and after the switch is switching between trusted and untrusted applications and between different memory partition groups, and the partition number of the initialized memory partition is determined based on the determination result.

2. The memory protection method according to claim 1, characterized in that, Step S1 includes: Step S11: Obtain the application to which the processing thread belongs; Step S12: Obtain the classification information of the application to which it belongs; Step S13: Determine the access permissions of the processing thread according to the classification information.

3. The memory protection method according to claim 2, characterized in that, The access permissions include multiple sets of data category permissions, each set of data category permissions corresponds to a data category, and each set of data category permissions also includes task access permissions and interruption access permissions; When the processing thread is triggered by task scheduling, the actual access permissions of the processing thread to the memory partition corresponding to each data category are determined based on the task access permissions; When the processing thread is triggered by an interrupt, the actual access permissions of the processing thread to the memory partition corresponding to each data category are determined based on the interrupt access permissions.

4. The memory protection method according to claim 2, characterized in that, The data categories include: code outside the application to which it belongs, data outside the application to which it belongs, private data of the application to which it belongs, code of the processing thread, data of the processing thread, stack of the processing thread, code of other threads of the application to which it belongs, data of other threads, stack of other threads, and peripheral device interfaces.

5. The memory protection method according to claim 2, characterized in that, Multiple memory partitions form a memory partition group, and each memory partition group is constructed for the memory data of a given application.

6. The memory protection method according to claim 5, characterized in that, The process of performing step S43 also includes: Determine whether the processing thread needs to cross the memory partition group, and adjust the partition to be initialized according to the determination result.

7. A memory storing computer instructions adapted to be executed in a computer device, characterized in that, When the computer device executes the computer instructions, it performs the memory protection method as described in any one of claims 1-6.

Images