A process security defense method, product, device, and medium

Abstract

This invention discloses a process security defense method, product, device, and medium, relating to the field of network security technology. At the hardware level, a secure memory controller is added, located between the system bus and the memory controller. It employs a combined hardware and software control approach, requiring any access to physical memory to be verified by the secure memory controller. Each secure process is recorded in a secure memory control table and associated with a specific memory address range. Only after verification as a secure process can it access the corresponding memory area, preventing data theft and tampering by other unsecured processes during program execution. This effectively prevents malicious software or other unauthorized processes from accessing sensitive memory areas, thereby improving the overall security and stability of the system.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a process security defense method, product, device, and medium. Background Technology

[0002] Artificial intelligence (AI) security technology is a rapidly developing field, involving multiple aspects of protecting AI systems themselves and the cybersecurity enhanced by AI technology. Traditional AI security technologies employ software-based defense strategies, allowing attackers to launch attacks from multiple dimensions. During operation, the AI ​​program's data (such as its weights, features, and models) can be stolen and tampered with by other programs running on the host machine. This approach cannot completely solve AI security problems, leaving security risks still present.

[0003] Therefore, improving the security and defensive capabilities of artificial intelligence technology is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this invention is to provide a process security defense method, product, device, and medium to address the issue of reducing security risks associated with artificial intelligence security technologies.

[0005] To address the aforementioned technical problems, this invention provides a process security defense method applied to a secure memory controller; the secure memory controller is located between the system bus and the memory controller, and includes:

[0006] Obtain the current process identifier and a pre-established secure memory control table; wherein, the secure memory control table records accessible secure processes and their corresponding memory address ranges;

[0007] The matching result of the current process is determined by matching the current process identifier with the process identifier in the secure memory control table.

[0008] If the matching result is successful, the access permissions of the current process are determined based on the matching relationship between the current read / write address of the current process in the secure memory space corresponding to the secure memory controller and the memory address range of the secure memory control table.

[0009] If the current process has access permissions enabled, the current process is determined to be a safe process, so as to facilitate access to data in the successfully matched memory address range.

[0010] On the one hand, the process of establishing the secure memory control table includes:

[0011] Obtain accessible secure processes within the server;

[0012] A mapping relationship is established between the process identifier of the security process and the corresponding memory address range to complete the security memory control table; wherein, the memory address range of the security process is at least one.

[0013] On the other hand, matching the current process identifier with the process identifier in the secure memory control table to determine the matching result of the current process includes:

[0014] Determine whether the current process identifier is the same as the process identifier in the secure memory control table;

[0015] If a match is found, it is determined that the current process to which the current process identifier belongs has been successfully matched.

[0016] On the other hand, after matching the current process identifier with the process identifier in the secure memory control table to determine the matching result of the current process, before determining that the matching result is successful, the process further includes:

[0017] Obtain the enable flag of the secure memory control table;

[0018] If the current process identifier matches the current process, obtain the current enable flag of the current process;

[0019] If the current enable flag is the same as the enable flag in the secure memory control table, then the final matching result of the current process is determined to be successful.

[0020] On the other hand, the process of establishing the enable flag of the secure memory control table includes:

[0021] When a portion of the system memory space within the secure memory space is occupied, the process corresponding to the portion of the system memory space and the process corresponding to the secure memory space are distinguished by the enable flag, so as to establish the enable flag of the secure memory control table.

[0022] On the other hand, the process of determining the secure memory space includes:

[0023] Get the system memory space size and preset ratio;

[0024] The size of the corresponding safe memory space in the reserved physical memory is determined based on the relationship between the size of the system memory space and the preset ratio.

[0025] Obtain the address information of the corresponding system memory space within the physical memory;

[0026] The address information of the secure memory space is determined based on the address information of the system memory space and the size of the secure memory space, wherein the address information of the secure memory space is higher than the address information of the system memory space.

[0027] On the other hand, the current process identifier is the process identifier applied to the model, and the process of establishing the memory address range includes:

[0028] Obtain the accessible model size parameter within the server; wherein, the model size parameter is the model parameter corresponding to the process applied to the model;

[0029] The memory space to be requested is determined based on the accessible model size parameter within the server;

[0030] Within the secure memory space, request the corresponding target memory based on the memory space to be requested;

[0031] The target memory is named using block space to establish the memory address range.

[0032] On the other hand, determining the memory space to be requested based on the accessible model size parameter within the server includes:

[0033] Obtain the number of parameters and the corresponding floating-point type in the model size parameters of the target model;

[0034] The memory space to be requested for the target model is determined based on the relationship between the number of parameters, the floating-point number type, and the unit byte.

[0035] On the other hand, the memory address range corresponding to the block space is used as the memory address range of the secure memory control table, and arranged in a column form; wherein, one block space corresponds to one memory address range.

[0036] On the other hand, the method also includes:

[0037] When the target memory block space is full during the request for the memory space to be requested, the excess memory space is named the next block space, and the memory address range corresponding to the next block space is used as a new column of memory address range in the secure memory control table and written into the corresponding secure process.

[0038] On the other hand, determining the access permissions of the current process based on the matching relationship between the current read / write address of the current process in the secure memory space corresponding to the secure memory controller and the memory address range of the secure memory control table includes:

[0039] The system matches the current read / write address of the current process in the secure memory space corresponding to the secure memory controller with the current memory address range of the target secure process that has a successful match in the secure memory control table.

[0040] If the match is successful, the access permission of the current process is determined to be enabled.

[0041] If the match fails, the current read / write address is matched with the next memory address range corresponding to the target secure process that has a successful match in the secure memory control table, until all the memory address ranges of all columns of the target secure process that has a successful match in the secure memory control table have been matched.

[0042] If the memory address ranges of all columns of the target secure process that have a successful matching result in the secure memory control table fail to match, then the access permission of the current process is determined to be prohibited.

[0043] On the other hand, matching is performed based on the current read / write address of the current process in the secure memory space corresponding to the secure memory controller and the current memory address range of the target secure process whose matching result is successful in the secure memory control table, including:

[0044] Obtain the start and end address information of the current memory address range;

[0045] The first read / write address is obtained by performing a bitwise AND operation between the current read / write address and the starting address information.

[0046] Determine whether the first read / write address is the same as the starting address information;

[0047] If the first read / write address is the same as the starting address information, then the address information of the current read / write address exceeding the current read / write address information of the starting address information is ORed with the address information of the previous predetermined number of bits corresponding to the ending address information to obtain the second read / write address;

[0048] Determine if the second read / write address is 0;

[0049] If the second read / write address is not 0, then it is determined that the current read / write address and the current memory address range are successfully matched.

[0050] To address the aforementioned technical problems, the present invention also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implements the steps of a security defense method for the process.

[0051] To address the aforementioned technical problems, the present invention also provides a process security defense device, comprising:

[0052] Memory, used to store computer programs;

[0053] A processor for implementing the security defense method for the process as described when executing the computer program.

[0054] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the process security defense method as described above.

[0055] This invention provides a process security defense method applied to a secure memory controller. The secure memory controller is located between the system bus and the memory controller, and includes: acquiring the current process identifier and a pre-established secure memory control table; wherein the secure memory control table records accessible secure processes and their corresponding memory address ranges; matching the current process identifier with the process identifier in the secure memory control table to determine the matching result of the current process; if the matching result is successful, determining the access permissions of the current process based on the matching relationship between the current read / write address of the current process in the secure memory space corresponding to the secure memory controller and the memory address range in the secure memory control table; if the access permissions of the current process are enabled, determining the current process as a secure process, so as to facilitate access to data in the successfully matched memory address range.

[0056] The beneficial effect of this invention lies in the addition of a secure memory controller at the hardware level, located between the system bus and the memory controller. This combined hardware and software control method ensures that any access to physical memory requires secure verification by the secure memory controller to match the physical memory. Each secure process is recorded in the secure memory control table and associated with a specific memory address range. Only after verification as a secure process can it access the corresponding memory area, preventing data theft and tampering by other unsecured processes during program execution. This effectively prevents malicious software or other unauthorized processes from accessing sensitive memory areas, thereby improving the overall security and stability of the system.

[0057] Secondly, the establishment of the secure memory control table is a process of security verification for the current process's access. Each process is associated with a specific physical memory region in this table to ensure the current process's secure access to memory regions, improving the overall security and stability of the system. Process identifier matching is used to complete the initial screening of the current process, improving matching efficiency. Matching process identifiers and enable flags separately completes the initial screening and further filtering of the current process, improving matching accuracy and speed. The address information of the secure memory space is distinguished from the address information of the system memory space, and a certain amount of physical memory space is reserved specifically for its use, ensuring the security and usability of secure memory and preventing conflicts with applications or system components in the system memory space. The address matching process for logical operations reduces computational complexity and does not affect memory access speed, achieving memory safety at the hardware level.

[0058] In addition, the present invention also provides a computer program product, a process security defense device, and a computer-readable storage medium, which have the same beneficial effects as the process security defense method described above. Attached Figure Description

[0059] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0060] Figure 1 A flowchart illustrating a process security defense method provided in an embodiment of the present invention;

[0061] Figure 2 A schematic diagram showing the location of a secure memory controller provided in an embodiment of the present invention;

[0062] Figure 3 This is a structural diagram of a process security defense device provided in an embodiment of the present invention. Detailed Implementation

[0063] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0064] The core of this invention is to provide a process security defense method, product, device, and medium to address the problem of reducing security risks in artificial intelligence security technology.

[0065] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0066] Deploying artificial intelligence systems into business scenarios requires three layers of defense:

[0067] I. Offensive and defensive security: Targeted defense mechanisms designed against known attacks;

[0068] II. Model Security: Improve model robustness through model validation and other means;

[0069] III. Architecture Security: Design different security mechanisms to ensure architecture security in businesses that deploy artificial intelligence (AI).

[0070] Conventional AI security technologies mostly focus on software, attempting to mitigate risks through methods such as enhancing model robustness, data encryption, and security auditing. However, this software-based defense strategy cannot completely solve AI security problems because attackers can launch attacks from multiple dimensions. For example, attackers can exploit hardware vulnerabilities to implant malicious code on the hardware platform on which the model runs, directly affecting the model's execution results. Even if the model itself has undergone rigorous security testing, it cannot resist hardware-level attacks. The process security defense method provided by this invention can solve the above-mentioned technical problems.

[0071] Figure 1 A flowchart of a process security defense method provided in an embodiment of the present invention is shown below. Figure 1 As shown, it is applied to the secure memory controller; the secure memory controller is located between the system bus and the memory controller, and includes:

[0072] S11: Obtain the current process identifier and the pre-established secure memory control table; the secure memory control table records the accessible secure processes and their corresponding memory address ranges;

[0073] S12: Match the current process identifier with the process identifier in the safe memory control table to determine the matching result of the current process;

[0074] S13: If the matching result is successful, determine the access permissions of the current process based on the matching relationship between the current read / write address of the current process in the safe memory space corresponding to the safe memory controller and the memory address range of the safe memory control table;

[0075] S14: If the current process has access permissions enabled, determine the current process as a safe process so that it can access the data in the successfully matched memory address range.

[0076] Specifically, the secure memory controller of this invention is designed to enhance system memory security, acting as a gatekeeper for memory access. Any access to physical memory must first undergo security verification by this controller. Its working principle involves matching physical memory using the process's identity document (ID), primarily employing a physical matching method. This matching can be a logical operation and does not affect memory access speed. Figure 2 This is a schematic diagram showing the location of a secure memory controller according to an embodiment of the present invention, as shown below. Figure 2 As shown, the secure memory controller 1 is located between the system bus 2 and the memory controller 3. It can be an additional control unit or processor unit, and can be packaged independently or integrated with other control units. The system bus 2 is connected to the central processing unit 4 and also to the hard disk 5. Furthermore, the memory controller 3 is connected to the double data rate memory 6. Additionally, this invention can be applied to any scenario based on any security defense, and is not limited thereto.

[0077] The current process identifier in step S11 is used to identify the current process. This is mainly because the essence of AI security technology is to protect the security policies of each model during runtime, and the corresponding current process is the process that needs to access physical memory. The current process identifier (PID) is a unique number used to identify the running process in the operating system, allowing the operating system and users to track and manage it. The secure memory control table records the secure processes that can be accessed and the memory address ranges. It can be understood that secure processes are those processes currently allowed to access physical memory. The memory address range is the address information accessed by the secure process, stored in the secure memory control table as address information records.

[0078] Table 1 is the first table of secure memory control. As shown in Table 1, it includes the PID of the secure process and the memory address range corresponding to multiple physical addresses.

[0079] Table 1

[0080] Security process identifier Memory address range 1 Memory address range 22 101 0×10000000-0×10200000 0×10000000-0x20200000

[0081] In step S12, the matching result of the current process is determined by matching the current process identifier with the process identifier (process identifier of the safe process) in the safe memory control table. If the match is the same, it is determined that the current process to which the current process identifier belongs can be subject to subsequent access permission determination. If the match is different, it is determined that the current process to which the current process identifier belongs is not in the safe memory control table.

[0082] In step S13, the access permission result of the current process is determined based on the matching relationship between the current read / write address of the current process and the memory address range of the secure memory control table. That is, the address information of multiple memory address ranges in Table 1 is matched with the current read / write address information. If the match is successful, the current process is allowed to access the data and is determined to be a secure process, so as to facilitate the access to the data in the memory address range that was successfully matched in step S14.

[0083] It is understandable that the matching process in step S13 can be performed using logical operations or other methods for comparison and determination. No limitation is made here, and it can be set according to the actual situation.

[0084] The establishment of a safe memory control table requires reserving safe memory space in physical memory to store model parameters. Based on the specific memory space size within the safe memory space for different models, a model size parameter (i.e., the number of parameters to run) can be used to determine this. Furthermore, a block storage method can be employed to prevent address fragmentation and enable centralized access.

[0085] This invention provides a process security defense method applied to a secure memory controller. The secure memory controller is located between the system bus and the memory controller, and includes: acquiring the current process identifier and a pre-established secure memory control table; wherein the secure memory control table records accessible secure processes and their corresponding memory address ranges; matching the current process identifier with the process identifier in the secure memory control table to determine the matching result of the current process; if the matching result is successful, determining the access permissions of the current process based on the matching relationship between the current read / write address of the current process in the secure memory space corresponding to the secure memory controller and the memory address range in the secure memory control table; if the access permissions of the current process are enabled, the current process is determined to be a secure process, so as to facilitate access to data in the successfully matched memory address range. At the hardware level, an additional secure memory controller is added, located between the system bus and the memory controller, using a combination of hardware and software control methods. Any access to physical memory requires security verification by the secure memory controller to match the physical memory. Each secure process is recorded in the secure memory control table and associated with a specific memory address range. Only after being verified as a secure process can it access the corresponding memory area, preventing other unsecured processes from stealing or tampering with data during program execution. This effectively prevents malicious software or other unauthorized processes from accessing sensitive memory areas, thereby improving the overall security and stability of the system.

[0086] In some embodiments, the process of establishing a secure memory control table includes:

[0087] Obtain accessible secure processes within the server;

[0088] Establish a mapping relationship between the process identifier of a secure process and its corresponding memory address range to complete the secure memory control table; wherein, the memory address range of a secure process is at least one.

[0089] Understandably, accessible processes within the server are considered secure processes. For security verification, it's necessary to obtain the process identifier of these secure processes and establish a mapping between them and memory address ranges to create a secure memory control table. This mapping relationship ensures the connection between the secure process identifier and its corresponding memory address range; the process identifier allows you to locate the memory address range, facilitating subsequent determination of address access permissions.

[0090] The secure memory control table establishment process provided in this embodiment is a process of determining security verification for the access of the current process. Each process is associated with a specific physical memory region in the table to ensure that the current process can safely access the memory region, thereby improving the overall security and stability of the system.

[0091] In some embodiments, matching the current process identifier with the process identifier in the secure memory control table to determine the matching result of the current process includes:

[0092] Determine if the current process identifier is the same as the process identifier in the safe memory control table;

[0093] If a match is found, it is determined that the current process to which the current process identifier belongs has successfully matched.

[0094] Understandably, the comparison between the current process identifier and the process identifier in the secure memory control table can be done by comparing data. If the identifier is long, it is necessary to compare it by using feature information to ensure the accuracy of the comparison.

[0095] In this embodiment, the comparison method is not limited. As long as the comparison result between the current process identifier and the process identifier in the secure memory control table can be determined, if they are the same, it is considered that the current process to which the current process identifier belongs has been successfully matched, and the subsequent access permission matching process can be carried out. If they are different, access is denied.

[0096] This embodiment uses process identifiers for matching to complete the initial screening of the current process and improve matching efficiency.

[0097] In some embodiments, after matching the current process identifier with the process identifier in the secure memory control table to determine the matching result of the current process, and before determining that the matching result is successful, the method further includes:

[0098] Get the enable flag for the secure memory control table;

[0099] If the current process identifier matches the current process, obtain the current enable flag of the current process;

[0100] If the current enable flag is the same as the enable flag in the secure memory control table, then the final matching result of the current process is considered successful.

[0101] Understandably, after step S12 and before step S13, based on the matching using process identifiers, a second filtering is performed by comparing enable flags. If the enable flags are the same, the final matching result is considered successful. Considering the possibility of system memory access within the current safe memory space, a comparison will be made, excluding processes allowed to access system memory. To make comprehensive use of physical memory, there is a scenario where the current system memory space is large enough that it occupies some safe memory space after the original system memory space is full. This results in data stored in the safe memory space and processes that contain system memory space being affected.

[0102] In some embodiments, the process of establishing the enable flag for the security memory control table includes:

[0103] When a portion of the system memory space is occupied within the safe memory space, the processes corresponding to the portion of the system memory space and the processes corresponding to the safe memory space are distinguished by an enable flag, in order to establish the enable flag for the safe memory control table.

[0104] Therefore, the system uses an enable flag to distinguish between processes that can access the system memory space and processes that can access the safe memory space, in order to ensure the comprehensive utilization of memory space and the differentiation of effective processes.

[0105] Table 2 is the second table of secure memory control. As shown in Table 2, it includes enable flags, PIDs of secure processes, and memory address ranges corresponding to multiple physical addresses.

[0106] Table 2

[0107]

[0108] Therefore, the enable flag of the secure memory control table is obtained. If the current process identifier in the above embodiment matches successfully, the current enable flag of the current process is obtained. The current enable flag of the current process is compared with the enable flag of the secure memory control table. If they are the same, the final matching result of the current process is determined to be successful. This comparison process can be the same as the comparison process between the current process identifier and the process identifier of the secure memory control table in the above embodiment, and is not limited here.

[0109] This embodiment uses process identifiers and enable flags for matching to complete the initial screening and further screening of the current process, thereby improving the accuracy and speed of matching.

[0110] In some embodiments, the process of determining a safe memory space includes:

[0111] Get the system memory space size and preset ratio;

[0112] The size of the corresponding safe memory space in the reserved physical memory is determined based on the relationship between the system memory space size and the preset ratio.

[0113] Obtain the address information of the corresponding system memory space within physical memory;

[0114] The address information of the safe memory space is determined based on the address information of the system memory space and the size of the safe memory space, wherein the address information of the safe memory space is higher than the address information of the system memory space.

[0115] Specifically, this embodiment considers that the size of the reserved physical memory space is determined based on a preset ratio within the system memory space. In other words, a portion of the physical memory is allocated to the safe memory space according to the preset ratio. To prevent conflicts with applications or system components in the system memory space and to isolate their address spaces from those of the system memory space, the address information of the safe memory space is set higher than that of the system memory space. The address information of the safe memory space can be determined by combining the address information of the system memory space with the size of the safe memory space; that is, the address information of the safe memory space is stored at the address following the address information of the system memory space.

[0116] For example: allocate 80% of the address space to AI-safe memory, with reserved space at (20%-100%) * total memory size; if it is also used to run other processes, then reserve 50% to allocate AI-safe memory, with reserved space at (50%-100%) * total memory size.

[0117] In addition, the secure memory space will be used to store and run sensitive data and code related to AI processes, such as model parameters, training data, and security policies. By reserving this space during the kernel startup phase, the availability and isolation of AI secure memory can be ensured, providing a safe and reliable operating environment for AI processes.

[0118] This embodiment distinguishes the address information of the secure memory space from the address information of the system memory space, and reserves a certain amount of physical memory space for its use, ensuring the security and ease of use of the secure memory, and preventing conflicts with applications or system components in the system memory space.

[0119] In some embodiments, the current process identifier is the process identifier applied to the model, and the process of establishing the memory address range includes:

[0120] Retrieve the accessible model size parameters within the server; where the model size parameters are the model parameters corresponding to the process applied to the model;

[0121] The memory space to be requested is determined based on the accessible model size parameter within the server;

[0122] Within the safe memory space, request the corresponding target memory based on the memory space to be requested;

[0123] The target memory is named using block space to establish a memory address range.

[0124] Specifically, the process identifier applied to the model is the process identifier of the model process that can run within the current server's storage. The memory space to be allocated is determined based on the model size parameter accessed within the server. This model size parameter mainly applies to the model parameters corresponding to the model's process, such as the number of parameters. The corresponding target memory is then allocated based on the memory space to be allocated, and the memory space is named using block spaces to establish the memory space.

[0125] In some embodiments, determining the memory space to be requested based on the model size parameter accessible within the server includes:

[0126] Obtain the number of parameters and their corresponding floating-point types from the model size parameters of the target model;

[0127] The memory space to be allocated for the target model is determined based on the relationship between the number of parameters, the floating-point number type, and the unit byte.

[0128] Specifically, when a model has 10B (10 billion) parameters, "10B" means that the model has 10 billion parameters. In computer science and machine learning, model parameters usually refer to the number of trainable parameters such as weights and biases in a neural network. A large model with 10B parameters means that the model has 10 billion parameters. The memory occupied by the parameters is typically a 32-bit floating-point number. A 32-bit floating-point number occupies 4 bytes (32 bits = 4 bytes). Therefore, a large model with 10B parameters would occupy approximately 40GB (Gigabytes) of memory.

[0129] Table 3 is a memory address allocation table. As shown in Table 3, the applicable models correspond to different numbers of parameters, and their corresponding memory sizes are also different, as are the naming methods of the block spaces.

[0130] Table 3

[0131] Blockname size Applicable Model Block_0 40GB >=10B parameters Block_1 4G bytes >=1B parameter Block_2 400M bytes >=100M parameters Block_3 40M bytes >=10M parameters Block_4 4Mbyte >=1M parameters Block_5 400Kbyte ……

[0132] The reserved memory addresses are allocated in blocks, and the block size can be configured according to the runtime model size parameter. Different applications can have different block sizes, thereby reducing memory idle time.

[0133] The establishment of memory address ranges provided in this embodiment is intuitively represented by memory address ranges 1 and 2 in Tables 1 and 2. Traditional memory allocation would distribute the physical memory used by the user in a fragmented manner across various non-contiguous memory spaces, which would increase the matching time of the security memory controller. Therefore, a block allocation method is adopted, allocating the memory allocated to each process into several memory blocks with contiguous addresses. This increases the address allocation speed. This method can minimize the need for memory block reallocation, thereby ensuring the contiguity of memory blocks.

[0134] In some embodiments, the memory address range corresponding to the block space is used as the memory address range of the secure memory control table, and arranged in a columnar manner; wherein, one block space corresponds to one memory address range.

[0135] Specifically, the memory address ranges corresponding to the block spaces in Table 3 are arranged in columns as the memory address ranges in Tables 1 and 2. That is to say, one block space corresponds to one memory address range, and one process corresponds to at least one memory address range or at least one block space.

[0136] In some embodiments, the method further includes:

[0137] When requesting memory space, if the block space corresponding to the target memory is full, the excess memory space is named using the next block space, and the memory address range corresponding to the next block space is used as a new column of memory address range in the secure memory control table and written into the corresponding secure process.

[0138] Specifically, if the requested memory space is full and the corresponding block space is already full, the excess memory space needs to be named using the next block space method. Simultaneously, the memory address range corresponding to the next block space is added as a new column in the secure memory control table and written to the corresponding secure process. Taking Table 1 as an example, this would add a new column for memory address ranges, namely memory address range 3.

[0139] In this embodiment, when the pre-allocated range (memory address interval) is full and memory needs to be reallocated, a block size of Block_(n+1) is used. After memory allocation is completed, the system creates a new row in the secure memory control table and writes the corresponding memory range to the corresponding process ID.

[0140] In some embodiments, if the safe memory space is full and there is unallocated memory space, the method further includes:

[0141] Obtain the access frequency of each secure process within the secure memory space;

[0142] Release the memory address range corresponding to the least frequently accessed secure process so that the process that needs to request memory space can store it, and update the secure memory control table.

[0143] Alternatively, reserve corresponding memory space in the system memory space according to the size of the memory space to be requested so that the process requesting the memory space can store it and update the safe memory control table.

[0144] Understandably, the safe memory space has a limited size. Based on the model size, the required block size (Block_n) is estimated, along with the memory size needed by the program. The system then pre-allocates the corresponding number of memory blocks (memory size required / Block_n) based on the maximum memory requested. If the pre-allocated range is full, memory needs to be re-allocated. Since the safe memory space is already full, free memory space needs to be released or borrowed from system memory to ensure that the currently pre-allocated space can be accessed by subsequent processes.

[0145] This embodiment provides a method of releasing free memory space or borrowing from system memory space to ensure that the currently pre-allocated space can be accessed by subsequent processes.

[0146] In some embodiments, determining the access permissions of the current process based on the matching relationship between the current read / write address of the current process in the secure memory space corresponding to the secure memory controller and the memory address range of the secure memory control table includes:

[0147] Match the current read / write address of the current process in the secure memory space corresponding to the secure memory controller with the current memory address range of the target secure process that has a successful match in the secure memory control table;

[0148] If a match is found, the current process's access permissions are determined to be enabled.

[0149] If the match fails, the current read / write address will be matched with the next memory address range corresponding to the target secure process that has a successful match in the secure memory control table, until all the memory address ranges of the target secure process that has a successful match in the secure memory control table have been matched.

[0150] If the memory address ranges of all columns of the target secure process that have a successful match in the secure memory control table fail to match, then the access permissions of the current process are determined to be prohibited.

[0151] Specifically, as shown in Tables 1 and 2, a secure process corresponds to at least one memory address range. Therefore, it is necessary to match the current read / write address of the current process with a memory address range corresponding to the target secure process that has a successful match. If successful, the access permission of the current process is set to enabled; if unsuccessful, the matching continues with the next memory address range of the target secure process until all memory address ranges of the target secure process have been matched. If all matches fail, the access permission of the current process is determined to be disabled.

[0152] When access permissions are denied, the secure memory controller will refuse access and return an error, while also triggering an illegal memory access system warning. This mechanism effectively prevents malware or other unauthorized processes from accessing sensitive memory areas, thereby improving the overall security and stability of the system.

[0153] In some embodiments, matching is performed based on the current read / write address of the current process in the secure memory space corresponding to the secure memory controller and the current memory address range of the target secure process that has a successful match in the secure memory control table, including:

[0154] Get the start and end address information of the current memory address range;

[0155] The first read / write address is obtained by performing a bitwise AND operation between the current read / write address and the starting address information.

[0156] Determine if the first read / write address is the same as the starting address information;

[0157] If the first read / write address is the same as the starting address information, then the address information of the first predetermined number of bits in the current read / write address that exceeds the starting address information is ORed with the address information of the first predetermined number of bits corresponding to the ending address information to obtain the second read / write address;

[0158] Check if the second read / write address is 0;

[0159] If the second read / write address is not 0, then it is determined that the current read / write address and the current memory address range are successfully matched.

[0160] Specifically, this embodiment performs logical operations on the address information of a finite number of block addresses to complete the address matching operation. A memory address range includes start address information and end address information. The current read / write address is ANDed and ORed with the start address information. Here, it is considered that the current read / write address may be a multiple of the start address information. The multiple relationship here is based on whether the number of zeros after the last 1 position in the current read / write address information and the start address information is the same. If they are the same, it means that the two address information are multiples of each other.

[0161] To accommodate multiple relationships, logical operations such as AND and OR operations are performed to determine a successful match. The current read / write address is ANDed with the starting address to obtain the first read / write address. If the first read / write address matches the starting address, the current read / write address is then ORed with the ending address to obtain the second read / write address. It's important to note that the first few bits of the current read / write address refer to the portion exceeding the starting address. For example, if the starting address is 1KB, the hexadecimal representation is 0000 0100 0000 0000. Addresses exceeding 1KB are represented by the first 5 bits, which are then used as the higher address bits. Similarly, the ending address is compared with the first few bits of the starting address, and in the example above, the first 5 bits are also used for ORing.

[0162] If the second read / write address is not 0, then the match is successful. If the match fails, the next memory address range of the target secure process needs to be matched until all memory address ranges of the target secure process have been matched. If all matches fail, then the current process's access permissions are prohibited.

[0163] The address matching process for logical operations provided in this embodiment reduces computational complexity and does not affect memory access speed, thus achieving memory safety in hardware.

[0164] Furthermore, the present invention also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implements the steps of a process security defense method.

[0165] For an introduction to the computer program product provided by the present invention, please refer to the above method embodiments. The present invention will not be described in detail here, but it has the same beneficial effects as the above process security defense method.

[0166] The foregoing has described in detail various embodiments of the process security defense method. Based on this, the present invention also discloses a process security defense device corresponding to the above-described method. Figure 3 A structural diagram of a process security defense device provided in an embodiment of the present invention is shown below. Figure 3 As shown, the device includes:

[0167] Memory 21 is used to store computer programs;

[0168] Processor 22, for implementing steps of security defense methods for processes when executing computer programs.

[0169] The process security defense device provided in this embodiment may include, but is not limited to, smartphones, tablets, laptops, or desktop computers.

[0170] The processor 22 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 22 may be implemented using at least one of the following hardware forms: Digital Signal Processor (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 22 may also include a main processor and a coprocessor. The main processor, also known as the Central Processing Unit (CPU), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 22 may integrate a Graphics Processing Unit (GPU), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 22 may also include an Artificial Intelligence (AI) processor, which handles computational operations related to machine learning.

[0171] The memory 21 may include one or more computer-readable storage media, which may be non-transitory. The memory 21 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 21 is used to store at least the following computer program 211, which, after being loaded and executed by the processor 22, is capable of implementing the relevant steps of the process security defense method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 21 may also include an operating system 212 and data 213, etc., and the storage method may be temporary storage or permanent storage. The operating system 212 may include Windows, Unix, Linux, etc. The data 213 may include, but is not limited to, the data involved in the process security defense method, etc.

[0172] In some embodiments, the process security defense device may further include a display screen 23, an input / output interface 24, a communication interface 25, a power supply 26, and a communication bus 27.

[0173] Those skilled in the field can understand, Figure 3 The structure shown does not constitute a limitation on the security defenses of the process and may include more or fewer components than illustrated.

[0174] The processor 22 implements the process security defense method provided in any of the above embodiments by calling instructions stored in the memory 21.

[0175] For a description of the process security defense device provided by the present invention, please refer to the above method embodiments. The present invention will not be described in detail here, but it has the same beneficial effects as the above process security defense method.

[0176] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by processor 22, implements the steps of the security defense method for the process described above.

[0177] It is understood that if the methods in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0178] For an introduction to the computer-readable storage medium provided by the present invention, please refer to the above method embodiments. The present invention will not be described in detail here, but it has the same beneficial effects as the above-described process security defense method.

[0179] The foregoing has provided a detailed description of a process security defense method, product, apparatus, and medium provided by the present invention. The various embodiments in the specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section. It should be noted that those skilled in the art can make several improvements and modifications to the present invention without departing from the principles of the invention, and these improvements and modifications also fall within the protection scope of the present invention.

[0180] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

Claims

1. A method for security defense of a process, characterized in that, Applied to a secure memory controller; the secure memory controller is located between the system bus and the memory controller, and includes: Obtain the current process identifier and a pre-established secure memory control table; wherein, the secure memory control table records accessible secure processes and their corresponding memory address ranges; The matching result of the current process is determined by matching the current process identifier with the process identifier in the secure memory control table. If the matching result is successful, the access permissions of the current process are determined based on the matching relationship between the current read / write address of the current process in the secure memory space corresponding to the secure memory controller and the memory address range of the secure memory control table. If the current process has access permissions enabled, the current process is determined to be a safe process, so as to facilitate access to data in the successfully matched memory address range; Correspondingly, after matching the current process identifier with the process identifier in the secure memory control table to determine the matching result of the current process, and before determining that the matching result is successful, the method further includes: Obtain the enable flag of the secure memory control table; If the current process identifier matches the current process, obtain the current enable flag of the current process; If the current enable flag is the same as the enable flag in the secure memory control table, then the final matching result of the current process is determined to be successful. Correspondingly, the process of establishing the enable flag of the secure memory control table includes: When a portion of the system memory space within the secure memory space is occupied, the process corresponding to the portion of the system memory space and the process corresponding to the secure memory space are distinguished by the enable flag, so as to establish the enable flag of the secure memory control table.

2. The process security defense method according to claim 1, characterized in that, The process of establishing the secure memory control table includes: Obtain accessible secure processes within the server; A mapping relationship is established between the process identifier of the security process and the corresponding memory address range to complete the security memory control table; wherein, the memory address range of the security process is at least one.

3. The process security defense method according to claim 2, characterized in that, The matching result of the current process identifier is determined by matching it with the process identifier in the secure memory control table, including: Determine whether the current process identifier is the same as the process identifier in the secure memory control table; If a match is found, it is determined that the current process to which the current process identifier belongs has been successfully matched.

4. The process security defense method according to claim 3, characterized in that, The process of determining the secure memory space includes: Get the system memory space size and preset ratio; The size of the corresponding safe memory space in the reserved physical memory is determined based on the relationship between the size of the system memory space and the preset ratio. Obtain the address information of the corresponding system memory space within the physical memory; The address information of the secure memory space is determined based on the address information of the system memory space and the size of the secure memory space, wherein the address information of the secure memory space is higher than the address information of the system memory space.

5. The process security defense method according to claim 2, characterized in that, The current process identifier is the process identifier applied to the model, and the process of establishing the memory address range includes: Obtain the accessible model size parameter within the server; wherein, the model size parameter is the model parameter corresponding to the process applied to the model; The memory space to be requested is determined based on the accessible model size parameter within the server; Within the secure memory space, request the corresponding target memory based on the memory space to be requested; The target memory is named using block space to establish the memory address range.

6. The process security defense method according to claim 5, characterized in that, The memory space to be requested is determined based on the accessible model size parameter within the server, including: Obtain the number of parameters and the corresponding floating-point type in the model size parameters of the target model; The memory space to be requested for the target model is determined based on the relationship between the number of parameters, the floating-point number type, and the unit byte.

7. The process security defense method according to claim 6, characterized in that, The memory address range corresponding to the block space is used as the memory address range of the secure memory control table, and arranged in column form; wherein, one block space corresponds to one memory address range.

8. The process security defense method according to claim 7, characterized in that, The method further includes: When the target memory block space is full during the request for the memory space to be requested, the excess memory space is named the next block space, and the memory address range corresponding to the next block space is used as a new column of memory address range in the secure memory control table and written into the corresponding secure process.

9. The process security defense method according to any one of claims 1 to 8, characterized in that, The access permissions of the current process are determined based on the matching relationship between the current read / write address of the current process in the secure memory space corresponding to the secure memory controller and the memory address range of the secure memory control table, including: The system matches the current read / write address of the current process in the secure memory space corresponding to the secure memory controller with the current memory address range of the target secure process that has a successful match in the secure memory control table. If the match is successful, the access permission of the current process is determined to be enabled. If the match fails, the current read / write address is matched with the next memory address range corresponding to the target secure process that has a successful match in the secure memory control table, until all the memory address ranges of all columns of the target secure process that has a successful match in the secure memory control table have been matched. If the memory address ranges of all columns of the target secure process that have a successful matching result in the secure memory control table fail to match, then the access permission of the current process is determined to be prohibited.

10. The process security defense method according to claim 9, characterized in that, Matching is performed based on the current read / write address of the current process in the secure memory space corresponding to the secure memory controller and the current memory address range of the target secure process that has a successful match in the secure memory control table, including: Obtain the start and end address information of the current memory address range; The first read / write address is obtained by performing a bitwise AND operation between the current read / write address and the starting address information. Determine whether the first read / write address is the same as the starting address information; If the first read / write address is the same as the starting address information, then the address information of the current read / write address exceeding the current read / write address information of the starting address information is ORed with the address information of the previous predetermined number of bits corresponding to the ending address information to obtain the second read / write address; Determine if the second read / write address is 0; If the second read / write address is not 0, then it is determined that the current read / write address and the current memory address range are successfully matched.

11. A computer program product, comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the security defense method for the process according to any one of claims 1 to 10.

12. A process security defense device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the security defense method for a process as described in any one of claims 1 to 10 when executing the computer program.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the process security defense method as described in any one of claims 1 to 10.

Images