Method for constructing reference data and accessing reference data

Abstract

The invention discloses a reference data construction method and a reference data access method. The reference data construction method comprises the following steps: in response to a reference data creation instruction, creating reference data; constructing data attribute information corresponding to the reference data, and storing the data attribute information and the reference data in a set storage area together; writing the physical address of the data attribute information into a reference data table, and obtaining an index of the data attribute information in the reference data table; generating a reference from the index, taking the reference as a response result of a reference data creating instruction, and subsequently accessing the reference data through reference or pointer * taking. According to the technical scheme, the novel reference data of the memory address used for storing the data is provided, and based on the reference, the flexibility and safety of memory data access are improved while the memory data access effect similar to that of a pointer is achieved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method for constructing reference data and accessing the reference data. Background Art

[0002] WebAssembly (wasm for short) belongs to the virtual instruction set architecture. Based on WebAssembly bytecode technology, applications can be written in a variety of programming languages, and the written applications are converted to generate WebAssembly bytecode. The WebAssembly bytecode is then interpreted and executed by the virtual machine in the device, so that the application can run normally.

[0003] In the prior art, various applications only store memory addresses through pointer-type variables. The construction and use of pointer-type variables are fixed, which can increase the flexibility of application programming; however, the pointer-type variables can arbitrarily access the non-volatile storage space in the device, which destroys the data isolation feature between applications and has certain security risks. Summary of the invention

[0004] An embodiment of the present invention provides a method for constructing reference data and accessing reference data, so as to provide a new type of reference data that is also used to store the memory address of data, so as to improve the flexibility and security of memory data access. At the same time, the reference can be used for pointer programming to provide flexibility for application programming.

[0005] According to one aspect of an embodiment of the present invention, a method for constructing reference data is provided, comprising:

[0006] In response to the reference data creation instruction, the reference data is created; wherein the reference data creation instruction is triggered when the application is installed or when the application is selected in the logical channel;

[0007] Constructing data attribute information corresponding to the reference data, and storing the data attribute information and the reference data together in a set storage area, wherein the reference data can be located based on the data attribute information;

[0008] Write the physical address of the data attribute information into the reference data table, and obtain the index of the data attribute information in the reference data table;

[0009] A reference is generated according to the index of the reference data table according to the data attribute information as a response result to the reference data creation instruction for subsequent access to the reference data.

[0010] According to another aspect of an embodiment of the present invention, a method for accessing reference data is also provided, including:

[0011] Access the referenced data element by calling an application programming interface; or

[0012] Access the elements of the referenced data through pointer * programming;

[0013] The reference data is constructed by the method described in any one of the embodiments of the present invention.

[0014] According to another aspect of an embodiment of the present invention, a method for securely accessing reference data is provided, including:

[0015] In response to a memory data access instruction, obtaining an instruction type and at least one operand matching the memory data access instruction;

[0016] When it is determined according to the instruction type and each operand that the target access data to be accessed belongs to an element of the target reference data, a target index matching the target reference data and a target array offset of the target access data in the target reference data are obtained;

[0017] Querying the target index in the reference data table, and when a valid target physical address is found, obtaining target data attribute information of the target reference data from the target physical address;

[0018] The reference data table stores the physical address of the data attribute information corresponding to the reference data, and the reference data can be located based on the data attribute information;

[0019] Perform security access check on target access data based on target data attribute information and target array offset.

[0020] According to another aspect of an embodiment of the present invention, there is also provided a device for constructing reference data, including:

[0021] A reference data creation module, used to create reference data in response to a reference data creation instruction; wherein the reference data creation instruction is triggered when the application is installed or when the application is selected in the logical channel;

[0022] A reference data storage module, used for constructing data attribute information corresponding to the reference data, and storing the data attribute information and the reference data together in a set storage area, wherein the reference data can be located based on the data attribute information;

[0023] A physical address writing module is used to write the physical address of the data attribute information into the reference data table and obtain the index of the data attribute information in the reference data table;

[0024] The reference generation module is used to generate a reference in the index of the reference data table according to the data attribute information as a response result to the reference data creation instruction for subsequent access to the reference data.

[0025] According to another aspect of an embodiment of the present invention, there is also provided a device for accessing reference data, including:

[0026] The first type of access module is used to access the elements of the referenced data by calling the application programming interface; or

[0027] The second type of access module is used to access the elements of the referenced data through pointer access programming;

[0028] The reference data is constructed by the method described in any one of the embodiments of the present invention.

[0029] According to another aspect of an embodiment of the present invention, there is also provided a device for securely accessing reference data, comprising:

[0030] An instruction information acquisition module, configured to obtain, in response to a memory data access instruction, an instruction type and at least one operand matching the memory data access instruction;

[0031] A key information acquisition module, for acquiring a target index matching the target reference data and a target array offset of the target access data in the target reference data when it is determined according to the instruction type and each operand that the target access data to be accessed belongs to an element of the target reference data;

[0032] The attribute information acquisition module is used to query the target index in the reference data table, and when a valid target physical address is queried, obtain the target data attribute information of the target reference data from the target physical address;

[0033] The reference data table stores the physical address of the data attribute information corresponding to the reference data, and the reference data can be located based on the data attribute information;

[0034] The security access check module is used to perform security access check on target access data based on target data attribute information and target array offset.

[0035] According to another aspect of an embodiment of the present invention, there is further provided an electronic device, on which an operating system is installed, in which a runtime environment is executed, the electronic device comprising:

[0036] at least one processor; and

[0037] a memory communicatively connected to the at least one processor; wherein,

[0038] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform any method as described in any one of the embodiments of the present invention.

[0039] According to another aspect of the embodiments of the present invention, a terminal is provided, comprising the electronic device as described in any one of the embodiments of the present invention.

[0040] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a method as described in any one of the embodiments of the present invention when executed.

[0041] According to another aspect of the embodiments of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the method according to any one of the embodiments of the present invention is implemented.

[0042] The technical solution of the embodiment of the present invention provides a method for constructing reference data, which creates reference data by responding to a reference data creation instruction; constructs data attribute information corresponding to the reference data, and stores the data attribute information and the reference data together in a set storage area, writes the physical address of the data attribute information into a reference data table, and obtains the index of the data attribute information in the reference data table; generates a reference according to the index of the data attribute information in the reference data table, as a response result to the reference data creation instruction, and subsequently accesses the reference data through a reference or a pointer. A new type of reference data that is also used to store the memory address of data is proposed, and a method for creating reference data is defined. Based on the reference, while achieving a memory data access effect similar to that of a pointer, the flexibility and security of memory data access are improved.

[0043] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1is a flowchart of a method for constructing reference data provided according to an embodiment of the present invention;

[0046] Figure 2 is a flowchart of another method for constructing reference data provided by an embodiment of the present invention;

[0047] Figure 3 is a flowchart of another method for constructing reference data provided by an embodiment of the present invention;

[0048] Figure 4 is a flow chart of a method for accessing reference data provided according to an embodiment of the present invention;

[0049] Figure 5 is a flowchart of an implementation method for accessing elements of reference data by calling an application programming interface applicable to an embodiment of the present invention;

[0050] Figure 6 It is a flowchart of an implementation method of accessing elements of referenced data by pointer access programming, which is applicable to an embodiment of the present invention;

[0051] Figure 7 is a flow chart of a method for securely accessing reference data provided according to an embodiment of the present invention;

[0052] Figure 8 is a flowchart of another method for securely accessing reference data provided according to an embodiment of the present invention;

[0053] Fig. 9 is a schematic diagram of the structure of a reference data construction device provided according to an embodiment of the present invention;

[0054] Fig.10 is a schematic diagram of the structure of a reference data access device provided according to an embodiment of the present invention;

[0055] Fig.11 is a schematic diagram of the structure of a secure access device for reference data provided according to an embodiment of the present invention;

[0056] Fig.12 is a structural diagram of an electronic device provided according to an embodiment of the present invention;

[0057] Fig.13 is a structural diagram of a terminal provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0059] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0060] Figure 1 This is a flowchart of a reference data construction method provided in the first embodiment of the present invention. This embodiment can be applied to the case of creating reference data to manage the memory address of application data. The method can be executed by a reference data construction device, which can be implemented in the form of hardware and / or software and can generally be configured in an electronic device with an operating system installed. Among them, the operating system can generally be an embedded operating system, and the electronic device can generally be a resource-constrained device such as various security elements or smart cards.

[0061] The method of this embodiment can be executed by the runtime environment in the operating system. The runtime environment (RTE) is a secure runtime environment for executing virtual machines on restricted resources such as smart cards or security elements, and can be regarded as an ultra-lightweight container. The application runs in the runtime environment and can be completely isolated from the native functions of the embedded operating system.

[0062] Correspondingly, such as Figure 1 As shown, the method includes:

[0063] S110 . In response to a reference data creation instruction, reference data is created.

[0064] In various embodiments of the present invention, a new data type is defined, namely, reference data. Similar to the way a pointer takes * to point to a data storage address, by using reference data (also referred to as a reference array), the memory address (or, also referred to as a logical address or pseudo address, etc.) of the storage data can be identified.

[0065] Specifically, when the application is installed or selected in the logical channel, reference data corresponding to the application data can be created, and the reference data can be used to store the memory addresses of various application data generated by the application during installation or operation. For example, after the memory address of application data A in application X is stored in the reference data corresponding to application X, other variables can directly obtain the memory address of application data A from the reference data to reference application data A.

[0066] Optionally, creating reference data (also called a reference array) for the application to record the memory address of the application data is called a reference, and whether the application data is referenced can be identified by querying the reference data.

[0067] When the application is installed or selected in a logical channel, a reference data creation instruction may be triggered to generate, and based on the reference data creation instruction, reference data corresponding to the application, or a reference array, may be created.

[0068] In a specific example, an operating system API (Application Programming Interface) such as MEM_TYPE mallocMem(u16 size, u8 type, u8 align) can be used to apply for a storage space of a set size in a non-volatile memory (NVM) or a volatile memory (also called a linear memory space, typically RAM) for storing reference data.

[0069] Among them, size is the array size to be applied for, type is the storage type to be applied for (for example, RAM or NVM), and align is the array type to be applied for (for example, CHAR, INT, or SHORT).

[0070] S120: Construct data attribute information corresponding to the reference data, and store the data attribute information and the reference data together in a set storage area, wherein the reference data can be located based on the data attribute information.

[0071] In this embodiment, the data size of the reference data may be identified by the data attribute information, or the owner of the reference data may be identified by the data attribute information, or both the data size and the owner of the reference data may be identified by the data attribute information.

[0072] Optionally, the owner of the reference data can be described by the application identifier of the target application to which the reference data belongs, or the module identifier of the application module to which the target application belongs, or the application identifier of the target application to which the reference data belongs and the module identifier of the application module to which the target application belongs. The above information can also be referred to as the virtual machine running domain information to which the reference data belongs.

[0073] By using the data attribute information corresponding to the reference data, a security check of memory access can be performed before actually accessing the reference data. For example, check whether the visitor's virtual machine running domain information matches the virtual machine running domain information of the reference data to determine whether it complies with the firewall policy; or check whether the data offset that the visitor needs to access exceeds the memory range limited by the data size of the reference data, etc.

[0074] The data attribute information and the reference data may be stored adjacently or non-adjacently in the set storage area. However, it is required to locate the reference data based on the data attribute information.

[0075] In a specific example, if the data attribute information and the reference data are stored adjacent to each other, the reference data can be effectively located based on the location of the data tail of the data attribute information and the data size of the reference data recorded in the data attribute information.

[0076] In another specific example, if the data attribute information is not stored adjacent to the reference data, a separate field can be used in the data attribute information to store the storage location information of the reference data in a set storage area. Furthermore, after reading the field in the data attribute information, the reference data can be effectively located in combination with the data size of the reference data and the storage location information of the reference data.

[0077] It is understandable that the reference data can be effectively located by the data attribute information of the reference data. Therefore, it is only necessary to effectively manage the physical address of the data attribute information to facilitate index search.

[0078] S130. Write the physical address of the data attribute information into the reference data table, and obtain the index of the data attribute information in the reference data table.

[0079] In this embodiment, the data attribute information of each reference data is uniformly stored and managed through the reference data table. Optionally, the reference data table can be stored in a set storage space in the non-volatile memory.

[0080] Among them, by using the index of the data attribute information in the reference data table, the table entry corresponding to the data attribute information (the physical address used to store the data attribute information) in the reference data table can be quickly located (for example, the row in the reference data table).

[0081] Optionally, the reference data table may be a primary reference data table, a secondary reference data table, or a reference data table of more levels.

[0082] If the reference data table is a primary reference data table, the physical address of the data attribute information can be directly stored in a blank table entry in the unique reference data table, and the index position of the blank table entry in the unique reference data table can be determined as the index of the data attribute information in the reference data table.

[0083] If the reference data table is a secondary reference data table, it means that the secondary reference data table has a 0th level reference data table and multiple 1st level reference data tables. The physical address of the data attribute information is stored in a specific 1st level reference data table, and the 0th level reference data table is used to store the storage addresses of each 1st level reference data table.

[0084] Correspondingly, the index of the data attribute information in the reference data table (that is, the position of the table entry for storing the physical address of the data attribute information in the secondary reference data table) contains two parts of content. One part of the content is the index position of the specific first-level reference data table that actually stores the physical address of the data attribute information in the zero-level reference data table, and the second part of the content is the index position of the table entry for storing the physical address of the data attribute information in the specific first-level reference data table.

[0085] S140. Generate a reference in the index of the reference data table according to the data attribute information as a response result to the reference data creation instruction, so as to facilitate subsequent access to the reference data.

[0086] It can be understood that based on the index of the data attribute information in the reference data table, the physical address of the data attribute information can be accurately located, and based on the data attribute information, the reference data can be accurately located, and further, the data content in the reference data can be securely read and written.

[0087] Accordingly, a reference can be generated based on the index of the data attribute information in the reference data table, and the referenced data can be accessed based on the reference later by reference or pointer *. The index can be used to generate a reference by arithmetic operations, for example, the arithmetic operation can be used to superimpose the index of the data attribute information in the reference data table with a fixed offset to generate a reference to the referenced data.

[0088] The technical solution of the embodiment of the present invention provides a method for constructing reference data, which creates reference data by responding to a reference data creation instruction; constructs data attribute information corresponding to the reference data, and stores the data attribute information and the reference data together in a set storage area, writes the physical address of the data attribute information into a reference data table, and obtains the index of the data attribute information in the reference data table; generates a reference according to the index of the data attribute information in the reference data table, as a response result to the reference data creation instruction, and subsequently accesses the reference data through a reference or a pointer. A new type of reference data that is also used to store the memory address of data is proposed, and a method for creating reference data is defined. Based on the reference, while achieving a memory data access effect similar to that of a pointer, the flexibility and security of memory data access are improved.

[0089] Figure 2 A flowchart of another method for constructing reference data provided by an embodiment of the present invention is provided. This embodiment is optimized based on the above embodiment. In this embodiment, the operation of "constructing data attribute information corresponding to the reference data, and storing the data attribute information and the reference data together in a set storage area" is concretized.

[0090] Correspondingly, such as Figure 2 As shown, the method may include:

[0091] S210 . In response to a reference data creation instruction, reference data is created.

[0092] S220: If the referenced data is persistent data, data attribute information is constructed according to the data type of the referenced data, the virtual machine running domain information to which it belongs, and the data size.

[0093] Among them, persistent data refers to a kind of non-volatile storage data created by calling the storage space allocation interface provided by the operating system runtime environment during the installation or operation of the application module, and its initial value content is 0. Persistent data belongs to the application itself, and the persistent data can be written and read through the interface or pointer variable provided by the operating system runtime environment, and the virtual machine instruction can directly access the persistent data through the pointer variable. The reference data belongs to persistent data, which can be understood as the data in the reference data will not be lost even if the power is off, that is, the storage space where the data is located is the heap space (or NVM space).

[0094] The data types include: basic array types or structure data types; wherein the reference data of the structure data type includes both reference data values ​​and non-reference data values. The reference data values ​​can be understood as memory addresses of application data, while the non-reference data values ​​can be understood as basic type data values, for example, ordinary variable values.

[0095] The virtual machine running domain information may include: a module identifier (typically, ModuleID) of an application module to which the reference data belongs, and an application identifier (typically, APPID) of an application to which the reference data belongs.

[0096] S230: Store the data attribute information and the reference data adjacent to each other in a set storage area.

[0097] The data size of the referenced data in the data attribute information is used to identify the data end position of the referenced data.

[0098] In this embodiment, when the reference data is persistent data, the data attribute information of the reference data and the reference data can be stored adjacently in a continuous storage space in the form of data attribute information + data content. Then, after successfully locating the data attribute information, the reference data can be located accordingly.

[0099] S240: If the referenced data is temporary data, the referenced data is stored in a set storage area, and storage location information of the referenced data is obtained.

[0100] Temporary data is a type of data used during the running of an application, which will be cleared or reset when a specific event occurs to ensure security and protect sensitive data. Reference data is temporary data, which means that the memory address of the temporary data is stored in the reference data. At the same time, the data in the reference data will be lost when the power is off or will be cleared when a specific time occurs, that is, the storage space where the data is located is the memory space (or RAM space).

[0101] Specifically, when the reference data is temporary data, the reference data and the data attribute information of the reference data cannot be stored adjacently, and the data attribute information and the storage location of the reference data need to be dynamically determined according to the current storage area usage. In this case, only the storage location information of the reference data needs to be written into the data attribute information of the reference data.

[0102] The storage location information may include: a logical address of the data, or an offset of the data in a volatile storage area.

[0103] S250: construct data attribute information according to the data type of the referenced data, the virtual machine operation domain information, the data size and the storage location information, and store the data attribute information in a set storage area.

[0104] The reference data and the data attribute information are stored adjacently or non-adjacently in the set storage area.

[0105] S260: Write the physical address of the data attribute information into the reference data table, and obtain the index of the data attribute information in the reference data table.

[0106] In an optional implementation of this embodiment, writing the physical address of the data attribute information into the reference data table and obtaining the index of the data attribute information in the reference data table may include:

[0107] Obtain a unique reference data table, and obtain a first free table entry in the unique reference data table; write the physical address of the data attribute information into the first free table entry, and determine the index of the first free table entry in the reference data table as the index of the data attribute information in the reference data table.

[0108] Specifically, during the OS (Operating System) production process, a memory space may be first initialized for storing a reference data table, wherein the reference data table includes a plurality of free table entries, each of which is used to store a physical address of data attribute information.

[0109] Furthermore, whenever the physical address of the data attribute information needs to be stored, a free table entry can be obtained from the reference data table as the first free table entry, and the physical address of the data attribute information can be written into the first free table entry. Furthermore, the index of the first free table entry in the reference data table can be determined as the index of the data attribute information in the reference data table.

[0110] S270. Generate a reference in the index of the reference data table according to the data attribute information as a response result to the reference data creation instruction, so as to facilitate subsequent access to the reference data.

[0111] The technical solution of the embodiment of the present invention defines the specific data form in the data attribute information corresponding to the reference data when the reference data belongs to persistent data or temporary data, and also defines the storage method of the reference data and the matching data attribute information in the storage area. Based on the above implementation method, efficient and accurate data access to the elements in the reference data can be achieved, and data access can also be performed based on the reference identifier and through the pointer * method, which improves the flexibility and security of memory data access.

[0112] Figure 3 A flowchart of another reference data construction method provided by an embodiment of the present invention, which is optimized based on the above embodiment. In this embodiment, the operation of "writing the physical address of the data attribute information into the reference data table and obtaining the index of the data attribute information in the reference data table" is concretized.

[0113] Correspondingly, such as Figure 3 As shown, the method may include:

[0114] S310 . In response to a reference data creation instruction, reference data is created.

[0115] S320: Construct data attribute information corresponding to the reference data, and store the data attribute information and the reference data together in a set storage area, wherein the reference data can be located based on the data attribute information.

[0116] S330. Obtain the 0th level reference data table from the second level reference data table.

[0117] In this embodiment, the reference data table may be a secondary reference data table, which includes a level 0 reference data table and multiple level 1 reference data tables. The level 0 reference data table is used to store the storage addresses of each level 1 reference data table, and the level 1 reference data table is used to actually store the physical address of the reference data.

[0118] S340 . According to the level 0 reference data table, obtain a level 1 reference data table in the level 2 reference data table, and obtain a second free table entry in the obtained level 1 reference data table.

[0119] In this embodiment, the storage addresses of the first-level reference data tables can be stored in the 0-level reference data table in sequence. Whenever a first-level reference data table is full, a new first-level reference data table is created accordingly, and the storage address of the new first-level reference data table is stored in the 0-level reference data table. Furthermore, by querying the table tail of the 0-level reference data table, a first-level reference data table of the physical address that can currently be used to store reference data can be obtained accordingly, and then a free table entry, that is, the second free table entry, is obtained in the first-level reference data table.

[0120] Optionally, in addition to being used to store the storage addresses of each first-level reference data table, the 0th-level reference data table can also be used to store the number of valid table entries contained in each first-level reference data table, which is not limited in this embodiment.

[0121] S350: Write the physical address of the data attribute information into the second free table entry, and obtain the index of the second free table entry in the obtained level 1 reference data table.

[0122] S360: Combine the obtained index of the first-level reference data table in the zero-level reference data table and the index of the second free table entry in the obtained first-level reference data table to obtain the index of the data attribute information in the reference data table.

[0123] S370. Generate a reference in the index of the reference data table according to the data attribute information as a response result to the reference data creation instruction, so as to facilitate subsequent access to the reference data.

[0124] The technical solution of the embodiment of the present invention defines a specific implementation method for storing data attribute information in a secondary reference data table. By combining the index of the first-level reference data table where the physical address of the data attribute information is written in the zero-level reference data table and the index of the second free table entry where the physical address of the data attribute information is written in the first-level reference data table, the index of the data attribute information in the reference data table is obtained. Based on the index, the storage area of ​​the referenced data can be quickly and accurately located, thereby achieving efficient and accurate data access to the elements in the referenced data.

[0125] Based on the above embodiments, the method may further include:

[0126] If it is determined that all the created level 1 reference data tables in the level 0 reference data table are full, a new level 1 reference data table is created, and the storage address of the new level 1 reference data table is written into the level 0 reference data table.

[0127] Through the above settings, the first-level reference data table in the second-level reference data table can be created on demand, thereby making efficient use of precious memory resources in resource-constrained devices and meeting application requirements in resource-constrained scenarios.

[0128] Figure 4 This is a flowchart of a method for accessing reference data provided according to an embodiment of the present invention. This embodiment is applicable to the case where the memory address of application data is obtained by accessing the reference data, and then the application data is accessed. The method can be executed by a reference data access device, which can be implemented in the form of hardware and / or software, and can generally be configured in an electronic device with an operating system installed. Among them, the operating system can generally be an embedded operating system, and the electronic device can generally be a resource-constrained device such as various security elements or smart cards.

[0129] Correspondingly, such as Figure 4 As shown, the method may include:

[0130] S410: Access the elements of the referenced data by calling an application programming interface.

[0131] Optionally, the reference data may store various data elements in an array. An element of the reference data may be understood as a memory address (or logical address) of a certain application data.

[0132] During the execution of the application, the memory address of the application data can be obtained from the reference data, and the application data can be accessed based on the memory address.

[0133] In an optional implementation of this embodiment, the elements of the referenced data can be accessed by calling an application programming interface, wherein the application programming interface can be a programming interface specially customized by the operating system for the referenced data, or can be a combination of an existing application programming interface (typically, a pointer-based application programming interface) of the operating system.

[0134] Optional, in Figure 5 A flowchart of an implementation method for accessing elements of reference data by calling an application programming interface applicable to an embodiment of the present invention is shown in FIG.

[0135] like Figure 5 As shown, the implementation of accessing the elements of the referenced data by calling the application programming interface may include:

[0136] S510: By calling an application programming interface, a reference or pointer to the memory data to be accessed is passed in a parameter of the application programming interface.

[0137] Specifically, if the called application programming interface is a system API for reference operations, for example, a customized system API for reading array data from an array object, a reference to the memory data to be accessed may be directly passed in the parameters of the application programming interface.

[0138] If the called application programming interface is a system API for pointer operations, for example, an existing system API for implementing array comparison or array copying, a pointer to the memory data to be accessed may be passed in the parameters of the application programming interface.

[0139] The reference or pointer includes information that can be used to obtain the index of the data attribute information of the referenced data in the referenced data table, and the index is used to locate the physical address of the referenced data. At the same time, the referenced data can be located based on the data attribute information.

[0140] Specifically, through the reference or pointer passed in the parameter of the application programming interface, the index of the data attribute information of the referenced data in the referenced data table is obtained, and then the data attribute information of the referenced data can be located. After obtaining the data attribute information, the referenced data can be further located. After that, after determining the array offset of the element to be accessed in the referenced data, the element in the referenced data can be accurately accessed.

[0141] In an optional implementation of the present embodiment, if the parameter type of the application programming interface is reference, a reference to the memory data to be accessed is generated based on the index of the data attribute information of the referenced data in the referenced data table; the reference to the memory data to be accessed and the array offset of the element of the referenced data in the referenced data are passed to the application programming interface as two parameters respectively.

[0142] In this optional implementation, the system API involving reference operations can directly pass two independent parameters, one is the reference to the referenced data, and the other is the array offset of the element of the referenced data in the referenced data. Based on the above two parameters, the element of the referenced data that needs to be accessed can be accurately located.

[0143] Similarly, a reference to the memory data to be accessed can be generated by performing certain arithmetic operations on the index of the data attribute information of the referenced data in the referenced data table. The arithmetic operations include but are not limited to superimposing the index of the data attribute information of the referenced data in the referenced data table with a fixed value.

[0144] In another optional implementation of the present embodiment, if the parameter type of the application programming interface is a pointer, a reference to the memory data to be accessed is generated based on the index of the data attribute information of the referenced data in the referenced data table; the reference to the memory data to be accessed and the array offset of the element of the referenced data in the referenced data are combined to form a pointer value, and the pointer value is passed to the application programming interface as a parameter value.

[0145] At present, the system API involving pointer operation generally only passes a single parameter, that is, the parameter value of the pointer parameter, which is mainly used to describe the pointer value of the memory address to be accessed. As mentioned above, in order to access the reference data, a reference based on the reference data and the array offset of the element of the reference data in the reference data are required. In order to be able to use the system API for pointer operation, the reference of the memory data to be accessed and the array offset of the element of the reference data in the reference data can be simply combined to form a pointer value, and the pointer value can be passed to the application programming interface as a parameter value.

[0146] Optionally, if the parameter type of the application programming interface is a pointer, you may consider adding reference mask information to the passed pointer value, for example, an identifier in the form of "REFMASK", to identify that the parameter value passed by the application programming interface is not an ordinary memory offset, but a reference to referenced data and a combination of the array offsets of the elements of the referenced data in the referenced data.

[0147] S520. In the application programming interface, memory data access is performed by parsing references or pointers, the physical address of the referenced data is located according to the reference of the memory data to be accessed, and the elements of the referenced data are accessed according to the physical address of the referenced data and the array offset of the elements of the referenced data in the referenced data.

[0148] Among them, by parsing the reference or pointer, the physical address of the data attribute information of the referenced data can be first obtained, and then the physical address of the referenced data can be accurately located according to the physical address of the data attribute information. Then, combined with the array offset of the element of the referenced data in the referenced data, the element of the referenced data can be accurately accessed.

[0149] S420. Access the elements of the referenced data by means of pointer access * programming.

[0150] Generally speaking, in addition to using system APIs involving pointer operations to access the memory address pointed to by the pointer value, developers can also independently write memory data access instructions through pointer access * programming to access memory data. Considering the convenience of reference data access, the embodiments of the present invention consider that the pointer access * programming method can also be used to access the elements of the reference data.

[0151] Among them, the pointer access programming method only needs to construct a pointer value, and access to the memory data is achieved based on the memory address pointed to by the pointer value.

[0152] Optional, in Figure 6 A flowchart of an implementation method for accessing elements of referenced data through pointer access programming applicable to an embodiment of the present invention is shown in FIG.

[0153] like Figure 6 As shown, the implementation of accessing the elements of the referenced data by pointer access programming may include:

[0154] S610, construct memory data access instructions through pointer fetch * programming method.

[0155] In an optional implementation of this embodiment, constructing a memory data access instruction by pointer fetching * programming may include:

[0156] Generate a reference to the memory data to be accessed according to the index of the data attribute information of the referenced data in the referenced data table; combine the reference to the memory data to be accessed and the array offset of the element of the referenced data in the referenced data to form a pointer value; and construct a memory data access instruction corresponding to the pointer value by pointer access programming.

[0157] Optionally, when constructing a memory data access instruction, you can consider adding reference mask information to the pointer value, for example, an identifier in the form of "REFMASK" to identify that the pointer value is not a memory operation on the module data set and the program data set, but a reference operation instruction.

[0158] S620. By executing the memory data access instruction, according to the pointer value of the memory data to be accessed, the reference value of the referenced data and the array offset of the element of the referenced data in the referenced data are obtained, and the element of the referenced data is accessed according to the reference value of the referenced data and the array offset.

[0159] The reference value includes information that can be used to obtain the index of the data attribute information of the reference data in the reference data table, and the index is used to locate the physical address of the reference data. The reference data can be located based on the data attribute information.

[0160] In this embodiment, the elements of the reference data can be accessed by using either S410 or S420, wherein the reference data is constructed by the reference data access method described in any one of the embodiments of the present invention.

[0161] The technical solution of the embodiment of the present invention accesses the elements of the referenced data by calling an application programming interface; or by pointer access programming, providing an efficient and convenient new way to access elements in a new type of referenced data. The implementation method is simple and easy to understand, and developers can quickly master the access method to the referenced data without complicated learning.

[0162] Figure 7 This is a flowchart of a method for securely accessing reference data provided according to an embodiment of the present invention. This embodiment is applicable to the case where application data pointed to by an element in the reference data is securely accessed. The method can be executed by a secure access device for reference data, which can be implemented in the form of hardware and / or software and can generally be configured in an electronic device with an operating system installed. Among them, the operating system can generally be an embedded operating system, and the electronic device can generally be various types of security elements or resource-constrained devices such as smart cards.

[0163] Correspondingly, such as Figure 7 As shown, the method may include:

[0164] S710. In response to a memory data access instruction, obtain an instruction type and at least one operand that match the memory data access instruction.

[0165] The instruction types may include: function call instructions based on reference data, function call instructions based on pointers, or memory data loading or storing instructions based on pointers, etc. Different instruction types require different operands to be obtained.

[0166] Optionally, in a virtual machine of a resource-constrained device, a stack-based structure can generally be used. Furthermore, a stack frame (also referred to as a virtual machine stack frame) can be stored through a virtual machine stack, including parameters, local variables, intermediate operation results, return values, and calling method information.

[0167] Accordingly, obtaining at least one operand matching the memory data access instruction may include:

[0168] Obtaining a virtual machine stack frame that matches the memory data access instruction, and obtaining the at least one operand from the virtual machine stack frame; or

[0169] In the memory data access instruction, the at least one operand is directly fetched.

[0170] S720. When it is determined according to the instruction type and each operand that the target access data to be accessed belongs to an element of the target reference data, obtain a target index matching the target reference data and a target array offset of the target access data in the target reference data.

[0171] In an optional implementation of the present embodiment, when determining that the instruction type is a function call instruction based on reference data, it is determined that the target access data to be accessed belongs to the element of the target reference data, and a first call parameter and a second call parameter are obtained; a target index matching the target reference data is separated from the first call parameter, and the second call parameter is used as the target array offset.

[0172] Among them, if the instruction type is a function call instruction based on reference data, it means that the call parameter is a system API involving reference operations. As mentioned above, this type of system API can pass two call parameters separately when passing parameters. One call parameter (that is, the first call parameter) contains the target index that matches the target reference data, and the other call parameter is the target array offset. Specifically, the first call parameter can be in the form of: "((REFMASK)|(REFHANDLER)", where REFMASK is the reference mask information, which is used to identify that the content that appears later is related to the reference data, and REFHANDLER can identify the target index that matches the target reference data.

[0173] Among them, the target index refers to the index position of the physical address of the data attribute information of the target reference data in the reference data table, and the target array offset refers to the target array offset of the target access data matching the memory data access instruction in the target reference data.

[0174] In another optional implementation of this embodiment, when it is determined that the instruction type is a pointer-based function call instruction, a pointer offset parameter is obtained; if the pointer offset parameter contains reference mask information, it is determined that the target access data to be accessed belongs to an element of the target reference data, and the target index and target array offset are separated from the pointer offset parameter.

[0175] Among them, the pointer-based function call instruction can be understood as a system API involving pointer operations. Generally speaking, the above-mentioned pointer-based function call instruction generally only passes a single parameter, which can also be called a pointer offset parameter. The pointer offset parameter corresponds to a pointer value, which generally points to the memory address of the target access data to be accessed.

[0176] In this embodiment, after determining that the instruction type is a pointer-based function call instruction and obtaining the pointer offset parameter accordingly, the pointer offset parameter can be a pointer value pointing to a module data set and a program data set, or a modified value obtained by assembling a reference and an array offset. Therefore, it is possible to first detect whether the pointer offset parameter contains reference mask information. If so, it means that the pointer offset parameter is combined to access the elements of the reference data, and therefore, it is necessary to separate the target index and the target array offset from the pointer offset parameter.

[0177] In an optional implementation of the present embodiment, assuming that a pointer offset parameter of the form: "((REFMASK)|(REFHANDLER)|(offset))" is passed through a pointer-based function call instruction, and by parsing the pointer offset parameter, it is found that the pointer offset parameter carries reference mask information, that is, the "REFMASK" identifier. At this time, the target index REFHANDLER and the target array offset offset can be separated from the REFMASK respectively.

[0178] In another optional implementation of this embodiment, when it is determined that the instruction type is a pointer-based memory data loading or storing instruction, the memory offset pointed to by the pointer is obtained; if the memory offset contains reference mask information, the target access data to be accessed belongs to an element of the target reference data, and the target index and target data offset are separated from the memory offset.

[0179] Furthermore, the instructions for loading or storing memory data can be executed by pointer * programming, and then the pointer value of * in the memory data access instruction can be obtained, that is, the memory offset. Similarly, if the memory offset does not contain reference mask information, it means that the memory offset is a pointer value pointing to the memory data in the module data set and the program data set, and the pointer can be directly aligned to access the content pointed to by the pointer. If the memory offset contains reference mask information, it means that the memory data access instruction uses the pointer * programming method to access the elements of the referenced data. Therefore, it is necessary to separate the target index and the target data offset in the memory offset accordingly.

[0180] S730: query the target index in the reference data table, and when a valid target physical address is found, obtain target data attribute information of the target reference data from the target physical address.

[0181] The reference data table stores the physical address of the data attribute information corresponding to the reference data, and the reference data can be located based on the data attribute information.

[0182] In an optional implementation of this embodiment, querying the target index in the reference data table may include:

[0183] Query the target index in the unique reference data table.

[0184] In another optional implementation of this embodiment, querying the target index in the reference data table further includes:

[0185] Split the target index into a first index and a second index;

[0186] In the 0th level reference data table of the second level reference data table, query the first index to obtain the storage address of the target 1st level reference data table corresponding to the first index;

[0187] Locating the target level 1 reference data table according to the storage address of the target level 1 reference data table, and querying the second index in the target level 1 reference data table;

[0188] The level 0 reference data table is used to store the storage addresses of each level 1 reference data table, and the level 1 reference data table is used to actually store the physical address of the reference data.

[0189] S740: Perform a security access check on the target access data according to the target data attribute information and the target array offset.

[0190] In an optional implementation of this embodiment, the target data attribute information of the target reference data stores the virtual machine operation domain information to which the target reference data belongs and the data size of the target reference data. Based on one or all of the above two information, a security access check can be performed on the target access data. For example, check whether the virtual machine operation domain where the visitor of the target access data is located and the virtual machine operation domain to which the target reference data belongs comply with the firewall access rules, or whether the target array offset exceeds the data size of the target reference data. Through the above security access check, access to other unauthorized memory data can be avoided, thereby improving the security of memory access.

[0191] The technical solution of the embodiment of the present invention obtains the instruction type and at least one operand matching the memory data access instruction in response to the memory data access instruction; when it is determined according to the instruction type and each operand that the target access data to be accessed belongs to the element of the target reference data, the target index matching the target reference data and the target array offset of the target access data in the target reference data are obtained; the target index is queried in the reference data table, and when a valid target physical address is queried, the target data attribute information of the target reference data is obtained from the target physical address; according to the target data attribute information and the target array offset, a security access check is implemented on the target access data, and effective security control is performed on the memory access of the reference or pointer class, data isolation between different application data is guaranteed to the greatest extent, and the security of memory access is improved.

[0192] Figure 8 It is a flowchart of another method for secure access to reference data provided according to an embodiment of the present invention. This embodiment is optimized based on the above embodiments. In this embodiment, the operation of "performing a security access check on the target access data based on the target data attribute information and the target array offset" is specifically refined.

[0193] Correspondingly, such as Figure 8 As shown, the method may specifically include:

[0194] S810. In response to a memory data access instruction, obtain an instruction type and at least one operand that match the memory data access instruction.

[0195] S820. When it is determined according to the instruction type and each operand that the target access data to be accessed belongs to an element of the target reference data, a target index matching the target reference data and a target array offset of the target access data in the target reference data are obtained.

[0196] S830: query the target index in the reference data table, and when a valid target physical address is found, obtain target data attribute information of the target reference data from the target physical address.

[0197] The reference data table stores the physical address of the data attribute information corresponding to the reference data, and the reference data can be located based on the data attribute information.

[0198] S840. Obtain the target data size corresponding to the target reference data in the target data attribute information.

[0199] S850, check whether the target array offset exceeds the target data size: if so, execute S860; otherwise, execute S870.

[0200] S860: Determine that the target access data fails the boundary security access check.

[0201] When it is determined that the target access data has not passed the boundary security access check, access to the target access data may be prohibited, and corresponding warning prompt information may be generated.

[0202] S870. Determine whether the target access data passes the boundary security access check, and execute S880.

[0203] S880. Obtain the target virtual machine running domain corresponding to the target reference data in the target data attribute information, and execute S890.

[0204] S890. Check whether the virtual machine running domain where the memory data access instruction is located and the target instruction virtual machine running domain comply with the firewall access rules: if so, execute S8100; otherwise, execute S8110.

[0205] Specifically, only the module identifier corresponding to the memory data access instruction can be detected to see whether it is consistent with the module identifier recorded in the target virtual machine running domain: if so, it is determined that the virtual machine running domain where the memory data access instruction is located is consistent with the target instruction virtual machine running domain.

[0206] Alternatively, the module identifier and application identifier corresponding to the memory data access instruction can also be detected at the same time to see whether they are consistent with the module identifier and application identifier recorded in the target virtual machine running domain (that is, when the two module identifiers are consistent, the two application identifiers are also consistent): If so, it is determined that the virtual machine running domain where the memory data access instruction is located is consistent with the target instruction virtual machine running domain.

[0207] S8100. Determine that the target access data passes the operation domain security check, and execute S8120.

[0208] S8110. Determine that the target access data fails the operation domain security check.

[0209] When it is determined that the target access data has not passed the operational domain security check, access to the target access data may be prohibited, and corresponding warning prompt information may be generated.

[0210] S8120. After the target data attribute information is obtained and the target data type of the target reference data is determined, execute S8130.

[0211] S8130. If it is determined that the target data type is a structure data type, and the memory data access instruction is a pointer programming instruction, it is determined that the target access data fails the data type security check.

[0212] As mentioned above, the structure data type refers to the reference data that contains both reference data value and non-reference data value. The reference data value can be understood as reference data, that is, the memory address of application data, and the non-reference data value can be understood as the memory address of data in the module data set, for example, 1, 2, etc. The inventor found through research that the reference data of this type of structure data type can only be accessed through reference or pointer-type system APIs, but cannot be accessed through pointer programming instructions (that is, pointer * programming), which will cause access errors. Therefore, the corresponding data type security check is further added.

[0213] When it is determined that the target access data fails the data type security check, access to the target access data may be prohibited, and corresponding warning prompt information may be generated.

[0214] It can be understood that if it is determined that the target access data has passed the boundary security access check, the operation domain security check, and the data type security check, it means that the target access data has passed the security access check.

[0215] The technical solution of the embodiment of the present invention is based on a special construction method of reference data, and effectively stores the data size, data type and operating domain information of the reference data. Furthermore, effective security access checks can be performed from dimensions such as boundary security access checks, operating domain security checks and data type security checks, thereby further improving the security of memory access.

[0216] Based on the above embodiments, after performing a security access check on the target access data according to the target data attribute information and the target array offset, the following may also be included:

[0217] If it is determined that the target access data passes the security access check, obtaining the starting physical address of the target reference data to which the target access data belongs through a one-time or two-time positioning method according to the target data attribute information;

[0218] Target access data is obtained according to the starting physical address and the target array offset.

[0219] Specifically, if the target reference data is persistent data, the target reference data and the target data attribute information of the target reference data are stored adjacent to each other. After the target data attribute information is located, the starting physical address of the target reference data to which the target access data belongs can be directly obtained through one-time positioning.

[0220] Furthermore, if the target reference data is temporary data, the storage location information of the target reference data is stored in the target data attribute information. Then, after the target data attribute information is located, based on the storage location information of the target reference data, the starting physical address of the target reference data to which the target access data belongs can be obtained through secondary positioning.

[0221] Fig. 9 A schematic diagram of a reference data construction device provided by an embodiment of the present invention. Fig. 9 As shown, the device includes: a reference data creation module 910, a reference data storage module 920, a physical address writing module 930 and an index feedback module 940, wherein:

[0222] A reference data creation module 910, configured to create reference data in response to a reference data creation instruction;

[0223] A reference data storage module 920 is used to construct data attribute information corresponding to the reference data, and store the data attribute information and the reference data together in a set storage area, wherein the reference data can be located based on the data attribute information;

[0224] A physical address writing module 930 is used to write the physical address of the data attribute information into the reference data table and obtain the index of the data attribute information in the reference data table;

[0225] The reference generation module 940 is used to generate a reference in the index of the reference data table according to the data attribute information as a response result to the reference data creation instruction, so as to facilitate subsequent access to the reference data.

[0226] The technical solution of the embodiment of the present invention provides a device for constructing reference data, which creates reference data by responding to a reference data creation instruction; constructs data attribute information corresponding to the reference data, and stores the data attribute information and the reference data together in a set storage area, writes the physical address of the data attribute information into a reference data table, and obtains the index of the data attribute information in the reference data table; generates a reference according to the index of the data attribute information in the reference data table as a response result to the reference data creation instruction, and subsequently accesses the reference data through a reference or a pointer. A new type of reference data that is also used to store the memory address of data is proposed, and a method for creating reference data is defined. Based on the reference, while achieving a memory data access effect similar to that of a pointer, the flexibility and security of memory data access are improved.

[0227] Based on the above embodiments, the data storage module 920 can be used to:

[0228] If the referenced data is persistent data, the data attribute information is constructed based on the data type of the referenced data, the virtual machine running domain information to which it belongs, and the data size;

[0229] storing the data attribute information adjacent to the reference data in a set storage area;

[0230] The data size of the referenced data in the data attribute information is used to identify the data end position of the referenced data.

[0231] Based on the above embodiments, the data storage module 920 can be used to:

[0232] If the referenced data is temporary data, the referenced data is stored in a set storage area, and storage location information of the referenced data is obtained;

[0233] Constructing data attribute information according to the data type of the referenced data, the virtual machine operation domain information, the data size, and the storage location information, and storing the data attribute information in a set storage area;

[0234] The reference data and the data attribute information are stored adjacently or non-adjacently in the set storage area.

[0235] Based on the above embodiments, the data type may include: a basic array type, or a structure data type;

[0236] Wherein, the reference data of the structure data type includes both reference data values ​​and non-reference data values;

[0237] The virtual machine operation domain information includes: an identifier of an application module to which the reference data belongs, and an identifier of an application to which the reference data belongs;

[0238] The storage location information includes: a logical address of the data, or an offset of the data in a volatile storage area.

[0239] Based on the above embodiments, the physical address writing module 930 can be specifically used for:

[0240] Obtain a unique reference data table, and obtain a first free table entry in the unique reference data table;

[0241] The physical address of the data attribute information is written into the first free table entry, and the index of the first free table entry in the reference data table is determined as the index of the data attribute information in the reference data table.

[0242] Based on the above embodiments, the physical address writing module 930 can be specifically used for:

[0243] In the secondary reference data table, obtain the 0th level reference data table;

[0244] According to the level 0 reference data table, a level 1 reference data table is obtained from the level 2 reference data table, and a second free table entry is obtained from the obtained level 1 reference data table;

[0245] Wherein, the level 0 reference data table is used to store the storage addresses of each level 1 reference data table, and the level 1 reference data table is used to actually store the physical address of the reference data;

[0246] Writing the physical address of the data attribute information into the second free table entry, and obtaining the index of the second free table entry in the obtained level 1 reference data table;

[0247] The index of the obtained first-level reference data table in the zero-level reference data table and the index of the second free table entry in the obtained first-level reference data table are combined to obtain the index of the data attribute information in the reference data table.

[0248] On the basis of the above embodiments, the present invention may further include: a first-level reference data table creation module, which is used to:

[0249] If it is determined that all the created level 1 reference data tables in the level 0 reference data table are full, a new level 1 reference data table is created, and the storage address of the new level 1 reference data table is written into the level 0 reference data table.

[0250] The reference data construction device provided in the embodiment of the present invention can execute the reference data construction method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0251] Fig.10 A schematic diagram of the structure of a reference data access device provided by an embodiment of the present invention. Fig.10 As shown, the device includes: a first type access module 1010, or a second type access module 1020, wherein:

[0252] The first type of access module 1010 is used to access the elements of the referenced data by calling an application programming interface; or

[0253] The second type of access module 1020 is used to access the elements of the referenced data by means of pointer fetching * programming;

[0254] The reference data is constructed by the reference data creation method described in any one of the embodiments of the present invention.

[0255] The technical solution of the embodiment of the present invention accesses the elements of the referenced data by calling an application programming interface; or by pointer access programming, providing an efficient and convenient new way to access elements in a new type of referenced data. The implementation method is simple and easy to understand, and developers can quickly master the access method to the referenced data without complicated learning.

[0256] Based on the above embodiments, the first type of access module 1010 may include:

[0257] A reference or pointer transfer unit, used to transfer a reference or pointer of memory data to be accessed in a parameter of an application programming interface by calling the application programming interface;

[0258] The reference or pointer includes information that can be used to obtain the index of the data attribute information of the referenced data in the referenced data table, and the index is used to locate the physical address of the referenced data;

[0259] The first element access unit is used to perform memory data access within the application programming interface by parsing references or pointers, locate the physical address of the referenced data according to the reference of the memory data to be accessed, and access the elements of the referenced data according to the physical address of the referenced data and the array offset of the elements of the referenced data in the referenced data.

[0260] Based on the above embodiments, the second type of access module 1020 may specifically include:

[0261] An instruction construction unit, used to construct memory data access instructions through pointer fetch* programming;

[0262] A second element access unit is used to obtain a reference value of the referenced data and an array offset of an element of the referenced data in the referenced data according to a pointer value of the memory data to be accessed by executing a memory data access instruction, and access the element of the referenced data according to the reference value of the referenced data and the array offset;

[0263] The reference value includes information that can be used to obtain the index of the data attribute information of the reference data in the reference data table, and the index is used to locate the physical address of the reference data.

[0264] Based on the above embodiments, the reference or pointer transfer unit can be specifically used for:

[0265] If the parameter type of the application programming interface is reference, generating a reference to the memory data to be accessed according to the index of the data attribute information of the referenced data in the referenced data table;

[0266] The reference of the memory data to be accessed and the array offset of the element of the referenced data in the referenced data are respectively passed to the application programming interface as two parameters.

[0267] Based on the above embodiments, the reference or pointer transfer unit can be specifically used for:

[0268] If the parameter type of the application programming interface is a pointer, a reference to the memory data to be accessed is generated according to the index of the data attribute information of the referenced data in the referenced data table;

[0269] A reference to the memory data to be accessed and an array offset of an element of the referenced data in the referenced data are combined to form a pointer value, and the pointer value is passed as a parameter value to the application programming interface.

[0270] Based on the above embodiments, the instruction construction unit can be specifically used for:

[0271] Generate a reference to the memory data to be accessed according to the index of the data attribute information of the referenced data in the referenced data table;

[0272] The reference to the memory data to be accessed and the array offset of the element of the referenced data in the referenced data are combined to form a pointer value;

[0273] By means of pointer fetch * programming, a memory data access instruction corresponding to the pointer value is constructed.

[0274] Based on the above embodiments, the reference data can be located based on the data attribute information.

[0275] The reference data access device provided in the embodiment of the present invention can execute the reference data access method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0276] Fig.11 A schematic diagram of the structure of a reference data access device provided by an embodiment of the present invention. Fig.11 As shown, the device includes: an instruction information acquisition module 1110, a key information acquisition module 1120, an attribute information acquisition module 1130 and a security access check module 1140, wherein:

[0277] The instruction information acquisition module 1110 is used to obtain, in response to a memory data access instruction, an instruction type and at least one operand matching the memory data access instruction;

[0278] A key information acquisition module 1120, for acquiring a target index matching the target reference data and a target array offset of the target access data in the target reference data when it is determined according to the instruction type and each operand that the target access data to be accessed belongs to an element of the target reference data;

[0279] The attribute information acquisition module 1130 is used to query the target index in the reference data table, and when a valid target physical address is queried, obtain the target data attribute information of the target reference data from the target physical address;

[0280] The reference data table stores the physical address of the data attribute information corresponding to the reference data, and the reference data can be located based on the data attribute information;

[0281] The security access check module 1140 is used to perform a security access check on the target access data according to the target data attribute information and the target array offset.

[0282] The technical solution of the embodiment of the present invention obtains the instruction type and at least one operand matching the memory data access instruction in response to the memory data access instruction; when it is determined according to the instruction type and each operand that the target access data to be accessed belongs to the element of the target reference data, the target index matching the target reference data and the target array offset of the target access data in the target reference data are obtained; the target index is queried in the reference data table, and when a valid target physical address is queried, the target data attribute information of the target reference data is obtained from the target physical address; according to the target data attribute information and the target array offset, a security access check is implemented on the target access data, and effective security control is performed on the memory access of the reference or pointer class, data isolation between different application data is guaranteed to the greatest extent, and the security of memory access is improved.

[0283] In the above-mentioned embodiments, the instruction information acquisition module 1110 can be used to:

[0284] Obtaining a virtual machine stack frame that matches the memory data access instruction, and obtaining the at least one operand from the virtual machine stack frame; or

[0285] In the memory data access instruction, the at least one operand is directly fetched.

[0286] Based on the above embodiments, the key information acquisition module 1120 can be used to:

[0287] When determining that the instruction type is a function call instruction based on reference data, determining that the target access data to be accessed belongs to an element of the target reference data, and obtaining a first call parameter and a second call parameter;

[0288] The target index matching the target reference data is separated in the first call parameter, and the second call parameter is used as the target array offset.

[0289] Based on the above embodiments, the key information acquisition module 1120 can be used to:

[0290] When determining that the instruction type is a pointer-based function call instruction, obtaining a pointer offset parameter;

[0291] If the pointer offset parameter includes reference mask information, it is determined that the target access data to be accessed belongs to the element of the target reference data, and the target index and the target array offset are separated from the pointer offset parameter.

[0292] Based on the above embodiments, the key information acquisition module 1120 can be used to:

[0293] When it is determined that the instruction type is a pointer-based memory data load or store instruction, obtaining the memory offset pointed to by the pointer;

[0294] If the memory offset contains reference mask information, the target access data to be accessed belongs to the element of the target reference data, and the target index and the target data offset are separated from the memory offset.

[0295] Based on the above embodiments, the attribute information acquisition module 1130 can be used to:

[0296] Query the target index in the unique reference data table.

[0297] Based on the above embodiments, the attribute information acquisition module 1130 can be used to:

[0298] Split the target index into a first index and a second index;

[0299] In the 0th level reference data table of the second level reference data table, query the first index to obtain the storage address of the target 1st level reference data table corresponding to the first index;

[0300] Locating the target level 1 reference data table according to the storage address of the target level 1 reference data table, and querying the second index in the target level 1 reference data table;

[0301] The level 0 reference data table is used to store the storage addresses of each level 1 reference data table, and the level 1 reference data table is used to actually store the physical address of the reference data.

[0302] Based on the above embodiments, the security access checking module 1140 can be used to:

[0303] Obtaining the target data size corresponding to the target reference data in the target data attribute information;

[0304] Detect whether the target array offset exceeds the target data size: if so, determine that the target access data fails the boundary security access check; otherwise, determine that the target access data passes the boundary security access check.

[0305] Based on the above embodiments, the security access checking module 1140 can be further used to:

[0306] Obtaining a target virtual machine operation domain corresponding to the target reference data in the target data attribute information;

[0307] Detect whether the virtual machine running domain where the memory data access instruction is located and the target instruction virtual machine running domain comply with the firewall access rules: if so, determine that the target access data passes the running domain security check; otherwise, determine that the target access data does not pass the running domain security check.

[0308] On the basis of the above embodiments, the security access checking module 1140 may be further used to: obtain the target data type of the target reference data in the target data attribute information;

[0309] If it is determined that the target data type is a structure data type, and the memory data access instruction belongs to a pointer programming instruction, it is determined that the target access data fails the data type security check.

[0310] Based on the above embodiments, a data access module may also be included, which is used to:

[0311] After performing a security access check on the target access data according to the target data attribute information and the target array offset, if it is determined that the target access data passes the security access check, obtaining the starting physical address of the target reference data to which the target access data belongs through a one-time or two-time positioning method according to the target data attribute information;

[0312] Target access data is obtained according to the starting physical address and the target array offset.

[0313] The secure access device for reference data provided by the embodiment of the present invention can execute the secure access method for reference data provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0314] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0315] Fig.12 A schematic structural diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown.

[0316] like Fig.12 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0317] The electronic device may be a resource-constrained device. A resource-constrained device may be understood as an electronic device with limited storage capacity, and its RAM resources are limited, generally a few KB to tens of KB, and its NVM (non-volatile memory) resources are limited. Fig.12 Taking ROM as an example) it is tens of KB to hundreds of KB, and the maximum is MB level.

[0318] The resource-constrained device may generally be: a smart card, a USBKEY, an ESAM (Embedded Secure Access Module), an IoT device or an SE (Secure Element), etc. The smart card may generally be a multi-application smart card.

[0319] The I / O interface 15 in the electronic device 10 may include: eSPI (Enhanced Serial Peripheral Interface) and SPI (Serial Peripheral Interface), etc.

[0320] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, for example, executing a method for constructing, accessing, and securely accessing reference data as described in various embodiments of the present invention.

[0321] In some embodiments, a method for constructing, accessing, and securely accessing reference data as described in various embodiments of the present invention may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 16. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for constructing, accessing, and securely accessing reference data as described in various embodiments of the present invention described above may be executed. Alternatively, in other embodiments, the processor 11 may be configured to execute a method for constructing, accessing, and securely accessing reference data as described in various embodiments of the present invention by any other appropriate means (e.g., by means of firmware).

[0322] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0323] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0324] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0325] Fig.13 is a structural diagram of a terminal provided according to an embodiment of the present invention. Fig.13 Said terminal includes the electronic device 1310 as described in any embodiment of the present invention.

[0326] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

Claims

1. A method for constructing reference data, characterized in that: include: In response to the reference data creation instruction, the reference data is created; wherein the reference data creation instruction is triggered when the application is installed or when the application is selected in the logical channel; Constructing data attribute information corresponding to the reference data, and storing the data attribute information and the reference data together in a set storage area, wherein the reference data can be located based on the data attribute information; Write the physical address of the data attribute information into the reference data table, and obtain the index of the data attribute information in the reference data table; A reference is generated according to the index of the reference data table according to the data attribute information as a response result to the reference data creation instruction for subsequent access to the reference data.

2. The method according to claim 1, characterized in that: Constructing data attribute information corresponding to the reference data, and storing the data attribute information and the reference data together in a set storage area, including: If the referenced data is persistent data, the data attribute information is constructed based on the data type of the referenced data, the virtual machine running domain information to which it belongs, and the data size; storing the data attribute information adjacent to the reference data in a set storage area; The data size of the referenced data in the data attribute information is used to identify the data end position of the referenced data.

3. The method according to claim 1, characterized in that Constructing data attribute information corresponding to the reference data, and storing the data attribute information and the reference data together in a set storage area, including: If the referenced data is temporary data, the referenced data is stored in a set storage area, and storage location information of the referenced data is obtained; Constructing data attribute information according to the data type of the referenced data, the virtual machine operation domain information, the data size, and the storage location information, and storing the data attribute information in a set storage area; The reference data and the data attribute information are stored adjacently or non-adjacently in the set storage area.

4. The method according to claim 2 or 3, characterized in that: The data types include: basic array types, or structure data types; Wherein, the reference data of the structure data type includes both reference data values ​​and non-reference data values; The virtual machine operation domain information includes: an identifier of an application module to which the reference data belongs, and an identifier of an application to which the reference data belongs; The storage location information includes: a logical address of the data, or an offset of the data in a volatile storage area.

5. The method according to claim 1, characterized in that: Write the physical address of the data attribute information into the reference data table, and obtain the index of the data attribute information in the reference data table, including: Obtain a unique reference data table, and obtain a first free table entry in the unique reference data table; The physical address of the data attribute information is written into the first free table entry, and the index of the first free table entry in the reference data table is determined as the index of the data attribute information in the reference data table.

6. The method according to claim 1, characterized in that Write the physical address of the data attribute information into the reference data table, and obtain the index of the data attribute information in the reference data table, including: In the secondary reference data table, obtain the 0th level reference data table; According to the level 0 reference data table, a level 1 reference data table is obtained from the level 2 reference data table, and a second free table entry is obtained from the obtained level 1 reference data table; Wherein, the level 0 reference data table is used to store the storage addresses of each level 1 reference data table, and the level 1 reference data table is used to actually store the physical address of the reference data; Writing the physical address of the data attribute information into the second free table entry, and obtaining the index of the second free table entry in the obtained level 1 reference data table; The index of the obtained first-level reference data table in the zero-level reference data table and the index of the second free table entry in the obtained first-level reference data table are combined to obtain the index of the data attribute information in the reference data table.

7. The method according to claim 6, characterized in that Also includes: If it is determined that all the created level 1 reference data tables in the level 0 reference data table are full, a new level 1 reference data table is created, and the storage address of the new level 1 reference data table is written into the level 0 reference data table.

8. A method for accessing reference data, characterized in that: include: Access the referenced data element by calling an application programming interface; or Access the elements of the referenced data through pointer * programming; Wherein, the reference data is constructed by the method described in any one of claims 1-7.

9. The method according to claim 8, characterized in that Access the elements of the referenced data by calling the application programming interface, including: By calling an application programming interface, a reference or pointer to the memory data to be accessed is passed in the parameters of the application programming interface; The reference or pointer includes information that can be used to obtain the index of the data attribute information of the referenced data in the referenced data table, and the index is used to locate the physical address of the referenced data; In the application programming interface, memory data access is performed by resolving references or pointers, the physical address of the referenced data is located according to the reference of the memory data to be accessed, and the elements of the referenced data are accessed according to the physical address of the referenced data and the array offset of the elements of the referenced data in the referenced data.

10. The method according to claim 8, characterized in that Access the elements of the referenced data through pointer access programming, including: Build memory data access instructions through pointer fetch* programming; By executing the memory data access instruction, according to the pointer value of the memory data to be accessed, the reference value of the referenced data and the array offset of the element of the referenced data in the referenced data are obtained, and the element of the referenced data is accessed according to the reference value of the referenced data and the array offset; The reference value includes information that can be used to obtain the index of the data attribute information of the reference data in the reference data table, and the index is used to locate the physical address of the reference data.

Images