Method and device for protecting access to memory space

Abstract

The embodiment of the present application provides a method for access protection of memory space, wherein the method includes: creating a virtual storage space corresponding to a target memory space in a virtual memory of a server; configuring a target space identifier for the virtual storage space in a target virtual page table according to the occupancy information of the storage space included in the target virtual page table; configuring pointer verification information for an initial pointer according to the target space identifier and the target page table identifier of the target virtual page table to obtain a target pointer, wherein the initial pointer records access information for accessing the virtual storage space, and the pointer verification information is used to indicate the location of the virtual space indicated by the target pointer in the virtual memory; and assigning the target pointer to an application. Through the present application, the problem of low efficiency of access protection to memory space in the related art is solved, thereby achieving the effect of improving the efficiency of access protection to memory space.

Description

Technical Field

[0001] The embodiments of the present application relate to the computer field, and more specifically, to a method and device for protecting access to a memory space. Background Art

[0002] With the rapid development of information technology, information security issues have become increasingly prominent. As a core component for data storage and processing in computer systems, the security of memory is directly related to the stability of the entire system and the security of data. In order to ensure the stability of the system and the security of data, the operating system has introduced virtual memory technology to achieve access protection for physical memory. In order to avoid erroneous access to virtual memory space, related technologies deploy detection programs in the server system, use compile-time conversion, insert boundary checks before referencing pointers to detect memory space vulnerabilities, and deploy garbage collection programs or track the survival status of memory objects to handle memory time vulnerabilities. However, this method will significantly increase the performance overhead of the system during runtime, resulting in low efficiency in access protection of memory space. Summary of the invention

[0003] The embodiments of the present application provide a method and device for protecting access to a memory space, so as to at least solve the problem of low efficiency of protecting access to a memory space in the related art.

[0004] According to an embodiment of the present application, a method for protecting access to a memory space is provided, comprising:

[0005] Creating a virtual storage space corresponding to a target memory space in a virtual memory of a server, wherein the virtual memory is used to record access information required to access the target memory space, and the target memory space is a memory space allocated to an application in a server memory;

[0006] According to the occupancy information of the storage space included in the target virtual page table, a target space identifier is configured for the virtual storage space in the target virtual page table, wherein the target virtual page table is a virtual page table where the virtual storage space is located, and the target space identifier is used to mark the position of the virtual storage space in the target virtual page table;

[0007] According to the target space identifier and the target page table identifier of the target virtual page table, pointer verification information is configured for the initial pointer to obtain a target pointer, wherein the initial pointer records access information for accessing the virtual storage space, and the pointer verification information is used to indicate the location of the virtual space indicated by the target pointer to be accessed in the virtual memory;

[0008] The target pointer is assigned to the application.

[0009] Optionally, configuring a target space identifier for the virtual storage space in the target virtual page table according to the occupancy information of the storage space included in the target virtual page table includes:

[0010] Filter out the target space identifier that is not occupied for the virtual storage space in the identifier sequence of the target virtual page table according to the occupancy information, wherein the identifier sequence includes a plurality of space identifiers configured for the target virtual page table, and the number of the plurality of space identifiers is equal to the number of storage spaces included in the target virtual page table;

[0011] The virtual storage space is marked using the target space identifier.

[0012] Optionally, the filtering out the unoccupied target space identifier for the virtual storage space in the identifier sequence of the target virtual page table according to the occupancy information includes:

[0013] Acquire a first space identifier of a reference storage space in an occupied state in the target virtual page table indicated by the occupation information;

[0014] Extracting a second space identifier other than the first space identifier included in the identifier sequence;

[0015] A target space identifier is allocated to the virtual storage space from the second space identifier.

[0016] Optionally, the filtering out the unoccupied target space identifier for the virtual storage space in the identifier sequence of the target virtual page table according to the occupancy information includes:

[0017] Converting a target space sequence number of the virtual storage space using the storage space occupation quantity, wherein the storage space occupation quantity is used to indicate the quantity of storage spaces in an occupied state in the target virtual page table before the virtual storage space is created, the target space sequence number is used to identify the occupation timing of the virtual storage space and other storage spaces in an occupied state in the target virtual page table, and the occupation information includes the storage space occupation quantity;

[0018] The space identifier corresponding to the target space sequence number in the identifier sequence is determined as the target space identifier.

[0019] Optionally, marking the virtual storage space with the target space identifier includes:

[0020] Constructing a target binding relationship between the target space identifier and the virtual storage space;

[0021] The target binding relationship is stored in the running memory of the server.

[0022] Optionally, configuring pointer verification information for the initial pointer according to the space identifier and the page table identifier of the target virtual page table includes:

[0023] Convert the pointer verification information using the space identifier and the page table identifier;

[0024] The pointer verification information is added to a target character position in the initial pointer, wherein the target character position is a character position in the initial pointer that is not occupied after the access information is stored.

[0025] Optionally, the converting the pointer verification information using the space identifier and the page table identifier includes:

[0026] The space identifier and the page table identifier are concatenated in sequence to obtain the pointer verification information.

[0027] Optionally, before configuring pointer verification information for the initial pointer according to the target space identifier and the target page table identifier of the target virtual page table, the method further includes:

[0028] Detecting a first page table identifier used by a virtual page table in an occupied state among virtual page tables included in the virtual memory;

[0029] Filtering out a second page table identifier from a page table identifier set, wherein the page table identifier set includes a plurality of page table identifiers configured for a virtual page table in the virtual memory, and the second page table identifier is a page table identifier in the page table identifier set except the first page table identifier;

[0030] The target page table identifier is filtered out for the target virtual page table from the second page table identifier.

[0031] Optionally, after allocating the target pointer to the application, the method further includes:

[0032] receiving the target pointer issued by the application program for accessing the server memory;

[0033] Extracting the pointer verification information and the virtual address pointer carried in the target pointer, wherein the virtual address pointer is used to indicate the storage space currently to be accessed in the virtual memory;

[0034] Obtaining a candidate space identifier and a candidate page table identifier of a candidate storage space found in the virtual memory using the virtual address pointer;

[0035] Verify the candidate space identifier and the candidate page table identifier using the pointer verification information;

[0036] When the candidate space identifier and the candidate page table identifier are verified, access rights for accessing the candidate storage space are configured for the application.

[0037] Optionally, the using the pointer verification information to verify the candidate space identifier and the candidate page table identifier includes:

[0038] Using the pointer verification information to restore the target space identifier and the target page table identifier;

[0039] Matching the target space identifier with the candidate space identifier, and matching the target page table identifier with the candidate page table identifier;

[0040] When the target space identifier and the candidate space identifier match each other, it is determined that the candidate space identifier has been verified. When the target page table identifier and the candidate page table identifier match each other, it is determined that the candidate page table identifier has been verified.

[0041] Optionally, obtaining a candidate space identifier and a candidate page table identifier of the candidate storage space found in the virtual memory using the virtual address pointer includes:

[0042] Searching the running memory of the server for the candidate space identifier having a binding relationship with the candidate storage space;

[0043] Search the target memory for a candidate page table entry corresponding to the candidate virtual page table to which the candidate storage space belongs, and search the candidate page table identifier corresponding to the candidate virtual page table from the candidate page table entry, wherein the target memory is used to store the page table entry corresponding to the virtual page table in the virtual memory.

[0044] According to another embodiment of the present application, a memory space access protection device is provided, including:

[0045] A creation module, used to create a virtual storage space corresponding to a target memory space in a virtual memory of a server, wherein the virtual memory is used to record access information required to access the target memory space, and the target memory space is a memory space allocated to an application in a server memory;

[0046] A first configuration module is used to configure a target space identifier for the virtual storage space in the target virtual page table according to the occupancy information of the storage space included in the target virtual page table, wherein the target virtual page table is a virtual page table where the virtual storage space is located, and the target space identifier is used to mark the position of the virtual storage space in the target virtual page table;

[0047] A second configuration module is used to configure pointer verification information for the initial pointer according to the target space identifier and the target page table identifier of the target virtual page table to obtain a target pointer, wherein the initial pointer records access information for accessing the virtual storage space, and the pointer verification information is used to indicate the location of the virtual space indicated by the target pointer to be accessed in the virtual memory;

[0048] The allocation module is used to allocate the target pointer to the application.

[0049] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.

[0050] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0051] According to another embodiment of the present application, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0052] Through this application, by creating a virtual storage space corresponding to the target memory space in the virtual memory of the server, it is possible to configure a target space identifier for marking the position of the virtual storage space in the target virtual page table in the target virtual page table according to the occupancy information of the storage space included in the virtual page table (i.e., the target virtual page table) where the virtual storage space is located, and then configure the initial pointer with pointer verification information indicating the position of the virtual space accessed by the target pointer in the virtual memory according to the target space identifier and the target page table identifier of the target virtual page table, obtain the target pointer, and finally assign the target pointer to the application. Through the above method, it is possible to realize double authentication of memory access through the target space identifier and the target page table identifier of the target virtual page table, thereby avoiding erroneous access to the target memory. Therefore, the problem of low efficiency of memory space access protection in the related art can be solved, and the effect of improving the efficiency of memory space access protection can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a hardware structure block diagram of a server device of a method for protecting access to memory space according to an embodiment of the present application;

[0054] Figure 2 is a flow chart of a method for protecting access to a memory space according to an embodiment of the present application;

[0055] Figure 3 It is a flow chart of a memory protection method for multi-granularity memory marking under Linux according to an embodiment of the present application;

[0056] Figure 4 is a schematic diagram of pointer encoding of a virtual space according to an embodiment of the present application;

[0057] Figure 5 is a memory access check logic diagram according to an embodiment of the present application;

[0058] Figure 6 is a flowchart of a multi-granularity label implementation according to an embodiment of the present application;

[0059] Figure 7 It is a structural block diagram of a memory space access protection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0060] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0061] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0062] The method embodiments provided in the embodiments of the present application can be executed in a server device or a similar computing device. Taking running on a server device as an example, Figure 1 1 is a hardware structure block diagram of a server device according to a method for protecting access to memory space in an embodiment of the present application. Figure 1 As shown, the server device may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned server device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above server device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0063] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the access protection method of the memory space in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the server device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0064] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the server device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0065] In this embodiment, a method for protecting access to a memory space is provided. Figure 2 is a flow chart of a method for protecting access to a memory space according to an embodiment of the present application, such as Figure 2 As shown, the process includes the following steps:

[0066] Step S202, creating a virtual storage space corresponding to the target memory space in the virtual memory of the server, wherein the virtual memory is used to record access information required to access the target memory space, and the target memory space is the memory space allocated to the application in the server memory;

[0067] Step S204, configuring a target space identifier for the virtual storage space in the target virtual page table according to the occupancy information of the storage space included in the target virtual page table, wherein the target virtual page table is a virtual page table where the virtual storage space is located, and the target space identifier is used to mark the position of the virtual storage space in the target virtual page table;

[0068] Step S206, configuring pointer verification information for the initial pointer according to the target space identifier and the target page table identifier of the target virtual page table to obtain a target pointer, wherein the initial pointer records access information for accessing the virtual storage space, and the pointer verification information is used to indicate the location of the virtual space indicated by the target pointer to be accessed in the virtual memory;

[0069] Step S208: assigning the target pointer to the application.

[0070] Through the above steps,

[0071] By creating a virtual storage space corresponding to the target memory space in the virtual memory of the server, it is possible to configure a target space identifier for marking the position of the virtual storage space in the target virtual page table in the target virtual page table according to the occupancy information of the storage space included in the virtual page table (i.e., the target virtual page table) where the virtual storage space is located, and then configure the initial pointer with pointer verification information indicating the position of the virtual space accessed by the target pointer in the virtual memory according to the target space identifier and the target page table identifier of the target virtual page table, obtain the target pointer, and finally assign the target pointer to the application. In the above manner, it is possible to realize double authentication of memory access through the target space identifier and the target page table identifier of the target virtual page table, thereby avoiding erroneous access to the target memory. Therefore, the problem of low efficiency of memory space access protection in the related art can be solved, and the effect of improving the efficiency of memory space access protection can be achieved.

[0072] In the embodiment provided in the above step S202, the target memory space is a physical storage space in the server memory that is allocated to the application program and is actually used to store data.

[0073] Optionally, in an embodiment of the present application, in the virtual memory of the server, a corresponding virtual storage space is created for each target memory space allocated to the application, enabling the operating system to manage and protect the memory at the virtual level without directly intervening in the physical memory, thereby providing an additional layer of isolation for the physical memory and improving the security of memory access.

[0074] In the embodiment provided in the above step S204, the target virtual page table is a virtual page table where the virtual storage space corresponding to the target memory space is located, and is used to track the physical memory mapping of the virtual storage space corresponding to the target memory space.

[0075] Optionally, in an embodiment of the present application, the target space identifier is a unique identifier used to mark the position of the virtual storage space in the target virtual page table. The target space identifier is configured for the virtual storage space in the target virtual table page based on the storage space occupancy information in the target virtual page table. The identifier ensures the uniqueness of the position of the virtual storage space corresponding to the target memory space in the target virtual page table, which allows the system to perform more fine-grained control over the memory access of the application, that is, it can be accurate to a specific virtual storage space rather than an entire page or a larger memory area, thereby avoiding illegal access to or incorrect positioning of the memory.

[0076] Optionally, in an embodiment of the present application, the occupancy information is used to indicate the occupancy of the storage space in the target virtual page table, which may include but is not limited to the number of storage spaces in an occupied state, and then the method of configuring the target space identifier for the virtual storage space according to the occupancy information may be: sorting the occupied storage space on the current target virtual page using the number of storage spaces in an occupied state indicated by the occupancy information, thereby obtaining the sequence number of the virtual storage space, and then searching the target space identifier sequence corresponding to the sequence number from the space identifier sequence configured from the target virtual page table according to the sequence number, wherein the space identifier sequence records the same number of storage spaces as the number of storage spaces included in the target virtual page table. In an embodiment of the present application, the occupancy information indicates the number of all occupied storage spaces in the target virtual page table in an identification information configuration round, including the storage space currently in an occupied state, and also including the storage space that has been occupied and has been released, and then when all the space identifiers in the space identifier sequence have been used once, the current round of identification information configuration ends, and the space identifier sequence used by the target virtual page table is reset. In an embodiment of the present application, in order to avoid the collision problem of space identifiers configured in adjacent representation information configuration rounds, the occupancy status of the storage space in the target virtual page table at the end of the previous identifier configuration round can be detected. If all the storage space in the target virtual page table is in a released state, all the space identifiers configured for the target virtual page table will be reset; if there is still some storage space in the target virtual page table that is in an occupied state, the first space identifier is filtered out from the space identifiers configured for the target virtual page table, wherein the first space identifier is a space identifier that is not currently occupied, and the first space identifier is reset (including but not limited to reordering the first space representation).

[0077] Optionally, in an embodiment of the present application, the occupancy information may also be a second space identifier for the storage space in an occupied state and the storage space in an occupied state that has been occupied in the target virtual page table. Then, the method of configuring the target space identifier for the virtual storage space according to the occupancy information may be to filter out an unoccupied third space identifier from the space identifier set of the target virtual page table, wherein the number of space identifiers recorded in the space identifier set is equal to the number of all storage spaces included in the target virtual page table; and then, the target space identifier may be randomly filtered out for the virtual storage space from the third space identifier.

[0078] In the embodiment provided in the above step S206, the pointer verification information combines the target space identifier and the target page table identifier of the target virtual page table, thereby ensuring the accuracy of the virtual storage space location pointed to by the target pointer, and the double identifier verification greatly reduces the probability of label collision. Figure 4 is a schematic diagram of pointer encoding of a virtual space according to an embodiment of the present application, such as Figure 4 As shown in the figure, a multi-granularity tag consisting of an object granularity tag (target space identifier) ​​and a page granularity tag (target page table identifier) ​​can be embedded into the upper virtual address bits of the pointer. For example, in a 39-bit virtual address space configuration, except for one bit for sign extension in the upper 25 bits, the other 24 bits are not used in address translation. Therefore, the tagged memory architecture uses 8 bits of these 24 bits as object granularity tags and 16 bits as page granularity tags. By marking an 8-bit tag for each 16 bytes of memory stored in DRAM, 256 possible memory objects in a 4kB page can be uniquely marked, thereby preventing tag conflicts within the page. Each page is marked with a 16-bit tag, so the probability of tag conflicts for data objects on different pages is 2 -8 *2 -16 =2 -24 .

[0079] Optionally, in the embodiment of the present application, the tag bit size of the object granularity tag (target space identifier) ​​and the page granularity tag (target page table identifier) ​​can be selected according to security and memory overhead requirements. For example, a 4-bit object granularity tag can be selected to reduce the introduced memory overhead by half. In addition, the size of the page granularity tag can also be adjusted as needed to reduce the number of bits required for PTE (Page Table Entry).

[0080] Optionally, in an embodiment of the present application, pointer verification information may be stored in the high bit of the initial pointer, where the high bit of the pointer is the unoccupied character after the virtual address pointer is stored in the initial pointer, and then the target space identifier and the target page table identifier may be converted to obtain the pointer verification information. The conversion operation may be, but is not limited to, merging the target space identifier and the target page table identifier to obtain the pointer verification information. In actual applications, the character bits occupied by the pointer verification information may exceed the number of character bits allowed to be written by the high bit of the initial pointer. At this time, the original label sequence with a larger number of bits can be compressed into a label sequence with a smaller number of bits by using a character bit conversion algorithm (such as a hash algorithm), thereby storing the pointer verification information in the high bit of the initial pointer. When the target pointer is used to access the storage space, the inverse hash function or the lookup table is used to restore the original number of multi-granularity label bits. Through the compression and recovery mechanism of the label bit number, the number of bits of the multi-granularity label sequence can be effectively reduced without sacrificing the memory protection function, thereby reducing memory overhead and improving system performance.

[0081] In the embodiment provided in the above step S208, a target pointer configured with verification information is assigned to an application, and then when the application initiates an access request to the target memory space, the target space identifier and the target page table identifier carried in the target pointer configured by the application can be verified at the same time. Only when both are verified, the application is allowed to access the target memory space. In this way, attackers can be effectively prevented from bypassing the memory protection mechanism by tampering with or forging pointers. Even if attackers can modify the pointers, it is difficult for them to predict the correct verification information, thereby improving the efficiency of access protection to the memory space.

[0082] Optionally, in an embodiment of the present application, after the target pointer is assigned to the application, when the application attempts to access data already in the cache, the cache unit will simultaneously check whether the cache line of the data and the tag information associated therewith are consistent. If both the data and the tag match the information in the target pointer, the cache hits. At this time, in order to track the modification status of the data, the cache line and its corresponding tag will be marked as "dirty", indicating that the data has been modified. When the cache needs to release the cache line due to capacity limitations, the system first checks the dirty bit of the cache line. If the dirty bit is marked, the system will write the modified content back to the main memory and update the tag information in the main memory to reflect the latest status of the data. The cache line will only be released after both the data and tag information have been written back to the main memory.

[0083] Optionally, in an embodiment of the present application, when the application does not find the corresponding data or tag in the cache, that is, the cache is invalid, the system needs to load the latest data and its tag information from the main memory and write it to the cache. The system needs to first release the contents of the current cache line to make room for the data to be subsequently written to the cache, and then check whether the tag in the main memory matches the tag verification information carried in the target pointer. If it matches, the data and tag information are written to the cache. If it does not match, the access request is blocked. In this process, if the target data is in the main memory, but its tag has been marked as illegal or has been recycled, then a new tag needs to be reallocated to the target data, and then the target data and the updated tag are loaded into the cache to ensure that illegal memory access can be prevented even during cache invalidation and data writeback.

[0084] As an optional embodiment, configuring a target space identifier for the virtual storage space in the target virtual page table according to the occupancy information of the storage space included in the target virtual page table includes:

[0085] Filter out the target space identifier that is not occupied for the virtual storage space in the identifier sequence of the target virtual page table according to the occupancy information, wherein the identifier sequence includes a plurality of space identifiers configured for the target virtual page table, and the number of the plurality of space identifiers is equal to the number of storage spaces included in the target virtual page table;

[0086] The virtual storage space is marked using the target space identifier.

[0087] Optionally, in an embodiment of the present application, the occupancy information is used to indicate the target space identifier that has been occupied in the identifier sequence of the target virtual page table, and the occupancy information may be the target space identifier number that has been used in the identifier sequence.

[0088] Optionally, in an embodiment of the present application, a unique space identifier is assigned to each storage space included in the target virtual page table, so the number of multiple space identifiers in the identification sequence is equal to the number of storage spaces included in the target virtual page table. For example, by using an 8-bit identification sequence, the number of space identifiers in the identification sequence is 2. 8 = 256, all 256 16-byte memory objects in a 4 kB page can be uniquely marked.

[0089] Optionally, in an embodiment of the present application, after filtering out the unoccupied target space identifier in the identifier sequence of the target virtual page table based on the occupancy information, the identifier will be bound to the requested virtual storage space, thereby ensuring that each virtual storage space in the virtual memory has a unique unoccupied space identifier, thereby avoiding identifier conflicts caused by repeated use of identifiers.

[0090] In the above manner, by allocating an unoccupied target space identifier to each virtual storage space, identifier conflicts caused by repeated use of identifiers can be effectively avoided, thereby effectively improving the security of system memory access.

[0091] As an optional embodiment, the step of filtering out the unoccupied target space identifier for the virtual storage space in the identifier sequence of the target virtual page table according to the occupancy information includes:

[0092] Acquire a first space identifier of a reference storage space in an occupied state in the target virtual page table indicated by the occupation information;

[0093] Extracting a second space identifier other than the first space identifier included in the identifier sequence;

[0094] A target space identifier is allocated to the virtual storage space from the second space identifier.

[0095] Optionally, in an embodiment of the present application, in order to ensure that each virtual storage space has a unique and unoccupied space identifier, the first space identifier of all currently allocated storage spaces in the target virtual page table can be first queried and extracted from the occupancy information, and then all identifiers except the first space identifier (i.e., the second space identifier) ​​can be extracted from the identifier sequence. The second space identifier is used to indicate the identifier in the target virtual page table that is currently not occupied or allocated to any storage space, and then a target space identifier is allocated to the requested virtual storage space from the second space identifier.

[0096] Through the above method, the allocation of space identifiers can be dynamically adjusted according to the current occupancy of the virtual storage space, which can ensure the uniqueness and security of the space identifier allocation, and help to better utilize limited identifier resources and avoid waste or over-allocation of space identifiers.

[0097] As an optional embodiment, the step of filtering out the unoccupied target space identifier for the virtual storage space in the identifier sequence of the target virtual page table according to the occupancy information includes:

[0098] Converting a target space sequence number of the virtual storage space using the storage space occupation quantity, wherein the storage space occupation quantity is used to indicate the quantity of storage spaces in an occupied state in the target virtual page table before the virtual storage space is created, the target space sequence number is used to identify the occupation timing of the virtual storage space and other storage spaces in an occupied state in the target virtual page table, and the occupation information includes the storage space occupation quantity;

[0099] The space identifier corresponding to the target space sequence number in the identifier sequence is determined as the target space identifier.

[0100] Optionally, in an embodiment of the present application, the target space serial number of the virtual storage space can be converted by using the storage space occupation number, and the target space identifier corresponding to the virtual storage space can be screened and determined accordingly. When creating a new virtual storage space, the number of storage spaces currently in an occupied state in the target virtual page table is first counted (i.e., the number of storage spaces occupied). The number of storage spaces occupied is used to reflect the number of storage spaces that have been allocated before the current moment, so as to determine the temporal position of the newly created virtual storage space in the page table, and then the storage space occupation number is used to convert the target space serial number. The target space serial number is used to locate the position of the newly created virtual storage space in the identifier sequence of the target virtual page table. For example, if there are already 10 occupied storage spaces in the current page table, the target space serial number of the newly created virtual storage space will be 11, that is, it is the 11th occupied storage space in the page table.

[0101] Optionally, in an embodiment of the present application, when a virtual storage space is released, its corresponding identifier can be marked as unoccupied, and its serial number position can be retained in the identifier sequence to facilitate subsequent identifier recycling and reallocation. When all space serial numbers in the identifier sequence are allocated, the space identifiers for the virtual storage space will be screened and allocated again based on the occupancy information of the identifier sequence.

[0102] In the above manner, the use of the target space serial number provides a clear timing reference for the allocation of space identifiers, so that the system can quickly locate unoccupied identifiers in the identifier sequence when allocating space identifiers, thereby improving the efficiency of space identifier allocation.

[0103] As an optional embodiment, marking the virtual storage space with the target space identifier includes:

[0104] Constructing a target binding relationship between the target space identifier and the virtual storage space;

[0105] The target binding relationship is stored in the running memory of the server.

[0106] Optionally, in an embodiment of the present application, after a virtual storage space is assigned a target space identifier, a binding relationship between the two needs to be created. By establishing a binding between the space identifier and the storage space, it can be ensured that when accessing the memory, the system can match the identifier carried in the pointer with the target space identifier corresponding to the virtual storage space, thereby preventing illegal access.

[0107] Optionally, in an embodiment of the present application, by directly storing the target binding relationship in the running memory of the server, each storage space only needs to reserve a small portion of its original space for storing the target binding relationship, thereby avoiding additional memory pressure and storage overhead.

[0108] In the above manner, by constructing and storing the binding relationship between the target space identifier and the virtual storage space, not only the security control of memory access is enhanced, but also the additional memory overhead is avoided and the efficiency of memory management is optimized.

[0109] As an optional embodiment, configuring pointer verification information for the initial pointer according to the space identifier and the page table identifier of the target virtual page table includes:

[0110] Convert the pointer verification information using the space identifier and the page table identifier;

[0111] The pointer verification information is added to a target character position in the initial pointer, wherein the target character position is a character position in the initial pointer that is not occupied after the access information is stored.

[0112] Optionally, in the embodiment of the present application, since the high bits of the initial pointer are usually not used in the address conversion process, they can be used to store additional metadata (such as tag information) without affecting the actual addressing capability of the pointer. Therefore, the multi-granularity identifier composed of the space identifier and the page table identifier can be embedded as pointer verification information in the unoccupied character bits in the initial pointer. For example, in the 39-bit virtual address space (initial pointer) configuration, except for one bit for sign extension in the upper 25 bits, the other 24 bits are not used in address conversion. Therefore, the tag memory architecture uses 8 of these 24 bits as object granularity tags (space identifiers) and 16 bits as page granularity tags (page table identifiers).

[0113] In the above manner, by configuring verification information in the pointer, the multi-granularity memory marking technology can provide security control at both the object granularity and the page granularity levels, thereby improving the security of access protection to the memory space.

[0114] As an optional embodiment, the converting the pointer verification information using the space identifier and the page table identifier includes:

[0115] The space identifier and the page table identifier are concatenated in sequence to obtain the pointer verification information.

[0116] Optionally, in the embodiments of the present application, Figure 4 is a schematic diagram of pointer encoding of a virtual space according to an embodiment of the present application, such as Figure 4As shown, except for one bit used for sign extension in the upper 25 bits of the initial pointer, the other 24 bits are not used in address conversion. Therefore, the first 8 bits of these 24 bits are used as the space identifier, and the last 16 bits are used as the page table identifier. The space identifier and the page table identifier are concatenated in order to obtain the pointer verification information.

[0117] Through the above method, by reasonably designing the identifier splicing and pointer encoding rules, the security of memory access can be improved without affecting the actual addressing capability of the pointer.

[0118] As an optional embodiment, before configuring pointer verification information for the initial pointer according to the target space identifier and the target page table identifier of the target virtual page table, the method further includes:

[0119] Detecting a first page table identifier used by a virtual page table in an occupied state among virtual page tables included in the virtual memory;

[0120] Filtering out a second page table identifier from a page table identifier set, wherein the page table identifier set includes a plurality of page table identifiers configured for a virtual page table in the virtual memory, and the second page table identifier is a page table identifier in the page table identifier set except the first page table identifier;

[0121] The target page table identifier is filtered out for the target virtual page table from the second page table identifier.

[0122] Optionally, in an embodiment of the present application, before configuring pointer verification information for the initial pointer, it is necessary to first filter out the target page table identifier of the target virtual page table. First, it is necessary to detect the virtual page table currently allocated to the memory object in the virtual memory, and for each occupied virtual page table, obtain the page table identifier used by it (i.e., the first page table identifier), and then filter out all page table identifiers except the first page table identifier (i.e., the second page table identifier) ​​from the page table identifier set, and then assign the target page table identifier to the target virtual page table from the second page table identifier, thereby ensuring that the page table identifier assigned to each virtual page table is unique.

[0123] Optionally, in an embodiment of the present application, before configuring the page table identifier set, it is necessary to detect the number of unused character bits in the pointer. For example, in a 64-bit pointer, if the virtual address space occupies 48 bits, the remaining 16 bits can be used to store identification information, including space identifiers and page table identifiers. Since the space identifier is responsible for tracking and protecting specific objects in memory, its validity and quantity are crucial to memory security. Therefore, when determining the page table identifier set, the allocation of the space identifier will be given priority. After the demand for the space identifier is guaranteed, the remaining unallocated character bits are used to configure the page table identifier. The size of the page table identifier can be flexibly adjusted according to the remaining number of bits, and when the space identifier demand changes, the number of page table identifiers can be dynamically configured based on historical data and current space identifier usage.

[0124] Through the above method, by reasonably allocating the remaining character bits, prioritizing the configuration of space identifiers, and then adjusting the size and number of page table identifiers according to actual conditions, the memory security protection capability can be significantly enhanced while ensuring system performance.

[0125] As an optional embodiment, after allocating the target pointer to the application, the method further includes:

[0126] receiving the target pointer issued by the application program for accessing the server memory;

[0127] Extracting the pointer verification information and the virtual address pointer carried in the target pointer, wherein the virtual address pointer is used to indicate the storage space currently to be accessed in the virtual memory;

[0128] Obtaining a candidate space identifier and a candidate page table identifier of a candidate storage space found in the virtual memory using the virtual address pointer;

[0129] Verify the candidate space identifier and the candidate page table identifier using the pointer verification information;

[0130] When the candidate space identifier and the candidate page table identifier are verified, access rights for accessing the candidate storage space are configured for the application.

[0131] Optionally, in an embodiment of the present application, after the system receives the target pointer issued by the application to access the server memory, it first parses the pointer and extracts the pointer verification information and virtual address pointer it carries, and then searches for the candidate storage space in the virtual memory according to the virtual address pointer, and simultaneously obtains the candidate space identifier and candidate page table identifier of the candidate storage space, and then matches the space identifier and page table identifier in the target pointer with the candidate space identifier and candidate page table identifier of the candidate storage space, respectively. When the candidate space identifier and the candidate page table identifier completely match the information in the target pointer, the system implements the configuration of access permissions by updating the access control list of the application, setting the memory permission bit, or calling the permission management interface of the operating system kernel.

[0132] Through the above method, when configuring the application program with the permission to access the server memory, the system can implement strict control over the memory access by extracting and verifying the identification information in the target pointer, thereby improving the security of access to the memory space.

[0133] As an optional embodiment, the using the pointer verification information to verify the candidate space identifier and the candidate page table identifier includes:

[0134] Using the pointer verification information to restore the target space identifier and the target page table identifier;

[0135] Matching the target space identifier with the candidate space identifier, and matching the target page table identifier with the candidate page table identifier;

[0136] When the target space identifier and the candidate space identifier match each other, it is determined that the candidate space identifier has been verified. When the target page table identifier and the candidate page table identifier match each other, it is determined that the candidate page table identifier has been verified.

[0137] Optionally, in an embodiment of the present application, since the space identifier and the page table identifier are usually encoded in the high bits of the pointer, it is necessary to restore the target space identifier and the target page table identifier in the target pointer through a specific decoding algorithm or a hardware-supported instruction set, and then match the target space identifier and the target page table identifier in the target pointer with the candidate space identifier and the candidate page table identifier of the candidate storage space, respectively. When the target space identifier and the candidate space identifier match consistently, and the target page table identifier and the candidate page table identifier match consistently, it indicates that the application's access request has undergone dual verification of space and time security, and its access behavior is legal and secure.

[0138] In the above manner, through identification matching and verification of the target pointer, the system can effectively prevent illegal access and exploitation of memory security vulnerabilities, thereby improving the security of access to server memory.

[0139] As an optional embodiment, the obtaining of the candidate space identifier and the candidate page table identifier of the candidate storage space found in the virtual memory using the virtual address pointer includes:

[0140] Searching the running memory of the server for the candidate space identifier having a binding relationship with the candidate storage space;

[0141] Search the target memory for a candidate page table entry corresponding to the candidate virtual page table to which the candidate storage space belongs, and search the candidate page table identifier corresponding to the candidate virtual page table from the candidate page table entry, wherein the target memory is used to store the page table entry corresponding to the virtual page table in the virtual memory.

[0142] Optionally, in an embodiment of the present application, each storage space has a corresponding space identifier and page table identifier, so the candidate space identifier having a binding relationship with the candidate storage space can be searched from the server's running memory, and the candidate page table entry corresponding to the candidate virtual page table to which the candidate storage space belongs can be searched from the target memory of the storage page table entry.

[0143] Through the above method, by accurately searching and matching the candidate space identifiers and the candidate page table identifiers, the system can effectively prevent illegal access at the time level and the space level, thereby improving the security of the server memory.

[0144] As an optional embodiment, the present application also provides a memory protection method of multi-granularity memory tagging under Linux, which uses a strategy combining object-granularity memory tagging and page-granularity memory tagging to respectively adopt memory detection and defense mechanisms for spatial security vulnerabilities and temporal security vulnerabilities, thereby improving the temporal and spatial security of memory objects and thus protecting the memory data of the operating system. This method mainly realizes the following features:

[0145] (1) Allocate tag bits in different virtual address spaces to achieve unique marking of memory objects.

[0146] (2) Memory access security is achieved by combining fine-grained object-granularity memory tags with coarse-grained page-granularity tags.

[0147] (3) Achieve spatial memory security through tag allocation and management.

[0148] (4) Achieve temporal memory safety through tag allocation and management.

[0149] This method mainly solves the following problems during implementation:

[0150] (1) This method solves the memory overhead problem by storing object-granularity tags in memory and page-granularity tags in page table entries.

[0151] (2) This method solves the problem of small tag size by embedding a multi-granularity tag consisting of an object-granularity tag and a page-granularity tag into the upper virtual address bits of a pointer.

[0152] (3) This method solves the problem of memory safety violations in adjacent or non-adjacent spaces within the same page by assigning a unique tag to each memory object.

[0153] (4) This method solves the problem of memory time security by allocating and retaining tags for each memory object.

[0154] Figure 3 This is a flowchart of a memory protection method for multi-granularity memory tagging under Linux according to an embodiment of the present application, such as Figure 3 As shown, the specific implementation steps are as follows:

[0155] (1) Configure the tag bit in the virtual address pointer

[0156] Depending on the size of the virtual address space, such as 39 bits or 48 bits, the top 25 bits or 16 bits of the virtual address are unused by default. Therefore, the method embeds a multi-granularity tag consisting of an object granularity tag and a page granularity tag into the upper virtual address bits of the pointer. In a 39-bit virtual address space configuration, except for one bit used for sign extension in the upper 25 bits, the other 24 bits are not used in address translation. Therefore, the tagged memory architecture designed by the method uses 8 bits of these 24 bits as object granularity tags and 16 bits as page granularity tags. Figure 4 is a schematic diagram of pointer encoding of a virtual space according to an embodiment of the present application, such as Figure 4 As shown, Figure 4 The pointer encoding method for a virtual space size of x is shown. By marking an 8-bit tag for each 16 bytes of memory stored in DRAM, 256 possible memory objects in a 4kB page can be uniquely marked, thereby preventing tag conflicts within the page. Each page is marked with a 16-bit tag, so the probability of tag conflicts between data objects on different pages is 2 -8 *2 -16 =2 -24 .

[0157] Since page-granularity tags are only stored in unused bits of the PTE, the introduced memory overhead is determined by an 8-bit tag for every 16 bytes, which is equivalent to an overhead of 6.25%. For a 48-bit configuration, the number of bits available in the PTE is reduced from 24 to 15. By using an 8-bit object-granularity tag, all 256 16-byte memory objects in a 4 kB page can still be uniquely tagged. Therefore, the tag size can be chosen based on security and memory overhead requirements. We can choose to use a 4-bit object-granularity tag, which can reduce the introduced memory overhead by half. In addition, the size of the page-granularity tag can also be adjusted as needed to reduce the number of bits required for the PTE. The operating system can set the size of both tags at boot time.

[0158] (2) Execute memory access through multi-granularity tag verification

[0159] During memory load and store operations, different hardware primitives use multi-granularity tags to perform access permission checks. Figure 5 It is a memory access check logic diagram according to an embodiment of the present application. As shown in FIG5 , the hardware compares the fine-grained part (related to a specific object) of the multi-granularity tag embedded in the pointer with the object-granularity tag stored in the memory at each memory access. In addition, the coarse-grained part (related to the memory page) of the multi-granularity tag is compared with the page-granularity tag embedded in the PTE. Access to a specific memory location is allowed only if both checks pass. The object-granularity tag is stored in the memory, while the page-granularity tag is stored in the page table entry (PTE), thereby avoiding additional memory pressure and storage overhead.

[0160] Figure 6 is a multi-granularity label implementation flow chart according to an embodiment of the present application, such as Figure 6 As shown in the figure, in order to implement multi-granularity tags, the existing CPU instruction set is extended to include object-granularity tag bits in pointers; a new system call is added to configure page-granularity tags in page table entries; specific instructions are created to implement reading and writing of tags. Ordinary memory operations cannot directly access the tag storage area. When reading and writing memory, the metadata of the tag is obtained through specific instructions to check whether the tag matches to prevent illegal memory access. When accessing the cache, data and tags are processed at the same time. In the case of a cache hit, the cache line holding the data and its corresponding tag will be marked as "dirty" to track subsequent data write changes. When the cache fails, the system needs to load the tag and data from the main memory and then write them to the cache.

[0161] In addition, to avoid the overflow of pointer arithmetic operations into the tag bits of the encoded pointer, which may lead to tag forgery attacks, tag-aware pointer arithmetic instructions need to be introduced.

[0162] (3) Achieving spatial memory security through tag allocation and management

[0163] In this tag allocation strategy, the present method assigns a unique object granularity tag to each memory object within a page, and achieves this by tracking the tag values ​​that have been assigned. To ensure this property, a tag granularity of 16 bytes and an object granularity tag of 8 bits can be selected as a tag size and granularity combination. With this parameter combination, all 256 16-byte memory objects on a 4KB page can be marked with different tags. This can prevent memory safety violations of adjacent or non-adjacent spaces within the same page, such as buffer overflows.

[0164] For page-granularity tags, this method assigns a pseudo-random tag to each page. To prevent memory safety violations in adjacent spaces across page boundaries, adjacent pages are assigned different page-granularity tags. For objects larger than a single page, the same page-granularity tag is used to tag all pages containing the object.

[0165] (4) Achieving spatial memory security through tag allocation and management

[0166] For temporal safety analysis, this approach distinguishes between uninitialized memory, double-free, and use-after-free (UAF) attacks. Since memory is zero-initialized on every allocation, uninitialized memory vulnerabilities are inherently prevented. The allocator checks the liveness of each object before freeing memory, using a special zero memory marker to prevent double free attacks. If an object with a zero marker is freed, the double free will be detected and handled accordingly.

[0167] This method prevents the misuse of dangling pointers due to use-after-free attacks through two independent techniques. First, the memory location is made inaccessible by marking it with a reserved zero object-granularity memory tag. Second, to prevent future allocations of the same object-granularity memory tag in that area, this tag value is excluded from that page until the page has a new page-granularity tag. This method also prevents double-free attacks by checking whether the tag of the corresponding memory location is valid before freeing it. If there is an unused tag within the page, memory reallocation is immediately possible. Otherwise, the page needs to be re-tagged. To do this, this method tracks isolated memory and waits until all objects in that page are freed. Once completed, the page is re-tagged with a different pseudo-random page-granularity tag to ensure that future memory allocations have different tags.

[0168] This method uses a strategy combining object-granular memory tagging and page-granular memory tagging to adopt memory detection and defense mechanisms for spatial security vulnerabilities and temporal security vulnerabilities, respectively. By allocating tag bits in different virtual address spaces, unique tagging of memory objects is achieved; the security of memory access is achieved by combining fine-grained object-granular memory tags with coarse-grained page-granular tags; spatial memory security is achieved through tag allocation and management; and temporal memory security is achieved through tag allocation and management. The temporal and spatial security of memory objects is improved, thereby protecting the memory data of the operating system.

[0169] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0170] In this embodiment, a memory space access protection device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0171] Figure 7 is a structural block diagram of a memory space access protection device according to an embodiment of the present application, such as Figure 7 As shown, the device comprises:

[0172] A creation module 72, configured to create a virtual storage space corresponding to a target memory space in a virtual memory of a server, wherein the virtual memory is used to record access information required to access the target memory space, and the target memory space is a memory space allocated to an application in a server memory;

[0173] A first configuration module 74 is used to configure a target space identifier for the virtual storage space in the target virtual page table according to the occupancy information of the storage space included in the target virtual page table, wherein the target virtual page table is a virtual page table where the virtual storage space is located, and the target space identifier is used to mark the position of the virtual storage space in the target virtual page table;

[0174] A second configuration module 76 is used to configure pointer verification information for the initial pointer according to the target space identifier and the target page table identifier of the target virtual page table to obtain a target pointer, wherein the initial pointer records access information for accessing the virtual storage space, and the pointer verification information is used to indicate the location of the virtual space indicated by the target pointer in the virtual memory;

[0175] The allocation module 78 is used to allocate the target pointer to the application.

[0176] Through the above device, by creating a virtual storage space corresponding to the target memory space in the virtual memory of the server, it is possible to configure a target space identifier for marking the position of the virtual storage space in the target virtual page table in the target virtual page table according to the occupancy information of the storage space included in the virtual page table (i.e., the target virtual page table) where the virtual storage space is located, and then configure the initial pointer with pointer verification information for indicating the position of the virtual space in the virtual memory indicated by the target pointer according to the target space identifier and the target page table identifier of the target virtual page table, obtain the target pointer, and finally assign the target pointer to the application. Through the above method, it is possible to realize double authentication of the access to the memory through the target space identifier and the target page table identifier of the target virtual page table, thereby avoiding erroneous access to the target memory. Therefore, the problem of low efficiency of access protection to the memory space in the related art can be solved, and the effect of improving the efficiency of access protection to the memory space can be achieved.

[0177] Optionally, the first configuration module includes:

[0178] a screening unit, configured to screen out the unoccupied target space identifier for the virtual storage space in the identifier sequence of the target virtual page table according to the occupancy information, wherein the identifier sequence includes a plurality of space identifiers configured for the target virtual page table, and the number of the plurality of space identifiers is equal to the number of storage spaces included in the target virtual page table;

[0179] The marking unit is used to mark the virtual storage space with the target space identifier.

[0180] Optionally, the screening unit is further used for:

[0181] Acquire a first space identifier of a reference storage space in an occupied state in the target virtual page table indicated by the occupation information;

[0182] Extracting a second space identifier other than the first space identifier included in the identifier sequence;

[0183] A target space identifier is allocated to the virtual storage space from the second space identifier.

[0184] Optionally, the screening unit is further used for:

[0185] Converting a target space sequence number of the virtual storage space using the storage space occupation quantity, wherein the storage space occupation quantity is used to indicate the quantity of storage spaces in an occupied state in the target virtual page table before the virtual storage space is created, the target space sequence number is used to identify the occupation timing of the virtual storage space and other storage spaces in an occupied state in the target virtual page table, and the occupation information includes the storage space occupation quantity;

[0186] The space identifier corresponding to the target space sequence number in the identifier sequence is determined as the target space identifier.

[0187] Optionally, the marking unit is further used for:

[0188] Constructing a target binding relationship between the target space identifier and the virtual storage space;

[0189] The target binding relationship is stored in the running memory of the server.

[0190] Optionally, the second configuration module includes:

[0191] A conversion unit, configured to convert the pointer verification information using the space identifier and the page table identifier;

[0192] An adding unit is used to add the pointer verification information to a target character position in the initial pointer, wherein the target character position is a character position in the initial pointer that is not occupied after the access information is stored.

[0193] Optionally, the conversion unit is further used for:

[0194] The space identifier and the page table identifier are concatenated in sequence to obtain the pointer verification information.

[0195] Optionally, the device further includes:

[0196] A detection module, used for detecting a first page table identifier used by a virtual page table in an occupied state in a virtual page table included in the virtual memory;

[0197] A first screening module is used to screen out a second page table identifier from a page table identifier set, wherein the page table identifier set includes a plurality of page table identifiers configured for a virtual page table in the virtual memory, and the second page table identifier is a page table identifier in the page table set other than the first page table identifier;

[0198] The second screening module is used to screen out the target page table identifier for the target virtual page table from the second page table identifier.

[0199] Optionally, the device further includes:

[0200] A receiving module, used for receiving the target pointer issued by the application program for accessing the server memory;

[0201] An extraction module, used to extract the pointer verification information and the virtual address pointer carried in the target pointer, wherein the virtual address pointer is used to indicate the storage space currently to be accessed in the virtual memory;

[0202] An acquisition module, used for acquiring a candidate space identifier and a candidate page table identifier of a candidate storage space found in the virtual memory using the virtual address pointer;

[0203] A verification module, used to verify the candidate space identifier and the candidate page table identifier using the pointer verification information;

[0204] The third configuration module is used to configure access rights for the application to access the candidate storage space when the candidate space identifier and the candidate page table identifier are verified.

[0205] Optionally, the verification module includes:

[0206] A restoration unit, used to restore the target space identifier and the target page table identifier using the pointer verification information;

[0207] A matching unit, used for matching the target space identifier with the candidate space identifier, and matching the target page table identifier with the candidate page table identifier;

[0208] A determination unit is used to determine that the candidate space identifier is verified if the target space identifier and the candidate space identifier match each other, and to determine that the candidate page table identifier is verified if the target page table identifier and the candidate page table identifier match each other.

[0209] Optionally, the acquisition module includes:

[0210] A first searching unit, configured to search the candidate space identifier having a binding relationship with the candidate storage space from the running memory of the server;

[0211] The second search unit is used to search the target memory for a candidate page table entry corresponding to the candidate virtual page table to which the candidate storage space belongs, and to search the candidate page table identifier corresponding to the candidate virtual page table from the candidate page table entry, wherein the target memory is used to store the page table entry corresponding to the virtual page table in the virtual memory.

[0212] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0213] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0214] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0215] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0216] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0217] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any one of the above method embodiments are implemented.

[0218] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0219] The embodiments of the present application also provide a computer program, which includes computer instructions, which are stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in any one of the above method embodiments.

[0220] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0221] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0222] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for protecting access to a memory space, characterized in that: include: Creating a virtual storage space corresponding to a target memory space in a virtual memory of a server, wherein the virtual memory is used to record access information required to access the target memory space, and the target memory space is a memory space allocated to an application in a server memory; According to the occupancy information of the storage space included in the target virtual page table, a target space identifier is configured for the virtual storage space in the target virtual page table, wherein the target virtual page table is a virtual page table where the virtual storage space is located, and the target space identifier is used to mark the position of the virtual storage space in the target virtual page table; According to the target space identifier and the target page table identifier of the target virtual page table, pointer verification information is configured for the initial pointer to obtain a target pointer, wherein the initial pointer records access information for accessing the virtual storage space, and the pointer verification information is used to indicate the location of the virtual space indicated by the target pointer to be accessed in the virtual memory; assigning the target pointer to the application; Among them, configuring pointer verification information for the initial pointer according to the space identifier and the page table identifier of the target virtual page table includes: using the space identifier and the page table identifier to convert the pointer verification information; adding the pointer verification information to the target character bit in the initial pointer, wherein the target character bit is a character bit that is not occupied after the access information is stored in the initial pointer.

2. The method according to claim 1, characterized in that The configuring a target space identifier for the virtual storage space in the target virtual page table according to the occupancy information of the storage space included in the target virtual page table includes: Filter out the target space identifier that is not occupied for the virtual storage space in the identifier sequence of the target virtual page table according to the occupancy information, wherein the identifier sequence includes a plurality of space identifiers configured for the target virtual page table, and the number of the plurality of space identifiers is equal to the number of storage spaces included in the target virtual page table; The virtual storage space is marked using the target space identifier.

3. The method according to claim 2, characterized in that The step of screening out the unoccupied target space identifier for the virtual storage space in the identifier sequence of the target virtual page table according to the occupancy information includes: Acquire a first space identifier of a reference storage space in an occupied state in the target virtual page table indicated by the occupation information; Extracting a second space identifier other than the first space identifier included in the identifier sequence; A target space identifier is allocated to the virtual storage space from the second space identifier.

4. The method according to claim 2, characterized in that: The step of screening out the unoccupied target space identifier for the virtual storage space in the identifier sequence of the target virtual page table according to the occupancy information includes: Converting a target space sequence number of the virtual storage space using the storage space occupation quantity, wherein the storage space occupation quantity is used to indicate the quantity of storage spaces in an occupied state in the target virtual page table before the virtual storage space is created, the target space sequence number is used to identify the occupation timing of the virtual storage space and other storage spaces in an occupied state in the target virtual page table, and the occupation information includes the storage space occupation quantity; The space identifier corresponding to the target space sequence number in the identifier sequence is determined as the target space identifier.

5. The method according to claim 2, characterized in that: The step of marking the virtual storage space with the target space identifier includes: Constructing a target binding relationship between the target space identifier and the virtual storage space; The target binding relationship is stored in the running memory of the server.

6. The method according to claim 1, characterized in that The converting the pointer verification information using the space identifier and the page table identifier includes: The space identifier and the page table identifier are concatenated in sequence to obtain the pointer verification information.

7. The method according to claim 1, characterized in that Before configuring pointer verification information for the initial pointer according to the target space identifier and the target page table identifier of the target virtual page table, the method further includes: Detecting a first page table identifier used by a virtual page table in an occupied state among virtual page tables included in the virtual memory; Filtering out a second page table identifier from a page table identifier set, wherein the page table identifier set includes a plurality of page table identifiers configured for a virtual page table in the virtual memory, and the second page table identifier is a page table identifier in the page table identifier set except the first page table identifier; The target page table identifier is filtered out for the target virtual page table from the second page table identifier.

8. The method according to claim 1, characterized in that After allocating the target pointer to the application, the method further comprises: receiving the target pointer issued by the application program for accessing the server memory; Extracting the pointer verification information and the virtual address pointer carried in the target pointer, wherein the virtual address pointer is used to indicate the storage space currently to be accessed in the virtual memory; Obtaining a candidate space identifier and a candidate page table identifier of a candidate storage space found in the virtual memory using the virtual address pointer; Verify the candidate space identifier and the candidate page table identifier using the pointer verification information; When the candidate space identifier and the candidate page table identifier are verified, access rights for accessing the candidate storage space are configured for the application.

9. The method according to claim 8, characterized in that The using the pointer verification information to verify the candidate space identifier and the candidate page table identifier includes: Using the pointer verification information to restore the target space identifier and the target page table identifier; Matching the target space identifier with the candidate space identifier, and matching the target page table identifier with the candidate page table identifier; When the target space identifier and the candidate space identifier match each other, it is determined that the candidate space identifier has been verified. When the target page table identifier and the candidate page table identifier match each other, it is determined that the candidate page table identifier has been verified.

10. The method according to claim 8, characterized in that The step of obtaining a candidate space identifier and a candidate page table identifier of a candidate storage space found in the virtual memory using the virtual address pointer includes: Searching the running memory of the server for the candidate space identifier having a binding relationship with the candidate storage space; Search the target memory for a candidate page table entry corresponding to the candidate virtual page table to which the candidate storage space belongs, and search the candidate page table identifier corresponding to the candidate virtual page table from the candidate page table entry, wherein the target memory is used to store the page table entry corresponding to the virtual page table in the virtual memory.

11. A memory space access protection device, characterized in that: include: A creation module, used to create a virtual storage space corresponding to a target memory space in a virtual memory of a server, wherein the virtual memory is used to record access information required to access the target memory space, and the target memory space is a memory space allocated to an application in a server memory; A first configuration module is used to configure a target space identifier for the virtual storage space in the target virtual page table according to the occupancy information of the storage space included in the target virtual page table, wherein the target virtual page table is a virtual page table where the virtual storage space is located, and the target space identifier is used to mark the position of the virtual storage space in the target virtual page table; A second configuration module is used to configure pointer verification information for the initial pointer according to the target space identifier and the target page table identifier of the target virtual page table to obtain a target pointer, wherein the initial pointer records access information for accessing the virtual storage space, and the pointer verification information is used to indicate the location of the virtual space indicated by the target pointer to be accessed in the virtual memory; An allocating module, used for allocating the target pointer to the application; Among them, the second configuration module includes: a conversion unit, used to use the space identifier and the page table identifier to convert the pointer verification information; an adding unit, used to add the pointer verification information to the target character bit in the initial pointer, wherein the target character bit is a character bit that is not occupied after the access information is stored in the initial pointer.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 10 when executed by a processor.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 10 are implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 10 are implemented.

Images