Virtual memory data management method and terminal

Abstract

The invention discloses a virtual memory data management method and a terminal, after a thread object generated by a user process is captured, if the thread object conforms to a preset thread rule, the thread object is sent to a client to be processed, otherwise, the thread object is sent to a corresponding virtual machine, and the virtual memory data is stored in the corresponding virtual machine. And creating virtual memory mapping data or virtual memory copy data in the virtual machine according to the memory data of the thread object. In this way, other threads cannot affect the data by creating the virtual memory data, the memory data of the local thread object is blurred to achieve the effect of data isolation, and the blurring protection efficiency can also be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data protection, and in particular to a virtual memory data management method and terminal. Background Art

[0002] At present, the security and monitoring of memory data is an important aspect to ensure the stable operation of the system and information security. With the continuous development of technology, a variety of technical means have been applied to achieve access control and monitoring of memory data, among which VT-X technology and process hook technology are two typical and widely used solutions. However, both technologies have certain limitations and shortcomings in practical applications, which has prompted the exploration of more efficient and stable solutions.

[0003] Specifically, VT-X (Virtualization Technology Extensions) technology is a hardware virtualization technology that allows an operating system or virtual machine manager (VMM) to create and manage multiple virtual environments at the hardware level. With the support of VT-X technology, the system can enter the virtualization technology mode, at which time the entire system is in a completely virtualized state. This technology greatly improves the performance and isolation of virtual machines, allowing multiple independent operating system instances to run simultaneously on the same physical hardware. However, VT-X technology also has significant disadvantages: when the system runs completely in VT mode, once data errors occur or the system encounters unforeseen anomalies such as blue screens, the entire virtualization environment will often crash, and this crash is often unrecoverable, thus affecting the stability and reliability of the system.

[0004] Process Hook technology is a technical means to intercept and modify specific operations by modifying the underlying function calls of the system or application. Process Hook technology is often used to establish a global HOOK to intercept access to specific memory areas. When a process attempts to access a memory area within the monitoring range, the Hook mechanism will trigger and execute preset operations, such as prohibiting access, logging, or performing other custom operations. Although this technology can effectively monitor and control memory data, its shortcomings are also obvious: the introduction of global HOOK may increase the complexity and instability of the system, and may also be used by malware to bypass security mechanisms, thereby threatening the overall security of the system.

[0005] In summary, the existing VT-X technology and process hook technology have certain limitations and shortcomings in memory data monitoring and control. In order to overcome these shortcomings and improve the stability and security of the system, it is necessary to explore and develop a more efficient and secure memory data protection solution. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a virtual memory data management method and terminal, which can improve the efficiency and security of memory data protection by means of local virtualization.

[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0008] A method for managing virtual memory data, comprising the steps of:

[0009] Capturing the thread object generated by the user process, and if the thread object conforms to the preset thread rule, sending the thread object to the client for processing;

[0010] If the thread object does not comply with the preset thread rules, the thread object is sent to the corresponding virtual machine, and virtual memory data is created in the virtual machine according to the memory data of the thread object, wherein the virtual memory data includes virtual memory mapping data for client processing and virtual memory copy data for virtual machine processing threads.

[0011] In order to solve the above technical problems, another technical solution adopted by the present invention is:

[0012] A virtual memory data management terminal comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step of the above-mentioned virtual memory data management method is implemented.

[0013] The beneficial effect of the present invention is that after capturing the thread object generated by the user process, if the thread object meets the preset thread rules, the thread object is sent to the client for processing, otherwise the thread object is sent to the corresponding virtual machine, and virtual memory mapping data or virtual memory copy data is created in the virtual machine according to the memory data of the thread object. In this way, by creating virtual memory data, other threads cannot affect the data, thereby improving the security of the virtual memory data, and only virtualizing the memory data of the local thread object has achieved the effect of data isolation, which can also improve the efficiency of virtualization protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A flowchart of a method for managing virtual memory data according to an embodiment of the present invention;

[0015] Figure 2 A schematic diagram of a virtual memory data management terminal according to an embodiment of the present invention;

[0016] Figure 3 A flowchart of creating virtualized memory data according to an embodiment of the present invention;

[0017] Figure 4 A flow chart of virtualized memory data management according to an embodiment of the present invention;

[0018] Figure 5 The present invention is a flowchart of creating virtual memory data according to memory data and performing address replacement.

[0019] Description of labels:

[0020] 1. A virtual memory data management terminal; 2. Memory; 3. Processor. DETAILED DESCRIPTION

[0021] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in conjunction with the implementation modes and the accompanying drawings.

[0022] Please refer to Figure 1 , an embodiment of the present invention provides a method for managing virtual memory data, comprising the steps of:

[0023] Capturing the thread object generated by the user process, and if the thread object conforms to the preset thread rule, sending the thread object to the client for processing;

[0024] If the thread object does not comply with the preset thread rules, the thread object is sent to the corresponding virtual machine, and virtual memory data is created in the virtual machine according to the memory data of the thread object, wherein the virtual memory data includes virtual memory mapping data for client processing and virtual memory copy data for virtual machine processing threads.

[0025] From the above description, it can be seen that the beneficial effect of the present invention is that after capturing the thread object generated by the user process, if the thread object meets the preset thread rules, the thread object is sent to the client for processing, otherwise the thread object is sent to the corresponding virtual machine, and virtual memory mapping data or virtual memory copy data is created in the virtual machine according to the memory data of the thread object. In this way, by creating virtual memory data, other threads cannot affect the data, and only the memory data of the local thread object is virtualized to achieve the effect of data isolation, which can also improve the efficiency of virtualization protection.

[0026] Further, sending the thread object to the corresponding virtual machine includes:

[0027] A memory control system is established for the user process, in which a storage page directory base address of the system part and a storage page directory base address of the user part are stored.

[0028] From the above description, it can be seen that by establishing a memory control system and distinguishing the storage page directory base addresses of the system part and the user part in the memory control system, it is convenient to perform targeted virtualization on data of different parts later.

[0029] Furthermore, creating virtual memory data in the virtual machine according to the memory data of the thread object includes:

[0030] In the virtual machine, obtaining a first storage page directory base address of memory data of the thread object in the memory control system, and searching for a corresponding first virtual address according to the storage page directory base address;

[0031] A new memory address is created, wherein the memory address includes a second storage page directory base address and a second virtual address, the memory data is copied to the new memory address, and the first storage page directory base address corresponding to the memory data in the memory control system is replaced with the second storage page directory base address.

[0032] From the above description, it can be seen that the page directory of the operation process is replaced with the newly created directory address when accessing data, so that the correct page directory is only used when accessing itself, which can effectively isolate and protect data.

[0033] Furthermore, creating virtual memory data in the virtual machine according to the memory data of the thread object also includes:

[0034] In the virtual machine, it is determined whether the memory data of the thread object is system data; if so, virtual memory mapping data is created according to the memory data; otherwise, virtual memory copy data is created according to the memory data.

[0035] From the above description, it can be seen that since the system data is a whole, the original data needs to be modified synchronously when the system data changes; and the user data is real data that is only exposed to itself and the system, so the memory content corresponding to the user data can be modified at will by copying. In this way, the security of memory data protection can be improved through local virtualization.

[0036] Furthermore, the thread object generated by the user process is captured, which includes:

[0037] Obtain the thread identifier of the thread object, determine whether the thread identifier is stored in the thread binary tree, and if so, determine that the thread object complies with the preset thread rules; otherwise, determine that the thread object does not comply with the preset thread rules.

[0038] From the above description, it can be seen that the method of thread judgment through thread ID can restrict the thread memory generated by the user process to a specific thread ID, that is, the memory under the specific thread ID is normal memory and can be processed by the client, while the memory outside the specific thread ID needs to be processed by the virtual machine.

[0039] Please refer to Figure 2 Another embodiment of the present invention provides a virtual memory data management terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the various steps of the above-mentioned virtual memory data management method when executing the computer program.

[0040] The virtual memory data management method and terminal of the present invention are suitable for improving the efficiency and security of memory data protection by means of local virtualization, and are described below through specific implementation methods:

[0041] Embodiment 1

[0042] Please refer to Figure 1 , a method for managing virtual memory data, comprising the steps of:

[0043] S1. Capture a thread object generated by a user process. If the thread object complies with a preset thread rule, send the thread object to a client for processing.

[0044] Among them, after capturing the thread object generated by the user process, the thread identifier of the thread object is obtained, and it is determined whether the thread identifier is stored in the thread binary tree. If so, it is determined that the thread object complies with the preset thread rules, otherwise, it is determined that the thread object does not comply with the preset thread rules.

[0045] For details, please refer to Figure 3 , create a thread event, and capture the thread object through the thread event. That is, when the user process generates a thread object, the thread event can capture the thread object and its thread identifier. After obtaining the thread identifier, traverse the thread binary tree to find out whether the thread identifier is stored in the thread binary tree. If so, send the thread object to the client, otherwise, send the thread object to the virtual machine.

[0046] In this embodiment, system threads and threads created by the virtual machine itself are set as a white list and stored in the form of a binary tree.

[0047] S2. If the thread object does not comply with preset thread rules, the thread object is sent to a corresponding virtual machine, and virtual memory data is created in the virtual machine according to the memory data of the thread object, wherein the virtual memory data includes virtual memory mapping data for client processing and virtual memory copy data for virtual machine processing threads.

[0048] S21. A memory control system is established for the user process, wherein the memory control system stores a storage page directory base address of the system part and a storage page directory base address of the user part.

[0049] Please refer to Figure 4 , it is necessary to rebuild the properties of the page directory base address, set the system part and the client to a mapping relationship, because the system is a whole, and the original data also needs to be synchronized when it changes; set the user part and the client to a copy relationship. Since the user part only exposes real data to itself and the system, it is necessary to adopt a copy method, so that the memory content can be modified at will.

[0050] S22: Send the thread object to a corresponding virtual machine, and create virtual memory data in the virtual machine according to the memory data of the thread object.

[0051] Among them, in the virtual machine, the first storage page directory base address of the memory data of the thread object in the memory control system is obtained, and the corresponding first virtual address is searched according to the storage page directory base address; a new memory address is created, and the memory address includes a second storage page directory base address and a second virtual address, the memory data is copied to the newly created memory address, and the first storage page directory base address corresponding to the memory data in the memory control system is replaced with the second storage page directory base address.

[0052] Furthermore, it is determined in the virtual machine whether the memory data of the thread object is system data; if so, virtual memory mapping data is created according to the memory data; otherwise, virtual memory copy data is created according to the memory data.

[0053] Specifically, in this embodiment, the user memory needs to be page-aligned when copied to the virtual machine memory. The memory is aligned in the corresponding way, that is, PAGE_SIZE=0x1000:

[0054] Furthermore, please refer to Figure 5 , parse the page table directory, convert the original client user virtual memory to the physical memory address, and find the client physical address in the page table directory and get the index, and then replace the converted physical address in the virtual machine address, that is, d[i] = pv, where pv is the virtual machine physical address and d represents the page directory.

[0055] For example: if the base address of CR3 is FFFFFA8004917000, the client virtual address is 0x1780000, and the physical address corresponding to the client is 0x157000, then read the address position of 0x157000 in FFFFFA8004917000, then create a new memory address, copy the original 0x1780000 size data to the new memory address 0x2100000 and the new physical address 0x124000. After the replacement, the original 0x157000 in FFFFFA8004917000 is replaced with 0x124000.

[0056] Furthermore, the virtual machine memory also needs to filter data through the intermediate data module. The intermediate data module can process data of different dimensions. In data processing, the intermediate data generated in each stage will be passed to the next stage, with spatial uniqueness, feature uniqueness, and data processing in multiple spatial dimensions. Intermediate data processing is in each hierarchical environment and is isolated and does not affect each other. The processing only affects the current space. The intermediate data module is used to create data spaces of multiple dimensions, making the virtual machine data changeable, and is used to regulate the memory data of the corresponding virtual machine.

[0057] Embodiment 2

[0058] Please refer to Figure 2 A virtual memory data management terminal 1 includes a memory 2, a processor 3, and a computer program stored in the memory 2 and executable on the processor 3. When the processor 3 executes the computer program, each step of a virtual memory data management method of embodiment 1 is implemented.

[0059] In summary, the present invention provides a method and terminal for managing virtual memory data. After capturing the thread object generated by the user process, if the thread object meets the preset thread rules, the thread object is sent to the client for processing, otherwise the thread object is sent to the corresponding virtual machine, and virtual memory mapping data or virtual memory copy data is created in the virtual machine according to the memory data of the thread object. For the copy data and mapping data, since the system data is a whole, the original data needs to be modified synchronously when the system data changes, that is, virtual memory mapping data needs to be created; and the user data is real data that is only exposed to itself and the system, so the memory content corresponding to the user data can be modified at will by copying, that is, virtual memory copy data needs to be created. In this way, the security of memory data protection can be improved by local virtualization.

[0060] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for managing virtual memory data, characterized in that: Includes steps: Capturing the thread object generated by the user process, and if the thread object conforms to the preset thread rule, sending the thread object to the client for processing; If the thread object does not comply with the preset thread rules, the thread object is sent to the corresponding virtual machine, and virtual memory data is created in the virtual machine according to the memory data of the thread object, wherein the virtual memory data includes virtual memory mapping data for client processing and virtual memory copy data for virtual machine processing threads.

2. A method for managing virtual memory data according to claim 1, characterized in that: Sending the thread object to the corresponding virtual machine includes: A memory control system is established for the user process, in which a storage page directory base address of the system part and a storage page directory base address of the user part are stored.

3. A method for managing virtual memory data according to claim 2, characterized in that: Creating virtual memory data in the virtual machine according to the memory data of the thread object includes: In the virtual machine, obtaining a first storage page directory base address of memory data of the thread object in the memory control system, and searching for a corresponding first virtual address according to the storage page directory base address; A new memory address is created, wherein the memory address includes a second storage page directory base address and a second virtual address, the memory data is copied to the new memory address, and the first storage page directory base address corresponding to the memory data in the memory control system is replaced with the second storage page directory base address.

4. A method for managing virtual memory data according to claim 2, characterized in that: Creating virtual memory data in the virtual machine according to the memory data of the thread object also includes: In the virtual machine, it is determined whether the memory data of the thread object is system data; if so, virtual memory mapping data is created according to the memory data; otherwise, virtual memory copy data is created according to the memory data.

5. A method for managing virtual memory data according to claim 1, characterized in that: Capture the thread object generated by the user process, followed by: Obtain the thread identifier of the thread object, determine whether the thread identifier is stored in the thread binary tree, and if so, determine that the thread object complies with the preset thread rules; otherwise, determine that the thread object does not comply with the preset thread rules.

6. A virtual memory data management terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the following steps are implemented: Capturing the thread object generated by the user process, and if the thread object conforms to the preset thread rule, sending the thread object to the client for processing; If the thread object does not comply with the preset thread rules, the thread object is sent to the corresponding virtual machine, and virtual memory data is created in the virtual machine according to the memory data of the thread object, wherein the virtual memory data includes virtual memory mapping data for client processing and virtual memory copy data for virtual machine processing threads.

7. A virtual memory data management terminal according to claim 6, characterized in that: Sending the thread object to the corresponding virtual machine includes: A memory control system is established for the user process, in which a storage page directory base address of the system part and a storage page directory base address of the user part are stored.

8. A virtual memory data management terminal according to claim 7, characterized in that: Creating virtual memory data in the virtual machine according to the memory data of the thread object includes: In the virtual machine, obtaining a first storage page directory base address of memory data of the thread object in the memory control system, and searching for a corresponding first virtual address according to the storage page directory base address; A new memory address is created, wherein the memory address includes a second storage page directory base address and a second virtual address, the memory data is copied to the new memory address, and the first storage page directory base address corresponding to the memory data in the memory control system is replaced with the second storage page directory base address.

9. A virtual memory data management terminal according to claim 7, characterized in that: Creating virtual memory data in the virtual machine according to the memory data of the thread object also includes: In the virtual machine, it is determined whether the memory data of the thread object is system data; if so, virtual memory mapping data is created according to the memory data; otherwise, virtual memory copy data is created according to the memory data.

10. A virtual memory data management terminal according to claim 6, characterized in that: Capture the thread object generated by the user process, followed by: Obtain the thread identifier of the thread object, determine whether the thread identifier is stored in the thread binary tree, and if so, determine that the thread object complies with the preset thread rules; otherwise, determine that the thread object does not comply with the preset thread rules.

Images