Power distribution network terminal data protection method and device based on memory access control and medium

Abstract

The invention discloses a power distribution network terminal data protection method and device based on memory access control and a medium, and the method comprises the steps: S01, dividing a memory for a page table of a stage 2, creating the page table, and starting the stage 2; s02, constructing a memory protection mechanism, mapping the middle physical address to an actual physical address according to the stage two-page table, and modifying a descriptor in the stage two-page table to realize memory protection; s03, dividing a memory in the memory space, storing the required key data in the memory, setting the access authority of the memory by using a memory protection mechanism, and checking the access to realize the protection of the key data; and S04, a memory is divided in the memory space, a memory protection mechanism is used for the memory to set the access permission of the memory, access is checked, and a peripheral protection function is realized. The method has the advantages of being simple in implementation method, low in cost, high in flexibility and expandability, safe, reliable and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of power distribution network terminal security control, and in particular to a power distribution network terminal data protection method, device and medium based on memory access control. Background Art

[0002] Distribution network terminals face security risks such as illegal eavesdropping, malicious tampering and replay attacks. Once they are attacked by malicious network, important information will be lost. In serious cases, it will affect the normal operation of the power system and may even cause the system to be paralyzed. There are a large number of underlying distribution terminal devices. In order to ensure the overall security of many distribution terminal devices and even the distribution automation system, it is necessary to study solutions to improve the confidentiality of distribution network terminal data and the security protection of hardware equipment.

[0003] For the protection of distribution network terminal data, the prior art usually adopts a post-event response type of terminal passive protection method, that is, after a security incident occurs, a series of protection actions are taken to prevent being attacked again. However, this type of post-event response type of terminal passive protection method can only provide protection after a security incident occurs, and cannot effectively protect the terminal's key data and hardware equipment before the security incident occurs. Therefore, it still cannot avoid the occurrence of security incidents and cannot meet the current needs of power safety protection. Summary of the invention

[0004] The technical problem to be solved by the present invention is: in response to the technical problems existing in the prior art, the present invention provides a distribution network terminal data protection method, device and medium based on memory access control, which is simple in implementation, low in cost, flexible and scalable, and safe and reliable. It can protect key data, key memory and peripheral access of distribution network terminals based on memory access control, and effectively reduce security risks.

[0005] In order to solve the above technical problems, the technical solution proposed by the present invention is:

[0006] A method for protecting data of a distribution network terminal based on memory access control, comprising the following steps:

[0007] Step S01. Divide memory and create a page table for the stage 2 page table, and enable the memory address translation stage 2, the memory address translation stage 2 is the stage of mapping the intermediate physical address to the actual physical address in the process of implementing memory access control using address translation, and the stage 2 page table is the page table for storing the memory address translation stage 2;

[0008] Step S02: construct a memory protection mechanism, wherein the memory protection mechanism maps the intermediate physical address to the actual physical address according to the stage 2 page table, and modifies the descriptor in the stage 2 page table to set the access rights of the corresponding protected memory, thereby realizing memory protection;

[0009] Step S03. A first key memory is allocated in the memory space for storing the required key data, the required key data is stored in the first key memory, the memory protection mechanism is used to set the access rights of the first key memory, and the access to the first key memory is checked to protect the key data;

[0010] Step S04. Allocate a second key memory in the memory space for storing peripheral registers, map the peripheral registers to the second key memory, use the memory protection mechanism to set the access rights of the second key memory, and check the access to the second key memory to implement the peripheral protection function.

[0011] Furthermore, the step S01 includes:

[0012] Step S101. Allocate a piece of memory for storing the stage 2 page table, and store the memory first address of the stage 2 page table in a designated register;

[0013] Step S102. The memory of the normal world and the secure world are respectively divided into corresponding stage 2 page tables, so as to map the intermediate physical address to the actual physical address in the memory address translation stage 2, and modify the corresponding bit of the designated register according to the format of the stage 2 page table;

[0014] Step S103: Set the last bit of the HCR_EL2 register to enable the memory address translation stage 2.

[0015] Furthermore, each page table entry in the stage 2 page table includes a mapping status and access rights, and the description attribute bits in each page table entry are used to describe the mapping attributes of the virtual page, and the description attribute bits include access rights, cache policy, and memory type.

[0016] Furthermore, in the step S02, mapping the intermediate physical address to the actual physical address according to the stage 2 page table includes:

[0017] Step S201. Page search: search for the corresponding page table entry according to the primary index of the virtual address;

[0018] Step S202. Attribute check: check the attribute bits of the page table entry in the stage 2 page table to verify access rights;

[0019] Step S203. Address conversion: Calculate the corresponding physical address according to the physical page address and offset recorded in the page table entry in the stage 2 page table.

[0020] Further, in step S03, checking access to the first critical memory includes:

[0021] Step S301. Check whether the read, write and execute permissions specified by the attribute bits of the page table entry descriptor are consistent with the current operation. If not, a permission exception is triggered and access is blocked;

[0022] Step S302: Check whether the current access mode matches the mode attribute of the page table. If not, a mode exception is triggered and access is blocked.

[0023] Step S303: After the access control check is completed, the page table exception handling function is modified to redirect the instructions of the EL2 privilege level to access the required key data, and the required key data is returned to the trusted application along with the page table exception handling function.

[0024] Further, in step S04, checking access to the second critical memory includes:

[0025] Step S401. Check whether the read, write and execute permissions specified by the attribute bits of the page table entry descriptor are consistent with the current operation. If not, a permission exception is triggered and access is blocked;

[0026] Step S402: Check whether the current access mode matches the mode attribute of the page table. If not, a mode exception is triggered and access is blocked.

[0027] Furthermore, step S04 also includes a step of accessing the peripheral device through a trusted means, including:

[0028] If an untrusted program accesses the second critical memory of the peripheral register, triggering a related exception of the processor to prevent the abnormal access;

[0029] If a trusted program accesses the second critical memory of a peripheral register, the page table exception handling function is modified to implement access to the peripheral register using the EL2 privilege level.

[0030] Furthermore, step S04 also includes encrypting and decrypting the data transmitted and written by the peripheral device.

[0031] A computer device comprises a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to execute the computer program to perform the above method.

[0032] A computer-readable storage medium storing a computer program, wherein the computer program implements the above method when executed by a processor.

[0033] Compared with the prior art, the advantages of the present invention are: the present invention combines the hardware conditions of the distribution network terminal, introduces the trusted execution environment technology, realizes the protection of key data of the distribution network terminal based on memory access control, and makes full use of the memory access permission control provided by the modern operating system to protect key memory, protect key data and ensure the security of peripheral access. There is no need to modify the hardware or system architecture, and it will not have an adverse effect on the normal operation of the operating system. It can not only ensure the security and credibility of the system, but also improve the flexibility and scalability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a schematic diagram of the implementation flow of the distribution network terminal data protection method based on memory access control in this embodiment.

[0035] Figure 2 It is a schematic diagram of the address translation implementation principle after the memory address translation stage 2 is started in this embodiment.

[0036] Figure 3 It is a schematic diagram of the principle of implementing memory protection in this embodiment.

[0037] Figure 4 is a schematic diagram of implementing data protection in this embodiment;

[0038] Figure 5 It is a schematic diagram of implementing peripheral protection in this embodiment. DETAILED DESCRIPTION

[0039] The present invention is further described below in conjunction with the accompanying drawings and specific preferred embodiments, but the protection scope of the present invention is not limited thereby.

[0040] Address translation is divided into two stages: memory address translation stage 1, which translates virtual addresses into intermediate physical addresses, and memory address translation stage 2, which maps intermediate physical addresses into final physical addresses. If the memory access control permissions of memory address translation stage 2 are higher than those of the operating system, this means that when the operating system is attacked or invaded, memory address translation stage 2 can still protect data security. Moreover, due to its independent access control mechanism, memory address translation stage 2 can provide an additional layer of protection for key memory, key data and peripherals of distribution network terminals.

[0041] The present invention combines the hardware conditions of the distribution network terminal, introduces the trusted execution environment technology, and implements the protection of key data of the distribution network terminal based on memory access control. It fully utilizes the memory access permission control provided by the modern operating system to protect key memory, protect key data, and ensure the security of peripheral access. There is no need to modify the hardware or system architecture, and there will be no adverse effect on the normal operation of the operating system. It can not only ensure the security and credibility of the system, but also improve the flexibility and scalability of the system.

[0042] like Figure 1 As shown, the detailed steps of the distribution network terminal data protection method based on memory access control in this embodiment include:

[0043] Step S01. Enable memory address translation stage 2: divide memory and create page tables for stage 2 page tables, and enable memory address translation stage 2. Memory address translation stage 2 is the stage of mapping intermediate physical addresses to actual physical addresses in the process of using address translation to implement memory access control. Stage 2 page tables are page tables for storing memory address translation stage 2.

[0044] Before enabling memory address translation stage 2, you need to allocate a piece of memory to store the stage 2 page table to ensure that the stage 2 page table is automatically loaded after the system starts. After the page table is created, enable memory address translation stage 2.

[0045] As an optional implementation, enabling the memory address translation stage 2 may be performed by:

[0046] Step S101. Allocate a piece of memory in the device tree for storing the stage 2 page table, and store the memory first address of the stage 2 page table in a designated register (eg, VTTBR_EL2 register);

[0047] Step S102. Divide the memory of the normal world and the secure world into corresponding stage 2 page tables so that the memory address translation stage 2 can map the intermediate physical address to the actual physical address, and modify the corresponding bits of the specified register (such as the VTCR_EL2 register) according to the format of the stage 2 page table.

[0048] Step S103: Set the last bit of the HCR_EL2 register to enable memory address translation stage 2.

[0049] The last bit in the HCR_EL2 register (ie, HCR_EL2.VM) is used to control whether to enable the translation of memory address translation stage 2. When this bit is set, two-stage address translation is allowed in a virtualized environment.

[0050] In a specific application embodiment, first, memory is divided for the stage 2 page table, a piece of memory is allocated in the device tree to store the stage 2 page table, and the memory head address of the stage 2 page table is stored in the VTTBR_EL2 register. Then, a page table is created for stage 2, and the memory of the normal world and the secure world are divided into corresponding stage 2 page tables, so that stage 2 can map the intermediate physical address IPA to the actual physical address PA, and modify the corresponding bit of the VTCR_EL2 register according to the format of the stage 2 page table, and finally the last bit of the HCR_EL2 register is set to enable the memory address translation stage 2.

[0051] After the memory address translation phase 2 is enabled, the address translation process in the system is as follows: Figure 2 As shown, the stage 1 memory management unit translates the virtual address into an intermediate physical address and provides it to the stage 2 memory management unit, which then maps the intermediate physical address to the actual physical address based on the virtual address. The four exception levels EL0 to EL3 are EL0-user mode / APP, EL1-kernel, EL2-hypervisor and EL3-secure monitor, respectively. Each level has different privileges, functions and access rights.

[0052] Step S02: construct a memory protection mechanism, which maps the intermediate physical address to the actual physical address according to the stage 2 page table, and modifies the descriptor in the stage 2 page table to set the access rights of the corresponding protected memory, thereby realizing memory protection.

[0053] This embodiment maps the intermediate physical address IPA to the actual physical address PA according to the stage 2 page table, modifies the stage 2 page table to implement read and write permission control of the protected memory, ensures that untrusted programs cannot access the protected memory, and implements the memory protection function by utilizing the page table descriptor content in the stage 2 page table.

[0054] In this embodiment, the stage 2 page table is composed of multiple page table entries, each of which describes the mapping relationship between the virtual page and the physical page, and each of which includes mapping status, access rights, and other related information. The description attribute bits in each page table entry are used to describe the mapping attributes of the virtual page, and the description attribute bits include access rights, cache strategies, and memory types. These attribute bits are used to control the read, write, and execute permissions of the page and the optimization strategy for memory access. Each bit in the page table descriptor content of the stage 2 page table corresponds to different control content. By modifying the page table descriptor content of stage 2, the access rights of the physical address mapped to the virtual address can be modified, thereby achieving memory protection.

[0055] As an optional implementation, the following steps may be used to map the intermediate physical address to the actual physical address according to the stage 2 page table:

[0056] Step S201. Page search: search for the corresponding page table entry according to the primary index of the virtual address.

[0057] Specifically, the first-level page table can be searched according to the first-level index to obtain the base address of the second-level page table. Then, the corresponding second-level page table entry is searched according to the second-level index, and so on until the last-level page table (for example, the last-level page table can be a third-level page table).

[0058] Step S202. Attribute check: Check the attribute bits of the page table entry in the stage 2 page table to verify access rights.

[0059] Specifically, the attribute bits of the page table entry are checked to verify the access rights and other restrictions, for example, checking read and write permissions and whether execution is allowed.

[0060] Step S203. Address conversion: Calculate the corresponding physical address according to the physical page address and offset recorded in the page table entry in the stage 2 page table.

[0061] Optionally, additional access permission checks may be performed before accessing the physical address to ensure compliance with access rules and security policies.

[0062] In the memory protection mechanism of this embodiment, stage 2 maps the intermediate physical address IPA to the actual physical address PA through the stage 2 page table. Modifying the stage 2 page table requires the read and write permissions of the protected memory, so that the EL0 application cannot access the protected memory (critical memory). Figure 3 As shown, even if the operating system has been maliciously hijacked by an attacker and becomes untrustworthy, the mapping relationship of the stage 2 page table will not be tampered with, and untrustworthy programs will still not be able to access the protected memory, thereby effectively achieving security protection of memory data.

[0063] Step S03. Allocate a first key memory in the memory space to store the required key data, store the required key data in the first key memory, use the memory protection mechanism to set the access rights of the first key memory, and check the access to the first key memory to protect the key data.

[0064] This embodiment divides a block of memory (the first key memory) in the memory space for storing key data, and then uses the memory protection mechanism of step S02 to isolate the memory storing the key data and protect the key memory. In combination with the key memory access control check, permission and mode attribute checks are performed during the address translation process. The key data is accessed through trusted means, and the page table exception handling function is modified to redirect EL2 permission level instructions to access the key data. This can effectively protect the key data and greatly improve the protection of key data at the distribution network terminal.

[0065] It is understandable that the key data may be various types of control data, configuration data, etc. that require attention, and may be selected and configured according to actual needs.

[0066] As an optional implementation, during the address translation process, checking access to the first critical memory to verify access control includes:

[0067] Step S301. Page table entry descriptor check: Check whether the read, write and execute permissions specified by the attribute bits of the page table entry descriptor are consistent with the current operation. If not, a permission exception is triggered and access is blocked;

[0068] Step S302. Access mode check: check whether the current access mode matches the mode attribute of the page table. If not, a mode exception is triggered and access is blocked;

[0069] Step S303. Access key data by trusted means: After the access control check is completed, modify the page table exception handling function to redirect the EL2 permission level instructions to access key data, and return the key data to the trusted application along with the page table exception handling function.

[0070] Through the above steps, when the current operation does not conform to the read, write, and execute permissions specified by the attribute bits of the page table entry descriptor, a permission exception can be triggered in time and access can be blocked. At the same time, when the current access mode does not conform to the mode attribute of the page table, a mode exception can be triggered in time and access can be blocked, such as Figure 4 As shown, critical data can also be accessed through trusted means. If an untrusted program accesses critical data, the relevant exceptions of the processor will be triggered in time to prevent extraordinary access, making full use of memory access control to implement critical data protection functions.

[0071] Step S04: allocate a second key memory in the memory space for storing peripheral registers, map the peripheral registers to the second key memory, and check access to the second key memory to implement peripheral protection function.

[0072] In this embodiment, a block of memory (second key memory) is divided in the memory space to store peripheral registers, and the peripheral registers are mapped to the key memory by memory mapping, so that the peripheral registers need to be accessed through the stage 2 mechanism, and the memory protection mechanism in step S02 is used to set the access rights of the key memory where the peripheral registers are located to ensure the security of the peripherals. During the access to the peripheral registers, checks are performed to verify the access control, and the peripherals are accessed through trusted means. For non-trusted programs accessing the key memory of the peripheral registers, the relevant exceptions of the processor are triggered to prevent abnormal access, such as Figure 5 As shown, the peripheral protection function can be effectively realized.

[0073] As an optional implementation, checking access to the second critical memory includes:

[0074] Step S401. Check whether the read, write and execute permissions specified by the attribute bits of the page table entry descriptor are consistent with the current operation. If not, a permission exception is triggered and access is blocked;

[0075] Step S402: Check whether the current access mode matches the mode attribute of the page table. If not, a mode exception is triggered and access is blocked.

[0076] In this embodiment, the steps of accessing the peripheral device through a trusted means include:

[0077] If an untrusted program accesses critical memory of a peripheral register, a related exception of the processor is triggered to prevent abnormal access;

[0078] If a trusted program accesses the critical memory of a peripheral register, the page table exception handling function is modified to implement access to the peripheral register at the EL2 privilege level.

[0079] In this embodiment, the data transmitted and written by the peripheral device is also encrypted and decrypted. The encryption and decryption process is completed when accessing the key memory of the peripheral register to ensure that the data will not be stolen or tampered with during the transmission process, thereby further ensuring the security of the data.

[0080] The present invention combines the hardware conditions of the distribution network terminal, introduces the trusted execution environment technology, realizes the protection of the key data of the distribution network terminal based on memory access control, realizes the data protection of the distribution network terminal based on the memory access control mechanism, and realizes efficient data protection and peripheral protection through the memory address translation stage 2 without hardware modification. The memory address translation stage 2 provides memory access control permissions higher than the operating system permissions, so that data security can be protected even when the operating system is attacked, and can provide an additional protection layer for the key memory, key data and peripherals of the distribution network terminal, effectively improving the security and credibility of the system, without adversely affecting the normal operation of the operating system, providing flexibility and scalability for the system, and ensuring the security and credibility of the system.

[0081] This embodiment further provides a computer device, including a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to execute the computer program to perform the above method.

[0082] It is understandable that the above method of this embodiment can be executed by a single device, such as a computer or server, etc., and can also be applied to a distributed scenario and completed by multiple devices in cooperation with each other. In the case of a distributed scenario, one of the multiple devices can only execute one or more steps in the above method of this embodiment, and multiple devices interact to complete the above method. The processor can be implemented in the form of a general-purpose CPU, a microprocessor, an application-specific integrated circuit, or one or more integrated circuits, etc., for executing related programs to implement the above method of this embodiment. The memory can be implemented in the form of a read-only memory ROM, a random access memory RAM, a static storage device, and a dynamic storage device. The memory can store an operating system and other applications. When the above method of this embodiment is implemented by software or firmware, the relevant program code is stored in the memory and called and executed by the processor.

[0083] This embodiment further provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the above method is implemented.

[0084] Those skilled in the art will appreciate that the above-mentioned embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the functions in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0085] The above is only a preferred embodiment of the present invention, and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment, it is not intended to limit the present invention. Therefore, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A method for protecting data of a distribution network terminal based on memory access control, characterized in that the steps include: Step S01. Divide memory and create a page table for the stage 2 page table, and enable the memory address translation stage 2, the memory address translation stage 2 is the stage of mapping the intermediate physical address to the actual physical address in the process of implementing memory access control using address translation, and the stage 2 page table is the page table for storing the memory address translation stage 2; Step S02: construct a memory protection mechanism, wherein the memory protection mechanism maps the intermediate physical address to the actual physical address according to the stage 2 page table, and modifies the descriptor in the stage 2 page table to set the access rights of the corresponding protected memory, thereby realizing memory protection; Step S03. A first key memory is allocated in the memory space for storing the required key data, the required key data is stored in the first key memory, the memory protection mechanism is used to set the access rights of the first key memory, and the access to the first key memory is checked to protect the key data; Step S04. Allocate a second key memory in the memory space for storing peripheral registers, map the peripheral registers to the second key memory, use the memory protection mechanism to set the access rights of the second key memory, and check the access to the second key memory to implement the peripheral protection function.

2. The method for protecting data of a distribution network terminal based on memory access control according to claim 1, characterized in that: The step S01 comprises: Step S101. Allocate a piece of memory for storing the stage 2 page table, and store the memory first address of the stage 2 page table in a designated register; Step S102. The memory of the normal world and the secure world are respectively divided into corresponding stage 2 page tables, so as to map the intermediate physical address to the actual physical address in the memory address translation stage 2, and modify the corresponding bit of the designated register according to the format of the stage 2 page table; Step S103: Set the last bit of the HCR_EL2 register to enable the memory address translation stage 2.

3. The method for protecting data of a distribution network terminal based on memory access control according to claim 1, characterized in that: Each page table entry in the stage 2 page table includes a mapping status and access rights. The description attribute bits in each page table entry are used to describe the mapping attributes of the virtual page. The description attribute bits include access rights, cache policy, and memory type.

4. The method for protecting data of a distribution network terminal based on memory access control according to claim 1, characterized in that: In the step S02, mapping the intermediate physical address to the actual physical address according to the stage 2 page table includes: Step S201. Page search: search for the corresponding page table entry according to the primary index of the virtual address; Step S202. Attribute check: check the attribute bits of the page table entry in the stage 2 page table to verify access rights; Step S203. Address conversion: Calculate the corresponding physical address according to the physical page address and offset recorded in the page table entry in the stage 2 page table.

5. The method for protecting data of distribution network terminals based on memory access control according to claim 1, characterized in that: In step S03, checking access to the first critical memory includes: Step S301. Check whether the read, write and execute permissions specified by the attribute bits of the page table entry descriptor are consistent with the current operation. If not, a permission exception is triggered and access is blocked; Step S302: Check whether the current access mode matches the mode attribute of the page table. If not, a mode exception is triggered and access is blocked. Step S303: After the access control check is completed, the page table exception handling function is modified to redirect the instructions of the EL2 privilege level to access the required key data, and the required key data is returned to the trusted application along with the page table exception handling function.

6. The method for protecting data of a distribution network terminal based on memory access control according to any one of claims 1 to 5, characterized in that: In step S04, checking access to the second critical memory includes: Step S401. Check whether the read, write and execute permissions specified by the attribute bits of the page table entry descriptor are consistent with the current operation. If not, a permission exception is triggered and access is blocked; Step S402: Check whether the current access mode matches the mode attribute of the page table. If not, a mode exception is triggered and access is blocked.

7. The method for protecting data of a distribution network terminal based on memory access control according to any one of claims 1 to 5, characterized in that: Step S04 also includes a step of accessing the peripheral device through a trusted means, including: If an untrusted program accesses the second critical memory of the peripheral register, triggering a related exception of the processor to prevent the abnormal access; If a trusted program accesses the second critical memory of a peripheral register, the page table exception handling function is modified to implement access to the peripheral register using the EL2 privilege level.

8. The method for protecting data of a distribution network terminal based on memory access control according to any one of claims 1 to 5, characterized in that: Step S04 also includes encrypting and decrypting the data transmitted and written by the peripheral device.

9. A computer device comprising a processor and a memory, wherein the memory is used to store a computer program, wherein: The processor is configured to execute the computer program to perform the method according to any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images