Label computer system, memory protection method and device and electronic equipment

Abstract

The invention provides a tag computer system, a memory protection method and device and electronic equipment, and relates to the technical field of computers. The label computer system comprises a security policy configuration register which provides a security policy execution mechanism for a label processing unit according to a preset label operation rule; a page table item of the memory management unit is provided with a first expansion area, and the first expansion area is used for storing a security policy bitmap associated with a virtual page managed by the page table item; the label processing unit is used for acquiring a security policy bitmap stored in a page table item corresponding to an access address from the memory management unit when receiving a memory access instruction from the processor core; and the data cache is used for executing the memory access instruction from the processor core based on the label operation rule from the label processing unit. According to the method, the memory can be efficiently and comprehensively protected, so that the memory vulnerability attack can be effectively prevented.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a tag computer system and a memory protection method, device and electronic equipment. Background Art

[0002] In modern software development, memory safety has always been a core issue, which is directly related to the reliability and security of the program. Violations of memory safety rules often provide opportunities for attackers. These violations are mainly divided into two categories: spatial and temporal. Spatial violations, such as pointers accessing memory areas outside of their intended objects, are a common cause of buffer overflow attacks; while temporal violations occur when objects are still accessed after their life cycle ends, which may lead to problems such as double free and use after free. Both violations may cause memory leaks or corruption, which in turn create attack opportunities for attackers.

[0003] In order to deal with these memory safety-related vulnerability attacks, the industry continues to propose new defense solutions. However, due to performance and compatibility considerations, the security strength of most defense mechanisms is limited. They are often only targeted at a specific vulnerability type or attack method, and require certain assumptions to be met in order to work effectively. Therefore, attackers can often exploit other types of vulnerabilities and attack methods to undermine the prerequisites for the defense mechanism to take effect, thereby successfully bypassing these defenses.

[0004] Therefore, how to protect memory efficiently and comprehensively to effectively prevent memory vulnerability attacks has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of the above problems existing in the prior art, the present invention provides a tag computer system and a memory protection method, device and electronic device to achieve efficient and comprehensive memory protection to effectively prevent memory vulnerability attacks.

[0006] The present invention provides a tag computer system, comprising: a security policy configuration register, a memory management unit, a tag processing unit and a data cache; the security policy configuration register provides a mechanism for the tag processing unit to execute a security policy according to a preset tag operation rule; wherein the security policy is a configuration set of tag operation rules for a memory or a register in order to achieve a preset memory protection target, the memory tag is security metadata attached to memory data, and the register tag is security metadata attached to register storage data; the page table entry of the memory management unit is provided with a first extension area, and the first extension area is used to store a security policy bitmap associated with a virtual page managed by the page table entry; wherein the security policy bitmap is used to indicate the security policy bitmap when storing data to or from the virtual page The security policy that needs to be executed when loading data, the security policy bitmap includes multiple bits, each bit corresponds to a security policy, when the bit is set to 1, it indicates that the security policy corresponding to the bit needs to be executed, when the bit is set to 0, it indicates that the security policy corresponding to the bit is not executed; a tag processing unit, used to obtain the security policy bitmap stored in the page table entry corresponding to the access address from the memory management unit when receiving a memory access instruction from the processor core; and obtain the tag operation rule for executing the at least one security policy to be executed from the security policy configuration register corresponding to the at least one security policy to be executed indicated by the security policy bitmap; the data cache, used to execute the memory access instruction from the processor core based on the tag operation rule from the tag processing unit.

[0007] A tag computer system provided according to the present invention also includes a cache line, a register stack, a data bus, and a tag data conversion module; the cache line includes a second extension area, the second extension area is used to store the memory tag of the data stored in the cache line; wherein the memory tag includes multiple bits; the register stack includes a third extension area, the third extension area is used to store the register tag of the data stored in the register stack; wherein the register tag includes multiple bits; the data bus includes a fourth extension area, the fourth extension area is used to transmit the memory tag or register tag of the data transmitted on the data bus; the tag data conversion module is used to write the data carrying the memory tag into the data storage area in the memory and write the memory tag carried by the data into the tag storage area in the memory when the cache writes the data carrying the memory tag into the memory; and read the data from the data storage area and read the memory tag carried by the data from the tag storage area when the cache reads the data carrying the memory tag from the memory.

[0008] According to a label computer system provided by the present invention, the security policy configuration register includes a label operation rule field, a label granularity field and a label mask field; wherein the label granularity field is used to set the granularity of the memory unit configured with the label; the label mask field is used to determine the bits used by the security policy corresponding to the security policy configuration register from the label assigned to the memory unit; the label operation rule field is used to determine the label operation rules used by the security policy; the label operation rules include at least one of a label verification rule and a label update rule.

[0009] A tag computer system provided according to the present invention also includes a register tag configuration register; the register tag configuration register includes multiple bits, each bit is used to set a tag propagation rule when using a general register for data processing; wherein the tag propagation rule includes: a first rule, a destination register used to store processed data does not carry a tag; a second rule, when any register storing a source operand carries a tag, the tag is copied to the destination register; a third rule, an XOR operation is performed on the tag carried by the general register storing the source operand, and the XOR operation result is used as the tag of the destination register.

[0010] The present invention provides a memory protection method, comprising the following steps.

[0011] A tag processing unit, in response to receiving an access instruction from a processor core, obtains from a memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried by the access instruction; wherein the access instruction is generated by the processor core according to an access request received from a target program; the tag processing unit determines at least one security policy to be executed according to the security policy bitmap; the tag processing unit obtains at least one tag operation rule for the access instruction according to a security policy configuration register associated with each security policy to be executed; the data cache obtains the at least one tag operation rule from the tag processing unit; and executes the access instruction in accordance with the at least one tag operation rule.

[0012] According to a memory protection method provided by the present invention, the access request is an access request for a stack return address, and the security policy to be executed is a security policy for protecting the stack return address; the access instruction is executed in accordance with the at least one tag operation rule, including: obtaining a memory tag of a memory area storing the stack return address; in response to the memory tag being a first value, refusing to execute the access instruction, and returning access exception information to the processor core; in response to the memory tag being a second value, executing the access instruction, and returning an access result to the processor core; wherein, after the stack return address is saved to the stack, the target program executes a first code segment to set the memory tag to the first value; before the stack return address is loaded from the stack, the target program executes a second code segment to set the memory tag to the second value; wherein, the first code segment is inserted by a compiler extension in an intermediate compiled representation of the target program at a position after the stack return address is saved to the stack; and the second code segment is inserted by a compiler extension in an intermediate compiled representation of the target program at a position before the stack return address is loaded from the stack.

[0013] According to a memory protection method provided by the present invention, the access request is a write request for sensitive data, and the security policy to be executed is a security policy for sensitive data protection; the access instruction is executed in accordance with the at least one tag operation rule, including: writing the sensitive data into the memory, and setting a memory tag of a third value for the memory area storing the sensitive data; wherein, after the sensitive data is written into the memory, the target program executes a third code segment, and performs the following operations: setting a memory tag of a fourth value for the memory area storing the sensitive data; wherein, the third code segment is inserted in the compiler intermediate representation language of the target program by the compiler extension at a position after the sensitive data is written into the memory; the method further includes: in response to a received read instruction for the sensitive data, the data According to the cache, a memory tag of the memory area storing the sensitive data and a pointer tag of the pointer variable for loading the sensitive data are compared; when the comparison result is that the memory tag and the pointer tag are inconsistent, it is determined that the sensitive data has been tampered with, and access exception information is returned to the processor core; when the comparison result is that the memory tag and the pointer tag are consistent, the read instruction is executed, and the read result is returned to the processor core; wherein, before issuing a read request for the sensitive data, the target program executes a fourth code segment, and performs the following operations: setting the pointer tag of the fourth value for the pointer variable for loading the sensitive data; wherein, the fourth code segment is inserted by the compiler extension in the compiler intermediate representation language of the target program at a position before the read request for the sensitive data is issued.

[0014] According to a memory protection method provided by the present invention, the method is used to implement anti-reuse protection for a heap block pointer, and the method includes: in response to receiving an operation instruction for a heap block pointer from a target program, a processor core executes the operation instruction and stores the execution result of the operation instruction in a destination register; the tag processing unit calculates and sets the tag of the destination register according to the tag propagation rule set in the register tag configuration register; wherein the tag propagation rule of the register tag configuration register is set to the second rule; wherein: in the target program, before returning the address of the memory block allocated for the heap block pointer, the heap allocator sets a register tag of a fifth value for the general register storing the address of the memory block; in response to receiving a memory release request for the memory block, the heap allocator stores the address of the memory block in an isolation area; when the address data stored in the isolation area reaches a preset number threshold, the heap allocator searches for a heap block pointer with a tag of the fifth value in the memory, obtains a dangling heap block pointer pointing to the address stored in the isolation area, sets the dangling heap block pointer to a null pointer, and releases the address stored in the isolation area.

[0015] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-mentioned memory protection methods when executing the computer program.

[0016] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the memory protection method described above is implemented.

[0017] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned memory protection methods.

[0018] The label computer system and memory protection method, device and electronic device provided by the present invention, the label processing unit, in response to receiving an access instruction from the processor core, obtains the security policy bitmap stored in the page table entry corresponding to the access address carried by the access instruction from the memory management unit; according to the security policy bitmap, at least one security policy to be executed is determined, thereby realizing flexible configuration and dynamic selection of security policies, and different memory areas can be configured with different security policies to adapt to different security requirements and defense goals. According to the security policy configuration register associated with each security policy to be executed, at least one label operation rule for the access instruction is obtained; the data cache obtains at least one label operation rule from the label processing unit; and according to at least one label operation rule, the access instruction is executed, thereby using the security policy configuration register to realize the concretization and executable nature of the security policy, so that the data cache can execute the security policy in a predetermined manner, and because the label operation rule is implemented at the hardware level, it can provide high-intensity memory security protection with less software overhead. Therefore, the memory can be protected efficiently and comprehensively to effectively prevent memory vulnerability attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 It is a structural schematic diagram of the label computer system provided by the present invention.

[0021] Figure 2 This is one of the flow charts of the memory protection method provided by the present invention.

[0022] Figure 3 This is the second flowchart of the memory protection method provided by the present invention.

[0023] Figure 4 This is the third flow chart of the memory protection method provided by the present invention.

[0024] Figure 5 This is the fourth flowchart of the memory protection method provided by the present invention.

[0025] Figure 6 It is a process schematic diagram of the memory protection method provided by the present invention.

[0026] Figure 7 It is a schematic diagram of the principle of the storage tag granularity control function provided by the present invention.

[0027] Figure 8 It is a work flow chart of the label computer system provided by the present invention.

[0028] Fig. 9 It is a schematic diagram of the security strategy defense effect provided by the present invention.

[0029] Fig.10 It is a schematic diagram of the memory access request processing process provided by the present invention.

[0030] Fig.11 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] Combine the following Figure 1 The memory protection method of the present invention is described.

[0033] like Figure 1 As shown, the tag computer system includes a security policy configuration register, a memory management unit, a tag processing unit and a data cache.

[0034] The security policy configuration register provides a mechanism for the tag processing unit to execute security policies according to preset tag operation rules.

[0035] The security policy is a set of configurations for the tag operation rules of memory or registers in order to achieve the preset memory protection goals. The memory tag is the security metadata attached to the memory data, and the register tag is the security metadata attached to the register storage data.

[0036] Memory protection targets include but are not limited to: protection of stack return addresses, protection of sensitive data, and protection against pointer reuse.

[0037] As an example only, the memory protection target is to protect the stack return address, and the corresponding security policy may be: when the memory tag of the memory area storing the stack return address is 1, the access request (data read request or data write request) for the stack return address is rejected; when the memory tag of the memory area storing the stack return address is 0, the access request for the stack return address is executed.

[0038] The security policy configuration register is a status register that supports the configuration of label granularity (the number of bits a label contains), that is, it supports the covariance of label granularity and label bit number: on the premise that the proportion of labels to memory remains unchanged, it can support fine-grained labels with low bits or coarse-grained labels with high bits.

[0039] In some embodiments, the security policy configuration register includes a tag operation rule field, a tag granularity field, and a tag mask field.

[0040] The label operation rule field is used to determine the label operation rule used by the security policy; wherein the label operation rule includes at least one of a label verification rule and a label update rule.

[0041] The tag granularity field is used to set the granularity of the memory unit configured with tags. A memory unit is a memory area configured with tags. Different granularities will result in different number of tag bits allocated to it.

[0042] Just as an example, Figure 7 As shown, the tag computer system configures a total of 16-bit tags for the 64-byte memory area, and uses the tag granularity field to set the granularity of the memory unit to 32 bytes, then an 8-bit tag is used to mark the 32-byte memory unit; and uses the tag granularity field to set the granularity of the memory unit to 4 bytes, then a 1-bit tag is used to mark the 4-byte memory unit.

[0043] The tag mask field is used to determine the bits used by the security policy corresponding to the security policy configuration register from the tag assigned to the memory unit.

[0044] By dividing the limited tag bits into fine-grained divisions, it is possible to support multiple security policy combinations. For example, in a 64-bit system, the pointer size is 8 bytes; the tag granularity field can be used to set the granularity of the memory unit configured with the tag to 8 bytes. When a total of 32 bits of tags are allocated to the 64-byte memory area, each 8-byte memory unit is marked with a 4-bit tag; the tag mask field is used to further set the bits used by different security policies from the 4-bit tag allocated to the memory unit: bit 0 is used for the security policy for stack return address protection; bit 1 is used for the security policy for sensitive data protection; bit 2 is used for the security policy for pointer reuse protection; bit 3 is reserved.

[0045] The tag operation rules include one or more combinations of verification operations and update operations for tags. The present invention extends the instruction set architecture (ISA) of the processor core to support tag operation instructions: including instructions for modifying and reading register tags, and instructions for modifying and reading memory tags.

[0046] As an example only, the tag operation rules implemented by the tag computer system are shown in Table 1 below: Table 1

[0047] Each security policy can be associated with a security policy configuration register. In the security policy configuration register, for the associated memory protection target, the tag operation rule (e.g., S_UNSET shown in Table 1), tag granularity (e.g., 1, using a 1-bit tag) and tag mask used (e.g., 00000010, used to select the tag bit to use) are configured.

[0048] The label computer system provided by the present invention can support multiple security policies at the same time.

[0049] As an example only, in a configuration where a 16-bit tag is added to every 64 bytes, the security policy configuration register can be used in the following manner to combine and implement a security policy for stack return address protection and a security policy for sensitive data protection.

[0050] The granularity used by the stack return address is 8 bytes. The configuration of the security policy configuration register associated with the security policy for stack return address protection is as follows: For access to the stack return address, it is necessary to check whether the memory tag of the corresponding memory area is 0; the tag mask is 0101010101010101, that is, use even-numbered tags 0, 2, 4, etc., recorded as mask_1.

[0051] The granularity used for sensitive data is also 8 bytes. The configuration of the security policy configuration register associated with the security policy for sensitive data protection is as follows: When writing data, set the corresponding memory label to 0, and check that the pointer label is consistent with the memory label when reading; the label mask is 1010101010101010, that is, use odd-numbered labels 1, 3, 5..., recorded as mask_2.

[0052] Assume that a memory read / write operation accesses the first 8 bytes in a 64-byte memory area; then the label mask corresponding to the address access is 0000000000000011, recorded as mask_access.

[0053] Assume that the tag of the pointer used for data access is tag_ptr. When the processor performs a read operation, it needs to check the mask to be (mask_1 | mask_2)&mask_access = 0000000000000011, and the check value is (mask_1&0 | mask_2&tag_ptr) = 0000000000000001&tag_ptr; the update mask is 0.

[0054] When the processor performs a write operation, the check mask is (mask_1 | mask_2&0)&mask_access = 0000000000000001, and the check value is (mask_1&0 | mask_2&0) = 0000000000000000; the update mask is (mask_1&0 | mask_2)&mask_access = 0000000000000010, and the update value is (mask_1&0 | mask_2) = 0.

[0055] In some embodiments, the tag computer system further includes a cache line, a register file, a data bus, and a tag data conversion module.

[0056] The cache line includes a second extension area, and the second extension area is used to store a memory tag of the data stored in the cache line. The memory tag includes a plurality of bits.

[0057] The register file includes a third extension area, and the third extension area is used to store register tags of data stored in the register file. The register tag includes multiple bits.

[0058] The data bus includes a fourth extension area, and the fourth extension area is used to transmit a memory tag or a register tag of data transmitted on the data bus.

[0059] By extending the data bus, the data bus can transmit data and tags at the same time.

[0060] The tag data conversion module is used to write the data into the data storage area in the memory and write the memory tag carried by the data into the tag storage area in the memory when the cache writes the data carrying the memory tag into the memory; and to read the data from the data storage area and read the memory tag carried by the data from the tag storage area when the cache reads the data carrying the memory tag from the memory.

[0061] Since the memory is difficult to expand, a part of the memory is dedicated to the storage of memory tags, and the added tag data conversion module is responsible for the conversion of unlabeled data and labeled memory data.

[0062] As an example only, based on the RISC-V system architecture, LLVM / Clang compiler and musl libc, the following specific implementation of storage expansion is provided. Other system architectures, compilers and C / C++ standard libraries can also be implemented in a similar way.

[0063] The data storage and data links have been expanded to include tag information. The expanded storage components include D-cache, register files, and pipeline registers. At the same time, the data channel connecting the CPU and D-cache has been expanded to add the ability to transmit tags that match the length of the cache line tag bits. In addition, TileLink (the on-chip bus protocol used by RISC-V) has been enhanced by introducing a new tag field to enable internal transmission of tags between the data cache, system bus, and memory bus.

[0064] In addition, in the RISC-V architecture, the TBI (Top Bit Ignore) function is implemented, which allows bits 55-48 in the pointer to be ignored when dereferencing the pointer (these bits are reserved for storing tag information). Ideally, the memory tag should be stored in 72-bit DDR together with the data, and such a design is usually used for ECC bits. However, considering that 64-bit DDR is still the mainstream product in the market, a separate memory space is allocated for memory tag storage.

[0065] The page table entry of the memory management unit is provided with a first extension area, which is used to store a security policy bitmap associated with the virtual page managed by the page table entry, and the security policy bitmap is used to indicate the security policy that needs to be executed when storing data in the virtual page or loading data from the virtual page.

[0066] The security policy bitmap includes multiple bits, each bit corresponds to a security policy. When the bit is set to 1, it means that the security policy corresponding to the bit needs to be executed. When the bit is set to 0, it means that the security policy corresponding to the bit is not executed.

[0067] In the specific implementation process, in order to ensure the accurate update of the security policy bitmap, it is necessary to modify the hardware page table traversal logic: when a Translation Lookaside Buffer (TLB) miss occurs, traverse the page table to obtain the last-level page table entry, read the security policy bitmap in it and put it into the TLB.

[0068] The security policy bitmap is used to indicate which security policies should be applied to the memory area managed by the virtual page. As an example, an 8-bit security policy bitmap '00000111' means that for the memory area corresponding to the bitmap, the security policies represented by the last three bits are enabled, namely stack return address protection, sensitive data isolation, and dangling pointer null.

[0069] In a specific implementation process, the kernel may call a standard library to set the security policy bitmap. For example, in a Linux platform, the mprotect / mmap library function may be used to set the security policy bitmap.

[0070] In the specific implementation process, the kernel is responsible for configuring the security policy for each process and each virtual page, maintaining the tag information related to the security policy, and handling the tag mismatch exception. For example, before each process starts, the kernel applies a set of default security policies (for example, disabling all security policies) to ensure compatibility. Subsequently, each thread can modify the security policy through system calls. When the kernel performs a context switch, the kernel needs to switch the configuration and register tags related to the security policy. If any memory access causes a tag mismatch exception, indicating a violation of the security policy, the kernel will handle the exception, for example by terminating the process.

[0071] Tag processing unit, such as Figure 8 As shown, it is used to obtain the security policy bitmap stored in the page table entry corresponding to the access address from the memory management unit when receiving the memory access instruction from the processor core; and obtain the label operation rules for executing at least one security policy to be executed from the security policy configuration register corresponding to at least one security policy to be executed indicated by the security policy bitmap.

[0072] A data cache is used to execute memory access instructions from the processor core based on tag operation rules from the tag processing unit.

[0073] In some embodiments, the tag computer system further includes a register tag configuration register.

[0074] The register tag configuration register includes multiple setting units, each setting unit is used to set the tag propagation rule of the corresponding tag bit in the general register when using the general register for data processing; wherein each setting unit includes at least one bit, and the tag propagation rules include: a first rule, the destination register used to store processed data does not carry a tag; a second rule, when any register storing a source operand carries a tag, the tag is copied to the destination register; a third rule, an XOR operation is performed on the tag carried by the general register storing the source operand, and the XOR operation result is used as the tag of the destination register.

[0075] As an example only, a 2-bit tag is configured for a general register, and the register tag configuration register includes two setting units, each of which includes 2 bits. Then, each setting unit can set up to 4 tag propagation rules for the corresponding tag bit of the general register. For example, the value of the register tag configuration register is 0001 (binary), which means that the first rule is set for the high-order tag bit of the general register, and the second rule is set for the low-order tag bit of the general register.

[0076] In the specific implementation process, different memory protection methods can be implemented by setting different label propagation rules for register label configuration registers. For detailed description, see Figure 5 The relevant content in will not be repeated here.

[0077] In the specific implementation process, a variety of software code reinforcement mechanisms can be designed based on the above-mentioned tag computer system. For example, for a certain memory protection target, based on the corresponding security policy implemented by the tag computer system hardware, software operations for tags are provided. These code reinforcement mechanisms can play a role in the protected software at the same time, provide defense in depth for memory security, and ensure the safe and stable operation of the software.

[0078] Combine the following Figure 2-Figure 9 The memory protection method of the present invention is described.

[0079] Figure 2 is one of the flow charts of the memory protection method provided by the present invention, such as Figure 2 As shown, the method includes the following: Step 201: In response to receiving an access instruction from a processor core, the tag processing unit obtains from the memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried in the access instruction.

[0080] The access instruction is generated by the processor core according to the access request received from the target program.

[0081] The target program is a program running on the label computer system provided by the present invention, and its memory usage needs to be protected.

[0082] Access requests may include data read requests and data write requests, etc.

[0083] For a detailed description of the security policy bitmap, see Figure 1 The relevant content in will not be repeated here.

[0084] Step 202: The label processing unit determines at least one security policy to be executed according to the security policy bitmap.

[0085] Step 203: The tag processing unit obtains at least one tag operation rule for the access instruction according to the security policy configuration register associated with each security policy to be executed.

[0086] Step 204: The data cache obtains at least one tag operation rule from the tag processing unit.

[0087] Step 205: The data cache executes the access instruction according to at least one tag operation rule.

[0088] In the specific implementation process, Fig.10 As shown, the data cache executes access instructions according to at least one tag operation rule, for example, verifies a certain type of tag, or performs an update operation on a certain type of tag, and executes an access request based on the result of the tag operation.

[0089] For an embodiment of executing an access instruction according to at least one tag operation rule, see Figure 3 , Figure 4 as well as Figure 5 The relevant content in will not be repeated here.

[0090] Figure 3 This is the second flowchart of the memory protection method provided by the present invention.

[0091] In this embodiment, the access request is an access request for the stack return address, and the security policy to be executed is a security policy for protecting the stack return address: verifying the memory tag of the stack return address, and if it is marked as a preset value (for example, 1), refusing to execute the access request.

[0092] like Figure 3 As shown, the method includes the following: Step 301: Obtain a memory tag of a memory area storing a stack return address.

[0093] In a specific implementation process, the data cache may utilize a memory tag read instruction to obtain a memory tag of a memory area storing a stack return address.

[0094] Step 302: In response to the memory tag being the first value, refusing to execute the access instruction, and returning access exception information to the processor core.

[0095] Step 303: In response to the memory tag being the second value, execute the access instruction and return the access result to the processor core.

[0096] The first value and the second value are two different values, and the specific values ​​may be determined according to the label granularity and rules used.

[0097] For example only, the first value is 1 and the second value is 0.

[0098] In order to cooperate with the above security policy executed by the processor, it is necessary that after the stack return address is saved to the stack, the target program calls the first code segment to set the memory tag to the first value; before the stack return address is loaded from the stack, the target program calls the second code segment to set the memory tag to the second value.

[0099] The first code segment includes a hardware executable instruction (eg, an assembly instruction) for calling a tag update instruction to set a memory tag of a memory area storing a stack return address to a first value.

[0100] The second code segment includes a hardware executable instruction (eg, an assembly instruction) for calling a tag update instruction to set a memory tag of a memory area storing a stack return address to a second value.

[0101] In a specific implementation process, the first code segment is inserted by a compiler extension (e.g., LLVM Pass) in an intermediate compiled representation of the target program (e.g., LLVM IR) at a position after the stack return address is saved to the stack; the second code segment is inserted by a compiler extension in the intermediate compiled representation of the target program at a position before the stack return address is loaded from the stack.

[0102] In this embodiment, specific instructions are inserted into the code through compiler extension, and the data cache executes the access request based on the tag operation result corresponding to the security policy, ensuring that the stack return address remains untampered during function execution, thereby effectively protecting the integrity of the backward control flow.

[0103] Figure 4 This is the third flow chart of the memory protection method provided by the present invention.

[0104] In this embodiment, the access request is a write request for sensitive data, and the security policy to be executed is a security policy for protecting sensitive data: when writing each word on the data segment, the memory tag 0 is also written; when reading, check whether the memory tag and the tag in the pointer are the same.

[0105] like Figure 4 As shown, the method includes the following: Step 401: write sensitive data into a memory, and set a memory tag of a third value for a memory area storing the sensitive data.

[0106] In order to cooperate with the above security policy executed by the processor, after the sensitive data is written into the memory, the target program calls the third code segment to perform the following operations: setting a memory tag of a fourth value for the memory area storing the sensitive data.

[0107] The third code segment includes a hardware executable instruction (eg, an assembly instruction) for calling a tag update instruction to set a memory tag of a fourth value for a memory area storing sensitive data.

[0108] In a specific implementation process, the third code segment is inserted by the compiler extension in the compiler intermediate representation language of the target program at a position after the sensitive data is written into the memory.

[0109] The third value and the fourth value are two different values, and the specific values ​​can be determined according to the label granularity and rules used.

[0110] For example only, the third value is 0 and the fourth value is 1.

[0111] Step 402: In response to a received read instruction for sensitive data, the data cache compares a memory tag of a memory area storing sensitive data and a pointer tag of a pointer variable for loading sensitive data.

[0112] Step 403: When the comparison result shows that the memory tag and the pointer tag are inconsistent, it is determined that the sensitive data has been tampered with, and access exception information is returned to the processor core.

[0113] Step 404: When the comparison result shows that the memory tag and the pointer tag are consistent, execute the read instruction and return the read result to the processor core.

[0114] In order to cooperate with the above security policy executed by the processor, before issuing a read request for sensitive data, the target program calls the fourth code segment to perform the following operations: setting a pointer tag of a fourth value for the pointer variable that loads the sensitive data.

[0115] The third code segment includes a segment of code for setting a pointer tag of a fourth value for a pointer variable loaded with sensitive data.

[0116] The fourth code segment is inserted by the compiler expansion in the compiler intermediate representation language of the target program at a position before the read request of the sensitive data is issued.

[0117] In this embodiment, specific instructions are inserted into the code through compiler extension, and the processor executes access requests based on security policies, thereby achieving isolation of sensitive data from non-sensitive data. This ensures that sensitive data will not be read without authorization, thereby avoiding the risk of leakage; and ensures that when sensitive data is tampered with, it can be discovered in time at the point of use, effectively preventing control flow hijacking.

[0118] Figure 5 This is the fourth flowchart of the memory protection method provided by the present invention.

[0119] In this embodiment, the access request is an operation request for a heap block pointer, and the security policy to be executed is a security policy for pointer reuse protection: when any register storing a source operand carries a tag, the tag is copied to the destination register.

[0120] like Figure 5 As shown, the method includes the following: Step 501: In response to receiving an operation instruction for a heap block pointer from a target program, the processor core executes the operation instruction and stores the execution result of the operation instruction in a destination register.

[0121] Step 502: The tag processing unit calculates and sets the tag of the destination register according to the tag propagation rule set in the register tag configuration register; wherein the tag propagation rule of the register tag configuration register is set to the second rule.

[0122] When the register tag configuration register is set to the second rule, it means that when any register storing the source operand carries a tag, the tag needs to be copied to the destination register. Therefore, in this embodiment, the tag processing unit sets the tag of the target register according to the second rule, so that the tag of the heap block pointer can be saved in any operation process.

[0123] In order to cooperate with the above security policy executed by the processor, in the target program, the heap allocator sets the register tag of the fifth value for the general register storing the address of the memory block before returning the address of the memory block allocated for the heap block pointer. Afterwards, due to the above security policy executed by the tag processing unit, the heap block pointer will carry the tag of the fifth value in any operation process, as well as in the process of storing from the register to the memory, or loading from the memory to the storage. Therefore, all heap block pointers in the memory can be found later according to the tag of the fifth value.

[0124] In response to receiving a memory release request for a memory block, the heap allocator stores the address of the memory block in an isolation area; when the address data stored in the isolation area reaches a preset quantity threshold, the heap allocator searches for a heap block pointer labeled with a fifth value in the memory, determines therefrom a dangling heap block pointer pointing to the address stored in the isolation area, sets the dangling heap block pointer to a null pointer, and releases the address stored in the isolation area.

[0125] In this embodiment, by modifying the processing logic of the heap allocator, when releasing a heap block, the heap block is first placed in the isolation zone. When the size of the isolation zone reaches a certain level, a full memory scan is performed to find the dangling heap block pointer and set it to NULL. The function of finding and setting the dangling pointer in the memory is realized, thereby effectively preventing the problem of use after free and ensuring the timing safety of the memory. After that, there is no dangling heap block pointer in the memory, and the heap block in the isolation zone can be released for reuse.

[0126] In the specific implementation process, when performing code reinforcement, it is necessary to select the reinforcement mechanism to be used for the memory protection target, and then choose to modify the compiler Pass and C standard library used when compiling the source code according to the reinforcement mechanism to be used. Furthermore, it is necessary to determine the memory range of each reinforcement mechanism and coordinate the use of label bits by these reinforcement mechanisms. If the memory ranges of the two strategies are different, the same label bit can be used; otherwise, different label bits need to be used. Furthermore, by setting the compilation options to enable the compilation extensions of different reinforcement mechanisms, the software source code and C standard library are compiled and linked to generate protected binary files. For example Figure 6 As shown, when the binary file runs on the tag architecture of the present invention, the hardware can automatically maintain and check the tag, thereby preventing memory attacks and ensuring the stable operation of the software, achieving the following Fig. 9 The protection effect shown. If the label check fails during runtime, it means that the security policy is violated and the program is likely to be attacked or there is a serious error. At this time, it is considered that the process execution is abnormal, and the hardware features of the target platform or the features provided by the operating system are used to block the process from continuing to execute (for example, sending a segment fault signal, SIGSEGV, to the process) to ensure that memory safety is not violated.

[0127] The memory protection device provided by the present invention is described below. The memory protection device described below and the memory protection method described above can be referenced to each other.

[0128] Fig.11 An example of a physical structure diagram of an electronic device is shown in FIG. Fig.11As shown, the electronic device may include: a processor 1110, a communication interface 1120, a memory 1130 and a communication bus 1140, wherein the processor 1110, the communication interface 1120 and the memory 1130 communicate with each other through the communication bus 1140. The processor 1110 may call the logic instructions in the memory 1130 to execute the memory protection method, which includes: a tag processing unit, in response to receiving an access instruction from a processor core, obtains from a memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried by the access instruction; wherein the access instruction is generated by the processor core according to an access request received from a target program; the tag processing unit determines at least one security policy to be executed according to the security policy bitmap; the tag processing unit obtains at least one tag operation rule for the access instruction according to a security policy configuration register associated with each security policy to be executed; the data cache obtains the at least one tag operation rule from the tag processing unit; and executes the access instruction according to the at least one tag operation rule.

[0129] In addition, the logic instructions in the above-mentioned memory 1130 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0130] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the memory protection method provided by the above-mentioned methods, and the method includes: a tag processing unit, in response to receiving an access instruction from a processor core, obtaining from a memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried by the access instruction; wherein the access instruction is generated by the processor core according to an access request received from a target program; the tag processing unit, determining at least one security policy to be executed according to the security policy bitmap; the tag processing unit, obtaining at least one tag operation rule for the access instruction according to a security policy configuration register associated with each security policy to be executed; the data cache obtaining the at least one tag operation rule from the tag processing unit; and executing the access instruction in accordance with the at least one tag operation rule.

[0131] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the memory protection method provided by the above-mentioned methods, the method comprising: a tag processing unit, in response to receiving an access instruction from a processor core, obtaining from a memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried by the access instruction; wherein the access instruction is generated by the processor core according to an access request received from a target program; the tag processing unit, determining at least one security policy to be executed according to the security policy bitmap; the tag processing unit, obtaining at least one tag operation rule for the access instruction according to a security policy configuration register associated with each security policy to be executed; the data cache obtaining the at least one tag operation rule from the tag processing unit; and executing the access instruction in accordance with the at least one tag operation rule.

[0132] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0133] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0134] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A label computer system, characterized in that: include: Security policy configuration registers, memory management unit, tag processing unit, and data cache; The security policy configuration register provides a mechanism for executing the security policy for the tag processing unit according to the preset tag operation rules; wherein the security policy is a configuration set of the tag operation rules of the memory or register in order to achieve the preset memory protection goal, the memory tag is the security metadata attached to the memory data, and the register tag is the security metadata attached to the register storage data; The page table entry of the memory management unit is provided with a first extension area, and the first extension area is used to store a security policy bitmap associated with the virtual page managed by the page table entry; wherein the security policy bitmap is used to indicate the security policy that needs to be executed when storing data to the virtual page or loading data from the virtual page, and the security policy bitmap includes a plurality of bits, each bit corresponding to a security policy, and when the bit is set to 1, it indicates that the security policy corresponding to the bit needs to be executed, and when the bit is set to 0, it indicates that the security policy corresponding to the bit is not executed; a tag processing unit, configured to obtain, from the memory management unit, a security policy bitmap stored in a page table entry corresponding to an access address when receiving a memory access instruction from the processor core; and Acquire a label operation rule for executing at least one security policy to be executed from a security policy configuration register corresponding to at least one security policy to be executed indicated by the security policy bitmap; The data cache is used to execute memory access instructions from the processor core based on the tag operation rules from the tag processing unit.

2. The label computer system according to claim 1, characterized in that: It also includes cache lines, register files, data buses, and tag data conversion modules; The cache line includes a second extension area, and the second extension area is used to store a memory tag of the data stored in the cache line; wherein the memory tag includes a plurality of bits; The register file includes a third extension area, and the third extension area is used to store a register tag of data stored in the register file; wherein the register tag includes a plurality of bits; The data bus comprises a fourth extension area, the fourth extension area being used to transmit a memory tag or a register tag of data transmitted on the data bus; The tag data conversion module is used to write the data carrying the memory tag into the data storage area in the memory and write the memory tag carried by the data into the tag storage area in the memory when the cache writes the data carrying the memory tag into the memory; and When the cache reads data carrying a memory tag from the memory, the data is read from the data storage area, and the memory tag carried by the data is read from the tag storage area.

3. The label computer system according to claim 2, characterized in that: The security policy configuration register includes a label operation rule field, a label granularity field and a label mask field; wherein the label granularity field is used to set the granularity of the memory unit configured with the label; the label mask field is used to determine the bits used by the security policy corresponding to the security policy configuration register from the label assigned to the memory unit; the label operation rule field is used to determine the label operation rules used by the security policy; the label operation rules include at least one of a label verification rule and a label update rule.

4. The label computer system according to claim 3, characterized in that: Also included are register tag configuration registers; The register tag configuration register includes a plurality of setting units, each of which is used to set a tag propagation rule corresponding to a tag bit in the general register when the general register is used for data processing; wherein each setting unit includes at least one bit, and the tag propagation rule includes: The first rule is that the destination register used to store processed data does not carry a tag; The second rule is that if any register storing a source operand carries a tag, the tag is copied to the destination register; The third rule is to perform an XOR operation on the tag carried by the general register storing the source operand, and use the XOR operation result as the tag of the destination register.

5. A memory protection method, characterized in that: The method is applied to the label computer system according to any one of claims 1 to 4, and the method comprises: The tag processing unit, in response to receiving an access instruction from a processor core, obtains from a memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried by the access instruction; wherein the access instruction is generated by the processor core according to an access request received from a target program; The label processing unit determines at least one security policy to be executed according to the security policy bitmap; The tag processing unit acquires at least one tag operation rule for the access instruction according to the security policy configuration register associated with each of the security policies to be executed; The data cache obtains the at least one label operation rule from the label processing unit; and The access instruction is executed according to the at least one tag operation rule.

6. The memory protection method according to claim 5, characterized in that: The access request is an access request for a stack return address, and the security policy to be executed is a security policy for stack return address protection; The executing the access instruction according to the at least one tag operation rule includes: Obtaining a memory tag of a memory area storing the stack return address; In response to the memory tag being a first value, refusing to execute the access instruction, and returning access exception information to the processor core; In response to the memory tag being a second value, executing the access instruction and returning an access result to the processor core; wherein, after the stack return address is saved to the stack, the target program executes a first code segment to set the memory tag to the first value; Before the stack return address is loaded from the stack, the target program executes a second code segment to set the memory tag to the second value; The first code segment is inserted by a compiler extension in the intermediate compiled representation of the target program at a position after the stack return address is saved to the stack; the second code segment is inserted by a compiler extension in the intermediate compiled representation of the target program at a position before the stack return address is loaded from the stack.

7. The memory protection method according to claim 5, characterized in that: The access request is a write request for sensitive data, and the security policy to be executed is a security policy for protecting sensitive data; The executing the access instruction according to the at least one tag operation rule includes: Writing the sensitive data into a memory, and setting a memory tag with a third value for a memory area storing the sensitive data; After the sensitive data is written into the memory, the target program executes the third code segment to perform the following operations: setting a memory tag of a fourth value for the memory area storing the sensitive data; The third code segment is inserted by the compiler in the intermediate representation language of the target program at a position after the sensitive data is written into the memory by the compiler extension; The method further comprises: In response to a received read instruction for the sensitive data, the data cache compares a memory tag of a memory area storing the sensitive data and a pointer tag of a pointer variable for loading the sensitive data; When the comparison result shows that the memory tag and the pointer tag are inconsistent, it is determined that the sensitive data has been tampered with, and access exception information is returned to the processor core; When the comparison result shows that the memory tag and the pointer tag are consistent, executing the read instruction and returning the read result to the processor core; Before issuing a read request for the sensitive data, the target program executes a fourth code segment to perform the following operations: setting a pointer tag of the fourth value for a pointer variable for loading the sensitive data; The fourth code segment is inserted by the compiler extension in the compiler intermediate representation language of the target program at a position before the read request for the sensitive data is issued.

8. A memory protection method, characterized in that: The method is applied to the tag computer system as claimed in claim 4, and is used to implement anti-reuse protection for heap block pointers, and the method comprises: In response to receiving an operation instruction for a heap block pointer from a target program, the processor core executes the operation instruction and stores the execution result of the operation instruction in a destination register; The label processing unit calculates and sets the label of the destination register according to the label propagation rule set in the register label configuration register; wherein the label propagation rule of the register label configuration register is set to the second rule; in: In the target program, the heap allocator sets a register tag of a fifth value for a general register storing the address of the memory block before returning the address of the memory block allocated for the heap block pointer; The heap allocator stores the address of the memory block into the isolation area in response to receiving a memory release request for the memory block; When the address data stored in the isolation area reaches a preset number threshold, the heap allocator searches for a heap block pointer with a label of the fifth value in the memory, obtains a dangling heap block pointer pointing to the address stored in the isolation area, sets the dangling heap block pointer to a null pointer, and releases the address stored in the isolation area.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the memory protection method according to any one of claims 5 to 8 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the memory protection method according to any one of claims 5 to 8 is implemented.

Images