Computer system and memory protection method, device and electronic device

Abstract

The present invention provides a tag computer system and a memory protection method, device, and electronic device, relating to the field of computer technology. The tag computer system includes: a security policy configuration register, which provides a mechanism for executing security policies for a tag processing unit based on preset tag operation rules; a page table entry of a memory management unit is provided with a first extension area, the first extension area being used to store a security policy bitmap associated with a virtual page managed by the page table entry; a tag processing unit, which is used to obtain, from the memory management unit, the security policy bitmap stored in the page table entry corresponding to the access address upon receiving a memory access instruction from a processor core; and a data cache, which is used to execute memory access instructions from the processor core based on the tag operation rules from the tag processing unit. The present invention can efficiently and comprehensively protect memory to effectively prevent memory vulnerability attacks.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a tag computer system and a memory protection method, device and electronic equipment. Background Art

[0002] Memory safety remains a core issue in modern software development, directly impacting program reliability and security. Violations of memory safety rules often provide opportunities for attackers. These violations can be categorized as spatial and temporal. Spatial violations, such as pointers accessing memory areas outside of their intended objects, are a common cause of buffer overflow attacks. Temporal violations, on the other hand, occur when objects are accessed after their lifecycles have expired, potentially leading to double-free and use-after-free issues. Both violations can lead to memory leaks or corruption, creating opportunities for attackers.

[0003] To combat these memory safety-related vulnerability attacks, the industry continues to propose new defenses. However, due to performance and compatibility considerations, the security strength of most defenses is limited. They often target only specific vulnerability types or attack methods and require certain assumptions to be met in order to be effective. Consequently, attackers can often exploit other vulnerabilities and attack methods to undermine the defense mechanisms' prerequisites, effectively bypassing them.

[0004] Therefore, how to protect memory efficiently and comprehensively to effectively prevent memory vulnerability attacks has become a technical problem that needs to be solved urgently. Summary of the Invention

[0005] In response to the above-mentioned problems existing in the prior art, the present invention provides a tag computer system and a memory protection method, device and electronic device to achieve efficient and comprehensive memory protection to effectively prevent memory vulnerability attacks.

[0006] The present invention provides a tag computer system, comprising: a security policy configuration register, a memory management unit, a tag processing unit and a data cache; the security policy configuration register provides a mechanism for the tag processing unit to execute a security policy according to a preset tag operation rule; wherein the security policy is a configuration set of tag operation rules for a memory or a register in order to achieve a preset memory protection target, the memory tag is security metadata attached to memory data, and the register tag is security metadata attached to register stored data; the page table entry of the memory management unit is provided with a first extension area, the first extension area is used to store a security policy bitmap associated with a virtual page managed by the page table entry; wherein the security policy bitmap is used to indicate the security policy bitmap when storing data to or from the virtual page When loading data, the security policy needs to be executed, and the security policy bitmap includes multiple bits, each bit corresponds to a security policy. When the bit is set to 1, it indicates that the security policy corresponding to the bit needs to be executed, and when the bit is set to 0, it indicates that the security policy corresponding to the bit is not executed; the tag processing unit is used to obtain the security policy bitmap stored in the page table entry corresponding to the access address from the memory management unit when receiving a memory access instruction from the processor core; and obtain the tag operation rule for executing the at least one security policy to be executed from the security policy configuration register corresponding to the at least one security policy to be executed indicated by the security policy bitmap; the data cache is used to execute the memory access instruction from the processor core based on the tag operation rule from the tag processing unit.

[0007] According to a tag computer system provided by the present invention, it also includes a cache line, a register file, a data bus, and a tag data conversion module; the cache line includes a second extension area, the second extension area is used to store the memory tag of the data stored in the cache line; wherein the memory tag includes multiple bits; the register file includes a third extension area, the third extension area is used to store the register tag of the data stored in the register file; wherein the register tag includes multiple bits; the data bus includes a fourth extension area, the fourth extension area is used to transmit the memory tag or register tag of the data transmitted on the data bus; the tag data conversion module is used to write the data carrying the memory tag into the data storage area in the memory when the cache writes the data carrying the memory tag into the memory, and write the memory tag carried by the data into the tag storage area in the memory; and when the cache reads the data carrying the memory tag from the memory, read the data from the data storage area and read the memory tag carried by the data from the tag storage area.

[0008] According to a tag computer system provided by the present invention, the security policy configuration register includes a tag operation rule field, a tag granularity field and a tag mask field; wherein the tag granularity field is used to set the granularity of the memory unit configured with the tag; the tag mask field is used to determine the bits used by the security policy corresponding to the security policy configuration register from the tag assigned to the memory unit; the tag operation rule field is used to determine the tag operation rules used by the security policy; the tag operation rules include at least one of a tag verification rule and a tag update rule.

[0009] A tag computer system provided according to the present invention also includes a register tag configuration register; the register tag configuration register includes multiple bits, each bit is used to set a tag propagation rule when using a general register for data processing; wherein, the tag propagation rule includes: a first rule, the destination register used to store processed data does not carry a tag; a second rule, when any register storing a source operand carries a tag, the tag is copied to the destination register; a third rule, an exclusive OR operation is performed on the tag carried by the general register storing the source operand, and the exclusive OR operation result is used as the tag of the destination register.

[0010] The present invention provides a memory protection method, which includes the following steps.

[0011] A tag processing unit, in response to receiving an access instruction from a processor core, obtains from a memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried by the access instruction; wherein the access instruction is generated by the processor core based on an access request received from a target program; the tag processing unit determines at least one security policy to be executed based on the security policy bitmap; the tag processing unit obtains at least one tag operation rule for the access instruction based on a security policy configuration register associated with each security policy to be executed; the data cache obtains the at least one tag operation rule from the tag processing unit; and executes the access instruction in accordance with the at least one tag operation rule.

[0012] According to a memory protection method provided by the present invention, the access request is an access request for a stack return address, and the security policy to be executed is a security policy for protecting the stack return address; executing the access instruction in accordance with the at least one tag operation rule includes: obtaining a memory tag of a memory area storing the stack return address; in response to the memory tag being a first value, refusing to execute the access instruction and returning access exception information to the processor core; in response to the memory tag being a second value, executing the access instruction and returning an access result to the processor core; wherein, after the stack return address is saved to the stack, the target program executes a first code segment and sets the memory tag to the first value; before the stack return address is loaded from the stack, the target program executes a second code segment and sets the memory tag to the second value; wherein, the first code segment is inserted by a compiler extension in an intermediate compiled representation of the target program at a position after the stack return address is saved to the stack; and the second code segment is inserted by a compiler extension in the intermediate compiled representation of the target program at a position before the stack return address is loaded from the stack.

[0013] According to a memory protection method provided by the present invention, the access request is a write request for sensitive data, and the security policy to be executed is a security policy for protecting sensitive data; the access instruction is executed in accordance with the at least one tag operation rule, including: writing the sensitive data into the memory, and setting a memory tag of a third value for the memory area storing the sensitive data; wherein, after the sensitive data is written into the memory, the target program executes a third code segment, and performs the following operations: setting a memory tag of a fourth value for the memory area storing the sensitive data; wherein, the third code segment is inserted by the compiler extension in the intermediate representation language of the compiler of the target program at a position after the sensitive data is written into the memory; the method further includes: in response to a received read instruction for the sensitive data, According to the cache, the memory tag of the memory area storing the sensitive data and the pointer tag of the pointer variable for loading the sensitive data are compared; when the comparison result is that the memory tag and the pointer tag are inconsistent, it is determined that the sensitive data has been tampered with, and access exception information is returned to the processor core; when the comparison result is that the memory tag and the pointer tag are consistent, the read instruction is executed, and the read result is returned to the processor core; wherein, before issuing a read request for the sensitive data, the target program executes a fourth code segment, and performs the following operation: setting the pointer tag of the fourth value for the pointer variable for loading the sensitive data; wherein, the fourth code segment is inserted by the compiler extension in the compiler intermediate representation language of the target program at a position before the read request for the sensitive data is issued.

[0014] According to a memory protection method provided by the present invention, the method is used to implement anti-reuse protection for heap block pointers, the method comprising: in response to receiving an operation instruction for a heap block pointer from a target program, the processor core executing the operation instruction and storing the execution result of the operation instruction in a destination register; the tag processing unit calculating and setting the tag of the destination register according to the tag propagation rule set in the register tag configuration register; wherein the tag propagation rule of the register tag configuration register is set to the second rule; wherein: in the target program, before returning the address of the memory block allocated for the heap block pointer, the heap allocator sets a register tag of a fifth value for the general register storing the address of the memory block; in response to receiving a memory release request for the memory block, the heap allocator stores the address of the memory block in an isolation area; when the address data stored in the isolation area reaches a preset number threshold, the heap allocator searches for a heap block pointer with the tag of the fifth value in the memory, obtains a dangling heap block pointer pointing to the address stored in the isolation area, sets the dangling heap block pointer to a null pointer, and releases the address stored in the isolation area.

[0015] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-described memory protection methods when executing the computer program.

[0016] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which implements any of the above-mentioned memory protection methods when executed by a processor.

[0017] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any one of the above-mentioned memory protection methods.

[0018] The present invention provides a tag computer system and memory protection method, device, and electronic device. The tag processing unit, in response to receiving an access instruction from a processor core, obtains a security policy bitmap stored in a page table entry corresponding to an access address carried by the access instruction from a memory management unit; based on the security policy bitmap, at least one security policy to be executed is determined, thereby achieving flexible configuration and dynamic selection of security policies. Different memory areas can be configured with different security policies to adapt to different security requirements and defense goals. Based on the security policy configuration register associated with each security policy to be executed, at least one tag operation rule for the access instruction is obtained; the data cache obtains at least one tag operation rule from the tag processing unit; and the access instruction is executed according to at least one tag operation rule, thereby utilizing the security policy configuration register to achieve the concretization and executable nature of the security policy, so that the data cache can execute the security policy in a predetermined manner. Moreover, since the tag operation rules are implemented at the hardware level, they can provide high-intensity memory security protection with less software overhead. Thus, the memory can be protected efficiently and comprehensively to effectively prevent memory vulnerability attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 It is a structural diagram of the label computer system provided by the present invention.

[0021] Figure 2 This is one of the flow charts of the memory protection method provided by the present invention.

[0022] Figure 3 This is the second flowchart of the memory protection method provided by the present invention.

[0023] Figure 4 This is the third flow chart of the memory protection method provided by the present invention.

[0024] Figure 5 This is the fourth flow chart of the memory protection method provided by the present invention.

[0025] Figure 6 It is a process diagram of the memory protection method provided by the present invention.

[0026] Figure 7 It is a schematic diagram of the principle of the tag storage granularity control function provided by the present invention.

[0027] Figure 8 This is a workflow diagram of the label computer system provided by the present invention.

[0028] Figure 9 It is a schematic diagram of the security policy defense effect provided by the present invention.

[0029] Figure 10 It is a schematic diagram of the memory access request processing process provided by the present invention.

[0030] Figure 11 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0031] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0032] The following combination Figure 1 The memory protection method of the present invention is described.

[0033] like Figure 1 As shown, the tag computer system includes a security policy configuration register, a memory management unit, a tag processing unit and a data cache.

[0034] The security policy configuration register provides a mechanism for the tag processing unit to execute security policies according to preset tag operation rules.

[0035] A security policy is a set of configurations for memory or register tag operation rules to achieve preset memory protection goals. Memory tags are security metadata attached to memory data, and register tags are security metadata attached to register stored data.

[0036] Memory protection targets include but are not limited to: stack return address protection, sensitive data protection, and pointer reuse protection.

[0037] As an example only, the memory protection target is to protect the stack return address. The corresponding security policy can be: when the memory tag of the memory area storing the stack return address is 1, the access request (data read request or data write request) for the stack return address is rejected; when the memory tag of the memory area storing the stack return address is 0, the access request for the stack return address is executed.

[0038] The security policy configuration register is a status register that supports configuration of label granularity (the number of bits in a label). This means that label granularity and the number of bits in a label can covariate: while maintaining the same memory usage ratio, it can support fine-grained labels with a low number of bits or coarse-grained labels with a high number of bits.

[0039] In some embodiments, the security policy configuration register includes a tag operation rule field, a tag granularity field, and a tag mask field.

[0040] The label operation rule field is used to determine the label operation rule used by the security policy; wherein the label operation rule includes at least one of a label verification rule and a label update rule.

[0041] The tag granularity field is used to set the granularity of the memory unit configured with tags. A memory unit is a tagged memory area. Different granularities result in different number of tag bits allocated to it.

[0042] Just as an example, Figure 7 As shown, the tag computer system configures a total of 16-bit tags for the 64-byte memory area. If the tag granularity field is used to set the granularity of the memory unit to 32 bytes, an 8-bit tag is used to mark the 32-byte memory unit; if the tag granularity field is used to set the granularity of the memory unit to 4 bytes, a 1-bit tag is used to mark the 4-byte memory unit.

[0043] The tag mask field is used to determine the bits used by the security policy corresponding to the security policy configuration register from the tag assigned to the memory unit.

[0044] By dividing the limited tag bits into fine-grained segments, support for multiple security policy combinations can be achieved. For example, in a 64-bit system, the pointer size is 8 bytes. The tag granularity field can be used to set the granularity of the tagged memory unit to 8 bytes. When a total of 32 bits of tags are allocated to the 64-byte memory area, each 8-byte memory unit is marked with a 4-bit tag. The tag mask field can be used to further set the bits used for different security policies from the 4-bit tag assigned to the memory unit: bit 0 is used for the security policy for stack return address protection; bit 1 is used for the security policy for sensitive data protection; bit 2 is used for the security policy for anti-pointer reuse protection; bit 3 is reserved.

[0045] Tag manipulation rules include one or more combinations of tag verification and update operations. The present invention extends the instruction set architecture (ISA) of the processor core to support tag manipulation instructions, including instructions for modifying and reading register tags, and instructions for modifying and reading memory tags.

[0046] As an example only, the tag operation rules implemented by the tag computer system are shown in Table 1 below:

[0047] Table 1

[0048]

[0049] Each security policy can be associated with a security policy configuration register. In the security policy configuration register, the tag operation rule (for example, S_UNSET shown in Table 1), tag granularity (for example, 1, using a 1-bit tag), and tag mask (for example, 00000010, used to select the tag bit to use) are configured for the associated memory protection target.

[0050] The label computer system provided by the present invention can support multiple security policies at the same time.

[0051] As an example, in a configuration where a 16-bit tag is added to every 64 bytes, the following method can be used to combine and implement a security policy for stack return address protection and a security policy for sensitive data protection using the security policy configuration register.

[0052] The granularity used by the stack return address is 8 bytes. The configuration of the security policy configuration register associated with the security policy for stack return address protection is as follows:

[0053] For access to the stack return address, it is necessary to check whether the memory tag of the corresponding memory area is 0; the tag mask is 0101010101010101, that is, using even-bit tags 0, 2, 4..., recorded as mask_1.

[0054] The granularity used for sensitive data is also 8 bytes. The configuration of the security policy configuration register associated with the security policy for sensitive data protection is as follows:

[0055] When writing data, set the corresponding memory tag to 0. When reading, check that the pointer tag is consistent with the memory tag. The tag mask is 1010101010101010, that is, use odd-numbered tags 1, 3, 5, etc., recorded as mask_2.

[0056] Assume that a memory read or write operation accesses the first 8 bytes of a 64-byte memory area; then the label mask corresponding to the address access is 0000000000000011, recorded as mask_access.

[0057] Assume that the tag of the pointer used for data access is tag_ptr. When the processor performs a read operation, it needs to check that the mask is (mask_1 | mask_2)&mask_access = 0000000000000011, and the check value is (mask_1&0 | mask_2&tag_ptr) = 0000000000000001&tag_ptr; the update mask is 0.

[0058] When the processor performs a write operation, the check mask is (mask_1|mask_2&0)&mask_access = 0000000000000001, and the check value is (mask_1&0 | mask_2&0) = 0000000000000000; the update mask is (mask_1&0|mask_2)&mask_access = 0000000000000010, and the update value is (mask_1&0|mask_2) = 0.

[0059] In some embodiments, the tag computer system further includes a cache line, a register file, a data bus, and a tag data conversion module.

[0060] The cache line includes a second extended area, and the second extended area is used to store a memory tag of the data stored in the cache line. The memory tag includes multiple bits.

[0061] The register file includes a third extended area, and the third extended area is used to store register tags of data stored in the register file. The register tag includes multiple bits.

[0062] The data bus includes a fourth extension area, and the fourth extension area is used to transmit a memory tag or a register tag of data transmitted on the data bus.

[0063] By extending the data bus, the data bus can transmit data and tags at the same time.

[0064] The tag data conversion module is used to write the data into the data storage area in the memory and write the memory tag carried by the data into the tag storage area in the memory when the cache writes data carrying the memory tag into the memory; and to read the data from the data storage area and read the memory tag carried by the data from the tag storage area when the cache reads data carrying the memory tag from the memory.

[0065] Since memory is difficult to expand, a portion of the memory is dedicated to storing memory tags, and an added tag data conversion module is used to convert unlabeled data into labeled memory data.

[0066] As an example only, the following specific implementation of storage expansion is provided based on the RISC-V system architecture, LLVM / Clang compiler, and musl libc. Other system architectures, compilers, and C / C++ standard libraries can also be implemented using similar methods.

[0067] The data storage and data links have been expanded to include tag information. The expanded storage components include the D-cache, register files, and pipeline registers. At the same time, the data channel connecting the CPU and the D-cache has been expanded to add the ability to transmit tags that match the length of the cache line tag bits. In addition, TileLink (the on-chip bus protocol used by RISC-V) has been enhanced by introducing a new tag field to enable internal transmission of tags between the data cache, system bus, and memory bus.

[0068] In addition, the RISC-V architecture implements a TBI (Top Bit Ignore) feature that allows bits 55-48 of a pointer (reserved for tag information) to be ignored when dereferencing it. Ideally, memory tags should be stored alongside the data in 72-bit DDR, a design typically used for ECC bits. However, given that 64-bit DDR is still the mainstream product in the market, a separate memory space is allocated for memory tag storage.

[0069] The page table entry of the memory management unit is provided with a first extension area, which is used to store a security policy bitmap associated with the virtual page managed by the page table entry. The security policy bitmap is used to indicate the security policy that needs to be executed when storing data in the virtual page or loading data from the virtual page.

[0070] The security policy bitmap includes multiple bits, each bit corresponds to a security policy. When the bit is set to 1, it indicates that the security policy corresponding to the bit needs to be executed. When the bit is set to 0, it indicates that the security policy corresponding to the bit is not executed.

[0071] During the specific implementation process, to ensure accurate updates of the security policy bitmap, it is necessary to modify the hardware page table traversal logic: when a Translation Lookaside Buffer (TLB) miss occurs, the page table is traversed to obtain the last-level page table entry, and the security policy bitmap therein is read and placed into the TLB.

[0072] The security policy bitmap indicates which security policies should be applied to memory regions managed by virtual pages. For example, an 8-bit security policy bitmap of '00000111' indicates that the security policies represented by the last three bits are enabled for the memory region corresponding to the bitmap: stack return address protection, sensitive data isolation, and dangling pointer nullification.

[0073] During specific implementation, the kernel may call a standard library to set the security policy bitmap. For example, in a Linux platform, the mprotect / mmap library function may be used to set the security policy bitmap.

[0074] In its implementation, the kernel is responsible for configuring security policies for each process and each virtual page, maintaining tag information related to the security policies, and handling tag mismatch exceptions. For example, before each process starts, the kernel applies a default set of security policies (e.g., disabling all security policies) to ensure compatibility. Subsequently, each thread can modify the security policies through system calls. During kernel context switches, the kernel switches the configuration and register tags related to the security policies. If any memory access results in a tag mismatch exception, indicating a security policy violation, the kernel handles the exception, for example, by terminating the process.

[0075] Tag processing unit, such as Figure 8 As shown, it is used to obtain the security policy bitmap stored in the page table entry corresponding to the access address from the memory management unit when receiving a memory access instruction from the processor core; and obtain the label operation rules for executing at least one security policy to be executed from the security policy configuration register corresponding to at least one security policy to be executed indicated by the security policy bitmap.

[0076] A data cache is used to execute memory access instructions from the processor core based on tag operation rules from the tag processing unit.

[0077] In some embodiments, the tag computer system further includes a register tag configuration register.

[0078] The register tag configuration register includes multiple setting units, each setting unit is used to set the tag propagation rule of the corresponding tag bit in the general register when using the general register for data processing; wherein, each setting unit includes at least one bit, and the tag propagation rules include: a first rule, the destination register used to store processed data does not carry a tag; a second rule, when any register storing the source operand carries a tag, the tag is copied to the destination register; a third rule, an exclusive OR operation is performed on the tag carried by the general register storing the source operand, and the exclusive OR operation result is used as the tag of the destination register.

[0079] As an example, consider configuring a 2-bit tag for a general-purpose register. The register tag configuration register includes two setting units, each containing two bits. Each setting unit can set up to four tag propagation rules for the corresponding tag bit of the general-purpose register. For example, if the value of the register tag configuration register is 0001 (binary), the first rule is set for the high-order tag bit of the general-purpose register, and the second rule is set for the low-order tag bit of the general-purpose register.

[0080] In the specific implementation process, different memory protection methods can be implemented by setting different label propagation rules for register label configuration registers. For detailed description, see Figure 5 The relevant content in will not be repeated here.

[0081] In specific implementations, various software code hardening mechanisms can be designed based on the aforementioned tagged computer systems. For example, for a specific memory protection target, software-specific tag operations can be provided based on the corresponding security policy implemented by the tagged computer system hardware. These code hardening mechanisms can also be applied to the protected software, providing defense-in-depth for memory security and ensuring the secure and stable operation of the software.

[0082] The following combination Figure 2-Figure 9 The memory protection method of the present invention is described.

[0083] Figure 2 This is one of the flow charts of the memory protection method provided by the present invention, such as Figure 2 As shown, the method includes the following:

[0084] Step 201: In response to receiving an access instruction from a processor core, the tag processing unit obtains from the memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried in the access instruction.

[0085] The access instruction is generated by the processor core according to the access request received from the target program.

[0086] The target program is a program running on the label computer system provided by the present invention, and its memory usage needs to be protected.

[0087] Access requests may include data read requests and data write requests, etc.

[0088] For a detailed description of the security policy bitmap, see Figure 1 The relevant content in will not be repeated here.

[0089] Step 202: The label processing unit determines at least one security policy to be executed according to the security policy bitmap.

[0090] Step 203: The tag processing unit obtains at least one tag operation rule for the access instruction according to the security policy configuration register associated with each security policy to be executed.

[0091] Step 204: The data cache obtains at least one tag operation rule from the tag processing unit.

[0092] Step 205: The data cache executes the access instruction according to at least one tag operation rule.

[0093] In the specific implementation process, Figure 10 As shown, the data cache executes access instructions according to at least one tag operation rule, for example, verifies a certain type of tag, or performs an update operation on a certain type of tag, and executes the access request based on the result of the tag operation.

[0094] For an embodiment of executing an access instruction according to at least one tag operation rule, see Figure 3 、 Figure 4 as well as Figure 5 The relevant content in will not be repeated here.

[0095] Figure 3 This is the second flow chart of the memory protection method provided by the present invention.

[0096] In this embodiment, the access request is an access request for the stack return address, and the security policy to be executed is a security policy for protecting the stack return address: verifying the memory tag of the stack return address, and if it is marked as a preset value (for example, 1), denying execution of the access request.

[0097] like Figure 3 As shown, the method includes the following:

[0098] Step 301: Obtain a memory tag of a memory area storing a stack return address.

[0099] During specific implementation, the data cache may utilize a memory tag read instruction to obtain a memory tag of a memory area storing a stack return address.

[0100] Step 302: In response to the memory tag being the first value, deny execution of the access instruction and return access exception information to the processor core.

[0101] Step 303: In response to the memory tag being the second value, execute the access instruction and return the access result to the processor core.

[0102] The first value and the second value are two different values, and the specific values ​​can be determined according to the label granularity and rules used.

[0103] For example only, the first value is 1 and the second value is 0.

[0104] In order to cooperate with the above security policy executed by the processor, after the stack return address is saved to the stack, the target program needs to call the first code segment and set the memory tag to the first value; before the stack return address is loaded from the stack, the target program needs to call the second code segment and set the memory tag to the second value.

[0105] The first code segment includes a hardware-executable instruction (eg, an assembly instruction) for calling a tag update instruction to set a memory tag of a memory area storing a stack return address to a first value.

[0106] The second code segment includes a hardware-executable instruction (eg, an assembly instruction) for calling a tag update instruction to set a memory tag of a memory area storing a stack return address to a second value.

[0107] In a specific implementation process, the first code segment is inserted by a compiler extension (e.g., LLVM Pass) in an intermediate compiled representation of the target program (e.g., LLVM IR) at a position after the stack return address is saved to the stack; the second code segment is inserted by the compiler extension in the intermediate compiled representation of the target program at a position before the stack return address is loaded from the stack.

[0108] In this embodiment, specific instructions are inserted into the code through compiler extension, and the data cache executes the access request based on the tag operation result corresponding to the security policy, ensuring that the stack return address remains unchanged during function execution, thereby effectively protecting the integrity of the backward control flow.

[0109] Figure 4 This is the third flow chart of the memory protection method provided by the present invention.

[0110] In this embodiment, the access request is a write request for sensitive data, and the security policy to be executed is a security policy for protecting sensitive data: when writing each word on the data segment, the memory tag 0 is also written; when reading, check whether the memory tag and the tag in the pointer are the same.

[0111] like Figure 4 As shown, the method includes the following:

[0112] Step 401: Write sensitive data into the memory, and set a memory tag with a third value for the memory area storing the sensitive data.

[0113] In order to cooperate with the above security policy executed by the processor, after the sensitive data is written into the memory, the target program calls the third code segment to perform the following operations: setting a memory tag of a fourth value for the memory area storing the sensitive data.

[0114] The third code segment includes a hardware-executable instruction (eg, an assembly instruction) for calling a tag update instruction to set a memory tag of a fourth value for a memory region storing sensitive data.

[0115] During a specific implementation, the third code segment is inserted into the compiler intermediate representation language of the target program by the compiler extension at a position after the sensitive data is written into the memory.

[0116] The third value and the fourth value are two different values, and the specific values ​​can be determined according to the label granularity and rules used.

[0117] For example only, the third value is 0 and the fourth value is 1.

[0118] Step 402: In response to a received read instruction for sensitive data, the data cache compares a memory tag of a memory region storing the sensitive data with a pointer tag of a pointer variable for loading the sensitive data.

[0119] Step 403: If the comparison result shows that the memory tag and the pointer tag are inconsistent, it is determined that the sensitive data has been tampered with, and access exception information is returned to the processor core.

[0120] Step 404: If the comparison result shows that the memory tag and the pointer tag are consistent, execute the read instruction and return the read result to the processor core.

[0121] In order to cooperate with the above security policy executed by the processor, before issuing a read request for sensitive data, the target program calls the fourth code segment to perform the following operations: setting a pointer tag of a fourth value for the pointer variable that loads the sensitive data.

[0122] The third code segment includes a segment of code for setting a pointer tag of a fourth value for a pointer variable loaded with sensitive data.

[0123] The fourth code segment is inserted by the compiler extension into the compiler intermediate representation language of the target program at a position before a read request for sensitive data is issued.

[0124] In this embodiment, specific instructions are inserted into the code through compiler extensions, and the processor executes access requests based on security policies, thereby achieving isolation between sensitive data and non-sensitive data. This ensures that sensitive data will not be read without authorization, thereby avoiding the risk of leakage; and ensures that when sensitive data is tampered with, it can be discovered in time at the point of use, effectively preventing control flow hijacking.

[0125] Figure 5 This is the fourth flow chart of the memory protection method provided by the present invention.

[0126] In this embodiment, the access request is an operation request for a heap block pointer, and the security policy to be executed is a security policy for anti-pointer reuse protection: when any register storing a source operand carries a tag, the tag is copied to the destination register.

[0127] like Figure 5 As shown, the method includes the following:

[0128] Step 501: In response to receiving an operation instruction for a heap block pointer from a target program, the processor core executes the operation instruction and stores the execution result of the operation instruction in a destination register.

[0129] Step 502: The tag processing unit calculates and sets the tag of the destination register according to the tag propagation rule set in the register tag configuration register; wherein the tag propagation rule of the register tag configuration register is set to the second rule.

[0130] When the register tag configuration register is set to the second rule, it indicates that if any register storing a source operand carries a tag, the tag must be copied to the destination register. Therefore, in this embodiment, the tag processing unit sets the tag of the destination register according to the second rule, so that the tag of the stack pointer can be preserved during any operation.

[0131] To comply with the processor's security policy, in the target program, the heap allocator sets a fifth-value register tag for the general-purpose register storing the address of the memory block allocated for the heap block pointer before returning the address of the memory block allocated for the heap block pointer. Subsequently, due to the security policy implemented by the tag processing unit, the heap block pointer carries the fifth-value tag during any operations, as well as when storing from registers to memory or loading from memory to storage. Therefore, all heap block pointers in memory can be subsequently found based on the fifth-value tag.

[0132] In response to receiving a memory release request for a memory block, the heap allocator stores the address of the memory block in the isolation area; when the address data stored in the isolation area reaches a preset number threshold, the heap allocator searches for a heap block pointer labeled with a fifth value in the memory, determines the dangling heap block pointer pointing to the address stored in the isolation area, sets the dangling heap block pointer to a null pointer, and releases the address stored in the isolation area.

[0133] In this embodiment, by modifying the heap allocator's processing logic, when a heap block is released, it is first placed in an isolated area. When the isolated area reaches a certain size, a full memory scan is performed to locate dangling heap block pointers and reset them to NULL. This functionality effectively prevents use-after-free issues and ensures memory timing safety. After this, there are no dangling heap block pointers in memory, and the heap blocks in the isolated area can be released for reuse.

[0134] In the specific implementation process, when performing code reinforcement, it is necessary to select the reinforcement mechanism to be used for the memory protection target, and then select the modifications to the compiler Pass and C standard library used when compiling the source code according to the reinforcement mechanism to be used. Furthermore, it is necessary to determine the memory range of each reinforcement mechanism and coordinate the use of label bits by these reinforcement mechanisms. If the memory ranges of the two strategies are different, the same label bit can be used; otherwise, different label bits need to be used. Furthermore, by setting the compilation options to enable the compilation extensions of different reinforcement mechanisms, the software source code and C standard library are compiled and linked to generate protected binary files. For example Figure 6 As shown, when the binary file runs on the tag architecture of the present invention, the hardware can automatically maintain and check the tag, thereby preventing memory attacks and ensuring the stable operation of the software, achieving the following Figure 9 If a label check fails during runtime, indicating a security policy violation, the program is likely vulnerable to attack or contains a serious error. In this case, the process is considered to have an execution exception, and the target platform's hardware features or operating system features are used to block the process from continuing (for example, by sending a segmentation fault signal (SIGSEGV) to the process) to ensure that memory safety is not violated.

[0135] The memory protection device provided by the present invention is described below. The memory protection device described below and the memory protection method described above can be referenced to each other.

[0136] Figure 11 An example of a physical structure diagram of an electronic device is shown below. Figure 11As shown, the electronic device may include: a processor 1110, a communications interface 1120, a memory 1130, and a communications bus 1140, wherein the processor 1110, the communications interface 1120, and the memory 1130 communicate with each other via the communications bus 1140. The processor 1110 may call logic instructions in the memory 1130 to execute a memory protection method, which includes: a tag processing unit, in response to receiving an access instruction from a processor core, obtaining from a memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried in the access instruction; wherein the access instruction is generated by the processor core based on an access request received from a target program; the tag processing unit, based on the security policy bitmap, determining at least one security policy to be executed; the tag processing unit, based on a security policy configuration register associated with each security policy to be executed, obtaining at least one tag operation rule for the access instruction; the data cache obtaining the at least one tag operation rule from the tag processing unit; and executing the access instruction in accordance with the at least one tag operation rule.

[0137] Furthermore, the logic instructions in the aforementioned memory 1130 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product, stored in a storage medium, includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0138] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the memory protection method provided by the above methods, and the method includes: a tag processing unit, in response to receiving an access instruction from a processor core, obtaining from a memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried by the access instruction; wherein the access instruction is generated by the processor core based on an access request received from a target program; the tag processing unit determines at least one security policy to be executed based on the security policy bitmap; the tag processing unit obtains at least one tag operation rule for the access instruction based on a security policy configuration register associated with each security policy to be executed; the data cache obtains the at least one tag operation rule from the tag processing unit; and executes the access instruction in accordance with the at least one tag operation rule.

[0139] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the memory protection method provided by the above-mentioned methods, the method comprising: a tag processing unit, in response to receiving an access instruction from a processor core, obtaining from a memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried by the access instruction; wherein the access instruction is generated by the processor core based on an access request received from a target program; the tag processing unit, based on the security policy bitmap, determines at least one security policy to be executed; the tag processing unit, based on a security policy configuration register associated with each of the security policies to be executed, obtains at least one tag operation rule for the access instruction; the data cache obtains the at least one tag operation rule from the tag processing unit; and executes the access instruction in accordance with the at least one tag operation rule.

[0140] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0141] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0142] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A label computer system, characterized in that: include: Security policy configuration registers, memory management unit, tag processing unit, and data cache; The security policy configuration register provides a mechanism for the tag processing unit to execute the security policy according to preset tag operation rules. The security policy is a configuration set of tag operation rules for memory or registers in order to achieve a preset memory protection goal. The memory tag is security metadata attached to memory data, and the register tag is security metadata attached to register stored data. The page table entry of the memory management unit is provided with a first extension area, and the first extension area is used to store a security policy bitmap associated with the virtual page managed by the page table entry; wherein the security policy bitmap is used to indicate the security policy that needs to be executed when storing data in the virtual page or loading data from the virtual page, and the security policy bitmap includes a plurality of bits, each bit corresponding to a security policy, when the bit is set to 1, it indicates that the security policy corresponding to the bit needs to be executed, and when the bit is set to 0, it indicates that the security policy corresponding to the bit is not executed; a tag processing unit, configured to, upon receiving a memory access instruction from a processor core, obtain from a memory management unit a security policy bitmap stored in a page table entry corresponding to an access address; and Obtaining, from a security policy configuration register corresponding to at least one security policy to be executed indicated by the security policy bitmap, a label operation rule for executing the at least one security policy to be executed; The data cache is configured to execute memory access instructions from the processor core based on tag operation rules from the tag processing unit.

2. The label computer system according to claim 1, characterized in that It also includes cache lines, register files, data buses, and tag data conversion modules; The cache line includes a second extended area, and the second extended area is used to store a memory tag of the data stored in the cache line; wherein the memory tag includes a plurality of bits; The register file includes a third extension area, and the third extension area is used to store register tags of data stored in the register file; wherein the register tag includes a plurality of bits; The data bus includes a fourth extension area, the fourth extension area being used to transmit a memory tag or a register tag of data transmitted on the data bus; The tag data conversion module is configured to write the data carrying the memory tag into the data storage area in the memory and write the memory tag carried by the data into the tag storage area in the memory when the cache writes the data carrying the memory tag into the memory; and When the cache reads data carrying a memory tag from the memory, the data is read from the data storage area, and the memory tag carried by the data is read from the tag storage area.

3. The label computer system according to claim 2, characterized in that The security policy configuration register includes a label operation rule field, a label granularity field, and a label mask field; wherein the label granularity field is used to set the granularity of the memory unit configured with the label; the label mask field is used to determine the bits used by the security policy corresponding to the security policy configuration register from the label assigned to the memory unit; the label operation rule field is used to determine the label operation rules used by the security policy; the label operation rules include at least one of a label verification rule and a label update rule.

4. The label computer system according to claim 3, characterized in that Also included are register tag configuration registers; The register tag configuration register includes a plurality of setting units, each of which is used to set a tag propagation rule for a corresponding tag bit in a general register when data processing is performed using the general register; wherein each setting unit includes at least one bit, and the tag propagation rule includes: The first rule is that the destination register used to store processed data does not carry a tag; The second rule is that if any register storing a source operand carries a tag, the tag is copied to the destination register; The third rule is to perform an XOR operation on the tag carried by the general register storing the source operand, and use the XOR operation result as the tag of the destination register.

5. A memory protection method, characterized in that: The method is applied to the label computer system according to any one of claims 1 to 4, and the method comprises: a tag processing unit, in response to receiving an access instruction from a processor core, obtaining from a memory management unit a security policy bitmap stored in a page table entry corresponding to an access address carried in the access instruction; wherein the access instruction is generated by the processor core based on an access request received from a target program; The label processing unit determines at least one security policy to be executed according to the security policy bitmap; The tag processing unit obtains at least one tag operation rule for the access instruction according to the security policy configuration register associated with each security policy to be executed; The data cache obtains the at least one label operation rule from the label processing unit; and The access instruction is executed according to the at least one tag operation rule.

6. The memory protection method according to claim 5, characterized in that: The access request is an access request for a stack return address, and the security policy to be executed is a security policy for stack return address protection; The executing the access instruction according to the at least one tag operation rule includes: Obtaining a memory tag of a memory area storing the stack return address; In response to the memory tag being the first value, refusing to execute the access instruction and returning access exception information to the processor core; In response to the memory tag being a second value, executing the access instruction and returning an access result to the processor core; wherein, after the stack return address is saved to the stack, the target program executes a first code segment and sets the memory tag to the first value; Before the stack return address is loaded from the stack, the target program executes a second code segment to set the memory tag to the second value; The first code segment is inserted by a compiler extension in the intermediate compiled representation of the target program at a position after the stack return address is saved to the stack; the second code segment is inserted by a compiler extension in the intermediate compiled representation of the target program at a position before the stack return address is loaded from the stack.

7. The memory protection method according to claim 5, wherein: The access request is a write request for sensitive data, and the security policy to be executed is a security policy for protecting sensitive data; The executing the access instruction according to the at least one tag operation rule includes: Writing the sensitive data into a memory, and setting a memory tag with a third value for a memory area storing the sensitive data; After the sensitive data is written into the memory, the target program executes the third code segment to perform the following operations: setting a memory tag of a fourth value for the memory area storing the sensitive data; The third code segment is inserted into the compiler intermediate representation language of the target program by the compiler extension at a position after the sensitive data is written into the memory; The method further comprises: In response to a received read instruction for the sensitive data, the data cache compares a memory tag of a memory area storing the sensitive data with a pointer tag of a pointer variable for loading the sensitive data; If the comparison result shows that the memory tag and the pointer tag are inconsistent, it is determined that the sensitive data has been tampered with, and access exception information is returned to the processor core; If the comparison result shows that the memory tag and the pointer tag are consistent, executing the read instruction and returning the read result to the processor core; Before issuing a read request for the sensitive data, the target program executes a fourth code segment to perform the following operations: setting a pointer tag of the fourth value for a pointer variable that loads the sensitive data; The fourth code segment is inserted into the compiler intermediate representation language of the target program by the compiler extension at a position before the read request for the sensitive data is issued.

8. A memory protection method, characterized in that: The method is applied to the tag computer system according to claim 4, and is used to implement anti-reuse protection for heap block pointers, and the method includes: In response to receiving an operation instruction for a heap block pointer from a target program, the processor core executes the operation instruction and stores an execution result of the operation instruction in a destination register; The tag processing unit calculates and sets the tag of the destination register according to the tag propagation rule set in the register tag configuration register; wherein the tag propagation rule of the register tag configuration register is set to the second rule; in: In the target program, the heap allocator sets a register tag of a fifth value for a general register storing the address of the memory block before returning the address of the memory block allocated for the heap block pointer; The heap allocator stores the address of the memory block into the isolation area in response to receiving a memory release request for the memory block; When the address data stored in the isolation area reaches a preset number threshold, the heap allocator searches for a heap block pointer with a label of the fifth value in the memory, obtains a dangling heap block pointer pointing to the address stored in the isolation area, sets the dangling heap block pointer to a null pointer, and releases the address stored in the isolation area.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the memory protection method according to any one of claims 5 to 8 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the memory protection method according to any one of claims 5 to 8 is implemented.

Images