Memory processing method and device, equipment and medium

Abstract

The embodiment of the invention provides a memory processing method and device, equipment and a medium. The method specifically comprises the steps that a memory allocation request is received; the memory allocation request comprises a parameter value of a secure memory indication parameter; under the condition that a parameter value of a secure memory indication parameter indicates that a secure memory is applied, allocating a corresponding first memory space for the memory allocation request, and adding a preset mark for the first memory space; receiving a transfer request of the memory data; the transfer request is used for transferring data in a second memory space to an exchange partition; and if the preset mark corresponding to the second memory space exists, rejecting the transfer request. According to the embodiment of the invention, the security requirement that the key data in the secure memory does not fall into the disk can be realized, and the probability that the key data is acquired and leaked by an attacker due to hard disk vulnerabilities can be reduced.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular, to a memory processing method, apparatus, device and medium. Background Art

[0002] With the advancement of computer technology, diskless computing technology has emerged. The core of diskless computing technology is that all data calculations are performed in memory, avoiding data storage on disk, thereby greatly improving data security. Diskless computing technology can play an important role in reading key data such as commercial confidential data, medical sensitive data, and undisclosed scientific research data, and can effectively prevent these key data from being leaked due to disk storage.

[0003] Currently, when the physical memory is insufficient, the operating system usually transfers the data in the memory to the swap partition. In this way, the operating system can have more physical memory to provide services for each process. When the system needs to access the data stored in the swap partition, the data in the swap partition will be loaded into the memory again. The above-mentioned measure of using the swap partition as a temporary storage area plays a role in expanding the size of physical memory.

[0004] However, since the security of the swap partition is lower than that of the physical memory, in a multi-user or security-threatened environment, the critical data in the swap partition is at risk of unauthorized access, tampering, or leakage. Summary of the invention

[0005] The embodiment of the present application provides a memory processing method, which can achieve the security requirement of not storing key data in the secure memory on the disk, thereby reducing the probability of key data being acquired and leaked by attackers due to hard disk vulnerabilities.

[0006] Correspondingly, an embodiment of the present application also provides a memory processing device, an electronic device and a machine-readable medium to ensure the implementation and application of the above method.

[0007] In order to solve the above problems, an embodiment of the present application discloses a memory processing method, the method comprising:

[0008] Receive a memory allocation request; the memory allocation request includes: a parameter value of a secure memory indication parameter;

[0009] In a case where the parameter value of the secure memory indication parameter indicates an application for secure memory, allocating a corresponding first memory space for the memory allocation request, and adding a preset mark to the first memory space;

[0010] receiving a transfer request for memory data; the transfer request is used to transfer data in the second memory space to the swap partition;

[0011] If there is a preset mark corresponding to the second memory space, the transfer request is rejected.

[0012] In order to solve the above problems, an embodiment of the present application discloses a memory processing device, the device comprising:

[0013] An allocation request receiving module is used to receive a memory allocation request; the memory allocation request includes: a parameter value of a secure memory indication parameter;

[0014] an allocation request processing module, configured to allocate a first memory space corresponding to the memory allocation request and add a preset mark to the first memory space when a parameter value of the secure memory indication parameter indicates that a secure memory is to be applied for;

[0015] A transfer request receiving module, used for receiving a transfer request for memory data; the transfer request is used for transferring the data in the second memory space to the swap partition;

[0016] The transfer request processing module is used to reject the transfer request if there is a preset mark corresponding to the second memory space.

[0017] Optionally, the parameter value of the secure memory indication parameter is of Boolean type, and a parameter value of true indicates application for secure memory, and a parameter value of false indicates application for non-secure memory; or

[0018] The parameter value of the secure memory indication parameter is of integer type, a parameter value of 1 indicates applying for secure memory, and a parameter value of 0 indicates applying for non-secure memory.

[0019] Optionally, the allocation request processing module includes:

[0020] A first allocation request processing module is configured to add a preset field to a related structure of the first memory space, wherein the preset field or a first preset value of the preset field is used as a preset mark; or

[0021] The second allocation request processing module is used to enable a preset reserved bit of a data structure related to the first memory space, and set the value of the preset reserved bit to a second preset value, which is used as a preset mark.

[0022] Optionally, the device further comprises:

[0023] A first judgment module is used to judge whether there is a preset field in the relevant structure of the second memory space, and if so, there is a preset mark corresponding to the second memory space; or

[0024] A second judgment module is used to judge whether there is a preset field in the relevant structure of the second memory space, and if so, and the value of the preset field is a first preset value, then there is a preset mark corresponding to the second memory space; or

[0025] The third judgment module is used to judge whether the value of the preset reserved bit of the relevant data structure of the second memory space is a second preset value, and if so, there is a preset mark corresponding to the second memory space.

[0026] Optionally, the related structure includes: a linked list node structure, a memory area descriptor structure, or a global memory attribute table.

[0027] Optionally, the allocation request processing module includes:

[0028] A fourth judgment module is used to judge whether the available physical memory is lower than a first preset ratio of the total physical memory of the system when the parameter value of the secure memory indication parameter indicates that the secure memory is applied, and obtain a judgment result;

[0029] an allocation adding module, configured to allocate a first memory space corresponding to the memory allocation request and add a preset mark to the first memory space if the judgment result is no;

[0030] The return module is used to return prompt information for the memory allocation request when the judgment result is yes.

[0031] Optionally, the device further comprises:

[0032] A sleep request receiving module, used for receiving a sleep check request;

[0033] The sleep request processing module is used to return an error message for the sleep check request if the parameter value of the secure memory indication parameter corresponding to any memory space in the memory management system indicates applying for secure memory, or if a preset mark corresponding to any memory space in the memory management system exists.

[0034] Optionally, the sleep check request is a call request for the sleep check function; after receiving the sleep check request, the sleep check function calls the sleep judgment function, and the sleep judgment function determines whether the parameter value of the secure memory indication parameter corresponding to any memory space in the memory management system indicates an application for secure memory, or the sleep judgment function determines whether a preset mark corresponding to any memory space in the memory management system exists, and if so, returns an error message to the sleep check function.

[0035] The embodiment of the present application further discloses an electronic device, including: a processor; and a memory, on which executable code is stored. When the executable code is executed, the processor executes the method described in the embodiment of the present application.

[0036] The embodiment of the present application further discloses a machine-readable medium on which executable code is stored. When the executable code is executed, a processor executes the method described in the embodiment of the present application.

[0037] The embodiments of the present application include the following advantages:

[0038] In the technical solution of the embodiment of the present application, a secure memory indication parameter is introduced in the memory allocation link. Specifically, when a memory allocation request is received, if the parameter value of the secure memory indication parameter indicates that secure memory is applied, the corresponding first memory space is allocated for the memory allocation request, and a preset mark is added to the first memory space. In this way, when a transfer request for memory data is received, it is determined whether the preset mark corresponding to the second memory space exists. If it exists, it means that the second memory space is secure memory. In this case, rejecting the transfer request can prevent the critical data in the second memory space from being transferred to the swap partition that has security risks.

[0039] Since the embodiments of the present application can prevent critical data in the secure memory from being exposed to a high-risk swap partition environment based on memory control, the embodiments of the present application can achieve the security requirement of not storing critical data in the secure memory on the disk, thereby reducing the probability of critical data being obtained and leaked by attackers due to hard disk vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a schematic diagram of the steps of a memory processing method according to an embodiment of the present application;

[0041] Figure 2 This is a schematic diagram of the steps of a memory processing method according to an embodiment of the present application;

[0042] Figure 3 is a structural diagram of a memory processing device according to an embodiment of the present application;

[0043] Figure 4 It is a schematic diagram of the structure of a device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0045] First, technical terms in the computer field are explained.

[0046] Process: It is a running activity of a program in a computer on a certain data set. It is the basic unit for resource allocation in the system and the foundation of the operating system structure. In the early computer structure designed for process, the process is the basic execution entity of the application; in the contemporary computer structure designed for thread, the process is the container of thread. The application is a description of instructions, data and their organizational form, and the process is the entity of the application.

[0047] Memory: It is an important part of the computer, also known as internal memory and main memory. It is used to temporarily store the calculation data in the CPU and the data exchanged with external memory such as the hard disk. It is a bridge for communication between the external memory and the CPU. All programs in the computer are run in the memory. The strength of the memory performance affects the overall performance of the computer. As long as the computer starts running, the operating system will transfer the data to be calculated from the memory to the CPU for calculation. When the calculation is completed, the CPU will transmit the result.

[0048] Disk: refers to a storage device that uses magnetic recording technology to store data. Disk is the main storage medium of computers. It can store a large amount of binary data and keep the data intact even after a power outage. The disk used in early computers was a floppy disk (floppy disk), and the commonly used disk today is a hard disk (hard disk).

[0049] Swap partition: Usually called the exchange partition, this is a special hard disk space. When the actual memory is not enough, the operating system will take out some temporarily unused data from the memory and put it in the swap partition, thereby freeing up enough memory space for the currently running applications.

[0050] Hibernation: Hibernation (or suspend to disk) in the computer field means keeping the computer running while shutting down. Through hibernation, the computer saves the contents of the memory to the hard disk or other non-volatile memory, and reloads these contents from the hard disk when it is turned on next time, restoring the computer to the same state before hibernation.

[0051] The memory processing method of the embodiment of the present application can be applied to the reading scenario of key data, and is used to effectively prevent the leakage of key data such as commercial confidential data, medical sensitive data, and scientific research undisclosed data due to disk storage. Of course, the embodiment of the present application can also be applied to other diskless computing scenarios such as database maintenance scenarios. It can be understood that the embodiment of the present application is not limited to specific application scenarios.

[0052] Currently, when physical memory is insufficient, the operating system usually transfers the data in the memory to the swap partition. However, since the swap partition is less secure than the physical memory, in a multi-user or security-threatened environment, the key data in the swap partition is at risk of unauthorized access, tampering, or leakage.

[0053] In view of the technical problem that there is a risk of critical data in a swap partition, an embodiment of the present application provides a memory processing method, which may specifically include:

[0054] Receive a memory allocation request; the memory allocation request includes: a parameter value of a secure memory indication parameter;

[0055] In the case where the parameter value of the secure memory indication parameter indicates an application for secure memory, allocating a corresponding first memory space for the memory allocation request, and adding a preset mark to the first memory space;

[0056] receiving a transfer request for memory data; the transfer request is used to transfer data in the second memory space to the swap partition;

[0057] If there is a preset mark corresponding to the second memory space, the transfer request is rejected.

[0058] The embodiment of the present application introduces a secure memory indication parameter in the memory allocation link. Specifically, when a memory allocation request is received, if the parameter value of the secure memory indication parameter indicates that secure memory is applied, the corresponding first memory space is allocated for the memory allocation request, and a preset mark is added to the first memory space. In this way, when a transfer request for memory data is received, it is determined whether the preset mark corresponding to the second memory space exists. If it exists, it means that the second memory space is secure memory. In this case, rejecting the transfer request can prevent the critical data in the second memory space from being transferred to the swap partition that has security risks.

[0059] Since the embodiments of the present application can prevent critical data in the secure memory from being exposed to a high-risk swap partition environment based on memory control, the embodiments of the present application can achieve the security requirement of not storing critical data in the secure memory on the disk, thereby reducing the probability of critical data being obtained and leaked by attackers due to hard disk vulnerabilities.

[0060] Method Example 1

[0061] refer to Figure 1 , shows a schematic flow chart of a memory processing method according to an embodiment of the present application, the method specifically comprising the following steps:

[0062] Step 101, receiving a memory allocation request; the memory allocation request includes: a parameter value of a secure memory indication parameter;

[0063] Step 102: when the parameter value of the secure memory indication parameter indicates that a secure memory is to be applied for, a first memory space corresponding to the memory allocation request is allocated, and a preset mark is added to the first memory space;

[0064] Step 103: receiving a transfer request for memory data; the transfer request is used to transfer the data in the second memory space to the swap partition;

[0065] Step 104: If there is a preset mark corresponding to the second memory space, the transfer request is rejected.

[0066] The memory processing method of the embodiment of the present application can be applied to environments of operating systems such as Linux and Unix. It can be understood that the embodiment of the present application is not limited to a specific operating system.

[0067] The embodiments of the present application enable the operating system to ensure that the security process started by the adapted security application on a host that uses a disk as a storage medium will not be written to the swap partition during operation, thereby preventing the leakage of critical data due to disk vulnerabilities.

[0068] The embodiments of the present application can be applied to a security suite for processing critical data. The security suite may include, but is not limited to: a data encryption suite, an access control suite, a data leakage prevention suite, an audit and monitoring suite, a data backup and recovery suite, and a document management and collaboration suite.

[0069] Security suites usually include multiple security applications that work together to provide comprehensive security protection. The memory processing method of the embodiment of the present application can be applied to these security suites, so that key data will not be written to the swap partition during the processing, thereby avoiding the leakage of key data.

[0070] Key data refers to data that is extremely valuable, sensitive and confidential to an organization, institution or individual, and which may lead to serious consequences if leaked, tampered or lost. Examples of key data may include: customer account information, transaction passwords, and fund flow data of financial institutions, or unpublished research results data, new drug development formulas, and core technical information of high-tech products of scientific research institutions, or business secret data of enterprises, etc. It is understood that the embodiments of the present application do not limit the specific key data.

[0071] In step 101, the received memory allocation request may originate from an application program. The application program may call a memory allocation function, and the memory allocation request may be: a call request of the application program for the memory allocation function.

[0072] Examples of memory allocation functions include: malloc (memory allocation) function. Malloc function is a function used for dynamic memory allocation in C and C++ programming languages. It allocates a specified number of bytes of continuous memory space on the heap and returns a pointer to the starting address of the memory block.

[0073] The above memory allocation request may include: a parameter value of a secure memory indication parameter. Those skilled in the art may determine the parameter value corresponding to the memory application type according to actual application requirements. The memory application type specifically includes: applying for secure memory or applying for non-secure memory.

[0074] In one implementation, the parameter value of the secure memory indication parameter is of Boolean type, and a parameter value of true indicates application for secure memory, and a parameter value of false indicates application for non-secure memory.

[0075] In another implementation, the parameter value of the secure memory indication parameter is of integer type, a parameter value of 1 indicates applying for secure memory, and a parameter value of 0 indicates applying for non-secure memory.

[0076] Of course, the parameter values ​​(1, 0) or parameter values ​​(true, false) corresponding to the above memory application types are only examples. In fact, those skilled in the art can determine the parameter values ​​corresponding to each memory application type according to actual application requirements. The embodiments of the present application do not limit the specific parameter values ​​corresponding to each memory application type.

[0077] The application programs of the embodiments of the present application may include: secure applications or non-secure applications. Among them, secure applications may apply for secure memory, and non-secure applications may apply for non-secure memory. Secure applications refer to those programs that have relatively high data security requirements during operation. Non-secure applications refer to those programs that have relatively low data security requirements during operation. The embodiments of the present application do not limit specific secure applications or non-secure applications.

[0078] Among them, the developer of the security application can specify the parameter value of the secure memory indication parameter in the code of the security application, so that the parameter value can indicate that the security application needs to apply for secure memory, thereby meeting the security application's demand for secure memory allocation.

[0079] Similarly, the developer of a non-secure application can specify the parameter value of the secure memory indication parameter in the code of the non-secure application, so that the parameter value can indicate that the secure application needs to apply for non-secure memory, thereby meeting the non-secure application's needs for non-secure memory allocation.

[0080] The operating system involved in the embodiments of the present application presents multiple space divisions at the architectural level. Among them, the more common and basic ones are user space and kernel space. The user space is mainly for various application programs to run, and these applications can send operation requests such as memory allocation requests to the kernel space. The kernel space is responsible for managing the core resources of the system and performing key operations, such as processing memory allocation requests from the user space. Among them, after receiving the memory allocation request sent by the application, the memory allocation function of the user space will use the system call to communicate with the kernel space to forward the memory allocation request to the kernel space.

[0081] It is understandable that the operating system may also include: other spaces. For example, in some embedded operating systems, a device driver space may be divided to run and manage hardware device driver programs.

[0082] When a secure application in user space sends a memory allocation request to kernel space, it automatically carries the parameter value used to characterize the application for secure memory; similarly, when a non-secure application sends a corresponding memory allocation request, it also automatically carries the parameter value used to characterize the application for non-secure memory, so that the operating system can accurately process memory allocation requests based on the characteristics of different applications.

[0083] In step 102, after receiving the memory allocation request, the kernel space determines the memory application type corresponding to the parameter value of the secure memory indication parameter in the memory allocation request.

[0084] If the parameter value of the secure memory indication parameter indicates an application for secure memory, a corresponding first memory space will be allocated for the above-mentioned memory allocation request, and a preset mark will be added to the first memory space.

[0085] Wherein, a memory allocation technology may be used to allocate the first memory space corresponding to the memory allocation request. Those skilled in the art may use various memory allocation technologies according to actual application requirements.

[0086] For example, in one example, the process of allocating the corresponding first memory space for the above-mentioned memory allocation request specifically includes: first, according to the first virtual memory address space layout of the process, the corresponding first virtual memory is allocated for the above-mentioned memory allocation request; then, using the physical memory allocation algorithm, the corresponding first physical memory is allocated for the allocated first virtual memory; then, a mapping relationship between the first virtual memory and the first physical memory is established in the page table, and the page table is used to convert the virtual address into a physical address, so that the CPU can find the corresponding first physical memory when the application accesses the first virtual memory; then, the kernel space returns the starting address of the first virtual memory to the memory allocation function of the user space. Among them, the process can be the process corresponding to the application that sends the memory allocation request. The above-mentioned first virtual memory or the first physical memory can both represent the above-mentioned first memory space.

[0087] The preset tag can serve as an identity identifier of the secure memory, so that the operating system can distinguish the secure memory from the non-secure memory based on the preset tag.

[0088] The embodiment of the present application can provide the following technical solution for adding a preset mark to the first memory space:

[0089] Technical solution 1,

[0090] Technical solution 1 adds a preset field to the relevant structure of the first memory space, and the preset field or the first preset value of the preset field is used as a preset mark.

[0091] A structure is a data structure used in programming to organize and store different types of data, and it can group multiple related data elements together. By intentionally adding a preset field to the structure associated with the first memory space, the newly added field can be assigned a specific value (i.e., the first preset value) to serve as a preset tag.

[0092] Examples of related structures may include: a linked list node structure, a memory region descriptor structure, or a global memory attribute table.

[0093] Among them, the linked list node structure is used to represent and manage the linked list structure associated with a specific memory space. Its member variables can store memory information such as pointers to specific memory areas and memory area sizes, and organize various memory information with the help of the link relationship between linked list nodes.

[0094] Technical Solution 1 uses a linked list node structure to store the memory information of a preset tag. Specifically, in the linked list node structure, the preset tag is included by adding a part used to represent the preset tag in its member variable, just like storing memory information such as a pointer to a specific memory area and the size of the memory area.

[0095] The memory region descriptor structure is a structure that describes a specific memory region in detail. Its member variables can store memory information such as the starting address, size, access rights, memory type, and usage status of the memory region. This memory information clarifies the location, operability, nature, and usage of the memory region, providing a basis for memory management operations.

[0096] Technical Solution 1 adds a field for representing a preset tag in the member variable of the memory area descriptor structure, so that the operating system can distinguish between secure memory and non-secure memory based on the preset tag during management.

[0097] The global memory attribute table is a data structure that presents the memory attribute information of a specific memory area. Its member variables store memory attribute information such as memory security level, sharing attributes, application or process ID, physical address mapping, and overall status, providing a basis for memory management.

[0098] Technical Solution 1 adds a field for representing a preset tag in the member variables of the global memory attribute table, so that the operating system can distinguish between secure memory and non-secure memory based on the preset tag during management.

[0099] Technical solution 2,

[0100] Technical solution 2 enables a preset reserved bit of a related data structure of the first memory space, sets the value of the preset reserved bit to a second preset value, and uses the second preset value as a preset mark.

[0101] Technical Solution 2 utilizes the second preset value of the preset reserved bit of the relevant data structure of the first memory space to mark the first memory space as secure memory.

[0102] These reserved bits do not participate in the operation of the operating system when they are not enabled. The embodiment of the present application modifies the state of the preset reserved bits to an enabled state, and sets the value of the preset reserved bits to a second preset value, so that the preset reserved bits can participate in the relevant operations of memory management. Specifically, when the operating system receives a request to transfer memory data, it will determine the second memory space as secure memory based on these preset reserved bits that are enabled and set to the second preset value.

[0103] Taking the page table entry structure as an example, it is assumed that there is a reserved bit of length 2 at a specific position (such as the lower 2 bits) of the page table entry. Normally, the value of the reserved bit is "00", indicating that it is not enabled. However, in the embodiment of the present application, the value of the reserved bit is set to a second preset value, such as "11", to indicate that the preset marking function is enabled, which is used to mark the memory space corresponding to the page table entry as secure memory.

[0104] The process of adding a preset mark to the first memory space is described in detail above through Technical Solution 1 to Technical Solution 2. It can be understood that those skilled in the art can adopt Technical Solution 1 or Technical Solution 2 according to actual application requirements, or other technical solutions can be adopted. For example, other technical solutions can generate a mapping relationship record between the unique identifier of the first memory space and the preset mark in the configuration file. The unique identifier can be: the starting address of the first memory space, or the unique identifier can be: the process identifier corresponding to the first memory space.

[0105] It should be noted that if the parameter value of the secure memory indication parameter indicates that a non-secure memory is requested, the process may be processed according to the conventional technology. Specifically, the corresponding third memory space may be allocated to the above memory allocation request, and no preset mark may be added to the third memory space.

[0106] In the technical field, some memory management systems will select a portion of hard disk space in the swap partition as the memory allocation result in order to cope with the shortage of memory. However, since the security of the swap partition is lower than that of the physical memory, if the hard disk space in the swap partition is allocated to the security application, it will easily lead to the leakage of key data in the security application.

[0107] In view of the above situation, in an embodiment of the present application, when the parameter value of the secure memory indication parameter indicates an application for secure memory, a process of allocating a corresponding first memory space for the memory allocation request and adding a preset mark to the first memory space specifically includes:

[0108] When the parameter value of the secure memory indication parameter indicates that secure memory is to be applied for, determining whether the available physical memory is lower than a first preset ratio of the total physical memory of the system, and obtaining a determination result;

[0109] If the judgment result is no, allocating a first memory space corresponding to the memory allocation request, and adding a preset mark to the first memory space;

[0110] If the judgment result is yes, prompt information is returned for the memory allocation request.

[0111] The embodiment of the present application processes a memory allocation request according to a secure memory indication parameter and a ratio between the amount of available physical memory and the total physical memory of the system.

[0112] When the secure memory indication parameter indicates to apply for secure memory, if the available physical memory is not less than a first preset ratio of the total physical memory of the system, a first memory space is allocated for the memory allocation request and a preset mark is added. The first memory space can be a physical space. In this case, using physical memory to store key data of the secure application can improve the security of the key data.

[0113] When the secure memory indication parameter indicates to apply for secure memory, if the available physical memory is lower than the first preset ratio, a prompt message is returned, thereby avoiding the situation where a swap partition is allocated for a secure application when the physical memory is tight.

[0114] The above prompt information can be used to inform the user or the security application that the physical memory is tight and cannot meet the security memory application requirements. The above prompt information can also suggest closing unnecessary applications or optimizing system settings to free up memory, and inform the security application that it can try to apply again after a certain period of time.

[0115] In step 103, when the physical memory of the operating system is insufficient, a portion of the memory space in the physical memory needs to be released for use by the currently running application. The released memory space may come from some target applications that have not been operated for a long time, and the released memory space is temporarily saved in the swap space.

[0116] Therefore, when memory usage information such as the available physical memory amount of the memory management system, the idle rate of memory pages, the usage frequency of memory pages, etc. meets preset conditions, a request for transferring memory data can be triggered.

[0117] The preset conditions may include: the amount of available physical memory is lower than a first preset ratio of the total physical memory of the system, or the memory page idle rate is lower than a second preset ratio, or the usage frequency of a memory page in the past 10 minutes is lower than a preset number of times, etc.

[0118] The above transfer request is used to transfer the data of the second memory space to the swap partition. The embodiment of the present application does not limit the specific determination process of the second memory space. For example, if the usage frequency of a memory page in the past 10 minutes is lower than the preset number of times, the memory space corresponding to the memory page is determined as the second memory space. For another example, if the idle rate of a memory page is lower than the second preset ratio, the memory space corresponding to the memory page is determined as the second memory space.

[0119] In step 104, if there is a preset mark corresponding to the second memory space, it means that the second memory space is a secure memory. In this case, rejecting the transfer request can prevent the critical data in the second memory space from being transferred to the swap partition with security risks.

[0120] Rejecting the transfer request may refer to refusing to process the transfer request. Rejecting the transfer request may specifically include: returning a rejection signal to the request source of the transfer request (such as the process or system component that issued the transfer request). The rejection signal may be a first error code, and the first error code is used to inform the request source of the reason why the transfer request was rejected. It can be understood that the embodiments of the present application do not limit the specific error code.

[0121] The embodiment of the present application may provide the following judgment scheme for whether the preset mark corresponding to the second memory space exists:

[0122] Determination scheme 1: determine whether there is a preset field in the relevant structure of the second memory space, and if so, there is a preset mark corresponding to the second memory space; or

[0123] Determination scheme 2: determine whether there is a preset field in the relevant structure of the second memory space. If so, and the value of the preset field is the first preset value, then there is a preset mark corresponding to the second memory space; or

[0124] Judgment scheme 3: judge whether the value of the preset reserved bit of the relevant data structure of the second memory space is the second preset value. If so, there is a preset mark corresponding to the second memory space.

[0125] In addition, when a mapping relationship record between the unique identifier of the first memory space and a preset mark is generated in the configuration file, a search can be performed in the configuration file based on the unique identifier of the second memory space. If the search hits, that is, the configuration file contains a mapping relationship record corresponding to the unique identifier of the second memory space, then there is a preset mark corresponding to the second memory space.

[0126] If there is a preset mark corresponding to the second memory space, it means that the second memory space is a non-secure memory. In this case, the transfer request can be processed, that is, according to the requirements of the transfer request, the data of the second memory space is transferred to the swap partition.

[0127] In summary, the memory processing method of the embodiment of the present application introduces a secure memory indication parameter in the memory allocation link. Specifically, when a memory allocation request is received, if the parameter value of the secure memory indication parameter indicates an application for secure memory, the corresponding first memory space is allocated for the memory allocation request, and a preset mark is added to the first memory space. In this way, when a transfer request for memory data is received, it is determined whether the preset mark corresponding to the second memory space exists. If so, it indicates that the second memory space is secure memory. In this case, rejecting the transfer request can prevent the critical data in the second memory space from being transferred to the swap partition that poses a security risk.

[0128] Since the embodiments of the present application can prevent critical data in the secure memory from being exposed to a high-risk swap partition environment based on memory control, the embodiments of the present application can achieve the security requirement of not storing critical data in the secure memory on the disk, thereby reducing the probability of critical data being obtained and leaked by attackers due to hard disk vulnerabilities.

[0129] Method Example 2

[0130] refer to Figure 2 , shows a schematic flow chart of a memory processing method according to an embodiment of the present application, the method specifically comprising the following steps:

[0131] Step 201, receiving a memory allocation request; the memory allocation request includes: a parameter value of a secure memory indication parameter;

[0132] Step 202: when the parameter value of the secure memory indication parameter indicates that a secure memory is to be applied for, a first memory space corresponding to the memory allocation request is allocated, and a preset mark is added to the first memory space;

[0133] Step 203: receiving a transfer request for memory data; the transfer request is used to transfer the data in the second memory space to the swap partition;

[0134] Step 204: If there is a preset mark corresponding to the second memory space, reject the transfer request;

[0135] Relative to Figure 1 The method of the first embodiment shown in the figure may further include:

[0136] Step 205: receiving a sleep check request;

[0137] Step 206: If the parameter value of the secure memory indication parameter corresponding to any memory space in the memory management system indicates applying for secure memory, or if a preset mark corresponding to any memory space in the memory management system exists, an error message is returned for the sleep check request.

[0138] Computer hibernation means temporarily saving the data in the memory to the hard disk and then cutting off the power supply to the memory. Since the disk storage environment is easier to be physically touched or accessed through software vulnerabilities than the memory, key data in the secure memory (such as encryption keys, user privacy data, etc.) may be stolen.

[0139] In step 205, the sleep check request may come from the power management module within the operating system. When the operating system is ready to enter the sleep state, the power management module will send this sleep check request to check the memory and other related conditions before sleep. Of course, the embodiment of the present application does not limit the specific source of the sleep check request.

[0140] In one implementation, the sleep check request may be a call request for a sleep check function. After receiving the sleep check request, the sleep check function calls the sleep judgment function, and the sleep judgment function judges whether the parameter value of the secure memory indication parameter corresponding to any memory space in the memory management system indicates the application for secure memory, or the sleep judgment function judges whether the preset mark corresponding to any memory space in the memory management system exists, and if so, returns an error message to the sleep check function. Correspondingly, the sleep check function may return an error message to the request source of the sleep check request. The error message may be a second error code. The second error code is used to inform the request source of the reason why the sleep check request is rejected. For example, the second error code may inform the security process that the secure memory applied for is not released, prohibit the system from entering the sleep to disk operation, and prevent the memory data from falling into the disk. The second error code facilitates the tracking and troubleshooting of the system status, and improves the convenience of system maintenance.

[0141] Step 206 will perform two checks on any memory space in the memory management system. The first check is to check the parameter value of the secure memory indication parameter corresponding to any memory space; the second check is to check the preset mark corresponding to any memory space in the memory management system. If any check result of any memory space meets the conditions, it can be said that there is secure memory in the memory management system. In this case, an error message is returned. On the one hand, the source of the request can be informed that the current operating system does not support hibernation. On the other hand, it can prevent critical data in the secure memory from being stored to the disk during hibernation, thereby improving the security of critical data.

[0142] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0143] Based on the above embodiment, this embodiment further provides a memory processing device, referring to Figure 3 As shown in the structural diagram, the device specifically includes: an allocation request receiving module 301, an allocation request processing module 302, a transfer request receiving module 303 and a transfer request processing module 304.

[0144] The allocation request receiving module 301 is used to receive a memory allocation request; the memory allocation request includes: a parameter value of a secure memory indication parameter;

[0145] An allocation request processing module 302, configured to allocate a first memory space corresponding to the memory allocation request and add a preset mark to the first memory space when the parameter value of the secure memory indication parameter indicates that a secure memory is to be applied for;

[0146] A transfer request receiving module 303, used to receive a transfer request for memory data; the transfer request is used to transfer the data in the second memory space to the swap partition;

[0147] The transfer request processing module 304 is configured to reject the transfer request if there is a preset mark corresponding to the second memory space.

[0148] Optionally, the parameter value of the secure memory indication parameter is of Boolean type, and a parameter value of true indicates application for secure memory, and a parameter value of false indicates application for non-secure memory; or

[0149] The parameter value of the secure memory indication parameter is of integer type, a parameter value of 1 indicates applying for secure memory, and a parameter value of 0 indicates applying for non-secure memory.

[0150] Optionally, the allocation request processing module includes:

[0151] A first allocation request processing module is configured to add a preset field to a related structure of the first memory space, wherein the preset field or a first preset value of the preset field is used as a preset mark; or

[0152] The second allocation request processing module is used to enable a preset reserved bit of a data structure related to the first memory space, and set the value of the preset reserved bit to a second preset value, which is used as a preset mark.

[0153] Optionally, the device further comprises:

[0154] A first judgment module is used to judge whether there is a preset field in the relevant structure of the second memory space, and if so, there is a preset mark corresponding to the second memory space; or

[0155] A second judgment module is used to judge whether there is a preset field in the relevant structure of the second memory space, and if so, and the value of the preset field is a first preset value, then there is a preset mark corresponding to the second memory space; or

[0156] The third judgment module is used to judge whether the value of the preset reserved bit of the relevant data structure of the second memory space is a second preset value, and if so, there is a preset mark corresponding to the second memory space.

[0157] Optionally, the related structure includes: a linked list node structure, a memory area descriptor structure, or a global memory attribute table.

[0158] Optionally, the allocation request processing module includes:

[0159] A fourth judgment module is used to judge whether the available physical memory is lower than a first preset ratio of the total physical memory of the system when the parameter value of the secure memory indication parameter indicates that the secure memory is applied, and obtain a judgment result;

[0160] an allocation adding module, configured to allocate a first memory space corresponding to the memory allocation request and add a preset mark to the first memory space if the judgment result is no;

[0161] The return module is used to return prompt information for the memory allocation request when the judgment result is yes.

[0162] Optionally, the device further comprises:

[0163] A sleep request receiving module, used for receiving a sleep check request;

[0164] The sleep request processing module is used to return an error message for the sleep check request if the parameter value of the secure memory indication parameter corresponding to any memory space in the memory management system indicates applying for secure memory, or if a preset mark corresponding to any memory space in the memory management system exists.

[0165] Optionally, the sleep check request is a call request for the sleep check function; after receiving the sleep check request, the sleep check function calls the sleep judgment function, and the sleep judgment function determines whether the parameter value of the secure memory indication parameter corresponding to any memory space in the memory management system indicates an application for secure memory, or the sleep judgment function determines whether a preset mark corresponding to any memory space in the memory management system exists, and if so, returns an error message to the sleep check function.

[0166] The embodiment of the present application also provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute instructions (instructions) of each method step in the embodiment of the present application.

[0167] The present application embodiment provides one or more machine-readable media on which instructions are stored, and when executed by one or more processors, an electronic device executes one or more of the methods described in the above embodiments. In the present application embodiment, the electronic device includes various types of devices such as terminal devices and servers (clusters).

[0168] The embodiments of the present disclosure may be implemented as a device that uses any appropriate hardware, firmware, software, or any combination thereof to perform a desired configuration, and the device may include: electronic devices such as terminal devices and servers (clusters). Figure 4 An exemplary apparatus 1100 that can be used to implement various embodiments described in this application is schematically shown.

[0169] For one embodiment, Figure 4 An exemplary apparatus 1100 is shown having one or more processors 1102, a control module (chip set) 1104 coupled to at least one of the (one or more) processors 1102, a memory 1106 coupled to the control module 1104, a non-volatile memory / storage device 1108 coupled to the control module 1104, one or more input / output devices 1110 coupled to the control module 1104, and a network interface 1112 coupled to the control module 1104.

[0170] The processor 1102 may include one or more single-core or multi-core processors, and the processor 1102 may include any combination of general-purpose processors or special-purpose processors (such as graphics processors, application processors, baseband processors, etc.). In some embodiments, the device 1100 can be used as a terminal device, server (cluster), etc. described in the embodiments of the present application.

[0171] In some embodiments, the device 1100 may include one or more computer-readable media (e.g., memory 1106 or non-volatile memory / storage device 1108) having instructions 1114 and one or more processors 1102 configured to execute the instructions 1114 in combination with the one or more computer-readable media to implement a module to perform the actions described in the present disclosure.

[0172] For one embodiment, the control module 1104 may include any suitable interface controller to provide any suitable interface to at least one of the processor(s) 1102 and / or any suitable device or component in communication with the control module 1104 .

[0173] The control module 1104 may include a memory controller module to provide an interface to the memory 1106. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0174] The memory 1106 may be used, for example, to load and store data and / or instructions 1114 for the device 1100. For one embodiment, the memory 1106 may include any suitable volatile memory, such as a suitable DRAM (Dynamic Random Access Memory). In some embodiments, the memory 1106 may include a double data rate type four synchronous dynamic random access memory.

[0175] For one embodiment, the control module 1104 may include one or more input / output controllers to provide an interface to the non-volatile memory / storage device 1108 and the input / output device(s) 1110 .

[0176] For example, non-volatile memory / storage 1108 may be used to store data and / or instructions 1114. Non-volatile memory / storage 1108 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives, one or more optical disk drives, and / or one or more digital versatile optical disk drives).

[0177] The non-volatile memory / storage device 1108 may include storage resources that are physically part of the device on which the apparatus 1100 is installed, or it may be accessible to the device without being part of the device. For example, the non-volatile memory / storage device 1108 may be accessed via (one or more) input / output devices 1110 over a network.

[0178] The input / output device(s) 1110 may provide an interface for the apparatus 1100 to communicate with any other appropriate device, and the input / output device 1110 may include a communication component, an audio component, a sensor component, etc. The network interface 1112 may provide an interface for the apparatus 1100 to communicate through one or more networks, and the apparatus 1100 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, for example, accessing a wireless network based on a communication standard, such as WiFi (Wireless Fidelity), 2G (2nd Generation Wireless Telephone Technology), 3G (3rd Generation Wireless Telephone Technology), 4G (4th Generation Wireless Telephone Technology), 5G (5th Generation Wireless Telephone Technology), etc., or a combination thereof for wireless communication.

[0179] For one embodiment, at least one of the processor(s) 1102 may be packaged together with the logic of one or more controllers (e.g., a memory controller module) of the control module 1104. For one embodiment, at least one of the processor(s) 1102 may be packaged together with the logic of one or more controllers of the control module 1104 to form a system-in-package. For one embodiment, at least one of the processor(s) 1102 may be integrated on the same die with the logic of one or more controllers of the control module 1104. For one embodiment, at least one of the processor(s) 1102 may be integrated on the same die with the logic of one or more controllers of the control module 1104 to form a system-on-chip.

[0180] In various embodiments, the device 1100 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a touch screen device, a netbook, etc.). In various embodiments, the device 1100 may have more or fewer components and / or a different architecture. For example, in some embodiments, the device 1100 includes one or more cameras, a keyboard, a liquid crystal display screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, a dedicated integrated circuit, and a speaker.

[0181] Among them, the main control chip can be used as a processor or control module in the detection device, sensor data, location information, etc. are stored in a memory or non-volatile memory / storage device, the sensor group can be used as an input / output device, and the communication interface may include a network interface.

[0182] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0183] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0184] The present application embodiment is described with reference to the flowchart and / or block diagram of the method, terminal device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device produce a device for implementing the function specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0185] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0186] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce computer-implemented processing, so that the instructions executed on the computer or other programmable terminal device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0187] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0188] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0189] The above is a detailed introduction to a memory processing method and device, an electronic device and a machine-readable medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application sets. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A memory processing method, characterized in that: The method comprises: Receive a memory allocation request; the memory allocation request includes: a parameter value of a secure memory indication parameter; In a case where the parameter value of the secure memory indication parameter indicates an application for secure memory, allocating a corresponding first memory space for the memory allocation request, and adding a preset mark to the first memory space; receiving a transfer request for memory data; the transfer request is used to transfer data in the second memory space to the swap partition; If there is a preset mark corresponding to the second memory space, the transfer request is rejected.

2. The method according to claim 1, characterized in that The parameter value of the secure memory indication parameter is of Boolean type, and a parameter value of true indicates application for secure memory, and a parameter value of false indicates application for non-secure memory; or The parameter value of the secure memory indication parameter is of integer type, a parameter value of 1 indicates applying for secure memory, and a parameter value of 0 indicates applying for non-secure memory.

3. The method according to claim 1, characterized in that The adding a preset mark to the first memory space includes: Adding a preset field to a related structure of the first memory space, wherein the preset field or a first preset value of the preset field is used as a preset mark; or A preset reserved bit of a data structure related to the first memory space is enabled, and a value of the preset reserved bit is set to a second preset value, and the second preset value is used as a preset mark.

4. The method according to claim 3, characterized in that The method further comprises: Determine whether there is a preset field in the relevant structure of the second memory space, and if so, there is a preset mark corresponding to the second memory space; or Determine whether there is a preset field in the related structure of the second memory space, and if so, and the value of the preset field is the first preset value, then there is a preset mark corresponding to the second memory space; or It is determined whether the value of the preset reserved bit of the data structure related to the second memory space is a second preset value. If so, there is a preset mark corresponding to the second memory space.

5. The method according to claim 3, characterized in that: The related structures include: a linked list node structure, a memory area descriptor structure, or a global memory attribute table.

6. The method according to any one of claims 1 to 5, characterized in that: In the case where the parameter value of the secure memory indication parameter indicates that the secure memory is to be applied for, allocating a corresponding first memory space for the memory allocation request, and adding a preset mark to the first memory space, comprises: When the parameter value of the secure memory indication parameter indicates that secure memory is to be applied for, determining whether the available physical memory is lower than a first preset ratio of the total physical memory of the system, and obtaining a determination result; If the judgment result is no, allocating a first memory space corresponding to the memory allocation request, and adding a preset mark to the first memory space; If the judgment result is yes, prompt information is returned for the memory allocation request.

7. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Receive a dormancy check request; If the parameter value of the secure memory indication parameter corresponding to any memory space in the memory management system indicates applying for secure memory, or if a preset mark corresponding to any memory space in the memory management system exists, an error message is returned for the sleep check request.

8. The method according to claim 7, characterized in that The sleep check request is a call request for the sleep check function; after receiving the sleep check request, the sleep check function calls the sleep judgment function, and the sleep judgment function judges whether the parameter value of the secure memory indication parameter corresponding to any memory space in the memory management system indicates an application for secure memory, or the sleep judgment function judges whether a preset mark corresponding to any memory space in the memory management system exists, and if so, returns an error message to the sleep check function.

9. A memory processing device, characterized in that: The device comprises: An allocation request receiving module is used to receive a memory allocation request; the memory allocation request includes: a parameter value of a secure memory indication parameter; an allocation request processing module, configured to allocate a first memory space corresponding to the memory allocation request and add a preset mark to the first memory space when a parameter value of the secure memory indication parameter indicates that a secure memory is to be applied for; A transfer request receiving module, used for receiving a transfer request for memory data; the transfer request is used for transferring the data in the second memory space to the swap partition; The transfer request processing module is used to reject the transfer request if there is a preset mark corresponding to the second memory space.

10. An electronic device, characterized in that: include: processor; and A memory having executable codes stored thereon, which, when executed, causes the processor to execute the method according to any one of claims 1 to 8.

11. A machine-readable medium having executable codes stored thereon, which, when executed, causes a processor to perform the method according to any one of claims 1 to 8.

Images