Memory safety management apparatus and method of operating system

Abstract

The application relates to the technical field of memory management, in particular to a memory safety management device and method of an operating system. The device comprises a memory management module, a data safety module, an authority management module, a log system module and an exception processing module; when the memory management module allocates memory for a program, space record information is simultaneously allocated, including data verification information; after writing data is completed, the data safety module verifies the data of the whole memory to generate a unique signature of the data, and writes the signature into the data verification information; when accessing the memory data, the data safety module generates a unique signature of the memory data and compares the signature with the signature in the data verification information; if the signatures are consistent, the memory access can be normally carried out; if the signatures are inconsistent, the memory access is terminated, and the exception processing module is informed. The application can avoid abnormal memory access, solve the hidden danger of memory protection, avoid memory out-of-bound access and improve the safety of memory protection.

Description

Technical Field

[0001] This invention relates to the field of memory management technology, and more specifically to a memory security management device and management method for an operating system. Background Technology

[0002] Existing operating system memory management mechanisms allow users to manipulate memory flexibly. While this brings convenience, it also introduces significant security risks. With rapid technological advancements and increasing software complexity, the arbitrariness of memory usage has greatly increased, as has the risk of memory corruption. This necessitates memory protection mechanisms.

[0003] Existing memory protection mechanisms typically use an MPU (Memory Protection Unit) to configure memory access permissions and boundaries via hardware, utilize built-in mechanisms in programming languages ​​to prevent out-of-bounds access, and manually add boundary checks. While these existing mechanisms can address some memory vulnerabilities to a certain extent, they still lack memory data verification and access control. Summary of the Invention

[0004] To address the aforementioned technical problems in the prior art, this invention provides a memory security management device and method for an operating system.

[0005] To achieve the above objectives, the technical solution of the present invention is as follows:

[0006] In a first aspect, the present invention provides a memory security management device for an operating system, comprising a memory management module, a data security module, and an exception handling module; the memory management module allocates space recording information when allocating memory for a program, the space recording information including memory security information; the memory security information including data verification information;

[0007] After writing data into memory, the data security module verifies the data in the entire memory block to generate a unique data signature and writes the signature into the data verification information.

[0008] When accessing memory data, the data security module generates a unique signature for the memory data and compares it with the signature in the data verification information;

[0009] If the signatures match, the memory data has not been tampered with and memory access can be performed normally.

[0010] If the signatures do not match, the memory data has been tampered with, memory access is terminated, the memory data is discarded, and the exception handling module is notified.

[0011] Furthermore, the data security module uses a data verification algorithm to verify the data in the entire memory block and generate a unique data signature. The data verification algorithm uses a hash algorithm.

[0012] Furthermore, the memory security information also includes keys, encryption algorithms, and decryption algorithms.

[0013] Furthermore, when writing data to memory, the encryption algorithm is used to encrypt the data before writing it.

[0014] Furthermore, the memory management module divides the memory into a privacy zone and a shared zone. The memory requested in the privacy zone can only be accessed by the owner's program, while the memory requested in the shared zone can be granted access permissions to other programs through an authorization code.

[0015] Furthermore, the memory management module creates a separate memory address mapping table for each program. When allocating memory, it maps memory addresses to random virtual memory addresses, hiding the real memory addresses.

[0016] Furthermore, the spatial recording information also includes basic memory information, which includes the actual memory address and memory size.

[0017] Furthermore, the memory management module sets memory boundaries through virtual memory addresses and memory sizes to prevent programs from accessing memory outside of these boundaries.

[0018] Furthermore, the space recording information also includes memory permission information, and the memory security management system further includes a permission management module, which is used to record and manage memory permission information; the memory permission information includes owner information and authorization information;

[0019] The authorization information includes: program ID, thread ID, authorization code, permission bitmask, and program startup time;

[0020] The permission bitmask is used to define different access permissions:

[0021] 0b0001: Read-only

[0022] 0b0010: Writable

[0023] 0b0100: Executable

[0024] 0b1000: Administrator privileges;

[0025] When a program requests access to memory data, it first verifies the authorization information. If the request information matches the authorization information, the operation is allowed.

[0026] If a mismatch occurs, memory access is terminated, and the exception handling module is notified.

[0027] Furthermore, the administrator privileges include:

[0028] Set the read, write, and execute permissions for child threads. Child threads do not inherit permissions by default; they need to be set by the main thread when creating the child thread.

[0029] A unique authorization code is randomly generated to grant third-party programs read, write, and execute permissions for shared memory;

[0030] Cancel the authorization code for third-party programs.

[0031] Furthermore, after obtaining authorization for shared memory through the authorization code, the third-party program automatically acquires administrator privileges, and only has the administrator privileges to set read, write, and execute permissions for child threads.

[0032] Furthermore, the owner information includes: program ID, main thread ID, parent program ID, owner ID, group ID, and program startup time.

[0033] Furthermore, the memory safety management system also includes a logging system module, which is used to create log files that record memory information requested by the program and memory usage log information.

[0034] Furthermore, the contents of the log file are encrypted by a data security module before being saved to the log file.

[0035] Secondly, the present invention provides a memory security management method, which uses the aforementioned memory security management system for management, the memory security management method comprising:

[0036] Program B is configured to access a portion of the memory information in program A.

[0037] First, program A generates an authorization code. During the generation of the authorization code, the program internally specifies the characteristic information of program B and saves the authorization code on the server. The characteristic information is memory permission information.

[0038] Then, when program B needs to access the server, the server will extract the characteristic information of program B, compare it with the internal information of the authorization code generated by program A, verify whether authorization is required, and grant the corresponding permissions.

[0039] If the verification passes, program B can access program A. During the data access process, the memory management module allocates memory and the data security module provides data security protection for the memory data access process.

[0040] Throughout the entire access process, the abnormal data module performs full-cycle monitoring.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] The memory security management device and method for an operating system provided by this invention provides security protection for the data access process through a data security module. When writing data, the data security module generates a unique signature for the memory data; when accessing data, it also generates a unique signature and compares it with the signature recorded in memory. If the signatures match, normal access is allowed. Therefore, the memory security management system provided by this invention has a data verification step, which can prevent abnormal memory access and solve memory protection risks.

[0043] In addition, this invention sets different levels of permissions through a permission management module to avoid out-of-bounds memory access and improve the security of memory protection. Detailed Implementation

[0044] The technical solution of the present invention will be clearly described below. Obviously, the described embodiments are not all embodiments of the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0045] It should be noted that, unless otherwise specifically stated, the relative arrangement and numerical expressions of the components and steps described in these embodiments should not be construed as limiting the scope of the invention.

[0046] The following description of exemplary embodiments is merely illustrative and is not intended to limit the invention or its application or use in any way. Techniques, methods, and apparatus known to those skilled in the art may not be discussed in detail herein, but where applicable, such techniques, methods, and apparatus should be considered part of this specification.

[0047] Example 1

[0048] This embodiment provides a memory security management device for an operating system, including a memory management module, a data security module, a permission management module, a log system module, and an exception handling module.

[0049] Memory management module

[0050] The memory management module divides memory into two regions: a privacy region and a shared region. The memory management module creates a separate memory address mapping table for each program. When allocating memory from the privacy region or the shared region, the memory address is mapped to a random virtual memory address, hiding the real memory address. The memory address mapping table records the mapping relationship between virtual memory addresses and real memory addresses.

[0051] After memory is allocated, the main thread of the program that requested the memory is the owner. Memory allocated in the privacy area can only be accessed by the owner's program, while memory allocated in the shared area can be granted access permissions to other programs through an authorization code.

[0052] Each time memory is allocated, additional space is allocated to record memory information, which can be called space record information. This includes basic memory information, memory security information, and memory permission information. The basic memory information includes the actual memory address and memory size.

[0053] In addition, the memory management module sets memory boundaries by using virtual memory addresses and memory sizes to prevent programs from accessing memory outside of these boundaries.

[0054] When a program actively releases memory or exits normally, the memory management module cleans up the memory requested by the program and the memory information, including basic memory information, memory security information, and memory permission information.

[0055] Data security module

[0056] The data security module records memory security information for each allocated memory block. This information includes data verification information, a key, an encryption algorithm, and a decryption algorithm. When allocating memory, the data security module writes the encryption / decryption algorithm and the generated key into the memory security information. Subsequent data encryption / decryption is then performed using the key and the encryption / decryption algorithm. The encryption / decryption algorithm can be a mainstream existing algorithm or a custom algorithm.

[0057] When writing data to memory, the data security module encrypts the data before writing it. After the data is written, a data verification algorithm is used to verify the data in the entire memory block to generate a unique data signature, and the signature is written into the data verification information. The preferred data verification algorithm is a hash algorithm, such as the SHA-256 algorithm, which can quickly generate a unique signature.

[0058] When accessing memory data, a unique signature is generated for the memory data using a data verification algorithm and compared with the signature of the data verification information. If the signatures match, the memory data has not been tampered with and memory access can be performed normally; if the signatures do not match, the memory data has been tampered with, memory access is terminated, the memory data is discarded, and the exception handling module is notified.

[0059] Access Management Module

[0060] The permission management module records memory permission information for each allocated memory block. The memory permission information includes owner information and authorization information. The owner information includes: program ID, main thread ID, parent program ID, owner ID, group ID, and program start time. The permission management module creates a permission table for each allocated memory block to record memory authorization information. Each permission information entry in the permission table includes: program ID, thread ID, authorization code, permission bitmask, and program start time.

[0061] The permission bits use a bitmask method to define different access permissions:

[0062] 0b0001: Read-only

[0063] 0b0010: Writable

[0064] 0b0100: Executable

[0065] 0b1000: Administrator privileges

[0066] The corresponding data position 1 indicates that the user has this permission;

[0067] Administrator privileges are exclusive to the main thread of the program, and there are three administrator privileges:

[0068] (1) Set the read / write / execute permissions for the child thread. The child thread does not inherit the permissions by default and needs to be set by the main thread when creating the child thread.

[0069] (2) Randomly generate a unique authorization code to grant third-party programs read / write / execute permissions for shared memory;

[0070] (3) Cancel the authorization code of the third-party program;

[0071] After a third-party program obtains authorization for shared memory through an authorization code, it automatically acquires administrator privileges, possessing only the first set of administrator privileges, but not other administrator privileges.

[0072] When the main thread grants shared memory permissions to a child thread, it cannot exceed its own permissions. For example, if the main thread has read permissions, it can only grant read permissions to the child thread, and cannot grant other permissions.

[0073] When a program requests access to memory data, it first verifies the information in the memory permission table. The operation is only allowed if the request information matches the information in the memory permission table. If they do not match, the memory access is terminated and the exception handling module is notified.

[0074] Log system module

[0075] The log system module creates log files on a program-by-program basis, recording the memory information requested by the program and the memory usage log information; the log content is encrypted by the data security module before being saved to the log file.

[0076] Exception handling module

[0077] The exception handling module monitors the entire lifecycle of each memory block from allocation to release;

[0078] The exception handling module maintains a program blacklist. When it detects abnormal access such as out-of-bounds memory access or unauthorized access, it records the information of the program making the abnormal access in the blacklist. All programs on the blacklist are prohibited from accessing memory data.

[0079] When the program exits, the exception handling module notifies other modules to clean up memory; if the program exits abnormally, the memory data is dumped and saved to a file before cleaning up memory. The log file and memory data dump file can then be decrypted to analyze the cause of the program exception.

[0080] Example 2

[0081] This embodiment provides a memory security management method for an operating system, using the memory security management device provided in Embodiment 1 for management. The memory security management method includes:

[0082] If program B wants to access some memory information in program A, then...

[0083] First, program A generates an authorization code. During the generation process, program B's characteristic information is specified internally, and the authorization code is stored on the server. The characteristic information is memory permission information, including: owner information and authorization information. The owner information includes: program ID, main thread ID, parent program ID, owner ID, group ID, and program startup time. When program A generates the authorization code, it will generate preliminary permission information, which can be modified and adjusted later as needed.

[0084] Then, when program B needs to access the server, the server will extract program B's characteristic information and compare it with the internal information of the authorization code generated by program A to verify whether authorization is required and grant the corresponding permissions. The permission bits use a bitmask method to define different access permissions:

[0085] 0b0001: Read-only

[0086] 0b0010: Writable

[0087] 0b0100: Executable

[0088] 0b1000: Administrator privileges

[0089] The corresponding data position 1 indicates that the user has this permission.

[0090] Afterwards, if the verification passes and program B can access the shared content, the memory management module allocates memory for the data access process. During data access, the data security module ensures data security, recording memory security information for each allocated memory block. This memory security information includes: data verification information, a key, and encryption / decryption algorithms. When allocating memory, the encryption / decryption algorithm and the generated key are written into the memory security information; subsequent data encryption / decryption is performed using the key and the encryption / decryption algorithm. When writing data to memory, the data is encrypted before writing. After the data is written, the data verification algorithm verifies the data in the entire memory block to generate a unique data signature, which is then written into the data verification information. Throughout the entire access process, the exception handling module performs full-cycle monitoring.

[0091] If the verification fails, memory access is terminated and the exception handling module is notified.

[0092] The above specific embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A memory security management device for an operating system, characterized in that, It includes a memory management module, a data security module, and an exception handling module; When the memory management module allocates memory for the program, it also allocates space recording information, which includes memory safety information. The memory security information includes data verification information; After writing data into memory, the data security module verifies the data in the entire memory block to generate a unique data signature and writes the signature into the data verification information. When accessing memory data, the data security module generates a unique signature for the memory data and compares it with the signature in the data verification information; If the signatures match, the memory data has not been tampered with and memory access can be performed normally. If the signatures do not match, the memory data has been tampered with, memory access is terminated, the memory data is discarded, and the exception handling module is notified. The spatial recording information also includes memory permission information. The memory permission information includes owner information and authorization information; The authorization information includes: program ID, thread ID, authorization code, permission bitmask, and program startup time; The permission bitmask is used to define different access permissions: 0b0001: Read-only 0b0010: Writable 0b0100: Executable 0b1000: Administrator privileges; The administrator privileges include: Set the read, write, and execute permissions for child threads. Child threads do not inherit permissions by default; they need to be set by the main thread when creating the child thread. A unique authorization code is randomly generated to grant third-party programs read, write, and execute permissions for shared memory; Cancel the authorization code for third-party programs; After obtaining authorization for shared memory through the authorization code, the third-party program automatically acquires administrator privileges, and only has the administrator privileges to set read, write, and execute permissions for child threads.

2. The memory security management device according to claim 1, characterized in that, The data security module uses a data verification algorithm to verify the data in the entire memory block and generate a unique data signature. The data verification algorithm uses a hash algorithm.

3. The memory security management device according to claim 1, characterized in that, The memory security information also includes keys, encryption algorithms, and decryption algorithms; When writing data to memory, the encryption algorithm is used to encrypt the data before writing.

4. The memory security management device according to claim 1, characterized in that, The memory management module divides memory into a privacy zone and a shared zone. Memory allocated in the privacy zone can only be accessed by the owner's program, while memory allocated in the shared zone can be granted access permissions to other programs through an authorization code. The memory management module creates a separate memory address mapping table for each program. When allocating memory, it maps memory addresses to random virtual memory addresses, thus hiding the real memory addresses. The spatial recording information also includes basic memory information, which includes the actual memory address and memory size.

5. The memory security management device according to claim 1, characterized in that, The memory management module sets memory boundaries by using virtual memory addresses and memory sizes to prevent programs from accessing memory outside of these boundaries.

6. The memory security management device according to claim 1, characterized in that, The memory security management system also includes a permission management module, which is used to record and manage memory permission information; When a program requests access to memory data, it first verifies the authorization information. If the request information matches the authorization information, the operation is allowed. If a mismatch occurs, memory access is terminated, and the exception handling module is notified.

7. The memory security management device according to claim 1, characterized in that, The memory safety management system also includes a log system module, which is used to create log files that record memory request information and memory usage log information of the program. The contents of the log file are encrypted by the data security module before being saved to the log file.

8. A memory security management method for an operating system, using the memory security management device according to any one of claims 1-7, characterized in that, The memory security management method includes: Program B is configured to access a portion of the memory information in program A. First, program A generates an authorization code. During the generation of the authorization code, the program internally specifies the characteristic information of program B and saves the authorization code on the server. The characteristic information is memory permission information. Then, when program B needs to access the server, the server will extract the characteristic information of program B, compare it with the internal information of the authorization code generated by program A, verify whether authorization is required, and grant the corresponding permissions. If the verification passes, program B can access program A. During the data access process, the memory management module allocates memory and the data security module provides data security protection for the memory data access process. Throughout the entire access process, the abnormal data module performs full-cycle monitoring.