A memory data management method, electronic equipment, storage medium and program product

Abstract

The application discloses a memory data management method, an electronic device, a storage medium and a program product, relates to the technical field of storage, and comprises the following steps: realizing memory data management based on a native memory management mechanism and a page fault exception mechanism, processing the physical address of to-be-encrypted data by using a first key through step-by-step encryption, performing exclusive or operation on the obtained first ciphertext and the to-be-encrypted data, and storing the obtained second ciphertext into a red-black tree in a memory space, so that the encryption range is expanded, the data security is improved, the memory space and the red-black tree are fully utilized, and the addition, deletion and modification performance is improved. The target second ciphertext to be migrated is further encrypted and written into a swap area file. The method is realized by using pure software and does not depend on specific hardware devices. The technical problems of poor compatibility, high cost, being not conducive to large-scale application and great influence on system performance are solved, the technical effects of good compatibility, reduced cost, convenience for large-scale application and reduced influence on system performance are achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of storage, and in particular to a memory data management method, an electronic device, a storage medium and a program product. BACKGROUND

[0002] The current memory data management methods mainly include two kinds, one is to encrypt the memory data on the hardware device responsible for memory management. The other is to encrypt the memory data through file data encryption method.

[0003] But the two kinds of memory data management methods have their own shortcomings, first, the encryption protection scheme through the hardware device needs to rely on hardware device, resulting in poor compatibility, high cost, not conducive to large-scale application. Secondly, the file data encryption method has a great influence on system performance. SUMMARY

[0004] The present application provides a memory data management method, an electronic device, a storage medium and a program product, to at least solve the problems of poor compatibility, high cost, not conducive to large-scale application, and great influence on system performance in the related art.

[0005] The present application provides a memory data management method, comprising:

[0006] Traverse the memory space corresponding to each process respectively to obtain the target memory page that can be encrypted;

[0007] Determine the data in the target memory page as the encrypted data to be encrypted, and read the encrypted data to be encrypted and the physical address of the encrypted data to be encrypted;

[0008] Obtain the first key and the physical address of the encrypted data to be encrypted, and process the physical address by using the first key to obtain the first ciphertext;

[0009] XOR operation is performed on the encrypted data to be encrypted and the first ciphertext to obtain the second ciphertext, and the second ciphertext is stored in the red-black tree;

[0010] Traverse the red-black tree to obtain the second ciphertext to be written into the swap area file, and determine the second ciphertext to be written into the swap area file as the target second ciphertext;

[0011] The target second ciphertext is called from the red-black tree, a second key is obtained, and the target second ciphertext is encrypted by using the second key to obtain a third ciphertext;

[0012] XOR operation is performed on the first ciphertext and the third ciphertext to obtain a fourth ciphertext, and the fourth ciphertext is written into the swap area file.

[0013] The application further provides an electronic device, comprising a memory for storing a computer program, and a processor for executing the computer program to implement the steps of any of the memory data management methods.

[0014] The application further provides a computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement the steps of any of the memory data management methods.

[0015] The application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of any of the memory data management methods.

[0016] Through the application, the memory data management based on the native memory management mechanism and the page fault exception mechanism is compatible with the native function in function, and has better compatibility and stability. By using step-by-step encryption, the physical address of the data to be encrypted is processed by using the first key to obtain the first ciphertext, and the data to be encrypted and the first ciphertext are subjected to XOR operation, and the obtained second ciphertext is stored in the red-black tree in the memory space, thereby expanding the encryption range and improving the data security, and the memory space and the red-black tree are fully utilized. Since the data encryption is currently performed in the system memory, and the data is accessed and used more frequently, the encryption and decryption of the data are also more frequent, so the XOR algorithm is used for basic encryption and decryption, which not only realizes further encryption of the data, but also improves the performance and reduces the influence on the system and process running. When the target second ciphertext to be migrated from the red-black tree to the swap file is determined, the target second ciphertext is further encrypted and written to the swap file. By using pure software implementation, the cost is lower, and the compatibility is further improved. By controlling the data to be encrypted, flexible encryption range control is realized, and a good balance between encryption strength and performance can be achieved. Thus, a dynamic memory encryption method and system compatible with the native memory management mechanism, independent of specific hardware, and with controllable performance influence is realized. Therefore, the technical problems of poor compatibility, high cost, not conducive to large-scale application, and large influence on system performance can be solved, and the technical effects of good compatibility, reduced cost, easy large-scale application, and reduced influence on system performance are achieved. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the application, the drawings needed in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0018] Figure 1A structural diagram of a memory data management system provided by an embodiment of the present application is shown in FIG. 1.

[0019] Figure 2 An implementation flowchart of a memory data management method provided by an embodiment of the present application is shown in FIG. 2.

[0020] Figure 3 An implementation flowchart of another memory data management method provided by an embodiment of the present application is shown in FIG. 3.

[0021] Figure 4 A structural block diagram of a memory data management device provided by an embodiment of the present application is shown in FIG. 4. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments of the present application, any other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0023] It should be noted that, in the description of the present application, the terms "comprise", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. The terms "first", "second" and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0024] In order for those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0025] In conjunction with the specific application environment architecture or specific hardware architecture on which the execution of the memory data management method depends, the specific application environment architecture or specific hardware architecture is described here.

[0026] Referring to Figure 1 , Figure 1 A structural diagram of a memory data management system provided by an embodiment of the present application is shown in FIG. 1. The memory data management system mainly includes three components, i.e. a memory replacement and data encryption component, an encrypted non-swapped memory page red-black tree component, and a page fault exception handling and data decryption component.

[0027] The memory replacement and data encryption component is based on the memory replacement function part in the original system kernel memory management system. The main difference is that the new scanning, replacement and data encryption function for dynamic memory pages are added. Compared with the original memory replacement mechanism, the new scanning algorithm for dynamic memory pages is not modified, such as the Least Recently Used (LRU) algorithm, but its conditions will be more stringent than the original algorithm, and it will replace a larger range of memory pages. The replacement here is different from the original meaning of replacement, but is a modified replacement with data encryption function, which is a new replacement with encrypted non-swap memory page red-black tree data structure. During the replacement process, the data in the target memory page will be encrypted, and the encryption algorithm is the first part of the XTS mode in the symmetric encryption algorithm mode, that is, the tweak and data plaintext are exclusive or, and then the encrypted data is passed to the encrypted non-swap memory page red-black tree component for storage. The memory replacement logic of the original system kernel memory management component is moved between the swap file and the encrypted non-swap memory page red-black tree component, and the data in the red-black tree that has not been accessed for a long time is swapped out to the swap file for storage, and in this process, the second and third parts of the XTS mode encryption operation are completed, that is, "data encryption" and "tweak and ciphertext exclusive or". Ensure that the data stored in the swap file is also ciphertext. By dividing the XTS mode into two parts, since the first part of the exclusive or operation has less performance impact, it is beneficial to quickly swap the memory page between the process memory and the red-black tree, reducing the impact on the system. And the disk write performance is poor, so the performance bottleneck of the encryption operation is no longer a problem, thereby minimizing the impact on the system. Of course, if the processor has excellent performance, then the complete XTS mode encryption and decryption operation can also be performed during the system memory and red-black tree replacement process.

[0028] The main function of the encrypted non-swapped memory page red-black tree component is to maintain a red-black tree data structure storing memory page information in memory, and to store encrypted data swapped out from the process memory (i.e., system memory) according to the requirements of the memory swapping and data encryption component. The encrypted data is decrypted and then swapped out from the red-black tree to the process memory or further encrypted and migrated to the swap file. The significance of this component is that the more stringent memory page scanning algorithm used in the memory swapping and data encryption component results in a larger range of data being encrypted and swapped out from the process memory, which is actually accessed and used by the process, and the probability of being accessed and used is much higher than the data swapped out by the original memory swapping mechanism of the system. If there is no mechanism to temporarily store encrypted data in memory, all data needs to be read and written from the swap file through the disk, and also needs to be encrypted and decrypted, which will have a great impact on the performance of the system. By setting up a red-black tree, the swapping of this part of data can be directly performed in memory, and the performance of adding, deleting, modifying and querying can be improved through the red-black tree data structure, thereby minimizing the impact of data access. The data that meets the original swapping condition and has not been accessed for a long time is also swapped from the red-black tree to the swap area, thereby achieving optimal use of memory space. A good balance point is achieved between the original memory management performance and the data encryption requirement of the memory.

[0029] The page fault exception handling and data decryption component is corresponding to the memory swapping and data encryption component, and is responsible for decrypting and loading the encrypted data from the red-black tree and the swap file back to the system memory. When the data is swapped out from the process memory, the process cannot directly access the data in the process memory. In the original memory management mechanism of the operating system, the page fault exception mechanism is used to realize the reloading of the data. When the process tries to access the data, the memory management unit checks whether the data is in the physical memory. If not, a page fault exception interrupt is triggered. The processor learns about the interrupt, finds and calls the page fault exception handling program according to the exception vector table, and the page fault exception handling program is responsible for finding the data, loading it from the swap file to the memory, and performing related memory management transactions, so that the program can normally access and use the data. The page fault exception handling and data decryption component is modified and improved based on the page fault exception handling program, so that it can search the encrypted non-swapped memory page red-black tree component and the swap file, find the target data, decrypt it and load it to the process memory, so that it can be normally accessed and used.

[0030] Embodiments of the present application provide a memory data management method. The method is described in detail in combination with the execution flow of the memory data management method.

[0031] Referring to Figure 2 ,Figure 2 An implementation flowchart of a memory data management method provided for an embodiment of the present application can include the following steps.

[0032] S201: Traverse the memory space corresponding to each process respectively to obtain an encryptable target memory page.

[0033] During the running of each process, the memory space corresponding to each process is traversed, and the memory space is placed with the code of the process, the pre-set data loaded from the program file, the data dynamically generated during running, etc. These data will dynamically change with the execution of the program, and there are cases where some data is read and written more frequently, and some data is read and written less frequently. The access of each memory page contained in each memory space can be determined according to the traversal result, and the encryptable target memory page can be found according to the access of each memory page.

[0034] S202: Determine the data in the target memory page as encrypted data, and read the encrypted data and the physical address of the encrypted data.

[0035] After obtaining the encryptable target memory page through traversal, the data in the target memory page is determined as encrypted data, and the encrypted data and the physical address of the encrypted data are read.

[0036] S203: Obtain a first key and process the physical address using the first key to obtain a first ciphertext.

[0037] After reading the encrypted data and the physical address of the encrypted data, a first key is obtained, such as a first key obtained from a Trusted Platform Module (TPM), or a first key defined by a user in advance as key data, and the physical address is processed using the first key to obtain a first ciphertext.

[0038] S204: Perform an exclusive OR operation on the encrypted data and the first ciphertext to obtain a second ciphertext, and store the second ciphertext in a red-black tree.

[0039] After processing the physical address of the encrypted data using the first key to obtain the first ciphertext, an exclusive OR operation is performed on the encrypted data and the first ciphertext to obtain a second ciphertext, and the second ciphertext is stored in a red-black tree. Since the data is currently encrypted in the system memory and will be accessed and used more frequently, the encryption and decryption of the data is also more frequent, so the exclusive OR algorithm is used for basic encryption and decryption, which not only realizes further encryption of the data, but also improves the performance and reduces the impact on the system and the running process. By storing the second ciphertext in the red-black tree, the release of the process corresponding to the memory space to which the target memory page belongs is realized.

[0040] S205: Traverse the red-black tree to obtain the second ciphertext to be written into the swap area file, and determine the second ciphertext to be written into the swap area file as the target second ciphertext.

[0041] After storing the second ciphertext in the red-black tree, traverse the red-black tree to obtain the second ciphertext to be written into the swap area file. For example, by traversing the red-black tree, the storage time of each second ciphertext in the red-black tree can be obtained. According to the storage time, the second ciphertext to be written into the swap area file is filtered from the second ciphertexts, and the second ciphertext to be written into the swap area file is determined as the target second ciphertext.

[0042] S206: Retrieve the target second ciphertext from the red-black tree, obtain the second key, and encrypt the target second ciphertext using the second key to obtain the third ciphertext.

[0043] After determining the second ciphertext to be written into the swap area file as the target second ciphertext, retrieve the target second ciphertext from the red-black tree, obtain the second key, and encrypt the target second ciphertext using the second key to obtain the third ciphertext. The second key realizes further encryption of data.

[0044] S207: XOR the first ciphertext and the third ciphertext to obtain the fourth ciphertext, and write the fourth ciphertext into the swap area file.

[0045] After encrypting the target second ciphertext using the second key to obtain the third ciphertext, XOR the first ciphertext and the third ciphertext to obtain the fourth ciphertext, and write the fourth ciphertext into the swap area file. By using the second key to further encrypt the target second ciphertext in the process of transferring the target second ciphertext from the red-black tree to the swap area file to obtain the third ciphertext, and then XORing the first ciphertext and the third ciphertext, since the swap area file is deployed in the disk, the write performance of the disk is poorer than that of the process memory, so the performance bottleneck of this part of encryption operation can be ignored, thereby achieving a good balance point between native memory management performance and memory data encryption demand.

[0046] By the application, the memory data management realized based on the native memory management mechanism and the page fault exception mechanism is compatible with the native function in function, and has better compatibility and stability. By using step-by-step encryption, the physical address of the data to be encrypted is processed by using the first key to obtain the first ciphertext, and the data to be encrypted and the first ciphertext are subjected to XOR operation, and the obtained second ciphertext is stored in the red-black tree in the memory space, thereby expanding the encryption range and improving the data security, and the memory space and the red-black tree are fully utilized. Since the data encryption is currently performed in the system memory, and the data is frequently accessed and used, the encryption and decryption of the data are also frequent, so the XOR algorithm is used for basic encryption and decryption, which not only realizes further encryption of the data, but also improves the performance and reduces the influence on the system and the process running. When the target second ciphertext to be migrated from the red-black tree to the swap file is determined, the target second ciphertext is further encrypted and written to the swap file. By using pure software implementation, the system does not depend on specific hardware, and the cost is lower, and the compatibility is further improved. By controlling the data to be encrypted, flexible encryption range control is realized, and a good balance between encryption strength and performance can be achieved. Thus, a dynamic memory encryption method and system compatible with the native memory management mechanism, independent of specific hardware, and with controllable performance influence is realized. Therefore, the technical problems of poor compatibility, high cost, not conducive to large-scale application, and great influence on system performance can be solved, and the technical effects of good compatibility, reduced cost, easy large-scale application, and reduced influence on system performance are achieved.

[0047] Referring to Figure 3 , Figure 3 An implementation flowchart of another memory data management method provided by the embodiment of the application can include the following steps.

[0048] S301: The memory spaces respectively corresponding to each process are traversed to obtain the idle time lengths respectively corresponding to each memory page in each memory space.

[0049] The idle time lengths respectively corresponding to each memory page are recorded in the memory space in advance, and the idle time length is the time length from the last access to the current time. The memory spaces respectively corresponding to each process are traversed to obtain the idle time lengths respectively corresponding to each memory page in each memory space.

[0050] S302: It is judged whether there is a memory page with an idle time length exceeding a first preset time length, if yes, step S303 is executed, and if not, step S301 is returned.

[0051] After the idle time of each memory page in each memory space is obtained by traversing the memory space corresponding to each process respectively, it is determined whether there is a memory page whose idle time exceeds the first preset time. If yes, it indicates that the current time is relatively far from the last access time of the memory page, and step S303 is executed. If no, it indicates that each memory page is relatively frequently accessed, and step S301 is returned to continue polling monitoring.

[0052] It should be noted that the first preset time can be set and adjusted according to actual conditions, and the embodiment of the application does not limit this.

[0053] S303: Determine the memory page whose idle time exceeds the first preset time as a target memory page.

[0054] When it is determined that there is a memory page whose idle time exceeds the first preset time, the memory page whose idle time exceeds the first preset time is determined as a target memory page, so that the target memory page that can be used for process release is screened.

[0055] S304: Determine the data in the target memory page as to-be-encrypted data, and read the to-be-encrypted data and the physical address of the to-be-encrypted data.

[0056] S305: Find a first key from a trusted security platform module, and process the physical address by using the first key to obtain a first ciphertext.

[0057] The trusted security platform module for key storage is pre-set. After the data in the target memory page is determined as to-be-encrypted data, and the to-be-encrypted data and the physical address of the to-be-encrypted data are read, the first key is found from the trusted security platform module, and the physical address is processed by using the first key to obtain the first ciphertext. By finding the first key from the trusted security platform module, the key protection capability of the trusted security platform module is fully utilized, which can avoid key leakage, and the trusted security platform module can perform encryption and decryption operations, which can improve the operation performance, reduce the occupation and influence of software performance, and the like.

[0058] S306: Perform exclusive or operation on the to-be-encrypted data and the first ciphertext to obtain a second ciphertext, and store the second ciphertext in a red-black tree.

[0059] S307: Obtain a target process memory page table corresponding to a target memory space to which the target memory page belongs.

[0060] The process memory page table corresponding to each memory space is pre-maintained, and the accessible memory page in the memory space is stored by using the process memory page table. After the second ciphertext is stored in the red-black tree, the target process memory page table corresponding to the target memory space to which the target memory page belongs is obtained.

[0061] S308: delete the target memory page from the target process memory page table.

[0062] After obtaining the target process memory page table corresponding to the target memory space to which the target memory page belongs, the target memory page is deleted from the target process memory page table. By deleting the target memory page from the target process memory page table in a timely manner, effective maintenance of the data storage situation is realized.

[0063] S309: traverse the red-black tree to obtain second ciphertexts that have not been accessed for more than a second preset time length in the red-black tree.

[0064] After storing the second ciphertext in the red-black tree, the red-black tree is traversed to obtain second ciphertexts that have not been accessed for more than a second preset time length in the red-black tree.

[0065] It should be noted that the second preset time length can be set and adjusted according to actual conditions, and the embodiments of the present application do not limit this.

[0066] The second preset time length can be a comparative reference object of the cumulative unaccessed time length from the time of storing in the red-black tree, in which case there is no size limit on the first preset time length and the second preset time length. The second preset time length can also be a comparative reference object of the cumulative unaccessed time length of data from the memory space, in which case the second preset time length is greater than the first preset time length. By setting the second preset time length as a screening condition for migrating data to the swap file, the accuracy of data migration is further ensured.

[0067] S310: determine the second ciphertexts that have not been accessed for more than a second preset time length as second ciphertexts to be written to the swap file, and determine the second ciphertexts to be written to the swap file as target second ciphertexts.

[0068] After traversing the red-black tree to obtain second ciphertexts that have not been accessed for more than a second preset time length in the red-black tree, the second ciphertexts that have not been accessed for more than a second preset time length are determined as second ciphertexts to be written to the swap file, and the second ciphertexts to be written to the swap file are determined as target second ciphertexts. By setting the second preset time length to screen the second ciphertexts to be written to the swap file, the system memory is released in a timely manner, so that the system memory can be better utilized.

[0069] S311: retrieve the target second ciphertext from the red-black tree, and find the second key from the trusted security platform module.

[0070] After the second ciphertext to be written into the swap file is determined as the target second ciphertext, the target second ciphertext is called from the red-black tree, and the second key is searched from the trusted secure platform module. By searching the second key from the trusted secure platform module, the trusted secure platform module key protection capability is fully utilized, key leakage can be avoided, and the second key can perform encryption and decryption operations, which can improve operation performance, reduce software performance occupation and influence, and other advantages.

[0071] S312: Perform encryption operation on the target second ciphertext by using the second key to obtain third ciphertext.

[0072] After the second key is searched from the trusted secure platform module, the encryption operation of the symmetric encryption and decryption algorithm is performed on the target second ciphertext by using the second key to obtain third ciphertext. By using the encryption operation of the symmetric encryption and decryption algorithm, the advantage of small performance influence of the symmetric encryption and decryption algorithm is fully utilized.

[0073] S313: Perform XOR operation on the first ciphertext and the third ciphertext to obtain fourth ciphertext, and write the fourth ciphertext into the swap file.

[0074] In one specific embodiment of the present application, the method can further include the following steps:

[0075] Step one: parse the received memory access request to obtain a memory page to be accessed;

[0076] Step two: perform memory page lookup on the process memory page table corresponding to the memory space to which the memory page to be accessed belongs;

[0077] Step three: determine whether the memory page to be accessed is found, if not, execute step four, if yes, execute step five;

[0078] Step four: trigger a page fault exception interrupt to make the processor search an interrupt table of a system kernel according to the page fault exception interrupt, search a page fault exception processing program from the interrupt table, and decrypt and load the memory page to be accessed by using the page fault exception processing program;

[0079] Step five: decrypt the memory page to be accessed from the swap file, and load the data obtained after decryption to the memory space to which the memory page to be accessed belongs.

[0080] For convenience of description, the above five steps can be combined for description.

[0081] When data access is needed, the received memory access request is parsed to obtain a to-be-accessed memory page, a memory page lookup is performed on a process memory page table corresponding to a memory space to which the to-be-accessed memory page belongs, it is judged whether the to-be-accessed memory page is found, if not, a page fault exception interrupt is triggered, so that the processor finds an interrupt table of a system kernel according to the page fault exception interrupt, and finds a page fault exception processing program from the interrupt table, the to-be-accessed memory page is decrypted and loaded by using the page fault exception processing program, if yes, the to-be-accessed memory page is decrypted from the swap file, and the data obtained after decryption is loaded to the memory space to which the to-be-accessed memory page belongs. By compatible with the original page fault exception mechanism, when the to-be-accessed memory page is not found in the process memory page table, the red-black tree and the swap file are directly found through the page fault exception processing program, better compatibility and stability are obtained, and normal data access is ensured.

[0082] In one specific embodiment of the application, decrypting and loading the to-be-accessed memory page by using the page fault exception processing program can include the following steps:

[0083] Step one: the memory page identifier information of the to-be-accessed memory page is found in the red-black tree by using the page fault exception processing program; wherein the red-black tree stores the corresponding relationship between each second ciphertext and each memory page identifier information;

[0084] Step two: it is judged whether the memory page identifier information of the to-be-accessed memory page is found in the red-black tree, if yes, step three is executed, if not, step four is executed;

[0085] Step three: the second ciphertext in the to-be-accessed memory page is decrypted from the red-black tree, and the data obtained after decryption is loaded to the memory space to which the to-be-accessed memory page belongs;

[0086] Step four: the to-be-accessed memory page is decrypted from the swap file, and the data obtained after decryption is loaded to the memory space to which the to-be-accessed memory page belongs.

[0087] For convenience of description, the above four steps can be combined for description.

[0088] The red-black tree stores the correspondence between each second ciphertext and each memory page identification information, when it is determined that the to-be-accessed memory page is not found in the process memory page table, the memory page identification information of the to-be-accessed memory page is found in the red-black tree by using a page fault exception processing program, it is judged whether the memory page identification information of the to-be-accessed memory page is found in the red-black tree, if yes, the second ciphertext in the to-be-accessed memory page is decrypted from the red-black tree, and the data obtained after decryption is loaded to the memory space to which the to-be-accessed memory page belongs, if not, the to-be-accessed memory page is decrypted from the swap file, and the data obtained after decryption is loaded to the memory space to which the to-be-accessed memory page belongs. By pre-storing the correspondence between each second ciphertext and each memory page identification information, and combining the adding, deleting and modifying performance of the red-black tree, the fast and accurate search of the second ciphertext in the to-be-accessed memory page is realized.

[0089] In one specific embodiment of the present application, the second ciphertext in the to-be-accessed memory page is decrypted from the red-black tree, which can include the following steps:

[0090] The second ciphertext in the to-be-accessed memory page is decrypted from the red-black tree by using the inverse operation of the first step of the cipher stealing adjustment password book mode.

[0091] After the memory page identification information of the to-be-accessed memory page is found in the red-black tree, the second ciphertext in the to-be-accessed memory page is decrypted from the red-black tree by using the inverse operation of the first step of the cipher stealing adjustment password book mode. Thus, the fast decryption of the second ciphertext in the system memory is realized, which greatly reduces the influence of the decryption process on the system performance.

[0092] In one specific embodiment of the present application, the to-be-accessed memory page is decrypted from the swap file, which can include the following steps:

[0093] The to-be-accessed memory page is decrypted from the swap file by executing the complete decryption process of the cipher stealing adjustment password book mode.

[0094] If the memory page identification information of the to-be-accessed memory page is not found in the red-black tree, the to-be-accessed memory page is decrypted from the swap file by executing the complete decryption process of the cipher stealing adjustment password book mode. By decrypting the to-be-accessed memory page from the swap file by executing the complete decryption process of the cipher stealing adjustment password book mode, since the swap file is deployed in the disk, the reading performance of the disk is poorer than that of the process memory, so the performance bottleneck of this part of encryption operation can be ignored, thereby a good balance point between the native memory management performance and the memory data decryption demand is obtained.

[0095] In one specific embodiment of the present application, loading the decrypted data into the memory space to which the memory page to be accessed belongs can include the following steps:

[0096] Step one: performing physical memory allocation on the memory page to be accessed to obtain a target physical memory;

[0097] Step two: migrating the decrypted data to the target physical memory;

[0098] Step three: obtaining a virtual address corresponding to the target physical memory;

[0099] Step four: modifying a process memory page table according to the virtual address.

[0100] For convenience of description, the above four steps can be combined for description.

[0101] Performing physical memory allocation on the memory page to be accessed to obtain a target physical memory, migrating the decrypted data to the target physical memory, obtaining a virtual address corresponding to the target physical memory, and modifying a process memory page table according to the virtual address. Through physical memory allocation, data migration, virtual address obtaining, and process memory page table modification, the decrypted data is accurately loaded into the memory space.

[0102] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be realized by means of software and a general hardware platform as necessary, and of course, it can also be realized by hardware, but in many cases, the former is a better embodiment.

[0103] The embodiments of the present application also provide a memory data management device.

[0104] Referring to Figure 4 , Figure 4 A structural block diagram of a memory data management device provided by the embodiments of the present application is shown in the figure, and the device can include:

[0105] A target memory page obtaining unit 41 is configured to traverse memory spaces respectively corresponding to each process to obtain an encryptable target memory page;

[0106] A data reading unit 42 is configured to determine data in the target memory page as to-be-encrypted data, and read the to-be-encrypted data and a physical address of the to-be-encrypted data;

[0107] A first ciphertext obtaining unit 43 is configured to obtain a first key and process the physical address by using the first key to obtain a first ciphertext;

[0108] A second ciphertext storage unit 44 is configured to perform exclusive or operation on the to-be-encrypted data and the first ciphertext to obtain a second ciphertext, and store the second ciphertext in a red-black tree;

[0109] The target second ciphertext determination unit 45 is configured to traverse the red-black tree to obtain the second ciphertext to be written into the swap file, and determine the second ciphertext to be written into the swap file as the target second ciphertext.

[0110] The third ciphertext obtaining unit 46 is configured to obtain the target second ciphertext from the red-black tree, obtain the second key, and encrypt the target second ciphertext by using the second key to obtain the third ciphertext.

[0111] The fourth ciphertext writing unit 47 is configured to perform XOR operation on the first ciphertext and the third ciphertext to obtain the fourth ciphertext, and write the fourth ciphertext into the swap file.

[0112] By the application, the memory data management based on the native memory management mechanism and the page fault exception mechanism is compatible with the native function, and has better compatibility and stability. By using the step-by-step encryption, the physical address of the data to be encrypted is processed by using the first key to obtain the first ciphertext, and the XOR operation is performed on the data to be encrypted and the first ciphertext to obtain the second ciphertext, which is stored in the red-black tree in the memory space. The encryption range is expanded, the data security is improved, and the memory space and the red-black tree are fully utilized. Since the data encryption is currently performed in the system memory, and the data is frequently accessed and used, the encryption and decryption of the data is also frequent. Therefore, the XOR algorithm is used for basic encryption and decryption, which not only realizes further encryption of the data, but also improves the performance and reduces the influence on the system and the process running. When the target second ciphertext to be migrated from the red-black tree to the swap file is determined, the target second ciphertext is further encrypted and written into the swap file. By using pure software implementation, the application does not depend on specific hardware, and the cost is lower, and the compatibility is further improved. By controlling the data to be encrypted, flexible encryption range control is realized, and a good balance between encryption strength and performance can be achieved. Thus, a dynamic memory encryption method and system compatible with the native memory management mechanism, independent of specific hardware, and controllable in performance is realized. Therefore, the technical problems of poor compatibility, high cost, not conducive to large-scale application, and great influence on system performance can be solved, and the technical effects of good compatibility, reduced cost, easy large-scale application, and reduced influence on system performance are achieved.

[0113] In one specific embodiment of the application, the target memory page obtaining unit 41 can include:

[0114] The idle duration obtaining sub-unit is configured to traverse the memory spaces corresponding to the respective processes to obtain the idle durations corresponding to the respective memory pages in the respective memory spaces.

[0115] The first judgment sub-unit is configured to determine whether there is a memory page with an idle duration exceeding a first preset duration.

[0116] The target memory page determination sub-unit is configured to determine the memory page with the idle duration exceeding the first preset duration as the target memory page when it is determined that there is the memory page with the idle duration exceeding the first preset duration.

[0117] The return execution sub-unit is configured to return to execute the step of traversing the memory space corresponding to each process when it is determined that there is no memory page with the idle duration exceeding the first preset duration.

[0118] In an embodiment of the present application, the second ciphertext storage unit 44 can include:

[0119] The second ciphertext obtaining sub-unit is configured to traverse the red-black tree to obtain the second ciphertext that has not been accessed for more than the second preset duration in the red-black tree.

[0120] The second ciphertext determination sub-unit is configured to determine the second ciphertext that has not been accessed for more than the second preset duration as the second ciphertext to be written into the swap file.

[0121] In an embodiment of the present application, the device can further include:

[0122] The process memory page table obtaining unit is configured to obtain the target process memory page table corresponding to the target memory space to which the target memory page belongs after the second ciphertext is stored in the red-black tree.

[0123] The memory page deletion unit is configured to delete the target memory page from the target process memory page table.

[0124] In an embodiment of the present application, the device can further include:

[0125] The memory page to be accessed obtaining unit is configured to parse the received memory access request to obtain the memory page to be accessed.

[0126] The memory page searching unit is configured to search the process memory page table corresponding to the memory space to which the memory page to be accessed belongs.

[0127] The judging unit is configured to judge whether the memory page to be accessed is found.

[0128] The first decryption and loading unit is configured to trigger a page fault exception interrupt when it is determined that the memory page to be accessed is not found, so that the processor searches an interrupt table of a system kernel according to the page fault exception interrupt, searches a page fault exception processing program from the interrupt table, and decrypts and loads the memory page to be accessed by using the page fault exception processing program.

[0129] In an embodiment of the present application, the first decryption and loading unit can include:

[0130] The memory page identification information searching subunit is configured to search for the memory page identification information of the memory page to be accessed from the red-black tree by using the page fault exception processing program, wherein the red-black tree stores the correspondence between each second ciphertext and each memory page identification information.

[0131] The second judging subunit is configured to judge whether the memory page identification information of the memory page to be accessed is found in the red-black tree.

[0132] The first data decryption and loading subunit is configured to, when it is determined that the memory page identification information of the memory page to be accessed is found in the red-black tree, decrypt the second ciphertext in the memory page to be accessed from the red-black tree, and load the data obtained after decryption to the memory space to which the memory page to be accessed belongs.

[0133] In one specific embodiment of the present application, the first data decryption and loading subunit is specifically a unit for decrypting the second ciphertext in the memory page to be accessed by using the inverse operation of the first step XOR encryption in the ciphertext stealing adjustment password book mode from the red-black tree.

[0134] In one specific embodiment of the present application, the device can further comprise:

[0135] The second decryption and loading unit is configured to, when it is determined that the memory page identification information of the memory page to be accessed is not found in the red-black tree, decrypt the memory page to be accessed from the swap file, and load the data obtained after decryption to the memory space to which the memory page to be accessed belongs.

[0136] In one specific embodiment of the present application, the second decryption and loading unit is specifically a unit for decrypting the memory page to be accessed by performing the complete decryption process of the ciphertext stealing adjustment password book mode from the swap file.

[0137] In one specific embodiment of the present application, the second decryption and loading unit can comprise:

[0138] The target physical memory obtaining subunit is configured to perform physical memory allocation on the memory page to be accessed to obtain a target physical memory.

[0139] The data migration subunit is configured to migrate the data obtained after decryption to the target physical memory.

[0140] The virtual address obtaining subunit is configured to obtain a virtual address corresponding to the target physical memory.

[0141] The process memory page table modifying subunit is configured to modify the process memory page table according to the virtual address.

[0142] In one specific embodiment of the present application, the first ciphertext obtaining unit 43 is specifically a unit for searching for the first key from the trusted security platform module.

[0143] The third ciphertext obtaining unit 46 is specifically configured to search the second key from the trusted secure platform module.

[0144] In a specific embodiment of the present application, the third ciphertext obtaining unit 46 is specifically configured to perform an encryption operation of a symmetric encryption and decryption algorithm on the target second ciphertext by using the second key.

[0145] The features of the embodiments of the memory data management apparatus can refer to the related descriptions of the embodiments of the memory data management method, which will not be repeated here.

[0146] The embodiments of the present application also provide an electronic device, which comprises a memory and a processor, the memory stores a computer program, and the processor is configured to execute the computer program to perform the steps in any of the embodiments of the memory data management method.

[0147] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program, wherein the computer program is configured to perform the steps in any of the embodiments of the memory data management method when executed.

[0148] In an exemplary embodiment, the computer readable storage medium can include but is not limited to a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0149] The embodiments of the present application also provide a computer program product, which comprises a computer program, and the computer program is executed by a processor to perform the steps in any of the embodiments of the memory data management method.

[0150] The embodiments of the present application also provide another computer program product, which comprises a non-volatile computer readable storage medium, the non-volatile computer readable storage medium stores a computer program, and the computer program is executed by a processor to perform the steps in any of the embodiments of the memory data management method.

[0151] Those skilled in the art will further realize that the mere concepts, teachings, and embodiments described herein are merely meant to provide an enabling description of the claimed invention and are not intended to limit the scope of the claimed invention to these embodiments. Therefore, embodiments described herein are not meant to be limiting, but merely representative. Further, the routines executed to implement the embodiments of the invention, individually or collectively, need not be limited to any specific combination of hardware and software. Various embodiments can also be implemented using more conventional components, as well as hardware and software that are not expressly identified herein. To clearly illustrate this interchangeability of hardware and software, various components will be described herein as being implemented with reference to a computerized system and / or a computerized device. General purpose computers or computerized devices programmed to perform the steps of the various embodiments described herein will be more fully appreciated from the following description.

[0152] The memory data management method, the electronic device, the storage medium and the program product provided by the present application are described in detail above. The principles and implementation manners of the present application are described by applying specific examples in the present article. The above description of the embodiments is only applicable to help understand the method of the present application and its core idea. It should be pointed out that, for those skilled in the art, without departing from the principles of the present application, some improvements and modifications can be made to the present application, and these improvements and modifications also fall within the protection scope of the present application.

Claims

1. A memory data management method, characterized by, The method comprises the following steps: traversing memory spaces corresponding to respective processes to obtain target memory pages that can be encrypted; determining data in the target memory pages as to-be-encrypted data, and reading the to-be-encrypted data and physical addresses of the to-be-encrypted data; obtaining a first key and processing the physical addresses by using the first key to obtain first ciphertext; performing exclusive OR operation on the to-be-encrypted data and the first ciphertext to obtain second ciphertext, and storing the second ciphertext in a red-black tree; traversing the red-black tree to obtain second ciphertext to be written into a swap area file, and determining the second ciphertext to be written into the swap area file as target second ciphertext; obtaining a second key from the red-black tree, and encrypting the target second ciphertext by using the second key to obtain third ciphertext; performing exclusive OR operation on the first ciphertext and the third ciphertext to obtain fourth ciphertext, and writing the fourth ciphertext into the swap area file; after storing the second ciphertext in the red-black tree, the method further comprises the following steps: obtaining a target process memory page table corresponding to a target memory space to which the target memory page belongs; deleting the target memory page from the target process memory page table; the method further comprises the following steps: parsing a received memory access request to obtain a to-be-accessed memory page; performing memory page lookup on a process memory page table corresponding to a memory space to which the to-be-accessed memory page belongs; determining whether the to-be-accessed memory page is found; if not, triggering a page fault exception interrupt to enable a processor to find an interrupt table of a system kernel according to the page fault exception interrupt, find a page fault exception processing program from the interrupt table, and decrypt and load the to-be-accessed memory page by using the page fault exception processing program; decrypting and loading the to-be-accessed memory page by using the page fault exception processing program comprises the following steps: traversing and finding memory page identification information of the to-be-accessed memory page from the red-black tree by using the page fault exception processing program; wherein the red-black tree stores a corresponding relationship between each second ciphertext and each memory page identification information; determining whether the memory page identification information of the to-be-accessed memory page is found in the red-black tree; if yes, decrypting second ciphertext in the to-be-accessed memory page from the red-black tree, and loading data obtained after decryption to a memory space to which the to-be-accessed memory page belongs.

2. The memory data management method of claim 1, wherein, traversing memory spaces corresponding to respective processes to obtain target memory pages that can be encrypted comprises the following steps: traversing memory spaces corresponding to respective processes to obtain idle time lengths of respective memory pages in respective memory spaces; determining whether there is a memory page with an idle time length exceeding a first preset time length; if yes, determining the memory page with the idle time length exceeding the first preset time length as the target memory page; if not, returning to the step of traversing the memory spaces corresponding to the respective processes.

3. The memory data management method of claim 1, wherein, traversing the red-black tree to obtain second ciphertext to be written into a swap area file comprises the following steps: traversing the red-black tree to obtain second ciphertext that has not been accessed for more than a second preset time length in the red-black tree; determining the second ciphertext that has not been accessed for more than the second preset time length as the second ciphertext to be written into the swap area file.

4. The memory data management method of claim 1, wherein, decrypting the second cipher text in the memory page to be accessed from the red-black tree, comprising: decrypting the second cipher text in the memory page to be accessed from the red-black tree by using the first step of the reverse operation of the cipher stealing adjustment mode.

5. The memory data management method of claim 1, wherein, when it is determined that the memory page identification information of the memory page to be accessed is not found in the red-black tree, further comprising: decrypting the memory page to be accessed from the swap file and loading the decrypted data to the memory space to which the memory page to be accessed belongs.

6. The memory data management method of claim 5, wherein, decrypting the memory page to be accessed from the swap file, comprising: decrypting the memory page to be accessed from the swap file by performing the complete decryption process of the cipher stealing adjustment mode.

7. The memory data management method of claim 5 or 6, wherein, loading the decrypted data to the memory space to which the memory page to be accessed belongs, comprising: allocating physical memory to the memory page to be accessed to obtain target physical memory; migrating the decrypted data to the target physical memory; obtaining the virtual address corresponding to the target physical memory; modifying the process memory page table according to the virtual address.

8. The memory data management method of claim 1, wherein, obtaining the first key and obtaining the second key, comprising: finding the first key from a trusted secure platform module; finding the second key from the trusted secure platform module.

9. The memory data management method of claim 1, wherein, encrypting the target second cipher text by using the second key, comprising: performing encryption operation of a symmetric encryption and decryption algorithm on the target second cipher text by using the second key.

10. An electronic device, comprising: comprising: a memory for storing a computer program; a processor for executing the computer program to implement the steps of the memory data management method according to any one of claims 1 to 9.

11. A computer readable storage medium, characterized in that, the computer readable storage medium stores a computer program, wherein the computer program is executed by the processor to implement the steps of the memory data management method according to any one of claims 1 to 9.

12. A computer program product comprising a computer program, characterized in that, the computer program is executed by the processor to implement the steps of the memory data management method according to any one of claims 1 to 9.

Images