Security-enhanced VPN equipment sensitive data memory security storage method and system

Abstract

The invention discloses a security-enhanced VPN (Virtual Private Network) equipment sensitive data memory security storage method and system. The method comprises the following steps: discretizing a memory region of a local variable in a VPN equipment stack, expanding the length of a to-be-used local variable, and partitioning the memory region of the local variable; discretizing the memory in the stack; discretization management is carried out on the heap memory, that is to say, the memory to be distributed and used with the specified size is divided into a plurality of small blocks, then distribution of the small blocks of memories is carried out, and the small blocks of memories are linked through control information; and discretizing the in-heap memory. According to the method, the risk that the memory data is scanned and stolen is reduced, and the security of sensitive information in the memory is improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and system for securely storing sensitive data in the memory of a VPN device with enhanced security. Background Technology

[0002] Virtual Private Network (VPN) devices utilize cryptographic principles, employing algorithms and keys to encrypt and decrypt data passing through them. Due to their cryptographic nature, VPN devices store a large amount of sensitive information, including keys and parameters, to protect user data. If a VPN device is compromised and data is stolen, it can have severe consequences for VPN users. Therefore, protecting the data within a VPN device is crucial. With the continuous development and iteration of attack methods, VPN devices face increasing challenges.

[0003] VPN devices store a large amount of sensitive information or intermediate data related to sensitive information in their memory. To prevent the theft of sensitive information, appropriate memory protection measures should be implemented. Common memory protection measures include Address Space Layout Randomization (ASLR), Data Execution Protection (DEP), stack protection, and memory isolation techniques.

[0004] Address Space Layout Randomization (ASLR) randomizes the memory address layout. When a program is loaded, the base addresses of the heap, stack, global variables, and code segments are randomized. These addresses are different each time the program is loaded, preventing attackers from predicting the base addresses of each memory region. Although this method increases the difficulty of attack, once an attacker obtains the base addresses, sensitive information can still be read directly.

[0005] Data Execution Protection (DEP) prevents the injection of malicious code into memory regions by marking the stack memory region as non-executable. This method is mainly aimed at the injection code threat of buffer overflow attacks, but it cannot prevent the theft of sensitive information in memory.

[0006] Stack protection inserts a Canary value during function calls to detect stack overflow. If the Canary value is changed, the system will trigger an exception and terminate the program. This method mainly protects against stack overflows, but does not protect memory data.

[0007] Memory isolation technology isolates data from different users or programs logically or physically in memory to prevent interference between different memory regions and ensure data integrity and security. This method is often used in multi-user operating systems or virtualized cloud environments. Although this method can prevent memory access between different users and prevent data leakage to a certain extent, it usually introduces complex software support and additional hardware resources, increasing software and hardware costs. It is not suitable for deployment and implementation on resource-constrained VPN devices.

[0008] In VPN devices, memory usage is mainly divided into stack memory usage and heap memory usage. The stack stores local variables and other memory data, while the heap stores dynamically allocated memory. Heap memory usage includes three steps: memory allocation, data writing and reading, and memory release. During memory allocation, the operating system automatically allocates a segment of available addresses based on system resources, and the allocated memory is linearly stored at logical addresses in the heap. Sensitive information such as keys and parameters in memory is generally of fixed length. Specific algorithms typically use fixed-length keys such as 64 bytes or 128 bytes. Fixed-length keys have obvious characteristics in memory. If an attacker retrieves multiple 64-byte random numbers in memory, and the data changes dynamically over time, the attacker can easily collect these and attempt to decrypt and crack the data. Memory management is an important and complex aspect of operating system design, aimed at efficient memory resource management, but not necessarily for security. Once an internal or external attacker gains superuser privileges, existing common memory protection measures cannot prevent memory data from being stolen, thereby gaining access to sensitive information such as keys and parameters.

[0009] VPN devices store a large amount of sensitive information or intermediate data related to sensitive information in their memory. In the operating system's memory management, the storage space for specific variables or allocated memory of a specified size is logically contiguous. When used, the memory content is read sequentially according to the starting address of the memory. Attackers may obtain the memory stack address of this sensitive information through technical means, and then directly read the sensitive information in memory. Attackers may also use memory scanning to guess the memory range of sensitive information by scanning the content of a fixed-length region in the heap or the changes in the content of a fixed-length region, and then obtain the sensitive information in memory. Summary of the Invention

[0010] In view of this, this application provides a method and system for secure storage of sensitive data in the memory of a VPN device with enhanced security. By discretely assembling the stack memory, inserting control information, and establishing a secure memory index, the memory is managed in a discrete manner, so that sensitive information is stored in multiple discrete blocks in memory. When in use, the control information is used to assemble the data, which reduces the risk of memory data being scanned and stolen, and improves the security of sensitive information in memory.

[0011] This application discloses a method for securely storing sensitive data in the memory of a security-enhanced VPN device, which includes: Step 1: Discretize the memory area of local variables in the VPN device stack, expand the length of the local variables to be used, and divide the memory area of local variables into blocks; each block after block discretization includes a block length area, a block data area, a security attribute information area, and a security attribute information execution method area; Step 2: Discretize the memory in the stack; the discretization process includes initialization, writing data, reading data, and ending; Step 3: Discretize the management of the heap memory, that is, divide the specified-size memory to be allocated and used into multiple small blocks, and then allocate the multiple small-block memories. Control information is used to link between the small-block memories; each block after discretization contains a pointer to the block data area, a block length area, a block data area, a security attribute information area, and a security attribute execution method area; Step 4: Discretize the memory in the heap, and the discretization process includes initialization, writing data, reading data, and ending.

[0012] Further, the control information is used for addressing the small-block memories; for the stack memory, the small-block memories are continuously stored, and the control information is the block length. According to the length information, each block can be sequentially found; for the heap memory, the small-block memories are discrete in the heap memory, and the control information is the pointer to the block data area. According to the pointer, each small-block memory can be addressed.

[0013] Further, in the said Step 1, the block length area is used to identify the total length of the block, the block data area is used to store the actual data content, the actual data content includes sensitive data, the security attribute information area is used to store security attribute information, and the security attribute information execution method area is used to store the security attribute execution method, that is, the callback function of the security attribute.

[0014] Further, use the random number key generated in the security attribute information to encrypt and XOR the actual data content stored in the block data area, use the fixed value or random value in the security attribute information to store and perform CRC check on the actual data content stored in the block data area. After calculating the check value of the actual data content stored in the block data area, store the check value in the security attribute information.

[0015] Further, the said Step 2 includes: Initialization: Determine the size of the temporary variable to be used. Assume that a temporary variable with a length of a is needed to store the key. Discretize a to obtain a total of n sub-block lengths a1, a2, a3,..., ai,..., an, where 0 < an < a, and a1 + a2 + a3... + ai... + an = a; Calculate the storage space size required for the \(i\)-th sub-block \(a_i\). Assume that the total length of the block length area, block data area, security attribute information area, and security attribute information execution method area in the \(i\)-th sub-block \(a_i\) is \(A_i\). Then, finally, we get \(A_1, A_2, A_3, \ldots, A_i, \ldots, A_n\). Define a temporary variable with length \(L_a\) on the stack, where \(L_a = A_1 + A_2 + A_3 + \cdots + A_i + \cdots + A_n\); Write data: When writing data, write the length \(a_i\) into the block length area of the \(A_i\) block, and write the content of \(a_i\) into the block data area of the \(A_i\) block; Read data: When reading data, read the length of the \(A_i\) block, read the data content in the \(A_i\) block according to the length, check whether the security attribute information is enabled. If it is enabled, process the security attribute information, and then read the data after the processing is completed; End: Overwrite the entire area occupied by the temporary variable with length \(L_a\) in memory, or let the system automatically recycle the temporary variable with length \(L_a\).

[0016] Furthermore, in the above-mentioned write data, if there is security attribute information, write it into the corresponding security attribute information area.

[0017] Furthermore, step 3 includes: During the initialization of the heap memory blocks, each time use the memory allocation function provided by the system to allocate multiple small memory blocks. The positions of each small memory block in the heap are not fixed. Use the pointer of the block data area to find the multiple small memory blocks allocated in the heap. The use of the block data area and the use of the security attribute information are the same as those of the stack memory blocks.

[0018] Furthermore, step 4 includes: Initialization: First, determine the memory size to be used. Assume that a memory space with length \(b\) is needed to store the key. Use an algorithm to discretize \(b\) to obtain \(b_1, b_2, b_3, \ldots, b_i, \ldots, b_n\) sub-block lengths, where \(0 < b_n < b\), and \(b_1 + b_2 + b_3 + \cdots + b_i + \cdots + b_n = b\); Calculate the storage space size required for the \(i\)-th sub-block \(b_i\). Assume that the total length of the block length area, block data area, security attribute information area, and security attribute information method area in the \(i\)-th sub-block \(b_i\) is \(B_i\). Then, finally, we get \(B_1, B_2, B_3, \ldots, B_i, \ldots, B_n\). Allocate \(B_1, B_2, B_3, \ldots, B_i, \ldots, B_n\) memory blocks in the heap. The starting address of the \(i\)-th memory block \(B_i\) is \(B_i\_addr\). The starting addresses of all memory blocks are \(B_1\_addr, B_2\_addr, B_3\_addr, \ldots, B_i\_addr, \ldots, B_n\_addr\) in sequence. The addresses of all memory blocks are stored in the pointer area of the corresponding block data area; Writing data: When writing data, for length bi, find the block data area pointer Bi_addr, write length bi to the block length area in the Bi block, and write the content of bi to the block data area in the Bi block. Reading data: When reading data, locate the block data area pointer Bi_addr, read the length of the Bi area, read the data content in the Bi area according to the length, check whether the security attribute is enabled, if enabled, perform relevant processing on the security attribute, and read the data after processing is complete; End: Sequentially free the memory at addresses B1_addr, B2_addr, B3_addr…Bi_addr…Bn_addr, and assign 0 to the variable storing the pointer address.

[0019] Furthermore, if security attribute information is included in the written data, it is written to the corresponding security attribute information area.

[0020] This application also discloses a security-enhanced VPN device sensitive data memory secure storage system, implementing the aforementioned security-enhanced VPN device sensitive data memory secure storage method, comprising: The stack memory discretization module is used to discretize the memory region of local variables in the VPN device stack, expand the length of the local variables to be used, and divide the memory region of local variables into blocks; each block after discretization includes a block length area, a block data area, a security attribute information area, and a security attribute information execution method area. Discretization modules in the stack are used to discretize the memory in the stack; the discretization process includes initialization, writing data, reading data, and termination. The heap memory discretization module is used to discretize and manage heap memory, which means dividing a specified size of memory to be allocated into multiple small blocks, allocating multiple small blocks of memory, and linking the small blocks of memory with control information; each discretized block contains a block data area pointer, a block length area, a block data area, a security attribute information area, and a security attribute execution method area; The heap discretization module is used to discretize the memory in the heap. The discretization process includes initialization, writing data, reading data, and termination.

[0021] By adopting the above technical solution, this application has the following advantages: This application stores sensitive information in blocks in memory, with each memory block linked by control information. The information is stored discretely during storage and reassembled during retrieval, preventing attackers from directly reading sensitive information when they know the addresses of variables in the stack. It also prevents attackers from dynamically scanning the heap memory to directly locate sensitive information stored in the heap based on specific length content or patterns of change within that content. This method supports configurable security enhancement methods. When using these methods, sensitive information blocks can be processed using corresponding encryption, XOR, hashing, etc., further improving the security of discretely stored sensitive information. Furthermore, this method is easy to implement, enhancing memory security without introducing complex software management overhead or additional hardware costs. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0023] Figure 1 This is a flowchart illustrating a method for securely storing sensitive data in the memory of a VPN device with enhanced security, according to an embodiment of this application. Figure 2 This is a schematic diagram of stack memory discreteness in an embodiment of this application; Figure 3 This is a schematic diagram of the discrete heap memory in an embodiment of this application; Figure 4 This diagram illustrates the storage of sensitive information using traditional memory usage methods. Figure 5 This is a schematic diagram illustrating the configurable and secure discrete assembly method for storing sensitive information, as described in an embodiment of this application. Detailed Implementation

[0024] The present application will be further described in conjunction with the accompanying drawings and embodiments. The described embodiments are only some, not all, of the embodiments of the present application. All other embodiments obtained by those skilled in the art should fall within the protection scope of the embodiments of the present application.

[0025] Current memory usage relies on operating system memory management, which is efficient but lacks security against attacks. It lacks protection measures for sensitive information such as keys and parameters, making this information vulnerable to high-level attacks. While Address Space Layout Randomization (ASLR) can randomize memory addresses, sensitive random information remains stored contiguously, making it ineffective against memory scanning attacks. Data Execution Prevention (DEP) and stack protection, used to prevent memory injection and stack overflows, also fail to address memory theft and scanning. Memory isolation technology can protect data to some extent, preventing unauthorized access, but once privileges are compromised, memory data remains exposed to attackers. Furthermore, it requires additional hardware resources and complex software management, significantly increasing costs.

[0026] For the above issues, please refer to Figure 1 This application provides an embodiment of a security-enhanced method for securely storing sensitive data in the memory of a VPN device, comprising: Step 1: Discretize the memory region of local variables in the VPN device stack, increase the length of the local variables to be used, and divide the memory region of local variables into blocks; each block after discretization includes a block length area, a block data area, a security attribute information area, and a security attribute information execution method area. Step 2: Discretize the memory in the stack; the discretization process includes initialization, writing data, reading data, and termination; Step 3: Discretize the heap memory, that is, divide the memory of a specified size to be allocated into multiple small blocks, and then allocate multiple small blocks of memory. The small blocks of memory are linked together using control information. Each discretized block contains a block data area pointer, a block length area, a block data area, a security attribute information area, and a security attribute execution method area. Step 4: Discretize the memory in the heap. Discretization includes initialization, writing data, reading data, and termination.

[0027] In this embodiment, local variables in the program are stored in the stack. Generally, the use of local variables in the stack involves four steps: definition, initialization, writing the target value, and usage. To improve security by discretizing stack memory data, the method of contiguous storage of local variables in the stack is improved. An innovative method is designed to discretize the memory region of local variables in the stack, expanding the length of the local variables to be used. The local variable region is divided into blocks, and each discretized block includes a length, a block data area, security attribute information, and a security attribute execution method, such as... Figure 2 As shown.

[0028] Optionally, the control information is used for addressing small chunks of memory; for stack memory, the small chunks of memory are stored continuously, and the control information is the chunk length. According to the length information, each chunk can be found sequentially, as shown in Figure 2 shown; for heap memory, the small chunks of memory are scattered in the heap memory, and the control information is the pointer to the chunk data area. According to the pointer, each small chunk of memory can be addressed, as shown in Figure 3 shown.

[0029] Optionally, the chunk length area identifies the total length of this chunk, the chunk data area stores the actual data content, the security attribute information area is an optional item. If the security attribute is enabled, this area stores the security attribute information. The security attribute execution method area is an optional item. If the security attribute is enabled, this area stores the execution method of the security attribute, that is, the callback function of the security attribute. When the security attribute is enabled, different methods can be selected to further secure the chunk data. For example, using algorithms such as AES and SM4, using the random number key generated in the security attribute information to encrypt the content of the data area, the method of simple XOR, using the fixed value or random value in the security attribute information to perform subsequent storage on the content of the data area, using the CRC check method, calculating the check value of the data in the data area and storing the check value in the security attribute information and other methods to further improve the security of the memory data.

[0030] Optionally, step 2 includes: Initialization: Determine the size of the temporary variable to be used. Assume that a temporary variable with a length of a is needed to store the key. Discretize a to obtain n sub-block lengths a1, a2, a3,..., ai,..., an, where 0 < an < a, and a1 + a2 + a3... + ai... + an = a; Calculate the storage space size required for the i-th sub-block ai. Assume that the total length of the chunk length area, the chunk data area, the security attribute information area, and the security attribute information execution method area in the i-th sub-block ai is Ai. Then, finally, obtain A1, A2, A3,..., Ai,..., An. Define a temporary variable with a length of La in the stack, and La = A1 + A2 + A3... + Ai... + An; Write data: When writing data, write the length ai into the chunk length area of the Ai block, and write the content of ai into the chunk data area of the Ai block; Read data: When reading data, read the length of the Ai block, read the data content in the Ai block according to the length, check whether the security attribute information is enabled. If it is enabled, process the security attribute information, and after the processing is completed, read in the data. Read the subsequent blocks in the same way; End: Overwrite the entire area occupied by the temporary variable with a length of La, or let the system automatically recycle the temporary variable with a length of La.

[0031] Optionally, in the written data, if there is security attribute information, it is written to the corresponding security attribute information area, and subsequent blocks are written in the same way.

[0032] In the embodiments of the present application, the heap memory belongs to the space that can be freely allocated by the user. The memory addresses are from low to high. Although the speed is slow, the space is large and the degree of freedom is higher. The usage method of the heap memory generally includes four steps: memory allocation, memory initialization, memory data writing and reading, and memory release. The space of the heap area will change dynamically according to the size of the memory allocation. Although the heap area is a relatively large space and it is not easy for an attacker to find sensitive information such as keys in this large space, sensitive information can still be found by combining scanning with length feature information.

[0033] In order to improve the security by discretely storing the heap memory data, the use of the heap memory is improved. In the present application, the allocated memory blocks are divided and calculated, divided into multiple small blocks, and then the multiple small memory blocks are allocated. Control information is used to link between the small memory blocks. Each divided block after discretization includes a pointer to the divided block data area, a divided block length area, a divided block data area, a security attribute information area, and a security attribute execution method area, as Figure 3 shown.

[0034] Optionally, step 3 includes: Different from the stack memory block using continuous stack memory space for storage, when initializing the heap memory block, the system-provided memory allocation function is used to allocate multiple small memory blocks each time. The position of each small memory block in the heap is not fixed, and the pointer to the divided block data area is used to find the multiple small memory blocks allocated in the heap; the usage of the divided block data area and the usage of the security attribute information are the same as those of the stack memory block.

[0035] Optionally, step 4 includes: Initialization: First, determine the size of the memory to be used. Assume that a memory space with a length of b is needed to store the key. Use an algorithm to discretize b, and obtain b1, b2, b3,..., bi,..., bn sub-block lengths, where 0 < bn < b, and b1 + b2 + b3... + bi... + bn = b; Calculate the storage space required for the i-th sub-block bi. Assume that the total length of the block length area, block data area, security attribute information area, and security attribute information method area in the i-th sub-block bi is Bi. Then, we get B1, B2, B3…Bi…Bn. Allocate B1, B2, B3…Bi…Bn memory blocks in the heap. The starting address of the i-th memory block Bi is Bi_addr. The starting addresses of all memory blocks are B1_addr, B2_addr, B3_addr…Bi_addr…Bn_addr. The addresses of all memory blocks are stored in the pointer area of ​​the block data area corresponding to the memory block. Writing data: When writing data, for length bi, find the block data area pointer Bi_addr, write length bi to the block length area in the Bi block, and write the content of bi to the block data area in the Bi block. Reading data: When reading data, locate the block data area pointer Bi_addr, read the length of the Bi area, read the data content in the Bi area according to the length, check whether the security attribute is enabled, if enabled, perform relevant processing on the security attribute, and read the data after processing. Subsequent blocks are read in the same way. End: Sequentially free the memory at addresses B1_addr, B2_addr, B3_addr…Bi_addr…Bn_addr, and assign 0 to the variable storing the pointer address.

[0036] Optionally, if security attribute information is included in the written data, it is written to the corresponding security attribute information area, and subsequent blocks are written in the same manner.

[0037] This application also provides an embodiment of a security-enhanced VPN device sensitive data memory secure storage system, implementing the security-enhanced VPN device sensitive data memory secure storage method described in the above embodiment, comprising: The stack memory discretization module is used to discretize the memory region of local variables in the VPN device stack, expand the length of the local variables to be used, and divide the memory region of local variables into blocks; each block after discretization includes a block length area, a block data area, a security attribute information area, and a security attribute information execution method area. Discretization modules in the stack are used to discretize the memory in the stack; the discretization process includes initialization, writing data, reading data, and termination. The heap memory discretization module is used to discretize and manage heap memory, which means dividing a specified size of memory to be allocated into multiple small blocks, allocating multiple small blocks of memory, and linking the small blocks of memory with control information; each discretized block contains a block data area pointer, a block length area, a block data area, a security attribute information area, and a security attribute execution method area; The heap discretization module is used to discretize the memory in the heap. The discretization process includes initialization, writing data, reading data, and termination.

[0038] Figure 4 This relates to the storage of sensitive information using traditional memory usage methods. Figure 5 This describes the storage status of sensitive information in this application.

[0039] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application and not to limit them. Although this application has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of this application. Any modifications or equivalent substitutions that do not depart from the spirit and scope of this application should be covered within the protection scope of the claims of this application.

Claims

1. A method for securely storing sensitive data in memory of a VPN device with enhanced security, characterized in that, Including: Step 1: Discretize the memory area of local variables in the VPN device stack, expand the length of the local variables to be used, and divide the memory area of local variables into blocks; Each block after block discretization includes a block length area, a block data area, a security attribute information area, and a security attribute information execution method area; Step 2: Discretize the memory in the stack; the discretization process includes initialization, writing data, reading data, and ending; Step 3: Discretely manage the heap memory, that is, divide the specified size memory to be allocated and used into multiple small blocks, and then allocate the multiple small block memories. Control information is used to link between the small block memories; Each block after discretization contains a pointer to the block data area, a block length area, a block data area, a security attribute information area, and a security attribute execution method area; Step 4: Discretize the memory in the heap, and the discretization process includes initialization, writing data, reading data, and ending.

2. The method for securely storing sensitive data in the memory of a VPN device with enhanced security according to claim 1, characterized in that, The control information is used for addressing the small block memories; For the stack memory, the small block memories are continuously stored, and the control information is the block length. Each block can be sequentially found according to the length information; For the heap memory, the small block memories are discrete in the heap memory, and the control information is the pointer to the block data area. Each small block memory can be addressed according to the pointer.

3. The method for securely storing sensitive data in the memory of a VPN device with enhanced security according to claim 1, characterized in that, The block length area is used to identify the total length of the block, the block data area is used to store the actual data content, the actual data content includes sensitive data, the security attribute information area is used to store security attribute information, and the security attribute information execution method area is used to store the security attribute execution method, that is, the callback function of the security attribute.

4. The method for securely storing sensitive data in the memory of a VPN device with enhanced security according to claim 3, characterized in that, Use the random number key generated in the security attribute information to encrypt and XOR the actual data content stored in the block data area, use the fixed value or random value in the security attribute information to store and perform CRC check on the actual data content stored in the block data area. After calculating the check value of the actual data content stored in the block data area, store the check value in the security attribute information.

5. The method for securely storing sensitive data in the memory of a VPN device with enhanced security according to claim 1, characterized in that, The said Step 2 includes: Initialization: Determine the size of the temporary variable to be used. Assume that a temporary variable with a length of a is needed to store the key. Discretize a to obtain n sub-block lengths a1, a2, a3, …, ai, …, an, where 0 < an < a, and a1 + a2 + a3 … + ai … + an = a; Calculate the storage space size required for the i-th sub-block ai. Assume that the total length of the block length area, the block data area, the security attribute information area, and the security attribute information execution method area in the i-th sub-block ai is Ai. Then finally obtain A1, A2, A3, …, Ai, …, An. Define a temporary variable with a length of La in the stack, La = A1 + A2 + A3 … + Ai … + An; Writing data: When writing data, write the length ai into the block length area in the Ai block, and write the content of ai into the block data area in the Ai block; Read out data: When reading data, read the length of block Ai, read the data content in block Ai according to the length, check whether the security attribute information is enabled. If it is enabled, process the security attribute information, and then read in the data after the processing is completed. End: Overwrite the entire area occupied by the temporary variable with length La, or the system automatically reclaims the temporary variable with length La.

6. The method for securely storing sensitive data in the memory of a VPN device with enhanced security according to claim 5, characterized in that, In the said data writing, if there is security attribute information, write it to the corresponding security attribute information area.

7. The method for securely storing sensitive data in the memory of a VPN device with enhanced security according to claim 1, characterized in that, The said step 3 includes: When initializing the heap memory blocks, each time use the memory allocation function provided by the system to allocate multiple small memory blocks. The positions of each small memory block in the heap are not fixed. Use the pointer of the block data area to find the multiple small memory blocks allocated in the heap. The use of the block data area and the use of the security attribute information are the same as those of the stack memory blocks.

8. The method for securely storing sensitive data in the memory of a VPN device with enhanced security according to claim 1, characterized in that, The said step 4 includes: Initialization: First determine the memory size to be used. Assume that the memory space with length b is needed to store the key. Use an algorithm to discretize b, and obtain b1, b2, b3, …, bi, …, bn sub-block lengths, where 0 < bn < b, and b1 + b2 + b3 … + bi … + bn = b; Calculate the storage space size required for the i-th sub-block bi. Assume that the total length of the block length area, block data area, security attribute information area, and security attribute information method area in the i-th sub-block bi is Bi. Then finally obtain B1, B2, B3 … Bi … Bn. Allocate B1, B2, B3 … Bi … Bn memory blocks in the heap. The starting address of the i-th memory block Bi is Bi_addr. The starting addresses corresponding to all memory blocks are B1_addr, B2_addr, B3_addr … Bi_addr … Bn_addr in sequence. The addresses of all memory blocks are stored in the pointer area of the corresponding block data area of the memory block; Write data: When writing data, for the length bi, find the pointer Bi_addr of the block data area, write the length bi to the block length area in block Bi, and write the content of bi to the block data area in block Bi; Read out data: When reading data, find the pointer Bi_addr of the block data area, read the length of area Bi, read the data content in area Bi according to the length, check whether the security attribute is enabled. If it is enabled, perform relevant processing on the security attribute, and then read in the data after the processing is completed; End: Release the memory at addresses B1_addr, B2_addr, B3_addr … Bi_addr … Bn_addr in sequence, and assign 0 to the variable storing the pointer address.

9. The method for securely storing sensitive data in the memory of a VPN device with enhanced security according to claim 8, characterized in that, In the said data writing, if there is security attribute information, write it to the corresponding security attribute information area.

10. A security-enhanced VPN device sensitive data memory secure storage system, implementing the security-enhanced VPN device sensitive data memory secure storage method according to any one of claims 1-9, characterized in that, Includes: A stack memory discretization module, used to discretize the memory area of the local variables in the VPN device stack, expand the length of the local variables to be used, and divide the memory area of the local variables into blocks; Each block after block discretization includes a block length area, a block data area, a security attribute information area, and a security attribute information execution method area; Discretization modules in the stack are used to discretize the memory in the stack; the discretization process includes initialization, writing data, reading data, and termination. The heap memory discretization module is used to discretize the heap memory, that is, to divide the memory of a specified size to be allocated into multiple small blocks, and then allocate multiple small blocks of memory. The small blocks of memory are linked together using control information. Each discretized block contains a block data area pointer, a block length area, a block data area, a security attribute information area, and a security attribute execution method area; The heap discretization module is used to discretize the memory in the heap. The discretization process includes initialization, writing data, reading data, and termination.

Images