Security access method and device for reference data, equipment and terminal

Abstract

The invention discloses a reference data security access method and device, electronic equipment, a terminal, a storage medium and a product. The secure access method comprises the following steps: in response to a memory data access instruction, obtaining an instruction type and an operand; when it is determined that target access data needing to be accessed belongs to target reference data elements according to the instruction type and the operands, a target index matched with the target reference data and target array offset of the target access data in the target reference data are obtained; querying the target index in the reference data table, and when an effective target physical address is queried, obtaining target data attribute information of the target reference data from the target physical address; and performing security access check on the target access data according to the target data attribute information and the target array offset. According to the technical scheme of the embodiment of the invention, the novel reference data which is also used for storing the memory address of the data is provided, and the flexibility and the safety of memory data access are improved based on the reference.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, electronic device, terminal, storage medium, and product for secure access to referenced data. Background Technology

[0002] WebAssembly (WASM) is a virtual instruction set architecture. Based on WebAssembly bytecode technology, applications can be written in various programming languages ​​and then converted into WebAssembly bytecode. This WebAssembly bytecode is then interpreted and executed by a virtual machine on the device, enabling the application to run correctly.

[0003] In existing technologies, various applications store memory addresses only through pointer variables. The construction and usage of pointer variables are fixed, which can increase the flexibility of application programming. However, these pointer variables can arbitrarily access the non-volatile storage space in the device, which undermines the data isolation feature between applications and poses certain security risks. Summary of the Invention

[0004] This invention provides a secure access method, apparatus, electronic device, terminal, storage medium, and product for reference data, offering a novel type of reference data for storing memory addresses, thereby improving the flexibility and security of memory data access. Furthermore, the reference can be used for pointer programming, providing flexibility for application programming.

[0005] According to one aspect of the present invention, a method for constructing reference data is provided, comprising:

[0006] In response to the reference data creation instruction, the reference data is created and obtained.

[0007] Construct data attribute information corresponding to the referenced data, and store the data attribute information and the referenced data together in a designated storage area. The referenced data can be located based on the data attribute information.

[0008] Write the physical address of the data attribute information to the referenced data table, and obtain the index of the data attribute information in the referenced data table;

[0009] A reference is generated in the index of the referenced data table based on the data attribute information, as a response to the instruction to create the referenced data, so that the referenced data can be accessed subsequently.

[0010] According to another aspect of the present invention, a method for accessing reference data is also provided, comprising:

[0011] Accessing elements of referenced data by calling application programming interfaces; or

[0012] Accessing elements of referenced data using pointer fetching;

[0013] The referenced data is constructed by the method described in any one of the embodiments of the present invention.

[0014] According to another aspect of the present invention, a secure access method for referenced data is also provided, comprising:

[0015] In response to a memory data access instruction, the system obtains an instruction type matching the memory data access instruction and at least one operand; wherein the memory data access instruction includes an instruction to call an application programming interface, or an instruction constructed using pointer fetch programming.

[0016] When determining that the target access data belongs to the element of the target reference data based on the instruction type and each operand, obtain the target index that matches the target reference data and the target array offset of the target access data in the target reference data;

[0017] The target index is queried in the referenced data table, and when a valid target physical address is found, the target data attribute information of the target referenced data is obtained from the target physical address;

[0018] The reference data table stores the physical address of the data attribute information corresponding to the referenced data, and the referenced data can be located based on the data attribute information;

[0019] Based on the target data attribute information and the target array offset, perform a security access check on the target access data.

[0020] According to another aspect of the present invention, an apparatus for constructing reference data is also provided, comprising:

[0021] The reference data creation module is used to create reference data in response to reference data creation instructions;

[0022] The reference data storage module is used to construct data attribute information corresponding to the reference data, and store the data attribute information and the reference data together in a designated storage area. The reference data can be located based on the data attribute information.

[0023] The physical address writing module is used to write the physical address of the data attribute information to the referenced data table and obtain the index of the data attribute information in the referenced data table.

[0024] The reference generation module is used to generate references in the index of the referenced data table based on data attribute information, as a response to the referenced data creation instruction, so that the referenced data can be accessed subsequently.

[0025] According to another aspect of the present invention, an access device for referenced data is also provided, comprising:

[0026] The first type of access module is used to access elements that reference data by calling application programming interfaces; or

[0027] The second type of access module is used to access elements of referenced data through pointer fetching programming.

[0028] The referenced data is constructed by the method described in any one of the embodiments of the present invention.

[0029] According to another aspect of the present invention, a secure access device for referenced data is also provided, comprising:

[0030] The instruction information acquisition module is used to acquire, in response to a memory data access instruction, an instruction type and at least one operand that match the memory data access instruction; wherein, the memory data access instruction includes an instruction to call an application programming interface, or an instruction constructed using pointer fetch programming.

[0031] The key information acquisition module is used to acquire the target index that matches the target reference data and the target array offset of the target access data in the target reference data when it is determined that the target access data to be accessed belongs to the element of the target reference data according to the instruction type and each operand.

[0032] The attribute information acquisition module is used to query the target index in the reference data table, and when a valid target physical address is found, to obtain the target data attribute information of the target reference data from the target physical address;

[0033] The reference data table stores the physical address of the data attribute information corresponding to the referenced data, and the referenced data can be located based on the data attribute information;

[0034] The security access check module is used to perform security access checks on the target access data based on the target data attribute information and the target array offset.

[0035] According to another aspect of the present invention, an electronic device is also provided, wherein an operating system is installed on the electronic device, and a runtime environment is executed in the operating system, the electronic device comprising:

[0036] At least one processor; and

[0037] A memory communicatively connected to the at least one processor; wherein,

[0038] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method as described in any one of the embodiments of the present invention.

[0039] According to another aspect of the present invention, a terminal is also provided, including an electronic device as described in any one of the embodiments of the present invention.

[0040] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium storing computer instructions for causing a processor to execute the method as described in any one of the embodiments of the present invention.

[0041] According to another aspect of the present invention, a computer program product is also provided, the computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of the embodiments of the present invention.

[0042] The method for constructing reference data provided by the technical solution of this invention creates reference data in response to a reference data creation instruction; constructs data attribute information corresponding to the reference data, and stores the data attribute information and the reference data together in a designated storage area; writes the physical address of the data attribute information into a reference data table, and obtains the index of the data attribute information in the reference data table; generates a reference based on the index of the data attribute information in the reference data table as a response result to the reference data creation instruction; and allows subsequent access to the reference data via reference or pointer dereference. This invention proposes a novel method for storing memory addresses of data using reference data, and defines a method for creating reference data. Based on this reference, while achieving a memory data access effect similar to that of pointers, it improves the flexibility and security of memory data access.

[0043] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart of a method for constructing reference data according to an embodiment of the present invention;

[0046] Figure 2 This is a flowchart of another method for constructing reference data according to an embodiment of the present invention;

[0047] Figure 3 This is a flowchart of another method for constructing reference data according to an embodiment of the present invention;

[0048] Figure 4 This is a flowchart of a method for accessing reference data according to an embodiment of the present invention;

[0049] Figure 5 This is a flowchart illustrating an implementation method for accessing elements of referenced data by calling an application programming interface, as applicable to an embodiment of the present invention.

[0050] Figure 6 This is a flowchart illustrating an implementation method for accessing elements of referenced data using pointer dereference programming, applicable to an embodiment of the present invention.

[0051] Figure 7 This is a flowchart of a secure access method for referenced data provided in an embodiment of the present invention;

[0052] Figure 8 This is a flowchart of another secure access method for referenced data provided by an embodiment of the present invention;

[0053] Figure 9 This is a schematic diagram of a data construction apparatus according to an embodiment of the present invention;

[0054] Figure 10 This is a schematic diagram of the structure of a data access device according to an embodiment of the present invention;

[0055] Figure 11 This is a schematic diagram of a secure access device for referenced data provided in an embodiment of the present invention;

[0056] Figure 12 This is a structural diagram of an electronic device provided according to an embodiment of the present invention;

[0057] Figure 13 This is a structural diagram of a terminal provided according to an embodiment of the present invention. Detailed Implementation

[0058] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0059] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0060] Figure 1 This is a flowchart illustrating a method for constructing reference data according to Embodiment 1 of the present invention. This embodiment is applicable to situations where reference data is created for memory address management of application data. The method can be executed by a reference data construction device, which can be implemented in hardware and / or software and is generally configured in an electronic device with an operating system installed. The operating system is generally an embedded operating system, and the electronic device is generally a resource-constrained device such as a security element or a smart card.

[0061] In this embodiment, the method can be executed by a runtime environment within the operating system. A runtime environment (RTE) is a secure runtime environment that executes a virtual machine on limited resources such as a smart card or secure element; it can be considered a lightweight container. Applications run within this runtime environment, thus achieving complete isolation from the native functions of the embedded operating system.

[0062] Correspondingly, such as Figure 1 As shown, the method includes:

[0063] S110. In response to the reference data creation instruction, the reference data is created.

[0064] In various embodiments of the present invention, a new data type, namely, reference data, is defined. Similar to the method of using a pointer to point to a data storage address, by using reference data (also called a reference array), the memory address (or logical address or pseudo address, etc.) of the stored data can be identified.

[0065] Specifically, reference data corresponding to the application data can be created during application installation or when the application is selected within a logical channel. This reference data is then used to store the memory addresses of various application data generated during the application's installation or operation. For example, after storing the memory address of application data A from application X in the reference data corresponding to application X, other variables can directly obtain the memory address of application data A from this reference data to reference application data A.

[0066] Optionally, you can record the memory addresses of application data by creating reference data (also known as reference arrays) for the application. These references can be used to identify whether application data is referenced.

[0067] Specifically, a reference data creation instruction can be triggered during application installation or when the application is selected within a logical channel. Based on this instruction, reference data, or a reference array, corresponding to the application can be created.

[0068] In a specific example, an operating system API (Application Programming Interface) of the form MEM_TYPE mallocMem(u16 size, u8 type, u8 align) can be used to request a storage space of a specified size in non-volatile memory (NVM) or volatile memory (also known as linear memory space, typically RAM) to store reference data.

[0069] Where size is the size of the array to be allocated, type is the type of storage to be allocated (e.g., RAM or NVM), and align is the type of array to be allocated (e.g., CHAR, INT, or SHORT).

[0070] S120. Construct data attribute information corresponding to the referenced data, and store the data attribute information and the referenced data together in a designated storage area. The referenced data can be located based on the data attribute information.

[0071] In this embodiment, the data size of the referenced data can be identified by data attribute information, or the owner of the referenced data can be identified by data attribute information, or both the data size and the owner of the referenced data can be identified by the data attribute information.

[0072] Optionally, the owner of the referenced data can be described by the application identifier of the target application to which the referenced data belongs, or the module identifier of the application module to which the target application belongs, or the application identifier of the target application to which the referenced data belongs and the module identifier of the application module to which the target application belongs. The above information can also be referred to as the virtual machine runtime domain information to which the referenced data belongs.

[0073] By using the data attribute information corresponding to the referenced data, a security check of memory access can be performed before the actual access to the referenced data. For example, it can check whether the virtual machine runtime domain information of the visitor matches the virtual machine runtime domain information of the referenced data to determine whether it complies with the firewall policy; or it can check whether the data offset that the visitor needs to access exceeds the memory range limited by the data size of the referenced data.

[0074] Data attribute information and referenced data can be stored adjacently or non-adjacently in this designated storage area. However, it is required that the referenced data can be located based on the data attribute information.

[0075] In a specific example, if the data attribute information and the referenced data are stored adjacently, the referenced data can be effectively located based on the position of the data tail of the data attribute information and the data size of the referenced data recorded in the data attribute information.

[0076] In another specific example, if the data attribute information is not stored adjacent to the referenced data, a separate field can be used in the data attribute information to store the storage location information of the referenced data in the designated storage area. Then, after reading the field in the data attribute information, the referenced data can be effectively located by combining the data size of the referenced data and the storage location information of the referenced data.

[0077] It is understandable that referenced data can be effectively located through its data attribute information. Therefore, it is only necessary to effectively manage the physical address of this data attribute information to facilitate index lookup.

[0078] S130. Write the physical address of the data attribute information to the referenced data table, and obtain the index of the data attribute information in the referenced data table.

[0079] In this embodiment, a reference data table is used to uniformly store and manage the data attribute information of each referenced data. Optionally, this reference data table can be stored in a designated storage space in non-volatile memory.

[0080] By using the index of the data attribute information in the referenced data table, the position of the table entry corresponding to the data attribute information (the physical address used to store the data attribute information) in the referenced data table can be quickly located (for example, in which row of the referenced data table).

[0081] Optionally, the referenced data table can be a first-level referenced data table, a second-level referenced data table, or even a referenced data table with more than one level.

[0082] If the referenced data table is a first-level referenced data table, the physical address of the data attribute information can be directly stored in a blank entry in the unique referenced data table, and the index position of the blank entry in the unique referenced data table can be used as the index of the data attribute information in the referenced data table.

[0083] If the referenced data table is a second-level referenced data table, it means that the second-level referenced data table has one level 0 referenced data table and multiple level 1 referenced data tables. The physical address of the data attribute information is stored in a specific level 1 referenced data table, while the level 0 referenced data table is used to store the storage addresses of each level 1 referenced data table.

[0084] Correspondingly, the index of data attribute information in the reference data table (that is, the position of the table entry used to store the physical address of data attribute information in the second-level reference data table) contains two parts. One part is the index position of the specific first-level reference data table that actually stores the physical address of the data attribute information in the first-level reference data table. The second part is the index position of the table entry that stores the physical address of the data attribute information in the specific first-level reference data table.

[0085] S140. Generate a reference in the index of the referenced data table based on the data attribute information, as a response to the referenced data creation instruction, so that the referenced data can be accessed subsequently.

[0086] It is understandable that by using the index of the referenced data table based on the data attribute information, the physical address of the data attribute information can be accurately located. Based on the data attribute information, the referenced data can be accurately located, and thus, the data content in the referenced data can be securely read and written.

[0087] Correspondingly, a reference can be generated based on the index of the referenced data table according to the data attribute information. Subsequently, the referenced data can be accessed based on the reference, either by reference or by taking the pointer with `*`. Generating a reference from an index can be done through arithmetic operations. For example, arithmetic operations can be used to combine the index of the referenced data table with a fixed offset to generate a reference to that data.

[0088] The method for constructing reference data provided by the technical solution of this invention creates reference data in response to a reference data creation instruction; constructs data attribute information corresponding to the reference data, and stores the data attribute information and the reference data together in a designated storage area; writes the physical address of the data attribute information into a reference data table, and obtains the index of the data attribute information in the reference data table; generates a reference based on the index of the data attribute information in the reference data table as a response result to the reference data creation instruction; and allows subsequent access to the reference data via reference or pointer dereference. This invention proposes a novel method for storing memory addresses of data using reference data, and defines a method for creating reference data. Based on this reference, while achieving a memory data access effect similar to that of pointers, it improves the flexibility and security of memory data access.

[0089] Figure 2 This is a flowchart of another method for constructing reference data provided by an embodiment of the present invention. This embodiment is based on the above embodiment and is optimized. In this embodiment, the operation of "constructing data attribute information corresponding to the reference data and storing the data attribute information and the reference data together in a designated storage area" is specified.

[0090] Correspondingly, such as Figure 2 As shown, the method may include:

[0091] S210. In response to the reference data creation instruction, the reference data is created.

[0092] S220. If the referenced data is persistent data, then the data attribute information is constructed based on the data type of the referenced data, the virtual machine runtime domain information to which it belongs, and the data size.

[0093] Persistent data refers to non-volatile storage data created during application module installation or operation by calling the storage space allocation interface provided by the operating system runtime environment. Its initial value is 0. Persistent data belongs to the application itself and can be written to and read from through interfaces or pointer variables provided by the operating system runtime environment. Virtual machine instructions can directly access this persistent data through pointer variables. Reference data, on the other hand, is also considered persistent data because the data within it is not lost even when power is off; its storage space is the heap space (or NVM space).

[0094] The data types include: basic array types or structured data types; wherein, the reference data of the structured data type contains both reference data values ​​and non-reference data values. The reference data value can be understood as the memory address of the application data, while the non-reference data value can be understood as a basic type data value, such as a regular variable value.

[0095] The virtual machine runtime domain information may include: the module identifier (typically ModuleID) of the application module to which the referenced data belongs, and the application identifier (typically APPID) of the application to which the referenced data belongs.

[0096] S230. Store the data attribute information and the referenced data adjacent to each other in a designated storage area.

[0097] The data size of the referenced data in the data attribute information is used to identify the end position of the referenced data.

[0098] In this embodiment, when the referenced data is persistent data, the data attribute information of the referenced data and the referenced data itself can be stored adjacently in a contiguous storage space in the form of data attribute information + data content. Then, once the data attribute information is successfully located, the referenced data can be located accordingly.

[0099] S240. If the referenced data is temporary data, the referenced data is stored in the designated storage area, and the storage location information of the referenced data is obtained.

[0100] Temporary data is data used during application runtime and is cleared or reset when a specific event occurs to ensure security and protect sensitive data. Reference data, on the other hand, is temporary data because it stores the memory address of temporary data. The data in reference data is either lost when power is off or cleared at a specific time; its storage space is memory space (or RAM space).

[0101] Specifically, when the referenced data is temporary, the referenced data and its data attribute information cannot be stored adjacently. The storage location of the data attribute information and the referenced data needs to be dynamically determined based on the current storage area usage. In this case, it is only necessary to write the storage location information of the referenced data into its data attribute information.

[0102] The storage location information may include: the logical address of the data, or the offset of the data in the volatile storage area.

[0103] S250. Based on the data type of the referenced data, the virtual machine runtime domain information, the data size, and the storage location information, the data attribute information is constructed and stored in the designated storage area.

[0104] Among them, reference data and data attribute information are stored either adjacently or non-adjacently in the designated storage area.

[0105] S260. Write the physical address of the data attribute information to the referenced data table, and obtain the index of the data attribute information in the referenced data table.

[0106] In an optional implementation of this embodiment, writing the physical address of the data attribute information to the reference data table and obtaining the index of the data attribute information in the reference data table may include:

[0107] Obtain a unique reference data table, and within that table, retrieve the first free entry; write the physical address of the data attribute information into the first free entry, and use the index of the first free entry in the reference data table as the index of the data attribute information in the reference data table.

[0108] Specifically, during the OS (Operating System) production process, a memory space is first initialized to store a reference data table. This reference data table includes multiple free entries, and each free entry stores the physical address of a data attribute information.

[0109] Furthermore, whenever the physical address for storing data attribute information is needed, a free entry can be retrieved from the referenced data table as the first free entry, and the physical address of the data attribute information can be written into the first free entry. Then, the index of the first free entry in the referenced data table can be used as the index of the data attribute information in the referenced data table.

[0110] S270. Generate a reference in the index of the referenced data table based on the data attribute information, as a response to the referenced data creation instruction, so that the referenced data can be accessed subsequently.

[0111] The technical solution of this invention defines the specific data format of the data attribute information corresponding to the referenced data when the referenced data is persistent or temporary data, and simultaneously defines the storage method of the referenced data and the matching data attribute information in the storage area. Based on the above implementation, efficient and accurate data access to elements in the referenced data can be achieved. Based on the reference identifier, data access is also performed through pointer multiplication, improving the flexibility and security of memory data access.

[0112] Figure 3 This is a flowchart of another method for constructing reference data provided by an embodiment of the present invention. This embodiment is based on the above embodiment and optimized. In this embodiment, the operation of "writing the physical address of data attribute information into the reference data table and obtaining the index of data attribute information in the reference data table" is specified.

[0113] Correspondingly, such as Figure 3 As shown, the method may include:

[0114] S310. In response to the reference data creation instruction, the reference data is created.

[0115] S320. Construct data attribute information corresponding to the referenced data, and store the data attribute information and the referenced data together in a designated storage area. The referenced data can be located based on the data attribute information.

[0116] S330. In the second-level reference data table, retrieve the 0th-level reference data table.

[0117] In this embodiment, the reference data table can be a two-level reference data table, which includes a level 0 reference data table and multiple level 1 reference data tables. The level 0 reference data table stores the storage addresses of each level 1 reference data table, while the level 1 reference data tables store the physical addresses of the actual reference data.

[0118] S340. Based on the level 0 reference data table, obtain a level 1 reference data table from the level 2 reference data table, and obtain a second free table entry from the obtained level 1 reference data table.

[0119] In this embodiment, the storage addresses of each Level 1 reference data table can be stored sequentially in the Level 0 reference data table. Whenever a Level 1 reference data table is full, a new Level 1 reference data table is created, and its storage address is stored in the Level 0 reference data table. Furthermore, by querying the end of the Level 0 reference data table, a Level 1 reference data table with a currently available physical address for storing reference data can be obtained, and a free entry, i.e., a second free entry, can be retrieved from this Level 1 reference data table.

[0120] Optionally, in addition to storing the storage addresses of each Level 1 reference data table, the Level 0 reference data table can also be used to store the number of valid entries contained in each Level 1 reference data table. This embodiment does not impose any limitations on this.

[0121] S350. Write the physical address of the data attribute information into the second free table entry, and obtain the index of the second free table entry in the obtained level 1 reference data table.

[0122] S360. The index of the first-level reference data table obtained in the first-level reference data table and the index of the second free table entry in the first-level reference data table are combined to obtain the index of the data attribute information in the reference data table.

[0123] S370. Generate a reference in the index of the referenced data table based on the data attribute information, as a response to the referenced data creation instruction, so that the referenced data can be accessed subsequently.

[0124] The technical solution of this invention defines a specific implementation method for storing data attribute information in a secondary reference data table. By combining the index of the first-level reference data table containing the physical address of the data attribute information in the 0-level reference data table, and the index of the second free entry containing the physical address of the data attribute information in the first-level reference data table, the index of the data attribute information in the reference data table is obtained. Based on this index, the storage area of ​​the reference data can be quickly and accurately located, thereby enabling efficient and accurate data access to the elements in the reference data.

[0125] Based on the above embodiments, the method may further include:

[0126] If it is determined that all Level 1 reference data tables already created in the Level 0 reference data table are full, a new Level 1 reference data table is created, and the storage address of the new Level 1 reference data table is written to the Level 0 reference data table.

[0127] The above settings enable the creation of first-level reference data tables in second-level reference data tables on demand, thereby enabling efficient use of precious memory resources in resource-constrained devices and meeting the application needs of resource-constrained scenarios.

[0128] Figure 4 This is a flowchart illustrating a method for accessing reference data according to an embodiment of the present invention. This embodiment is applicable to situations where the memory address of application data is obtained by accessing reference data, and then the application data is accessed. This method can be executed by a reference data access device, which can be implemented in hardware and / or software, and is generally configured in an electronic device with an operating system installed. The operating system is generally an embedded operating system, and the electronic device is generally a resource-constrained device such as a security element or a smart card.

[0129] Correspondingly, such as Figure 4 As shown, the method may include:

[0130] S410. Access elements of referenced data by calling application programming interfaces.

[0131] Optionally, reference data can be stored as arrays. Each element of the reference data can be understood as the memory address (or logical address) of a specific piece of application data.

[0132] During application execution, the memory address of the application data can be obtained from the reference data, and the application data can be accessed based on the memory address.

[0133] In an optional implementation of this embodiment, elements of the referenced data can be accessed by calling an application programming interface (API). This API can be a programming interface specifically designed for referenced data by the operating system, or it can be a compatible version of an existing operating system API (typically a pointer-based API).

[0134] Optional, in Figure 5 The diagram shows a flowchart of an implementation method for accessing elements of referenced data by calling an application programming interface, applicable to an embodiment of the present invention.

[0135] like Figure 5 As shown, the implementation methods for accessing elements of referenced data by calling application programming interfaces can include:

[0136] S510. By calling the application programming interface, a reference or pointer to the memory data to be accessed is passed in the parameters of the application programming interface.

[0137] Specifically, if the application programming interface being called is a system API that operates on references, such as a customized system API for reading array data from an array object, then a reference to the memory data to be accessed can be directly passed in the parameters of the application programming interface.

[0138] If the application programming interface being called is a system API for pointer operations, such as an existing system API for implementing array comparison or array copying, then a pointer to the memory data to be accessed can be passed as a parameter of the application programming interface.

[0139] The reference or pointer includes an index in the reference data table used to retrieve the data attribute information of the referenced data. This index is used to locate the physical address of the referenced data. Furthermore, the referenced data can be located based on the data attribute information.

[0140] Specifically, by using the reference or pointer passed as a parameter in the application programming interface (API), the index of the referenced data's attribute information in the referenced data table can be obtained. This allows for the location of the referenced data's attribute information. After obtaining the attribute information, the referenced data can be further located. Then, after determining the array offset of the desired element within the referenced data, the element can be precisely accessed.

[0141] In an optional implementation of this embodiment, if the parameter type of the application programming interface is a reference, a reference to the memory data to be accessed is generated based on the index of the reference data in the reference data table according to the data attribute information of the reference data; the reference to the memory data to be accessed and the array offset of the element of the reference data in the reference data are passed to the application programming interface as two parameters respectively.

[0142] In this optional implementation, the system API involving reference operations can directly pass two independent parameters: one is the reference to the referenced data, and the other is the array offset of the element of the referenced data within the referenced data. Based on these two parameters, the element of the referenced data to be accessed can be accurately located.

[0143] Similarly, a reference to the memory data to be accessed can be generated by performing certain arithmetic operations on the index of the referenced data's data attribute information in the referenced data table. The arithmetic operations include, but are not limited to, superimposing the index of the referenced data's data attribute information in the referenced data table with a fixed value.

[0144] In another optional implementation of this embodiment, if the parameter type of the application programming interface is a pointer, a reference to the memory data to be accessed is generated based on the index of the reference data table according to the data attribute information of the reference data; the reference to the memory data to be accessed and the array offset of the element of the reference data in the reference data are combined to form a pointer value, and the pointer value is passed to the application programming interface as a parameter value.

[0145] Currently, system APIs involving pointer operations typically only pass a single parameter, namely the pointer parameter value. This parameter value primarily describes the pointer to the memory address to be accessed. As mentioned earlier, accessing referenced data requires a reference to that referenced data and the array offset of the elements within that referenced data. To be compatible with this pointer-operation system API, a simple approach is to combine the reference to the memory data to be accessed and the array offset of the elements within that referenced data to construct a pointer value, and then pass this pointer value as the parameter value to the application programming interface.

[0146] Optionally, if the parameter type of the application programming interface is a pointer, reference mask information, such as an identifier like "REFMASK", can be added to the pointer value to indicate that the parameter value passed by the application programming interface is not a normal memory offset, but a reference to reference data and a combination of the array offset of the elements of the reference data in the reference data.

[0147] S520. Within the application programming interface, memory data access is performed by resolving references or pointers. The physical address of the referenced data is located based on the reference to the memory data to be accessed, and the elements of the referenced data are accessed based on the physical address of the referenced data and the array offset of the elements of the referenced data within the referenced data.

[0148] By resolving references or pointers, the physical address of the data attribute information of the referenced data can be obtained first. Then, based on the physical address of the data attribute information, the physical address of the referenced data can be accurately located. Finally, by combining the array offset of the element in the referenced data, the element of the referenced data can be accessed accurately.

[0149] S420: Access elements of referenced data using pointer fetching.

[0150] Generally, in addition to using system APIs involving pointer operations to access the memory address pointed to by a pointer value, developers can also write their own memory data access instructions using pointer fetch programming to access memory data. Considering the speed of accessing referenced data, embodiments of this invention also consider using pointer fetch programming to access elements of referenced data.

[0151] Among them, pointer fetch programming only requires constructing a pointer value, and then accessing memory data based on the memory address pointed to by the pointer value.

[0152] Optional, in Figure 6 The diagram shows a flowchart of an implementation method for accessing elements of referenced data using pointer fetch programming, applicable to an embodiment of the present invention.

[0153] like Figure 6 As shown, the implementation methods for accessing elements of referenced data using pointer fetching can include:

[0154] S610 constructs memory data access instructions using pointer fetch programming.

[0155] In an optional implementation of this embodiment, constructing memory data access instructions using pointer fetch programming may include:

[0156] Based on the index of the referenced data in the referenced data table according to the data attribute information of the referenced data, a reference to the memory data to be accessed is generated; the reference to the memory data to be accessed and the array offset of the element of the referenced data in the referenced data are combined to form a pointer value; and the memory data access instruction corresponding to the pointer value is constructed by pointer fetch programming.

[0157] Optionally, when constructing memory data access instructions, you can consider adding reference mask information to the pointer value, such as an identifier like "REFMASK", to indicate that the memory data access instructions constructed by the pointer dereference programming are not memory operations on the module dataset and program dataset, but reference operation instructions.

[0158] S620. By executing memory data access instructions, based on the pointer value of the memory data to be accessed, obtain the reference value of the reference data and the array offset of the element of the reference data in the reference data, and access the element of the reference data according to the reference value of the reference data and the array offset.

[0159] The reference value includes an index in the reference data table that can be used to retrieve the data attribute information of the referenced data. This index is used to locate the physical address of the referenced data. The referenced data can be located based on this data attribute information.

[0160] In this embodiment, either S410 or S420 can be used to access the elements of the referenced data. The referenced data is constructed using the referenced data access method described in any one of the embodiments of the present invention.

[0161] The technical solution of this invention provides an efficient and convenient way to access elements in new types of reference data by calling application programming interfaces or by using pointer fetch programming. The implementation is simple and easy to understand, and developers can quickly master the way to access reference data without complicated learning.

[0162] Figure 7 This is a flowchart illustrating a secure access method for referenced data according to an embodiment of the present invention. This embodiment is applicable to situations where secure access is performed on application data pointed to by elements in the referenced data. The method can be executed by a secure access device for referenced data, which can be implemented in hardware and / or software and is generally configured in an electronic device with an operating system installed. The operating system is generally an embedded operating system, and the electronic device is generally a resource-constrained device such as a security element or a smart card.

[0163] Correspondingly, such as Figure 7 As shown, the method may include:

[0164] S710, in response to a memory data access instruction, obtains the instruction type and at least one operand that match the memory data access instruction.

[0165] The memory data access instructions include instructions for calling application programming interfaces, or instructions constructed using pointer fetch programming.

[0166] The instruction types can include: function call instructions based on reference data, function call instructions based on pointers, or memory data loading or storing instructions based on pointers. The number of operands required varies depending on the instruction type.

[0167] Optionally, in virtual machines on resource-constrained devices, a stack-based structure can generally be used. Furthermore, stack frames (also called virtual machine stack frames) can be stored in the virtual machine stack, including storing parameters, local variables, intermediate execution results, return values, and method call information.

[0168] Accordingly, retrieving at least one operand that matches a memory data access instruction may include:

[0169] Obtain a virtual machine stack frame that matches the memory data access instruction, and obtain the at least one operand from the virtual machine stack frame; or

[0170] In the memory data access instruction, at least one operand is directly extracted.

[0171] S720. When determining that the target access data to be accessed belongs to the element of the target reference data based on the instruction type and each operand, obtain the target index that matches the target reference data and the target array offset of the target access data in the target reference data.

[0172] In an optional implementation of this embodiment, when the instruction type is determined to be a function call instruction based on reference data, the target access data to be accessed is determined to be an element of the target reference data, and the first call parameter and the second call parameter are obtained; the target index matching the target reference data is separated from the first call parameter, and the second call parameter is used as the target array offset.

[0173] If the instruction type is a function call instruction based on reference data, it indicates that the call parameter is a system API involving reference operations. As mentioned earlier, such system APIs can pass two call parameters: one call parameter (i.e., the first call parameter) contains the target index that matches the target reference data, and the other call parameter is the target array offset. Specifically, the first call parameter can be in the form of "((REFMASK)|(REFHANDLER)", where REFMASK is the reference mask information used to identify whether the following content is related to the reference data, and REFHANDLER identifies the target index that matches the target reference data.

[0174] Here, the target index refers to the index position of the physical address of the data attribute information of the target reference data in the reference data table, while the target array offset refers to the target array offset of the target access data that matches the memory data access instruction in the target reference data.

[0175] In another optional implementation of this embodiment, when the instruction type is determined to be a pointer-based function call instruction, a pointer offset parameter is obtained; if the pointer offset parameter contains reference mask information, it is determined that the target access data to be accessed belongs to the element of the target reference data, and the target index and target array offset are separated from the pointer offset parameter.

[0176] The pointer-based function call instruction can be understood as a system API involving pointer operations. Generally, the pointer-based function call instruction usually only passes a single parameter, which can also be called a pointer offset parameter. This pointer offset parameter corresponds to a pointer value, which generally points to the memory address of the target data to be accessed.

[0177] In this embodiment, after determining that the instruction type is a pointer-based function call instruction and obtaining the corresponding pointer offset parameter, the pointer offset parameter can be a pointer value pointing to the module dataset and the program dataset, or it can be a modified value obtained by assembling references and array offsets. Therefore, it is possible to first detect whether the pointer offset parameter contains reference mask information. If so, it indicates that the pointer offset parameter is combined to access elements of the referenced data. Therefore, it is necessary to separate the target index and the target array offset from the pointer offset parameter.

[0178] In an optional implementation of this embodiment, it is assumed that a pointer offset parameter of the form "((REFMASK)|(REFHANDLER)|(offset))" is passed through a pointer-based function call instruction. By parsing the pointer offset parameter, it is found that the pointer offset parameter carries reference mask information, that is, the "REFMASK" identifier. At this time, the target index REFHANDLER and the target array offset can be separated from the REFMASK respectively.

[0179] In another optional implementation of this embodiment, when it is determined that the instruction type is a pointer-based memory data loading or storing instruction, the memory offset pointed to by the pointer is obtained; if the memory offset contains reference mask information, the target access data to be accessed belongs to the element of the target reference data, and the target index and target data offset are separated in the memory offset.

[0180] Furthermore, pointer fetching can be used to execute instructions for loading or storing memory data. This allows obtaining the pointer value (i.e., the memory offset) from the memory access instruction. Similarly, if the memory offset does not contain a reference mask, it indicates that it is a pointer to memory data in the module dataset and program dataset, allowing direct access to the pointed-to content. If the memory offset contains a reference mask, it means that the memory access instruction also uses pointer fetching to access elements of referenced data. Therefore, the target index and target data offset need to be separated from the memory offset accordingly.

[0181] S730. Query the target index in the reference data table, and when a valid target physical address is found, obtain the target data attribute information of the target reference data from the target physical address.

[0182] The reference data table stores the physical address of the data attribute information corresponding to the referenced data, and the referenced data can be located based on the data attribute information.

[0183] In an optional implementation of this embodiment, querying the target index in the referenced data table may include:

[0184] Perform a query on the target index in the unique reference data table.

[0185] In another optional implementation of this embodiment, querying the target index in the referenced data table further includes:

[0186] Split the target index into a first index and a second index;

[0187] In the level 0 reference data table of the second-level reference data table, query the first index to obtain the storage address of the target level 1 reference data table corresponding to the first index;

[0188] Based on the storage address of the target first-level reference data table, locate the target first-level reference data table and query the second index in the target first-level reference data table;

[0189] The Level 0 reference data table stores the storage addresses of each Level 1 reference data table, while the Level 1 reference data table stores the physical addresses of the actual reference data.

[0190] S740. Perform a security access check on the target access data based on the target data attribute information and the target array offset.

[0191] In an optional implementation of this embodiment, the target data attribute information of the target reference data stores the virtual machine runtime domain information to which the target reference data belongs, and the data size of the target reference data. Based on one or both of the above two pieces of information, a security access check can be performed on the target access data. For example, it can check whether the virtual machine runtime domain of the visitor to the target access data complies with firewall access rules, or whether the target array offset exceeds the data size of the target reference data, etc. Through the above security access check, access to other unauthorized memory data can be avoided, thereby improving the security of memory access.

[0192] The technical solution of this invention, in response to a memory data access instruction, obtains the instruction type and at least one operand matching the memory data access instruction; when it is determined, based on the instruction type and operands, that the target access data to be accessed belongs to an element of the target reference data, it obtains the target index matching the target reference data and the target array offset of the target access data in the target reference data; it queries the target index in the reference data table, and when a valid target physical address is found, it obtains the target data attribute information of the target reference data from the target physical address; and it performs a security access check on the target access data based on the target data attribute information and the target array offset. This implementation method effectively controls memory access to reference or pointer types, maximizes data isolation between different application data, and improves the security of memory access.

[0193] Figure 8 This is a flowchart of another secure access method for referenced data provided by an embodiment of the present invention. This embodiment is based on the above embodiments and is optimized. In this embodiment, the operation of "performing a secure access check on the target access data according to the target data attribute information and the target array offset" is specifically refined.

[0194] Correspondingly, such as Figure 8 As shown, the method may specifically include:

[0195] S810, in response to a memory data access instruction, obtains the instruction type and at least one operand that match the memory data access instruction.

[0196] S820. When determining that the target access data to be accessed belongs to the element of the target reference data based on the instruction type and each operand, obtain the target index that matches the target reference data and the target array offset of the target access data in the target reference data.

[0197] S830. Query the target index in the reference data table, and when a valid target physical address is found, obtain the target data attribute information of the target reference data from the target physical address.

[0198] The reference data table stores the physical address of the data attribute information corresponding to the referenced data, and the referenced data can be located based on the data attribute information.

[0199] S840. Obtain the target data size corresponding to the target reference data from the target data attribute information.

[0200] S850. Detect whether the target array offset exceeds the target data size: if yes, execute S860; otherwise, execute S870.

[0201] S860. Determine that the target access data has not passed the boundary security access check.

[0202] If it is determined that the target access data has failed the boundary security access check, access to the target access data can be prohibited, and corresponding alarm messages can be generated.

[0203] S870: Determine that the target access data has passed the boundary security access check, and execute S880.

[0204] S880. Obtain the target virtual machine runtime domain corresponding to the target reference data from the target data attribute information, and execute S890.

[0205] S890. Check whether the virtual machine runtime domain where the memory data access instruction is located and the virtual machine runtime domain of the target instruction comply with the firewall access rules: if yes, execute S8100; otherwise, execute S8110.

[0206] Specifically, it can be determined whether the module identifier corresponding to the memory data access instruction is consistent with the module identifier recorded in the target virtual machine runtime domain. If so, it is determined that the virtual machine runtime domain where the memory data access instruction is located is consistent with the virtual machine runtime domain of the target instruction.

[0207] Alternatively, it can simultaneously detect whether the module identifier and application identifier corresponding to the memory data access instruction are consistent with the module identifier and application identifier recorded in the target virtual machine runtime domain (that is, the two module identifiers are consistent, and the two application identifiers are also consistent): if so, it is determined that the virtual machine runtime domain where the memory data access instruction is located is consistent with the virtual machine runtime domain of the target instruction.

[0208] S8100: Determine that the target access data has passed the domain security check, and execute S8120.

[0209] S8110. Determine that the target access data has not passed the runtime domain security check.

[0210] If it is determined that the target access data fails the runtime domain security check, access to the target access data can be prohibited, and corresponding alarm messages can be generated.

[0211] S8120, after obtaining the target data attribute information and the target data type of the target reference data, execute S8130.

[0212] S8130. If it is determined that the target data type is a structured data type and the memory data access instruction is a pointer programming instruction, then it is determined that the target access data has failed the data type security check.

[0213] As mentioned earlier, structured data types refer to reference data that simultaneously contains both reference data values ​​and non-reference data values. The reference data value can be understood as the memory address of the referenced data, i.e., the application data, while the non-reference data value can be understood as the memory address of the data in the module's dataset, such as 1, 2, etc. The inventors discovered through research that reference data in this type of structured data type can only be accessed through system APIs of reference or pointer classes, and cannot be accessed through pointer programming instructions (i.e., pointer fetch programming), as this would cause access errors. Therefore, corresponding data type security checks were further added.

[0214] If it is determined that the target access data fails the data type security check, access to the target access data can be prohibited, and corresponding alarm messages can be generated.

[0215] It is understood that if the target access data is determined to have passed the boundary security access check, the runtime domain security check, and the data type security check, then the target access data has passed the security access check.

[0216] The technical solution of this invention is based on a special construction method for reference data, which effectively stores the data size, data type, and virtual machine runtime domain information of the reference data. Therefore, it can perform effective security access checks from dimensions such as boundary security access checks, runtime domain security checks, and data type security checks, thereby further improving the security of memory access.

[0217] Based on the above embodiments, after performing a security access check on the target access data according to the target data attribute information and the target array offset, it may further include:

[0218] If it is determined that the target access data passes the security access check, then based on the target data attribute information, the starting physical address of the target reference data to which the target access data belongs is obtained through one or two location methods;

[0219] Based on the starting physical address and the target array offset, obtain the target access data.

[0220] Specifically, if the target reference data is persistent data, the target reference data and the target data attribute information of the target reference data are stored adjacently. After the target data attribute information is located, the starting physical address of the target reference data to which the target access data belongs can be obtained directly through a single location.

[0221] Furthermore, if the target reference data is temporary data, the target data attribute information stores the storage location information of the target reference data. Therefore, after locating the target data attribute information, based on the storage location information of the target reference data, the starting physical address of the target reference data to which the target access data belongs can be obtained through secondary positioning.

[0222] Figure 9 This is a schematic diagram of a data construction apparatus provided in an embodiment of the present invention. Figure 9 As shown, the device includes: a reference data creation module 910, a reference data storage module 920, a physical address writing module 930, and an index feedback module 940, wherein:

[0223] Reference data creation module 910 is used to create reference data in response to reference data creation instructions;

[0224] The reference data storage module 920 is used to construct data attribute information corresponding to the reference data, and store the data attribute information and the reference data together in a designated storage area. The reference data can be located based on the data attribute information.

[0225] The physical address writing module 930 is used to write the physical address of the data attribute information to the reference data table and obtain the index of the data attribute information in the reference data table;

[0226] The reference generation module 940 is used to generate references in the index of the reference data table based on data attribute information, as a response to the reference data creation instruction, so that the reference data can be accessed subsequently.

[0227] The reference data construction apparatus provided by the technical solution of this invention creates reference data in response to a reference data creation instruction; constructs data attribute information corresponding to the reference data, and stores the data attribute information and the reference data together in a designated storage area; writes the physical address of the data attribute information into a reference data table, and obtains the index of the data attribute information in the reference data table; generates a reference based on the index of the data attribute information in the reference data table as a response result to the reference data creation instruction; and subsequently accesses the reference data through reference or pointer dereference. This invention proposes a novel reference data method for storing memory addresses of data, and defines a method for creating reference data. Based on this reference, while achieving a memory data access effect similar to that of pointers, it improves the flexibility and security of memory data access.

[0228] Based on the above embodiments, the data storage module 920 can be used for:

[0229] If the referenced data is persistent data, then the data attribute information is constructed based on the data type, the virtual machine runtime domain information, and the data size.

[0230] The data attribute information and the referenced data are stored adjacent to each other in a designated storage area;

[0231] The data size of the referenced data in the data attribute information is used to identify the end position of the referenced data.

[0232] Based on the above embodiments, the data storage module 920 can be used for:

[0233] If the referenced data is temporary data, the referenced data will be stored in the designated storage area, and the storage location information of the referenced data will be obtained.

[0234] Data attribute information is constructed based on the data type, virtual machine runtime domain information, data size, and storage location information of the referenced data, and the data attribute information is stored in the designated storage area;

[0235] Among them, reference data and data attribute information are stored either adjacently or non-adjacently in the designated storage area.

[0236] Based on the above embodiments, the data type may include: a basic array type, or a structured data type;

[0237] The reference data of the structured data type contains both reference data values ​​and non-reference data values.

[0238] The virtual machine runtime domain information includes: the identifier of the application module to which the reference data belongs, and the identifier of the application to which the reference data belongs;

[0239] The storage location information includes: the logical address of the data, or the offset of the data in the volatile storage area.

[0240] Based on the above embodiments, the physical address writing module 930 can be specifically used for:

[0241] Retrieve the unique reference data table, and within the unique reference data table, retrieve the first free entry;

[0242] Write the physical address of the data attribute information into the first free table entry, and determine the index of the first free table entry in the referenced data table as the index of the data attribute information in the referenced data table.

[0243] Based on the above embodiments, the physical address writing module 930 can be specifically used for:

[0244] Retrieve the level 0 reference data table from the level 2 reference data table;

[0245] Based on the level 0 reference data table, obtain a level 1 reference data table from the level 2 reference data table, and obtain a second free table entry from the obtained level 1 reference data table;

[0246] Among them, the level 0 reference data table is used to store the storage address of each level 1 reference data table, and the level 1 reference data table is used to store the physical address of the actual reference data;

[0247] Write the physical address of the data attribute information into the second free table entry, and obtain the index of the second free table entry in the obtained level 1 reference data table;

[0248] The index of the first-level reference data table in the first-level reference data table and the index of the second free table entry in the first-level reference data table are combined to obtain the index of the data attribute information in the reference data table.

[0249] Based on the above embodiments, it may further include: a first-level reference data table creation module, used for:

[0250] If it is determined that all Level 1 reference data tables already created in the Level 0 reference data table are full, a new Level 1 reference data table is created, and the storage address of the new Level 1 reference data table is written to the Level 0 reference data table.

[0251] The reference data construction apparatus provided in the embodiments of the present invention can execute the reference data construction method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0252] Figure 10 This is a schematic diagram of a data access device provided in an embodiment of the present invention. Figure 10 As shown, the device includes: a first type of access module 1010, or a second type of access module 1020, wherein:

[0253] The first type of access module 1010 is used to access elements of referenced data by calling application programming interfaces; or

[0254] The second type of access module 1020 is used to access elements of referenced data through pointer fetch programming.

[0255] The reference data is constructed using the reference data creation method described in any one of the embodiments of the present invention.

[0256] The technical solution of this invention provides an efficient and convenient way to access elements in new types of reference data by calling application programming interfaces or by using pointer fetch programming. The implementation is simple and easy to understand, and developers can quickly master the way to access reference data without complicated learning.

[0257] Based on the above embodiments, the first type of access module 1010 may include:

[0258] The reference or pointer passing unit is used to pass a reference or pointer to the memory data to be accessed in the parameters of the application programming interface by calling the application programming interface;

[0259] The reference or pointer includes an index in the reference data table that can be used to obtain the data attribute information of the referenced data, and the index is used to locate the physical address of the referenced data.

[0260] The first element access unit is used to perform memory data access within the application programming interface by resolving references or pointers. It locates the physical address of the referenced data based on the reference to the memory data to be accessed, and accesses the elements of the referenced data based on the physical address of the referenced data and the array offset of the elements of the referenced data in the referenced data.

[0261] Based on the above embodiments, the second type of access module 1020 may specifically include:

[0262] Instruction building unit, used to build memory data access instructions using pointer fetch programming;

[0263] The second element access unit is used to execute memory data access instructions, obtain the reference value of the reference data and the array offset of the element of the reference data in the reference data according to the pointer value of the memory data to be accessed, and access the element of the reference data according to the reference value of the reference data and the array offset.

[0264] The reference value contains information that can be used to obtain the index of the data attribute information of the referenced data in the referenced data table, and the index is used to locate the physical address of the referenced data.

[0265] Based on the above embodiments, the reference or pointer passing unit can be specifically used for:

[0266] If the parameter type of the application programming interface is a reference, then a reference to the memory data to be accessed is generated based on the index of the reference data table according to the data attribute information of the reference data.

[0267] The reference to the memory data to be accessed and the array offset of the element in the referenced data are passed to the application programming interface as two parameters.

[0268] Based on the above embodiments, the reference or pointer passing unit can be specifically used for:

[0269] If the parameter type of the application programming interface is a pointer, then a reference to the memory data to be accessed is generated based on the index of the reference data table according to the data attribute information of the reference data.

[0270] The pointer value is formed by combining the reference to the memory data to be accessed and the array offset of the element in the reference data, and then the pointer value is passed as a parameter value to the application programming interface.

[0271] Based on the above embodiments, the instruction construction unit can be specifically used for:

[0272] Based on the data attribute information of the referenced data, an index in the referenced data table is used to generate a reference to the memory data to be accessed;

[0273] The pointer value is formed by combining the reference to the memory data to be accessed and the array offset of the element in the reference data.

[0274] By using pointer fetching programming, memory data access instructions corresponding to the pointer value are constructed.

[0275] Based on the above embodiments, the referenced data can be located based on the data attribute information.

[0276] The reference data access device provided in the embodiments of the present invention can execute the reference data access method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0277] Figure 11 This is a schematic diagram of a data access device provided in an embodiment of the present invention. Figure 11 As shown, the device includes: an instruction information acquisition module 1110, a key information acquisition module 1120, an attribute information acquisition module 1130, and a security access check module 1140, wherein:

[0278] The instruction information acquisition module 1110 is used to acquire, in response to a memory data access instruction, an instruction type and at least one operand that match the memory data access instruction; wherein, the memory data access instruction includes an instruction to call an application programming interface, or an instruction constructed by pointer fetch programming.

[0279] The key information acquisition module 1120 is used to acquire the target index that matches the target reference data and the target array offset of the target access data in the target reference data when it is determined that the target access data to be accessed belongs to the element of the target reference data according to the instruction type and each operand.

[0280] The attribute information acquisition module 1130 is used to query the target index in the reference data table, and when a valid target physical address is found, to obtain the target data attribute information of the target reference data from the target physical address;

[0281] The reference data table stores the physical address of the data attribute information corresponding to the referenced data, and the referenced data can be located based on the data attribute information;

[0282] The security access check module 1140 is used to perform security access checks on the target access data based on the target data attribute information and the target array offset.

[0283] The technical solution of this invention, in response to a memory data access instruction, obtains the instruction type and at least one operand matching the memory data access instruction; when it is determined, based on the instruction type and operands, that the target access data to be accessed belongs to an element of the target reference data, it obtains the target index matching the target reference data and the target array offset of the target access data in the target reference data; it queries the target index in the reference data table, and when a valid target physical address is found, it obtains the target data attribute information of the target reference data from the target physical address; and it performs a security access check on the target access data based on the target data attribute information and the target array offset. This implementation method effectively controls memory access to reference or pointer types, maximizes data isolation between different application data, and improves the security of memory access.

[0284] In terms of the technology of the above embodiments, the instruction information acquisition module 1110 can be used for:

[0285] Obtain a virtual machine stack frame that matches the memory data access instruction, and obtain the at least one operand from the virtual machine stack frame; or

[0286] In the memory data access instruction, at least one operand is directly extracted.

[0287] Based on the above embodiments, the key information acquisition module 1120 can be used for:

[0288] When determining that the instruction type is a function call instruction based on reference data, determine that the target access data to be accessed belongs to the element of the target reference data, and obtain the first call parameter and the second call parameter;

[0289] The target index matching the target reference data is extracted from the first call parameter, and the second call parameter is used as the target array offset.

[0290] Based on the above embodiments, the key information acquisition module 1120 can be used for:

[0291] When the instruction type is determined to be a pointer-based function call instruction, obtain the pointer offset parameter;

[0292] If the pointer offset parameter contains reference mask information, it is determined that the target access data to be accessed belongs to the element of the target reference data, and the target index and target array offset are separated from the pointer offset parameter.

[0293] Based on the above embodiments, the key information acquisition module 1120 can be used for:

[0294] When the instruction type is determined to be a pointer-based memory data load or store instruction, obtain the memory offset pointed to by the pointer;

[0295] If the memory offset contains reference mask information, the target access data to be accessed belongs to the element of the target reference data, and the target index and target data offset are separated in the memory offset.

[0296] Based on the above embodiments, the attribute information acquisition module 1130 can be used for:

[0297] Perform a query on the target index in the unique reference data table.

[0298] Based on the above embodiments, the attribute information acquisition module 1130 can be used for:

[0299] Split the target index into a first index and a second index;

[0300] In the level 0 reference data table of the second-level reference data table, query the first index to obtain the storage address of the target level 1 reference data table corresponding to the first index;

[0301] Based on the storage address of the target first-level reference data table, locate the target first-level reference data table and query the second index in the target first-level reference data table;

[0302] The Level 0 reference data table stores the storage addresses of each Level 1 reference data table, while the Level 1 reference data table stores the physical addresses of the actual reference data.

[0303] Based on the above embodiments, the security access inspection module 1140 can be used for:

[0304] Obtain the size of the target data corresponding to the target reference data from the target data attribute information;

[0305] Detect whether the target array offset exceeds the target data size: if yes, determine that the target access data has not passed the boundary security access check; otherwise, determine that the target access data has passed the boundary security access check.

[0306] Based on the above embodiments, the security access inspection module 1140 can be further used for:

[0307] Obtain the target virtual machine runtime domain corresponding to the target reference data from the target data attribute information;

[0308] The system checks whether the virtual machine runtime domain where the memory data access instruction resides and the virtual machine runtime domain of the target instruction comply with firewall access rules: if yes, it determines that the target access data has passed the runtime domain security check; otherwise, it determines that the target access data has not passed the runtime domain security check.

[0309] Based on the above embodiments, the security access inspection module 1140 can be further used to: obtain the target data type of the target data attribute information and the target reference data;

[0310] If the target data type is determined to be a structured data type, and the memory data access instruction is a pointer programming instruction, then the target access data is determined to have failed the data type security check.

[0311] Based on the above embodiments, a data access module may also be included, used for:

[0312] After performing a security access check on the target access data based on the target data attribute information and the target array offset, if it is determined that the target access data passes the security access check, the starting physical address of the target reference data to which the target access data belongs is obtained through one or two positioning methods based on the target data attribute information.

[0313] Based on the starting physical address and the target array offset, obtain the target access data.

[0314] The secure access device for referenced data provided in the embodiments of the present invention can execute the secure access method for referenced data provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0315] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0316] Figure 12 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown.

[0317] like Figure 12 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0318] This electronic device can be a resource-constrained device. A resource-constrained device can be understood as an electronic device with limited storage capacity, typically a few KB to tens of KB of RAM resources, and limited NVM (non-volatile memory) resources. Figure 12 (Taking ROM as an example) The size ranges from tens of KB to hundreds of KB, with a maximum size of MB.

[0319] The resource-constrained device can typically be: a smart card, USB key, ESAM (Embedded Secure Access Module), IoT device, or SE (Secure Element). Among these, the smart card is usually a multi-application smart card.

[0320] The I / O interface 15 in the electronic device 10 may include eSPI (Enhanced Serial Peripheral Interface) and SPI (Serial Peripheral Interface), etc.

[0321] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, for example, performing a method for constructing, accessing, and securely accessing referenced data as described in various embodiments of the present invention.

[0322] In some embodiments, a method for constructing, accessing, and securely accessing reference data as described in the various embodiments of the present invention can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 16. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the method for constructing, accessing, and securely accessing reference data as described above in the various embodiments of the present invention can be performed. Alternatively, in other embodiments, processor 11 can be configured by any other suitable means (e.g., by means of firmware) to perform the method for constructing, accessing, and securely accessing reference data as described in the various embodiments of the present invention.

[0323] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0324] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0325] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0326] Figure 13 This is a structural diagram of a terminal provided according to an embodiment of the present invention. Figure 13 The terminal includes the electronic device 1310 as described in any embodiment of the present invention.

[0327] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

Claims

1. A method for secure access to reference data, characterized in that, The application comprises the following steps: In response to the memory data access instruction, the instruction type and at least one operand matched with the memory data access instruction are obtained; wherein the memory data access instruction comprises a call instruction of an application programming interface or an instruction constructed by a pointer programming mode; When it is determined according to the instruction type and the operands that the target access data to be accessed belongs to the elements of the target reference data, the target index matched with the target reference data and the target array offset of the target access data in the target reference data are obtained; The target index is queried in the reference data table, and when a valid target physical address is queried, the target data attribute information of the target reference data is obtained from the target physical address; The reference data table stores the physical address of the data attribute information corresponding to the reference data, and the reference data can be located based on the data attribute information; According to the target data attribute information and the target array offset, the target access data is subjected to a security access check.

2. The method of claim 1, wherein, The at least one operand matched with the memory data access instruction is obtained, comprising: The at least one operand is obtained from the virtual machine stack frame matched with the memory data access instruction; or The at least one operand is directly extracted in the memory data access instruction.

3. The method of claim 1, wherein, When it is determined according to the instruction type and the operands that the target access data to be accessed belongs to the elements of the target reference data, the target index matched with the target reference data and the target array offset of the target access data in the target reference data are obtained, comprising: When it is determined that the instruction type is a function call instruction based on the reference data, it is determined that the target access data to be accessed belongs to the elements of the target reference data, and the first call parameter and the second call parameter are obtained; The target index matched with the target reference data is separated from the first call parameter, and the second call parameter is taken as the target array offset.

4. The method of claim 1, wherein, When it is determined according to the instruction type and the operands that the target access data to be accessed belongs to the elements of the target reference data, the target index matched with the target reference data and the target array offset of the target access data in the target reference data are obtained, comprising: When it is determined that the instruction type is a function call instruction based on the pointer, the pointer offset parameter is obtained; If the reference mask information is contained in the pointer offset parameter, it is determined that the target access data to be accessed belongs to the elements of the target reference data, and the target index and the target array offset are separated from the pointer offset parameter.

5. The method of claim 1, wherein, When it is determined according to the instruction type and the operands that the target access data to be accessed belongs to the elements of the target reference data, the target index matched with the target reference data and the target array offset of the target access data in the target reference data are obtained, comprising: When it is determined that the instruction type is a memory data loading or storing instruction based on the pointer, the memory offset pointed by the pointer is obtained; If the reference mask information is contained in the memory offset, the target access data to be accessed belongs to the elements of the target reference data, and the target index and the target data offset are separated from the memory offset.

6. The method of claim 1, wherein, The target index is queried in the reference data table, comprising: Querying the target index in a unique reference data table.

7. The method of claim 1, wherein, Querying the target index in a reference data table, comprising: Splitting the target index into a first index and a second index; Querying the first index in a 0th-level reference data table in a two-level reference data table to obtain a storage address of a target 1st-level reference data table corresponding to the first index; Locating the target 1st-level reference data table according to the storage address of the target 1st-level reference data table, and querying the second index in the target 1st-level reference data table; The 0th-level reference data table is used to store the storage addresses of the 1st-level reference data tables, and the 1st-level reference data table is used to actually store the physical addresses of the reference data.

8. The method of claim 1, wherein, According to the target data attribute information and the target array offset, the target access data is subjected to a security access check, comprising: Obtaining a target data size corresponding to the target reference data in the target data attribute information; Detecting whether the target array offset exceeds the target data size: if yes, determining that the target access data does not pass the boundary security access check; otherwise, determining that the target access data passes the boundary security access check.

9. The method of claim 8, wherein, According to the target data attribute information and the target array offset, the target access data is subjected to a security access check, further comprising: Obtaining a target virtual machine running domain corresponding to the target reference data in the target data attribute information; Detecting whether the virtual machine running domain where the memory data access instruction is located and the target instruction virtual machine running domain comply with a firewall access rule: if yes, determining that the target access data passes the running domain security check; otherwise, determining that the target access data does not pass the running domain security check.

10. The method of claim 8, wherein, According to the target data attribute information and the target array offset, the target access data is subjected to a security access check, further comprising: Obtaining a target data type of the target reference data in the target data attribute information; If it is determined that the target data type is a structure data type and the memory data access instruction belongs to a pointer programming instruction, it is determined that the target access data does not pass the data type security check.

11. The method according to any one of claims 1 to 10, characterized in that, After the target access data is subjected to a security access check according to the target data attribute information and the target array offset, further comprising: If it is determined that the target access data passes the security access check, obtaining a starting physical address of the target reference data to which the target access data belongs according to the target data attribute information by one or two positioning methods; Obtaining the target access data according to the starting physical address and the target array offset.

12. A secure access device for reference data, characterized by Comprising: An instruction information acquisition module, configured to acquire an instruction type and at least one operand matched with a memory data access instruction in response to the memory data access instruction; wherein the memory data access instruction comprises a call instruction to an application programming interface, or an instruction constructed by a pointer programming manner; A key information acquisition module, configured to acquire a target index matched with a target reference data and a target array offset of the target access data in the target reference data when it is determined that the target access data required to be accessed according to the instruction type and the operands belongs to an element of the target reference data; The attribute information acquisition module is configured to query the target index in the reference data table, and acquire target data attribute information of the target reference data from a target physical address when the valid target physical address is queried. The reference data table stores physical addresses of data attribute information corresponding to the reference data, and the reference data can be located based on the data attribute information. The secure access checking module is configured to perform secure access checking on the target access data according to the target data attribute information and the target array offset.

13. An electronic device, comprising: The electronic device is installed with an operating system, and the operating system executes a runtime environment. at least one processor; and The memory is in communication with the at least one processor; and The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the method of any one of claims 1-11.

14. The electronic device of claim 13, wherein, The electronic device is a resource-constrained device.

15. The electronic device of claim 14, wherein, The resource-constrained device includes a smart card, a USBKEY, an embedded secure control module, and a secure element.

16. A terminal, characterized by The electronic device includes any one of claims 13-15.

17. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing the processor to execute the method of any one of claims 1-11.

18. A computer program product, characterised in that, The computer program product includes a computer program that, when executed by a processor, implements the method according to any one of claims 1-11.

Images