Data access request processing method and device and electronic equipment

Abstract

The invention provides a data access request processing method and device and electronic equipment, and relates to the technical field of computer security. According to the technical scheme, under the condition that a data access request is received, multiple pieces of first sensitive data stored in a virtual machine heap memory are encrypted to obtain multiple pieces of encrypted data; according to the method, the data access request is acquired, the data access request is analyzed, and the multiple pieces of encrypted data are deleted under the condition that the data access request is unsafe, so that the problem of sensitive data leakage under the condition that the data access request is dangerous is avoided, and the accuracy of protecting the virtual machine heap memory is improved.

Description

Technical Field

[0001] This application relates to the field of computer security technology, specifically to a method, apparatus, and electronic device for processing data access requests. Background Technology

[0002] With the rapid development of information technology, the security of the JVM (Java Virtual Machine), as the runtime environment for Java applications, has received increasing attention. The JVM heap memory stores a large amount of sensitive data, such as payment vouchers and user privacy information. Unauthorized access can lead to serious data leaks. Current technologies typically encrypt the entire JVM heap memory. However, due to the large amount of data contained in the JVM heap memory, encrypting the entire heap memory incurs significant performance overhead. Furthermore, upon detecting unauthorized access, the entire heap memory area is erased, resulting in relatively poor accuracy in protecting the JVM heap memory using current technologies. Summary of the Invention

[0003] This application provides a method, apparatus, and related equipment for processing data access requests, which solves the problem of poor accuracy in protecting virtual machine heap memory in related technologies.

[0004] To solve the above problems, this application is implemented as follows:

[0005] In a first aspect, embodiments of this application provide a method for processing data access requests, the method comprising:

[0006] Upon receiving a data access request from a user, multiple first strings are generated corresponding to multiple first sensitive data stored in the virtual machine heap memory. The data access request is used to request the acquisition of the multiple first sensitive data in the virtual machine heap memory, and the first string is used to represent the encryption information of the corresponding first sensitive data.

[0007] Based on the multiple first strings, the multiple first sensitive data are encrypted respectively to obtain multiple encrypted data that correspond one-to-one with the multiple first sensitive data;

[0008] The data access request is parsed to obtain a parsing result, wherein the parsing result is used to indicate whether the data access request has access rights to the plurality of first sensitive data;

[0009] If the parsing result indicates that the data access request does not have access to the plurality of first sensitive data, the plurality of encrypted data are erased.

[0010] Optionally, the step of generating multiple first strings corresponding to multiple first sensitive data stored in the virtual machine heap memory upon receiving a data access request from a user terminal includes:

[0011] Upon receiving a data access request from a user, the system obtains the data type information, sensitive data content, and storage time information corresponding to the second sensitive data, wherein the second sensitive data is any one of the plurality of first sensitive data.

[0012] Based on the data type information, the sensitive data content, and the storage time information, a first string corresponding to the second sensitive data is generated.

[0013] Optionally, generating the first string corresponding to the second sensitive data based on the data type information, the sensitive data content, and the storage time information includes:

[0014] Based on the data type information and the sensitive data content, a second string corresponding to the second sensitive data is generated;

[0015] Based on the storage time information corresponding to the second sensitive data, a third string corresponding to the second sensitive data is generated;

[0016] A fourth string corresponding to the second sensitive data is generated according to a preset encryption algorithm;

[0017] The second string, the third string, and the fourth string are concatenated to obtain the first string corresponding to the second sensitive data.

[0018] Optionally, parsing the data access request to obtain the parsing result includes:

[0019] Upon receiving a data access request, obtain the process control character of the data access request;

[0020] Based on the process tree corresponding to the virtual machine heap memory, the process control descriptor is traversed and queried to obtain multiple parent processes corresponding to the data access request.

[0021] The multiple parent processes are parsed to obtain the parsing results.

[0022] Optionally, the step of parsing the plurality of parent processes to obtain the parsing result includes:

[0023] Information is extracted from the fields at preset positions of the parent processes to obtain multiple field information, and the multiple parent processes correspond one-to-one with the multiple field information;

[0024] If at least one of the multiple fields contains suspicious information, a first parsing result is generated, wherein the suspicious information includes at least one preset character. The first parsing result is used to indicate that the data access request does not have access rights to the multiple first sensitive data; or,

[0025] If none of the fields in the plurality of fields contain suspicious information, a second parsing result is generated. The second parsing result is used to indicate that the data access request has access rights to the plurality of first sensitive data.

[0026] Optionally, erasing the plurality of encrypted data when the parsing result indicates that the data access request does not have access rights to the plurality of first sensitive data includes:

[0027] If the parsing result indicates that the data access request is an illegal access instruction, a preset string is generated, wherein the preset string includes at least one of 0x00, 0xFF and a random byte sequence;

[0028] In the virtual machine heap memory, the preset string is randomly and alternately written into the plurality of encrypted data to erase the plurality of encrypted data.

[0029] Optionally, after parsing the data access request and obtaining the parsing result, the method further includes:

[0030] If the parsing result indicates that the data access request has access rights to the plurality of first sensitive data, the plurality of encrypted data is decrypted to obtain the plurality of first sensitive data;

[0031] The plurality of first sensitive data are sent to the user terminal.

[0032] Secondly, embodiments of this application provide a data access request processing apparatus, the apparatus comprising:

[0033] The determination module is used to generate multiple first strings corresponding to multiple first sensitive data stored in the virtual machine heap memory when a data access request is received from the user terminal. The data access request is used to request to obtain the multiple first sensitive data in the virtual machine heap memory, and the first string is used to represent the encryption information of the corresponding first sensitive data.

[0034] An encryption module is used to encrypt the plurality of first sensitive data based on the plurality of first strings respectively, so as to obtain a plurality of encrypted data that correspond one-to-one with the plurality of first sensitive data;

[0035] A parsing module is used to parse the data access request and obtain a parsing result, wherein the parsing result is used to indicate whether the data access request has access rights to the plurality of first sensitive data;

[0036] An erasure module is used to erase the plurality of encrypted data when the parsing result indicates that the data access request does not have access rights to the plurality of first sensitive data.

[0037] Thirdly, this application also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method described in the first aspect above.

[0038] Fourthly, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in the first aspect above.

[0039] Fifthly, this application also provides a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described in the first aspect above.

[0040] This application provides a method, apparatus, and electronic device for processing data access requests. The method includes: upon receiving a data access request from a user terminal, determining multiple first strings corresponding to multiple first sensitive data stored in a virtual machine heap memory, wherein the data access request requests access to the multiple first sensitive data in the virtual machine heap memory, the first strings corresponding one-to-one with the multiple first sensitive data, and the first strings representing the encryption information of the corresponding first sensitive data; encrypting the multiple first sensitive data based on the multiple first strings to obtain multiple encrypted data corresponding one-to-one with the multiple first sensitive data; parsing the data access request to obtain a parsing result, wherein the parsing result indicates whether the data access request has access rights to the multiple first sensitive data; and erasing the multiple encrypted data if the parsing result indicates that the data access request does not have access rights to the multiple first sensitive data. The technical solution of this application encrypts multiple first-sensitive data stored in the virtual machine heap memory to obtain multiple encrypted data when a data access request is received, and parses the data access request. If the data access request is insecure, the multiple encrypted data are deleted, thereby avoiding the problem of sensitive data leakage in the event of a dangerous data access request and improving the accuracy of protecting the virtual machine heap memory. Attached Figure Description

[0041] To more clearly illustrate the technical solution of this application, the drawings used in the description of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 A flowchart illustrating a data access request processing method provided in an embodiment of this application;

[0043] Figure 2 A flowchart illustrating the process of determining a data access request provided in an embodiment of this application;

[0044] Figure 3 A schematic diagram of the structure of a data access request processing device provided in an embodiment of this application;

[0045] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0046] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0047] The terms "first," "second," etc., used in the embodiments of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices. Additionally, the use of "and / or" in this application indicates at least one of the connected objects, such as A and / or B and / or C, representing seven possibilities: including A alone, B alone, C alone, and the presence of both A and B, both B and C, both A and C, and the presence of A, B, and C.

[0048] See Figure 1 , Figure 1 This is a flowchart illustrating the data access request processing method provided in an embodiment of this application. Figure 1 As shown, the method for processing data access requests may include the following steps:

[0049] Step 101: Upon receiving a data access request from the user, generate multiple first strings corresponding to multiple first sensitive data stored in the virtual machine heap memory. The data access request is used to request the acquisition of the multiple first sensitive data in the virtual machine heap memory, and the first string is used to represent the encryption information of the corresponding first sensitive data.

[0050] In this embodiment, the data access request processing method can be executed by the server, and the user terminal can be any terminal accessing the server. Virtual machine heap memory (HM) refers to the memory area allocated in the virtual machine environment, used to store data such as object instances and arrays. The virtual machine manages the dynamic memory required by the program during runtime through heap memory, which is an important component of the runtime environment of the Java Virtual Machine and some other languages. In this embodiment, the virtual machine heap memory stores multiple pieces of primary sensitive data, which can be ID card account information, bank card account information, etc., without specific limitations in this embodiment.

[0051] Data access requests are client-side generated requests used to access or retrieve multiple pieces of sensitive data in the virtual machine heap memory. In this case, multiple corresponding first strings need to be assigned to each piece of sensitive data. These first strings are used to encrypt the sensitive data. For example, if the sensitive data is text, a first string can be inserted at the beginning, end, or other parts of each piece of sensitive data for encryption.

[0052] It should be noted that the first string can be adaptively generated based on the content corresponding to the first sensitive data. For example, the first string can include multiple elements, such as the data type of the first sensitive data, its lifecycle, etc. Therefore, encryption using the first string corresponding to the first sensitive data results in better encryption.

[0053] Step 102: Encrypt the multiple first sensitive data based on the multiple first strings respectively to obtain multiple encrypted data that correspond one-to-one with the multiple first sensitive data.

[0054] In this embodiment, based on the generated multiple first strings, the corresponding first sensitive data is encrypted. The encryption method can be an encryption algorithm, such as Advanced Encryption Standard (AES), hash encryption algorithms, etc. After encryption, multiple encrypted data corresponding to the multiple first sensitive data are generated. When a user accesses the encrypted data, the user's data access request needs to be verified. Only after successful verification can the user's client access or call the multiple first sensitive data.

[0055] Step 103: Parse the data access request to obtain a parsing result, wherein the parsing result is used to indicate whether the data access request has access rights to the plurality of first sensitive data.

[0056] In this embodiment, after receiving a data access request from the user, the server analyzes the request. This analysis may include examining the content, source, and method of the request to ensure that the request has access rights to multiple pieces of sensitive data. Specifically, access rights to multiple pieces of sensitive data mean that the user has passed the server's security authentication, i.e., the data access request generated by the user is not an illegal request.

[0057] For example, the parsing result may include whether the data access request has access rights to the plurality of first sensitive data or not. Based on the specific permission status of the data access request, it is determined whether the plurality of first sensitive data needs to be actively erased for protection.

[0058] Step 104: If the parsing result indicates that the data access request does not have access rights to the plurality of first sensitive data, erase the plurality of encrypted data.

[0059] In this embodiment, if the parsing result indicates that the data access request does not have access rights to the first sensitive data, it indicates that the data access request is an illegal request. At this time, it is necessary to erase multiple encrypted data to ensure that the sensitive data is not leaked.

[0060] Specifically, erasing multiple encrypted data items can be achieved by formatting the encrypted data. Alternatively, multiple encrypted data items can be padded with random data or zeros to overwrite the original data. Software tools can also be used to perform data erasure. This embodiment does not specifically limit the erasure method.

[0061] The technical solution of this application encrypts multiple first-sensitive data stored in the virtual machine heap memory to obtain multiple encrypted data when a data access request is received, and parses the data access request. If the data access request is insecure, the multiple encrypted data are deleted, thereby avoiding the problem of sensitive data leakage in the event of a dangerous data access request and improving the accuracy of protecting the virtual machine heap memory.

[0062] In some feasible implementations, optionally, the step of generating multiple first strings corresponding to multiple first sensitive data stored in the virtual machine heap memory upon receiving a data access request sent by the user terminal includes:

[0063] Upon receiving a data access request from a user, the system obtains the data type information, sensitive data content, and storage time information corresponding to the second sensitive data, wherein the second sensitive data is any one of the plurality of first sensitive data.

[0064] Based on the data type information, the sensitive data content, and the storage time information, a first string corresponding to the second sensitive data is generated.

[0065] In this embodiment, a first string corresponding to each first sensitive data can be generated based on the data type information, sensitive data content, and storage time information corresponding to the first sensitive data, thereby encrypting the first sensitive data.

[0066] In this embodiment, the second sensitive data is any one of multiple first sensitive data. The generation process of the first string is explained using the second sensitive data as an example. Specifically, the data type information, sensitive data content, and storage time information represent the data type (such as text, number, image, etc.), the specific content of the data, and the time when the data was recorded, respectively. When a data access request is received, the server first analyzes the request to determine the type, content, and storage time of the second sensitive data, and then generates the first string based on these parameters.

[0067] It's important to note that the generated first string must be unique and random to enhance system security. For example, a hash algorithm can be used to combine data type, content, and storage time to generate a fixed-length, unpredictable first string. When processing user requests, the server has a strict permission verification mechanism to prevent unauthorized access to sensitive data. Effective logging and auditing functions are also crucial to track user access to sensitive data.

[0068] Optionally, generating the first string corresponding to the second sensitive data based on the data type information, the sensitive data content, and the storage time information includes:

[0069] Based on the data type information and the sensitive data content, a second string corresponding to the second sensitive data is generated;

[0070] Based on the storage time information, a third string corresponding to the second sensitive data is generated;

[0071] A fourth string corresponding to the second sensitive data is generated according to a preset encryption algorithm;

[0072] The second string, the third string, and the fourth string are concatenated to obtain the first string corresponding to the second sensitive data.

[0073] In this embodiment, the ASM framework is used to insert code during the object allocation stage to inject a 128-bit hash fingerprint into the header of each sensitive object. Specifically, based on the data type information and the sensitive data content, a second string corresponding to the second sensitive data is generated, such as generating a type label (32-bit): supporting composite type encoding (e.g., 0x01 | 0x02 represents the combination of ID card and bank card).

[0074] Based on the storage time information corresponding to the second sensitive data, a third string corresponding to the second sensitive data is generated, such as generating a lifecycle marker (32 bits): using a high-precision timestamp (millisecond level) and an access counter (8 bits) to record the object creation / modification timestamp, supporting eviction policies.

[0075] The fourth string corresponding to the second sensitive data is generated according to the preset encryption algorithm. For example, an encrypted signature (64 bits) is generated: a mixed mode of truncated SHA3-256 hash (taking the first 64 bits) and SM4 encryption is used.

[0076] After obtaining the second, third, and fourth strings, concatenate the first and last parts of the second, third, and fourth strings to generate a 128-bit hash fingerprint, which is the first string.

[0077] Sensitive objects are allocated to off-heap memory via the Unsafe API, with their metadata placed in contiguous off-heap memory blocks. This allows for fast access via pointer offsets, reducing memory fragmentation, enforced 64-byte alignment, and leverages CPU cache line features to improve read efficiency. Each object maintains a reference counter; when the counter reaches zero and exceeds the maximum lifespan (e.g., 30 seconds), automatic erasure is triggered to reduce the risk of memory residue. Automatic release logic is also encapsulated via JNI. An LRU queue is used to prioritize the cleanup of objects that have not been accessed for a long time. The eviction threshold is dynamically adjusted based on system memory load (e.g., when memory utilization is >80%, the lifespan is shortened to 15 seconds).

[0078] Before object deserialization or use, verify the integrity of the hash fingerprint and the validity of the signature. If tampered with, trigger a security exception. Use lazy signature verification, verifying the signature when passing across threads to avoid the performance overhead of each verification.

[0079] Optionally, parsing the data access request to obtain the parsing result includes:

[0080] Upon receiving a data access request, obtain the process control character of the data access request;

[0081] Based on the process tree corresponding to the virtual machine heap memory, the process control descriptor is traversed and queried to obtain multiple parent processes corresponding to the data access request.

[0082] The multiple parent processes are parsed to obtain the parsing results.

[0083] In this embodiment, upon receiving a data access request, the security of the request needs to be verified. Specifically, the process control identifier (PCI) of the data access request can be obtained. The PCI is crucial information for identifying the context of the data access request. The server then examines this PCI in the virtual machine heap memory, traversing the corresponding process tree to obtain multiple parent processes associated with the request. These parent processes are parsed to determine which are compliant and their status, permissions, and other information. The parsing results are used for subsequent logical judgments, such as whether to allow the request to access data. By analyzing the parent processes of the request, user permission verification is enhanced to ensure that only authorized processes can access sensitive data.

[0084] For example, you can choose to hook points and intercept system calls using eBPF (Extended Berkeley Packet Filter), hooking `vfs_write` and `procfs_read` in the kernel via tracepoints or kprobe. `vfs_write` can intercept the generation of memory snapshots (such as .hprof files) through file writes. `procfs_read` can monitor the process via ` / proc / `. <pid>The behavior of directly reading JVM memory through interfaces such as / mem. eBPF programs determine whether a data access request is illegal by capturing the context information of the calling process (such as process PID, parent process information, file path, etc.) and combining it with predefined rules.

[0085] Upon receiving a user's data access request, this embodiment obtains the process control descriptor and queries the virtual machine's process tree to identify multiple parent processes related to the request and parse their states. Through proper permission management and process monitoring, unauthorized data access can be effectively prevented, and the secure management of sensitive information can be ensured.

[0086] Optionally, the step of parsing the plurality of parent processes to obtain the parsing result includes:

[0087] Information is extracted from the fields at preset positions of the parent processes to obtain multiple field information, and the multiple parent processes correspond one-to-one with the multiple field information;

[0088] If at least one of the multiple fields contains suspicious information, a first parsing result is generated, wherein the suspicious information includes at least one preset character. The first parsing result is used to indicate that the data access request does not have access rights to the multiple first sensitive data; or...

[0089] If none of the fields in the plurality of fields contain suspicious information, a second parsing result is generated. The second parsing result is used to indicate that the data access request has access rights to the plurality of first sensitive data.

[0090] In this embodiment, by extracting field information from the parent process, the permissions of data access requests are determined to ensure that only compliant requests can access specific sensitive data. Specifically, relevant data is extracted from preset locations in each parent process, including process status, permissions, user identity information, etc. The fields at the preset locations can be adjusted according to actual conditions. Suspicious information is an indication of malicious behavior and includes at least one preset character, such as a specific keyword, format, or symbol. Specifically, through lineage analysis, the PID of the current process is obtained using `bpf_get_current_pid_tgid()`. The process tree is traversed, and the `comm` field of the parent process is checked to see if it is a `jmap`, `jstack`, or a JMX client (such as `jconsole`). If the parent process is found to be one of these tools, it is marked as a suspicious process. To avoid performance loss, only three levels of parent processes are traced upwards (e.g., `jmap → bash → sshd`), and the query is terminated if the range is exceeded. The implementation steps are as follows: Use eBPF to hook the execve system call; obtain the current process task_struct; traverse up to real_parent by up to 3 levels; read the comm field at each level; if jmap / jstack / jconsole is found, mark the current process as suspicious; cache the process context in BPF_LRU_HASH for subsequent fast querying.

[0091] The cache structure is as follows:

[0092] struct proc_context_t {

[0093] __u32 pid; / / Current process PID

[0094] __u32 ppid; / / Parent process PID

[0095] char comm

[16] ; / / Process name

[0096] __u8 suspicious; / / Whether the process is suspicious

[0097] __u64 timestamp; / / Cache timestamp

[0098] };

[0099] If at least one field among the extracted fields contains suspicious information, the system will generate a first parsing result, indicating that the data access request does not have permission. If none of the extracted fields contain suspicious information, the system will generate a second parsing result, confirming that the request has permission. This means that after the security check, the request is considered secure.

[0100] like Figure 2 As shown, Figure 2 This is a flowchart illustrating the process of determining data access requests in this embodiment. First, a micro-time window is defined, setting a fixed time window, such as 100ms. A system call trace window is maintained for each process (PID), recording the sequence of system calls that occurred within the past 100ms. A data structure is maintained for each process (most recent update timestamp, call counter, and a queue of the IDs of the most recent N system calls). The goal is to construct a sliding window to record the behavior sequence over a period of time. Next, using eBPF's tracepoint or kprobe, the following system calls are intercepted:

[0101] ptrace: Typically used for debugging or memory probing;

[0102] read: used to read from / proc / <pid> / mem or file read memory contents;

[0103] write: Used to output a dump file (such as .hprof);

[0104] -mmap: Maps memory segments, commonly used in dump tools;

[0105] -open: Used to open the target process or dump file path.

[0106] Each time a system call occurs, obtain the current process PID, find or initialize the process's call trace window. If the last update time exceeds 100ms, clear the old data and add the current syscallID to the trace (circular buffer). Determine if the current trace contains all suspicious system call combinations (e.g., ptrace+read+write+mmap simultaneously). Use bpf_ringbuf_submit or perf_submit to report suspicious events to user space, including: process PID, hit system call, timestamp, etc. Return the -EPERM error code directly in the kernel to block the system call. Set a system process whitelist (e.g., sshd, systemd, java itself) to filter out short-lived processes or processes that only made a portion of the system calls. "Legitimate combinations" or "suspicion thresholds" can be defined through a configuration file.

[0107] The system detects file path patterns, extracts filenames from the `file` structure, and checks if they have the `.hprof` extension. It is compatible with file path resolution methods across different kernel versions. It uses eBPF's hash mapping (`BPF_MAP_TYPE_HASH`) to record the cumulative write volume for each file. By identifying large amounts of data and frequent writes within a short period, it avoids false positives based on fixed thresholds. The implementation steps are as follows: Use `eBPFHookvfs_write`; extract the inode of the currently written file; record: total bytes written; first write time (`first_ts`); last write time (`last_ts`); write count (`write_count`); dynamically judge anomalies: total write volume > 10MB; write rate > 1MB / s; excessively high write frequency; if the conditions are met and the process context is suspicious. It intercepts illegal operations in conjunction with user space, directly rejecting system call execution by returning the error code `-EPERM` via eBPF, or terminating the process by sending a `SIGKILL` signal. In kernel-mode eBPF programs, a ring buffer is reserved through bpf_ringbuf_reserve. When illegal dump behavior is detected (such as jmap call chain or .hprof file writing), metadata such as sensitive object addresses and type labels are submitted to BPF_MAP_TYPE_RINGBUF through bpf_ringbuf_submit.

[0108] By conducting detailed analysis of the fields, the system can effectively identify potential security threats, thereby ensuring the security of sensitive data.

[0109] Optionally, erasing the plurality of encrypted data when the parsing result indicates that the data access request does not have access rights to the plurality of first sensitive data includes:

[0110] If the parsing result indicates that the data access request is an illegal access instruction, a preset string is generated, wherein the preset string includes at least one of 0x00, 0xFF and a random byte sequence;

[0111] In the virtual machine heap memory, the preset string is randomly and alternately written into the plurality of encrypted data to erase the plurality of encrypted data.

[0112] In this embodiment, when an unauthorized access request is detected, the system generates a preset string containing at least one of the following: 0x00: a hexadecimal value representing a null byte, typically used to initialize memory or indicate an empty value. 0xFF: a hexadecimal value representing a padding byte, typically used for purpose-specific marking or as a mask in certain security situations. Random byte sequence: indicating that the server can generate a non-deterministic byte sequence to increase security and ensure that attackers cannot predict the data content. The generated preset string will be randomly and alternately written into multiple encrypted data sets, thereby erasing the encrypted data—that is, overwriting the original data with invalid or random data—to prevent the leakage of potentially sensitive information.

[0113] Specifically, in user space, the event channel is polled using `bpf_buffer_poll`, a timeout threshold is set (e.g., 100ms), and a callback function is triggered to parse event metadata. A `sun.misc.Unsafe` instance is obtained by bypassing JVM security restrictions through reflection. The object header offset is obtained using `Unsafe.objectFieldOffset`, and the erasure range is determined by combining this with the 128-bit metadata injected by ASM. According to standard requirements, 0x00, 0xFF, and random byte sequences are written alternately, performing a total of 7 overwrites. The implementation code is as follows:

[0114] / / eBPF kernel-mode code snippet

[0115] struct event *alert = bpf_ringbuf_reserve(&events, sizeof(structevent), 0);

[0116] if (!alert) return 1;

[0117] alert->obj_addr = (u64)sensitive_obj_ptr; / / Address of the sensitive object

[0118] alert->obj_type = 0x01; / / Type label (e.g., ID card number)

[0119] bpf_ringbuf_submit(alert, 0);

[0120] / / User-mode event handling

[0121] static int handle_alert(void *ctx, void *data, size_t sz) {

[0122] struct event *e = data;

[0123] trigger_erase(e->obj_addr, e->obj_type); / / Trigger the erase logic

[0124] return 0;

[0125] }

[0126] The technical solution in this embodiment prevents sensitive information from being accessed or recovered by malicious users by generating and alternately writing invalid or random data. However, such operation also needs to be performed under appropriate conditions to avoid accidental deletion or data loss.

[0127] Optionally, after parsing the data access request and obtaining the parsing result, the method further includes:

[0128] If the parsing result indicates that the data access request has access rights to the plurality of first sensitive data, the plurality of encrypted data is decrypted to obtain the plurality of first sensitive data;

[0129] The plurality of first sensitive data are sent to the user terminal.

[0130] In this embodiment, when processing a data access request, the server first parses the request and determines whether the request has access rights to multiple first sensitive data.

[0131] If the analysis result indicates that the user has access to this sensitive data, the server will decrypt the encrypted data. For example, it might use an encryption key or credentials to recover the original sensitive data. The decrypted sensitive data is then returned to the user, thus ensuring that only authorized users can access and obtain sensitive data, while maintaining data security and privacy throughout the decryption and transmission process.

[0132] The technical solution of this application encrypts multiple first-sensitive data stored in the virtual machine heap memory to obtain multiple encrypted data when a data access request is received, and parses the data access request. If the data access request is insecure, the multiple encrypted data are deleted, thereby avoiding the problem of sensitive data leakage in the event of a dangerous data access request and improving the accuracy of protecting the virtual machine heap memory.

[0133] See Figure 3 , Figure 3 This is a structural diagram of the data access request processing apparatus provided in the embodiments of this application. Figure 3 As shown, the data access request processing device 300 includes:

[0134] The determining module 310 is used to generate multiple first strings corresponding to multiple first sensitive data stored in the virtual machine heap memory when a data access request is received from the user terminal. The data access request is used to request to obtain the multiple first sensitive data in the virtual machine heap memory, and the first string is used to represent the encryption information of the corresponding first sensitive data.

[0135] Encryption module 320 is used to encrypt the plurality of first sensitive data based on the plurality of first strings respectively, so as to obtain a plurality of encrypted data corresponding one-to-one with the plurality of first sensitive data;

[0136] The parsing module 330 is used to parse the data access request and obtain a parsing result, wherein the parsing result is used to indicate whether the data access request has access rights to the plurality of first sensitive data;

[0137] The erasure module 340 is used to erase the plurality of encrypted data when the parsing result indicates that the data access request does not have access rights to the plurality of first sensitive data.

[0138] Optionally, the determining module 310 includes:

[0139] The determination submodule is used to obtain the data type information, sensitive data content and storage time information corresponding to the second sensitive data when a data access request is received from the user terminal. The second sensitive data is any one of the multiple first sensitive data.

[0140] The first generation submodule is used to generate a first string corresponding to the second sensitive data based on the data type information, the sensitive data content, and the storage time information.

[0141] Optionally, the generated submodules include:

[0142] The first generation unit is used to generate a second string corresponding to the second sensitive data based on the data type information and the sensitive data content;

[0143] The second generation unit is used to generate a third string corresponding to the second sensitive data based on the storage time information corresponding to the second sensitive data;

[0144] The third generation unit is used to generate a fourth string corresponding to the second sensitive data according to a preset encryption algorithm;

[0145] The concatenation unit is used to concatenate the second string, the third string, and the fourth string to obtain the first string corresponding to the second sensitive data.

[0146] Optionally, the parsing module 330 includes:

[0147] The acquisition submodule is used to acquire the process control character of the data access request when a data access request is received;

[0148] The query submodule is used to traverse and query the process control descriptor based on the process tree corresponding to the virtual machine heap memory, and obtain multiple parent processes corresponding to the data access request.

[0149] The parsing submodule is used to parse the multiple parent processes and obtain the parsing results.

[0150] Optionally, the parsing submodule includes:

[0151] The extraction unit is used to extract information from fields at preset positions of the parent process to obtain multiple field information, and the multiple parent processes correspond one-to-one with the multiple field information;

[0152] The fourth generation unit is configured to generate a first parsing result when at least one field in the plurality of field information contains suspicious information, wherein the suspicious information includes at least one preset character, and the first parsing result is used to indicate that the data access request does not have access rights to the plurality of first sensitive data; or,

[0153] The fifth generation unit is used to generate a second parsing result when none of the fields in the plurality of field information contain suspicious information. The second parsing result is used to indicate that the data access request has access rights to the plurality of first sensitive data.

[0154] Optionally, the erase module 340 includes:

[0155] The second generation submodule is used to generate a preset string when the parsing result indicates that the data access request is an illegal access instruction, wherein the preset string includes at least one of 0x00, 0xFF and a random byte sequence;

[0156] The write submodule is used to randomly and alternately write the preset string into the plurality of encrypted data in the virtual machine heap memory in order to erase the plurality of encrypted data.

[0157] Optional, also includes:

[0158] The decryption module is used to decrypt the plurality of encrypted data to obtain the plurality of first sensitive data when the parsing result indicates that the data access request has access rights to the plurality of first sensitive data.

[0159] The sending module is used to send the plurality of first sensitive data to the user terminal.

[0160] The technical solution of this application encrypts multiple first-sensitive data stored in the virtual machine heap memory to obtain multiple encrypted data when a data access request is received, and parses the data access request. If the data access request is insecure, the multiple encrypted data are deleted, thereby avoiding the problem of sensitive data leakage in the event of a dangerous data access request and improving the accuracy of protecting the virtual machine heap memory.

[0161] This application also provides an electronic device. Please refer to [link to relevant documentation]. Figure 4 The electronic device may include a processor 401, a memory 402, and a program 4021 stored in the memory 402 and executable on the processor 401.

[0162] When program 4021 is executed by processor 401, it can achieve the following: Figure 1 Any step in the corresponding method embodiment:

[0163] Upon receiving a data access request from a user, multiple first strings are generated corresponding to multiple first sensitive data stored in the virtual machine heap memory. The data access request is used to request the acquisition of the multiple first sensitive data in the virtual machine heap memory, and the first string is used to represent the encryption information of the corresponding first sensitive data.

[0164] Based on the multiple first strings, the multiple first sensitive data are encrypted respectively to obtain multiple encrypted data that correspond one-to-one with the multiple first sensitive data;

[0165] The data access request is parsed to obtain a parsing result, wherein the parsing result is used to indicate whether the data access request has access rights to the plurality of first sensitive data;

[0166] If the parsing result indicates that the data access request does not have access to the plurality of first sensitive data, the plurality of encrypted data are erased.

[0167] Optionally, upon receiving a data access request from a user, determining the multiple first strings corresponding to the multiple first sensitive data stored in the virtual machine heap memory includes:

[0168] Upon receiving a data access request from a user, the system generates data type information, sensitive data content, and storage time information corresponding to the second sensitive data, wherein the second sensitive data is any one of the plurality of first sensitive data.

[0169] Based on the data type information, the sensitive data content, and the storage time information, a first string corresponding to the second sensitive data is generated.

[0170] Optionally, generating the first string corresponding to the second sensitive data based on the data type information, the sensitive data content, and the storage time information includes:

[0171] Based on the data type information and the sensitive data content, a second string corresponding to the second sensitive data is generated;

[0172] Based on the storage time information corresponding to the second sensitive data, a third string corresponding to the second sensitive data is generated;

[0173] A fourth string corresponding to the second sensitive data is generated according to a preset encryption algorithm;

[0174] The second string, the third string, and the fourth string are concatenated to obtain the first string corresponding to the second sensitive data.

[0175] Optionally, parsing the data access request to obtain the parsing result includes:

[0176] Upon receiving a data access request, obtain the process control character of the data access request;

[0177] Based on the process tree corresponding to the virtual machine heap memory, the process control descriptor is traversed and queried to obtain multiple parent processes corresponding to the data access request.

[0178] The multiple parent processes are parsed to obtain the parsing results.

[0179] Optionally, the step of parsing the plurality of parent processes to obtain the parsing result includes:

[0180] Information is extracted from the fields at preset positions of the parent processes to obtain multiple field information, and the multiple parent processes correspond one-to-one with the multiple field information;

[0181] If at least one of the multiple fields contains suspicious information, a first parsing result is generated, wherein the suspicious information includes at least one preset character. The first parsing result is used to indicate that the data access request does not have access rights to the multiple first sensitive data; or...

[0182] If none of the fields in the plurality of fields contain suspicious information, a second parsing result is generated. The second parsing result is used to indicate that the data access request has access rights to the plurality of first sensitive data.

[0183] Optionally, erasing the plurality of encrypted data when the parsing result indicates that the data access request does not have access rights to the plurality of first sensitive data includes:

[0184] If the parsing result indicates that the data access request is an illegal access instruction, a preset string is generated, wherein the preset string includes at least one of 0x00, 0xFF and a random byte sequence;

[0185] In the virtual machine heap memory, the preset string is randomly and alternately written into the plurality of encrypted data to erase the plurality of encrypted data.

[0186] Optionally, after parsing the data access request and obtaining the parsing result, the method further includes:

[0187] If the parsing result indicates that the data access request has access rights to the plurality of first sensitive data, the plurality of encrypted data is decrypted to obtain the plurality of first sensitive data;

[0188] The plurality of first sensitive data are sent to the user terminal.

[0189] The technical solution of this application encrypts multiple first-sensitive data stored in the virtual machine heap memory to obtain multiple encrypted data when a data access request is received, and parses the data access request. If the data access request is insecure, the multiple encrypted data are deleted, thereby avoiding the problem of sensitive data leakage in the event of a dangerous data access request and improving the accuracy of protecting the virtual machine heap memory.

[0190] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described data access request processing embodiment and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0191] This application also provides a computer program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the above-described data access request processing method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0192] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0193] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a communication device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0194] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.< / pid> < / pid>

Claims

1. A method for processing data access requests, characterized in that, The method includes: Upon receiving a data access request from a user, multiple first strings are generated corresponding to multiple first sensitive data stored in the virtual machine heap memory. The data access request is used to request the acquisition of the multiple first sensitive data in the virtual machine heap memory, and the first string is used to represent the encryption information of the corresponding first sensitive data. Based on the multiple first strings, the multiple first sensitive data are encrypted respectively to obtain multiple encrypted data that correspond one-to-one with the multiple first sensitive data; The data access request is parsed to obtain a parsing result, wherein the parsing result is used to indicate whether the data access request has access rights to the plurality of first sensitive data; If the parsing result indicates that the data access request does not have access to the plurality of first sensitive data, the plurality of encrypted data are erased.

2. The method according to claim 1, characterized in that, Upon receiving a data access request from a user, the process of generating multiple first strings corresponding to multiple first sensitive data stored in the virtual machine heap memory includes: Upon receiving a data access request from a user, the system obtains the data type information, sensitive data content, and storage time information corresponding to the second sensitive data, wherein the second sensitive data is any one of the plurality of first sensitive data. Based on the data type information, the sensitive data content, and the storage time information, a first string corresponding to the second sensitive data is generated.

3. The method according to claim 2, characterized in that, The step of generating a first string corresponding to the second sensitive data based on the data type information, the sensitive data content, and the storage time information includes: Based on the data type information and the sensitive data content, a second string corresponding to the second sensitive data is generated; Based on the storage time information, a third string corresponding to the second sensitive data is generated; A fourth string corresponding to the second sensitive data is generated according to a preset encryption algorithm; The second string, the third string, and the fourth string are concatenated to obtain the first string corresponding to the second sensitive data.

4. The method according to claim 1, characterized in that, The parsing of the data access request to obtain the parsing result includes: Upon receiving a data access request, obtain the process control character of the data access request; Based on the process tree corresponding to the virtual machine heap memory, the process control descriptor is traversed and queried to obtain multiple parent processes corresponding to the data access request. The multiple parent processes are parsed to obtain the parsing results.

5. The method according to claim 4, characterized in that, The process of parsing the multiple parent processes to obtain the parsing result includes: Information is extracted from the fields at preset positions of the parent processes to obtain multiple field information, and the multiple parent processes correspond one-to-one with the multiple field information; If at least one of the multiple fields contains suspicious information, a first parsing result is generated, wherein the suspicious information includes at least one preset character. The first parsing result is used to indicate that the data access request does not have access rights to the multiple first sensitive data; or... If none of the fields in the plurality of fields contain suspicious information, a second parsing result is generated. The second parsing result is used to indicate that the data access request has access rights to the plurality of first sensitive data.

6. The method according to claim 1, characterized in that, The step of erasing the encrypted data when the parsing result indicates that the data access request does not have access to the plurality of first sensitive data includes: If the parsing result indicates that the data access request is an illegal access instruction, a preset string is generated, wherein the preset string includes at least one of 0x00, 0xFF and a random byte sequence; In the virtual machine heap memory, the preset string is randomly and alternately written into the plurality of encrypted data to erase the plurality of encrypted data.

7. The method according to claim 1, characterized in that, After parsing the data access request and obtaining the parsing result, the method further includes: If the parsing result indicates that the data access request has access rights to the plurality of first sensitive data, the plurality of encrypted data is decrypted to obtain the plurality of first sensitive data; The plurality of first sensitive data are sent to the user terminal.

8. A data access request processing apparatus, characterized in that, The device includes: The determination module is used to generate multiple first strings corresponding to multiple first sensitive data stored in the virtual machine heap memory when a data access request is received from the user terminal. The data access request is used to request to obtain the multiple first sensitive data in the virtual machine heap memory, and the first string is used to represent the encryption information of the corresponding first sensitive data. An encryption module is used to encrypt the plurality of first sensitive data based on the plurality of first strings respectively, so as to obtain a plurality of encrypted data that correspond one-to-one with the plurality of first sensitive data; A parsing module is used to parse the data access request and obtain a parsing result, wherein the parsing result is used to indicate whether the data access request has access rights to the plurality of first sensitive data; An erasure module is used to erase the plurality of encrypted data when the parsing result indicates that the data access request does not have access rights to the plurality of first sensitive data.

9. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, Includes computer instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1 to 7.

Images