Permission adjustment method, device and equipment and computer readable storage medium

Abstract

The invention discloses a permission adjustment method, device and equipment and a computer readable storage medium, and is applied to the technical field of computing, and the method comprises the steps: obtaining the access frequency of a heap area in a virtual address, the number of errors of physical address permission detection, and the code exception jump condition; determining a corresponding control signal according to the access frequency, the error number and the code exception jump condition; the control signal comprises an authority change signal and a process freezing signal; dynamically adjusting the physical memory authority of the memory management unit according to the control signal; the dynamic adjustment includes adjusting read or write or execution permissions of the physical page, and disrupting an access sequence of the translation lookaside buffer cache. According to the method, the limitation that traditional static permission configuration cannot adapt to the dynamic running state of the process is solved; and the MMU cannot detect and block hostile attacks in real time, so that the safety and the flexibility of MMU authority management are improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and computer-readable storage medium for adjusting permissions. Background Technology

[0002] The Memory Management Unit (MMU) is a core hardware module in a computer system responsible for virtual-to-physical address translation, memory protection, and resource management. In existing technologies, the MMU commonly employs a fixed page table permission configuration mechanism for memory page access control. This static permission management model has significant security flaws: when a memory page is attacked by malicious code, it cannot promptly identify abnormal permission changes, leading to the theft or tampering of system memory data. Furthermore, the access patterns of the Translation Lookaside Buffer (TLB, also known as a translation side buffer, is a high-speed cache in the CPU cache used to store recently used virtual-to-physical address mappings) and page tables indirectly reveal process memory access patterns. Attackers can exploit this characteristic to launch side-channel attacks, posing a serious threat to system data security.

[0003] Therefore, how to provide a secure memory management unit architecture that can support dynamic permission adjustment, have abnormal access detection capabilities, and resist side-channel attacks is a technical problem that urgently needs to be solved. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a permission adjustment method, apparatus, device and computer-readable storage medium, which solves the problems in the prior art that the secure memory management unit cannot support dynamic permission adjustment, does not have the ability to detect abnormal access and cannot resist side-channel attacks.

[0005] To address the aforementioned technical problems, this invention provides a permission adjustment method applied to a memory management unit, comprising:

[0006] Obtain the access frequency of the heap region in the virtual address; the access frequency is determined based on the shift statistics of the heap region record register, which is left-shifted and padded according to whether the virtual address is a heap region address;

[0007] The number of errors and abnormal code jumps in the physical address permission detection are obtained; the number of errors is determined by the statistical results of the physical address permission detection error count register, and the abnormal code jumps are determined by the difference between the virtual addresses of two consecutive instructions.

[0008] Based on the access frequency, the number of errors, and the abnormal code jump, the corresponding control signals are determined; the control signals include permission change signals and process freeze signals.

[0009] According to the control signal, the physical memory permissions of the memory management unit are dynamically adjusted; the dynamic adjustment includes adjusting the read, write or execute permissions of physical pages, and shuffling the access order of the translation back buffer cache.

[0010] On the one hand, the number of errors and abnormal code jumps detected in obtaining physical address permissions include:

[0011] If the actual access behavior does not match the preset memory attributes, the physical address permission detection error count register is incremented by 1, and the number of errors is determined based on the value of the physical address permission detection error count register.

[0012] If the virtual address input by the instruction picking module is the first virtual address, the difference between the abnormal jump virtual addresses is 0. If the virtual address is not the first virtual address, the difference between the abnormal jump virtual addresses is equal to the absolute value of the difference between the current virtual address and the previous virtual address.

[0013] On the one hand, based on the access frequency, the number of errors, and the abnormal code jump situation, the corresponding control signals are determined, including:

[0014] The access frequency is compared with a preset frequency threshold. If the access frequency is greater than the preset frequency threshold, the heap permissions are adjusted page by page according to the heap address range, and the address and permission change signal are output.

[0015] The number of errors is compared with a preset error threshold. If the number of errors is greater than the preset error threshold, the process freeze signal is output.

[0016] The abnormal jump virtual address difference is compared with a preset jump difference threshold. If the abnormal jump virtual address difference is greater than the preset jump difference threshold, the process freeze signal is output.

[0017] On the one hand, obtain the access frequency of the heap area in the virtual address, including:

[0018] Configure the heap region record register, heap region range register, and heap region access frequency register; the heap region range register is used to represent the virtual address range of the heap region, and the heap region record register and the heap region access frequency register are initialized to all bits being 0;

[0019] When the instruction pickup module inputs a virtual address, it determines whether the virtual address is a heap address based on the heap range register.

[0020] If the virtual address is a heap address and the highest bit of the heap record register is 0, then the heap access frequency register is incremented by 1, and the entire heap record register is shifted left by 1 bit and padded with 1 on the right.

[0021] If the virtual address is a heap address and the highest bit of the heap record register is 1, then the heap access frequency register is incremented by 0, and the entire heap record register is shifted left by 1 bit and padded with 1 on the right.

[0022] If the virtual address is not a heap address and the highest bit of the heap record register is 0, then the heap access frequency register is incremented by 0, and the entire heap record register is shifted left by 1 bit and padded with 0 on the right.

[0023] If the virtual address is not a heap address and the highest bit of the heap record register is 1, then the heap access frequency register is decremented by 1, and the entire heap record register is shifted left by 1 bit and padded with 0s on the right.

[0024] The access frequency is determined based on the value of the heap access frequency register.

[0025] On the one hand, it also includes:

[0026] If the process switching instruction is received, the heap range register, the heap record register, and the heap access frequency register are reset, and the virtual address and heap record register judgment is terminated.

[0027] If the process switching instruction is received, the physical address permission detection error counter register is reset to zero;

[0028] If the process switching instruction is received, the abnormal jump virtual address difference is equal to 0.

[0029] On the one hand, based on the control signal, the physical memory permissions of the memory management unit are dynamically adjusted, including:

[0030] When the control signal is the permission change signal, the corresponding target working register is determined by querying the address register, the value of the target working register is read, and the permission is changed.

[0031] When the control signal is the process freeze signal, all working registers are configured to be unreadable and unwriteable, and a translation backstop buffer refresh signal is sent to the page table cache module.

[0032] On the one hand, it also includes:

[0033] If the control signal is a process switching signal, the working register in the configuration register will be updated to the value of the shadow register; the working register stores real-time physical address permissions, and the shadow register stores the same physical address permissions as the control status register.

[0034] The present invention also provides a permission adjustment device applied to a memory management unit, comprising:

[0035] The first acquisition module is used to acquire the access frequency of the heap area in the virtual address; the access frequency is determined based on the shift statistics of the heap area record register, and the heap area record register is left-shifted and padded according to whether the virtual address is a heap area address;

[0036] The second acquisition module is used to acquire the number of errors and abnormal code jumps in the physical address permission detection; the number of errors is determined by the statistical results of the physical address permission detection error count register, and the abnormal code jumps are determined by the difference between the virtual addresses of two consecutive instructions;

[0037] The control signal determination module is used to determine the corresponding control signal based on the access frequency, the number of errors, and the abnormal code jump situation; the control signal includes permission change signal and process freeze signal;

[0038] The dynamic adjustment module is used to dynamically adjust the physical memory permissions of the memory management unit according to the control signal; the dynamic adjustment includes adjusting the read, write or execute permissions of physical pages, and shuffling the access order of the translational backing buffer cache.

[0039] The present invention also provides a permission adjustment device, comprising:

[0040] Memory, used to store computer programs;

[0041] A processor for implementing the permission control method described above when executing the computer program.

[0042] The present invention also provides a computer-readable storage medium storing computer-executable instructions, which, when loaded and executed by a processor, implement the steps of the permission adjustment method described above.

[0043] The present invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the permission adjustment method described above.

[0044] As can be seen from the above technical solution, the present invention obtains the access frequency of the heap area in the virtual address; the access frequency is determined based on the shift statistics of the heap area record register, which is left-shifted and padded according to whether the virtual address is a heap area address; obtains the number of errors and abnormal code jumps in physical address permission detection; the number of errors is determined by the statistics of the physical address permission detection error count register, and the abnormal code jumps are determined by the difference between the virtual addresses of two consecutive instructions; determines the corresponding control signals based on the access frequency, the number of errors, and the abnormal code jumps; the control signals include permission change signals and process freeze signals; and dynamically adjusts the physical memory permissions of the memory management unit according to the control signals; the dynamic adjustment includes adjusting the read, write, or execute permissions of physical pages and shuffling the access order of the translational backing buffer cache.

[0045] The beneficial effects of this invention are as follows: Based on the shift and padding logic of the heap area record register, the frequency of heap area access is statistically analyzed, accurately capturing the behavioral characteristics of process memory access, overcoming the limitation that traditional static permission configuration cannot adapt to the dynamic running state of processes; simultaneously, by using the physical address permission detection error counter register to count the number of permission errors, and combining this with the virtual address difference of consecutive instructions to determine abnormal code jumps, it can promptly identify illegal behaviors such as malicious code tampering with permissions and ROP attacks, solving the defect that existing MMUs cannot detect and block malicious attacks in real time; based on the above multi-dimensional monitoring results, permission change signals and process freeze signals are output, which can not only dynamically adjust the read, write, and execute permissions of physical pages, but also disrupt the access order of the TLB cache, breaking the predictability of memory access patterns, and fundamentally resisting side-channel attacks, achieving a dual improvement in the security and flexibility of MMU permission management.

[0046] In addition, the present invention also provides a permission adjustment device, equipment, and computer-readable storage medium, which also have the above-mentioned beneficial effects. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0048] Figure 1 A flowchart of a permission adjustment method provided in an embodiment of the present invention;

[0049] Figure 2 This is an example diagram illustrating the state transition of a heap region access frequency monitoring module provided in an embodiment of the present invention.

[0050] Figure 3 This is an example diagram illustrating the state transition of dynamically adjusting physical memory permissions, provided in an embodiment of the present invention.

[0051] Figure 4 An example diagram of a configuration register provided in an embodiment of the present invention;

[0052] Figure 5 An example diagram of an address register provided in an embodiment of the present invention;

[0053] Figure 6 Architecture diagram for existing technology MMU implementation;

[0054] Figure 7 This is an example diagram illustrating the state transition of a dynamic permission adjustment control module provided in an embodiment of the present invention.

[0055] Figure 8 This is an example diagram of the state transition of a process freeze control module provided in an embodiment of the present invention;

[0056] Figure 9 This invention provides an implementation architecture diagram of an MMU module.

[0057] Figure 10 This is a schematic diagram of the structure of a permission adjustment device provided in an embodiment of the present invention;

[0058] Figure 11 This is a schematic diagram of the structure of a permission adjustment device provided in an embodiment of the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] The MMU (Memory Management Unit) is a core hardware module in a computer system responsible for virtual address to physical address translation, memory protection, and resource management.

[0061] The core functions of an existing MMU are: 1. Virtual to Physical Address Translation: Mapping virtual addresses to physical addresses using page tables or segment tables. Typical paging mechanisms divide memory into 4KB pages, supporting multi-level page tables (such as the 4-level page tables in x86 architecture). 2. Memory Protection: Restricting process access to memory regions through permission bits (such as RWX permissions) in page table entries. Isolating the address spaces of different processes to prevent illegal out-of-bounds access. 3. Translation Lookaside Buffer (TLB): Reducing address translation latency by caching recently used page table entries (PTEs).

[0062] The main shortcomings of the MMU are: 1. Static permission management mechanism: Traditional MMUs rely on fixed page table permissions (such as read-only and writable), which cannot dynamically adapt to changes in process behavior. For example, if the permissions of a memory page are tampered with by malicious code (such as bypassing read-only restrictions through a ROP attack), the MMU cannot detect and block it in real time. 2. Side-channel attack vulnerability: TLB and page table access patterns may reveal memory access patterns, which attackers can use to crack encryption keys or infer sensitive data. For example, by monitoring the number of TLB misses, the location of the encrypted memory area can be inferred. Therefore, the current reliance on fixed page table permissions (such as read-only and writable) cannot dynamically adapt to changes in process behavior. If the permissions of a memory page are tampered with by malicious code (such as bypassing read-only restrictions through a ROP attack), the MMU cannot detect and block it in real time. The TLB and page table access patterns may reveal memory access patterns, which attackers can use to crack encryption keys or infer sensitive data, making it unable to defend against side-channel attacks.

[0063] To address the above problems, this invention provides a permission adjustment method, which can be found in the following reference. Figure 1 , Figure 1 A flowchart illustrating a permission adjustment method provided in an embodiment of the present invention. The method may include:

[0064] S101: Obtain the access frequency of the heap area in the virtual address; the access frequency is determined based on the shift statistics of the heap area record register, which performs left shift and fills in bits according to whether the virtual address is a heap area address.

[0065] The execution entity in this embodiment is the Memory Management Unit (MMU). Each step in this embodiment can be executed by a module specified within the MMU. It should be noted that the heap, as a critical area for dynamically allocating memory during process execution, directly reflects the memory access behavior characteristics of the process and is an important basis for determining whether the process is running normally. This embodiment uses a heap record register to statistically analyze the heap access frequency. The bit sequence of the heap record register records the heap attributes of the most recent memory accesses. Based on the characteristics of this bit sequence, the heap access frequency can be calculated, achieving efficient, real-time hardware-level statistics and avoiding the performance overhead of software statistics.

[0066] Furthermore, the aforementioned acquisition of the heap access frequency in the virtual address can specifically include: setting the heap record register, the heap range register, and the heap access frequency register; the heap range register is used to represent the virtual address range of the heap, and the heap record register and the heap access frequency register are initialized to all bits being 0; when the instruction fetch module inputs a virtual address, it determines whether the virtual address is a heap address based on the heap range register; if the virtual address is a heap address, and the highest bit of the heap record register is 0, then the heap access frequency register is incremented by 1, and the entire heap record register is initialized. Shift left by 1 bit and fill the right side with 1; if the virtual address is a heap address and the most significant bit of the heap record register is 1, then increment the heap access frequency register by 0, shift the entire heap record register left by 1 bit, and fill the right side with 1; if the virtual address is not a heap address and the most significant bit of the heap record register is 0, then increment the heap access frequency register by 0, shift the entire heap record register left by 1 bit, and fill the right side with 0; if the virtual address is not a heap address and the most significant bit of the heap record register is 1, then decrement the heap access frequency register by 1, shift the entire heap record register left by 1 bit, and fill the right side with 0. The access frequency is determined based on the value of the heap access frequency register.

[0067] It should be noted that in this embodiment, the rightmost 1 or 0 directly indicates whether the current virtual address is a heap address. That is, if the rightmost bit is 0, it indicates a non-heap address; if the rightmost bit is 1, it indicates a heap address. In this embodiment, the heap record register is used to record the previous 4096 (which can be changed according to the specific design) virtual address translations. This register is 4096 bits. For details on the heap access frequency monitoring module, please refer to... Figure 2 , Figure 2 This is an example diagram illustrating the state transition of a heap region access frequency monitoring module, provided as an embodiment of the present invention.

[0068] (1) Initialization state: After power-on, configure the heap range register, write all bits of the heap record register to 0, write the heap access frequency register to 0, and enter the virtual address judgment state.

[0069] (2) Virtual address judgment state: If there is a virtual address input, determine whether it is a heap address. If it is, enter the heap input state; if not, enter the non-heap input state; if a process switching signal is received, enter the initialization state.

[0070] (3) Heap input status: If the highest bit of the heap record register is 0, the heap access frequency register is incremented by 1; if the highest bit of the heap record register is 1, the heap access frequency register is incremented by 0, and 1 is placed on the right side of the heap record register for left shifting. After completion, the virtual address judgment status is returned.

[0071] (4) Non-heap area input status: If the highest bit of the heap area record register is 0, the heap area access frequency register is incremented by 0; if the highest bit of the heap area record register is 1, the heap area access frequency register is decremented by 1; 0 is placed to the right of the heap area record register and left-shifted, and then the virtual address judgment status is returned.

[0072] This embodiment directly records memory access behavior in real time based on the left shift and padding operation of the heap area record register. Padding with 1 marks heap area access and padding with 0 marks non-heap area access, allowing the register bit sequence to intuitively reflect recent access characteristics, thus achieving efficient and accurate statistics of heap area access frequency. At the same time, this method associates the addition and subtraction logic of the frequency register with the highest bit of the register before the shift, combined with the register overflow / underflow protection mechanism, to avoid statistical distortion and accurately capture abnormal fluctuations in process heap area access.

[0073] S102: Obtain the number of errors and abnormal code jumps detected by physical address permission detection; the number of errors is determined by the statistical results of the physical address permission detection error count register, and the abnormal code jumps are determined by the difference between the virtual addresses of two consecutive instructions.

[0074] In this embodiment, physical address permission detection specifically involves comparing the attributes (read / write / execute) of the memory access request with the preset permission attributes of the physical page. If the requested attributes exceed the preset permission range, it can be determined that the permission detection is incorrect. During normal program execution, the jumps in instruction virtual addresses follow a regular pattern (the difference is the instruction length during sequential execution, and the difference is within a preset range during legitimate jumps). However, malicious behaviors such as ROP attacks and buffer overflows can cause abnormal jumps in instruction addresses that exceed the normal range. This embodiment can determine whether there is an abnormal code jump by monitoring the difference between the virtual addresses of two consecutive instructions.

[0075] Furthermore, the aforementioned error count and abnormal code jump situation for obtaining physical address permission detection can specifically include: if the actual access behavior does not match the preset memory attributes, the physical address permission detection error count register is incremented by 1, and the error count is determined based on the value of the physical address permission detection error count register; if the virtual address input by the instruction fetching module is the first virtual address, the abnormal jump virtual address difference is 0; if the virtual address is not the first virtual address, the abnormal jump virtual address difference is equal to the absolute value of the difference between the current virtual address and the previous virtual address.

[0076] This embodiment eliminates the performance overhead and response latency of traditional software monitoring by performing real-time comparison and difference calculation at the hardware level. It can accurately capture early characteristics of malicious attacks such as permission tampering and illegal instruction jumps. At the same time, the counter register can be independently cleared in conjunction with the process switching signal, ensuring the accuracy of abnormal data statistics for different processes. This provides reliable and real-time abnormal monitoring data support for subsequent dynamic permission adjustment and process security management.

[0077] Furthermore, it can also include: if a process switch instruction is received, resetting the heap range register, heap record register, and heap access frequency register, and terminating the judgment work of the virtual address and heap record register; if a process switch instruction is received, resetting the physical address permission detection error count register to zero; if a process switch instruction is received, setting the abnormal jump virtual address difference to 0. In this way, the register statistics process and the MMU address translation process are executed in parallel, without consuming additional system resources. Moreover, during process switching, independent statistics of different process data can be achieved through register reset, effectively avoiding cross-process statistical interference, and providing reliable and real-time process memory behavior data support for subsequent dynamic permission adjustment.

[0078] S103: Determine the corresponding control signals based on the access frequency, number of errors, and code exception jumps; control signals include permission change signals and process freeze signals.

[0079] In this embodiment, the heap access frequency can be compared with a first threshold to determine whether the process memory access behavior is abnormal; the number of permission detection errors can be compared with a second threshold to determine the severity of permission tampering attacks; and the result of the judgment of abnormal code jumps (to determine whether malicious code execution exists) can be used as input. Through preset logical operations (such as combinations of conditions such as "the number of errors exceeds the threshold and there is an abnormal jump" and "the heap access frequency is abnormal and the number of errors exceeds the threshold"), corresponding control signals are output. The control signals are divided into two categories: permission change signals are used to trigger the adjustment of physical memory permissions, and process freeze signals are used to directly freeze the process when the attack risk is high to prevent the attack from spreading, thus realizing hierarchical security control.

[0080] Furthermore, determining the corresponding control signal based on the access frequency, number of errors, and abnormal code jump can specifically include: comparing the access frequency with a preset frequency threshold; if the access frequency is greater than the preset frequency threshold, adjusting the heap permissions page by page according to the heap address range and outputting an address and permission change signal; comparing the number of errors with a preset error threshold; if the number of errors is greater than the preset error threshold, outputting a process freeze signal; and comparing the difference in virtual addresses during abnormal jumps with a preset jump difference threshold; if the difference in virtual addresses during abnormal jumps is greater than the preset jump difference threshold, outputting a process freeze signal.

[0081] In this embodiment, if the access frequency exceeds a preset frequency threshold, it indicates abnormal process heap access behavior. The system then adjusts physical memory permissions page by page across the heap address range and outputs a permission change signal, achieving precise control over abnormal memory access behavior. If the number of errors exceeds a preset error threshold, or the difference in virtual addresses during abnormal jumps exceeds a preset jump difference threshold, it indicates a risk of permission tampering or illegal code jumps. The system immediately outputs a process freeze signal to block the spread of malicious attacks at the process level. This approach achieves both flexible intervention in abnormal memory access behavior through page-by-page permission adjustment and rigid blocking of high-risk attacks through process freeze signals, balancing the effectiveness of memory security protection with system stability. It provides a reliable decision-making and execution solution for the MMU's dynamic permission management.

[0082] Furthermore, the aforementioned page-by-page adjustment of heap permissions involves changing the write permissions of physical pages in the heap to read-only permissions, and restoring the original write permissions of the physical pages in the heap when the heap access frequency drops below a preset frequency threshold. Through dynamic and reversible adjustment of heap permissions, while achieving security control over abnormal access behavior, the normal memory access needs of processes are also taken into account. This avoids the security risk of malicious code tampering with heap data through write permissions when the heap access frequency is abnormal, and it can promptly restore the original permissions after the process's heap access behavior returns to normal. This adaptive adjustment of permissions can be achieved without manual intervention, effectively resolving the contradiction between "security protection" and "business execution" in traditional permission control. It enhances memory security protection capabilities while ensuring the continuity and efficiency of system operation.

[0083] S104: Dynamically adjust the physical memory permissions of the memory management unit according to the control signal; dynamic adjustment includes adjusting the read, write or execute permissions of physical pages, and shuffling the access order of the translation back buffer cache.

[0084] In this embodiment, on the one hand, the read / write / execute permissions of physical pages can be adjusted. For example, when an abnormal heap access frequency is detected and the number of permission errors is high, the corresponding physical page permissions can be adjusted to read-only to prevent malicious code from tampering with the page. On the other hand, by disrupting the access order of the TLB cache, the predictability of memory access patterns is broken, thus solving the technical problem of TLB and page table access patterns leaking memory patterns and being easily exploited to launch side-channel attacks.

[0085] Furthermore, the aforementioned dynamic adjustment of the physical memory permissions of the memory management unit based on the control signal can specifically include: when the control signal is a permission change signal, determining the corresponding target working register based on the address lookup register, reading the value of the target working register, and changing the permissions; when the control signal is a process freeze signal, configuring all working registers to be unreadable and unwriteable, and sending a translation backstop refresh signal to the page table cache module. Furthermore, the aforementioned control signal may also be a process switching signal: if the control signal is a process switching signal, updating the working register in the configuration register to the value of the shadow register; the working register stores the real-time physical address permissions, and the shadow register stores the same physical address permissions as the control status register. In this embodiment, the process for dynamically adjusting physical memory permissions can be referred to... Figure 3 , Figure 3 This is an example diagram illustrating the state transition of dynamically adjusting physical memory permissions, provided as an embodiment of the present invention.

[0086] (1) IDLE state: wait to receive control signals. If a process switching signal is received, enter the permission reset state; if a level downgrade signal (i.e. permission change signal) is received, enter the permission change state; if a process freeze signal is received, enter the permission freeze state.

[0087] (2) Permission reset state: Update the working register group of the configuration register to the value of the shadow register group, and then enter the IDLE state;

[0088] (3) Permission change status: Based on the received address, query the address register to find the corresponding working register, read the register value and change the permission. If it is read and write permission, change it to read only; if it is read only, change it to read and write not allowed.

[0089] (4) Permission freeze state: Configure the permissions of all working registers to be unreadable and unwriteable.

[0090] Configuration registers and address registers are both present in the CSR (Control and Status Register). The registers in the Physical Memory Protection Detection Unit are copies of these registers in the CSR. The configuration registers use a dual register set (working register set and shadow register set) to achieve atomic operations. The working register set stores real-time physical address permissions, while the shadow register set stores the same physical address permissions as in the CSR. Both the working register set and the shadow register set perform permission checks. The check result of the working register set is output to the external MMU, while the check result of the shadow register set is output to the Virtual Address Translation and Physical Memory Protection Detection and Monitoring Unit. Figure 4 This is an example diagram of a configuration register provided in an embodiment of the present invention. The number of configuration registers is determined according to the number of allocated memory regions, typically 8, 16, 32, 64, etc. Setting the R (read), W (write), and X (execute) bits respectively indicates that the PMP (Physical Memory Protection) entry allows reading, writing, and instruction execution. When one of these bits is cleared, the corresponding access type is denied. Figure 5 This is an example diagram of an address register provided in an embodiment of the present invention. The number of registers is determined according to the number of allocated memory regions, and they store the corresponding physical addresses of configuration register entries. Because the PMP entry granularity in this design supports a minimum of 4KB, bits [8:0] will not be used for address authentication logic.

[0091] The permission adjustment method provided in this embodiment of the invention proceeds as follows: S101: Obtain the access frequency of the heap region in the virtual address; the access frequency is determined based on the shift statistics of the heap region record register, which is left-shifted and padded according to whether the virtual address is a heap region address; S102: Obtain the number of errors and abnormal code jumps in the physical address permission detection; the number of errors is determined by the statistics of the physical address permission detection error count register, and the abnormal code jumps are determined by the difference between the virtual addresses of two consecutive instructions; S103: Determine the corresponding control signals based on the access frequency, the number of errors, and the abnormal code jumps; the control signals include permission change signals and process freeze signals; S104: Dynamically adjust the physical memory permissions of the memory management unit according to the control signals; the dynamic adjustment includes adjusting the read, write, or execute permissions of physical pages and shuffling the access order of the translational backing buffer cache. This method uses the shift and padding logic of the heap record register to statistically analyze heap access frequency, accurately capturing the behavioral characteristics of process memory access. This overcomes the limitation of traditional static permission configuration, which cannot adapt to the dynamic running state of processes. Simultaneously, it uses a physical address permission detection error counter register to count the number of permission errors and combines this with the virtual address difference of consecutive instructions to determine abnormal code jumps. This allows for timely identification of malicious code tampering with permissions, ROP attacks, and other illegal behaviors, solving the deficiency of existing MMUs in their inability to detect and block malicious attacks in real time. Based on the above multi-dimensional monitoring results, it outputs permission change signals and process freeze signals. This not only dynamically adjusts the read, write, and execute permissions of physical pages but also disrupts the access order of the TLB cache, breaking the predictability of memory access patterns and fundamentally resisting side-channel attacks. This achieves a dual improvement in the security and flexibility of MMU permission management.

[0092] Existing technology refers to the MMU design method implemented on chips or FPGAs (Field Programmable Gate Arrays). Figure 6 Architecture diagram for existing technology MMU implementation.

[0093] The existing MMU mainly consists of a first-level bypass translation buffer (containing data and instruction buffers), a bypass translation cache duplicate area, and a second-level bypass translation buffer.

[0094] The first-level bypass translation buffer receives the virtual address of the instruction fetch unit and load memory unit, and queries the page table cache entry. If a hit is found, it checks the physical memory protection detection unit area for permissions. If the permission check is successful, the physical address is output; otherwise, an exception is reported. If the page table cache is not found, the virtual address is passed to the bypass translation buffer duplicate area.

[0095] The bypass translation cache duplicate area relays (temporarily caches) and filters (prevents duplicate lookups of the same virtual address) the virtual address of instructions or data, and then passes it to the second-level bypass translation cache after a 2-to-1 arbitration.

[0096] The secondary bypass translation buffer, through a 3-to-1 arbitrator, arbitrates reads and writes to the page table cache of this submodule by referencing the bypass translation cache duplicate area, the miss queue, and the prefetcher. If the virtual address provided by the bypass translation cache duplicate area is hit, the physical address is output to the bypass translation cache duplicate area, which then provides the address to the primary bypass translation buffer. If a miss occurs, the page table information is read from the cache or memory through each level of page table stepper and then sent to the miss queue. During this process, the page table reads at each level also require the physical memory protection detection unit area to check permissions. The prefetcher reduces the virtual address miss rate through prefetching.

[0097] To address the issues of existing MMU solutions where fixed page table permissions prevent real-time detection and blocking of read / write permission tampering, and the inability of existing MMU solutions to defend against side-channel attacks, this invention modifies the MMU architecture as follows:

[0098] (1) The physical memory protection detection unit has been modified, and the physical memory attributes have been designed as a dynamic adjustment scheme related to the process. The modifications to the physical memory protection detection unit are as follows:

[0099] Modify the physical memory protection detection unit to initialize it during process switching, update the permissions corresponding to the physical address area to the initial value, and read the permission to downgrade it after receiving the control signal from the physical address permission dynamic adjustment and process freeze control module. Upon receiving the freeze signal, downgrade the permission to the end, and the physical memory will be unreadable and unwritable.

[0100] (2) Add virtual address translation and physical memory protection detection and monitoring units, including: a physical address permission detection error recording module to record the number of errors in physical address permission detection; a code abnormal jump monitoring module to detect abnormal code jumps; and a heap area access frequency monitoring module that can record the access frequency of the heap area in the virtual address using a sliding method.

[0101] (3) Add a physical address permission dynamic adjustment and process freeze control module. Based on data from the virtual address translation and physical memory protection detection and monitoring unit, the module sends signals to the physical memory protection detection unit according to control logic to dynamically adjust physical address permissions and freeze all address translations of the process. The physical address permission dynamic adjustment and process freeze control module includes: a permission dynamic adjustment control module and a process freeze control module. Figure 7 This invention provides an example diagram of the state transitions of a dynamic permission adjustment control module, with each state described below:

[0102] (1) Initialization state: Reset all control signals and status registers to ensure that the system is in the initial state and enter the heap access frequency threshold comparison state.

[0103] (2) Heap access frequency threshold comparison state: compare the input heap access frequency with the set threshold. If the heap access frequency > the threshold, jump to the heap permission dynamic adjustment state. If a process switching signal is received, jump to the initialization state.

[0104] (3) Dynamic adjustment of heap permissions: Based on the heap address range, the heap permissions are adjusted page by page, and the address and level reduction signals are output to the physical memory protection detection unit. After the adjustment is completed, the adjustment is completed. If a process switch signal is received, the process jumps to the initialization state.

[0105] (4) If the process switching signal is received, the process will jump to the initialization state after the adjustment is completed.

[0106] Figure 8 This is an example diagram illustrating the state transitions of a process freeze control module provided in an embodiment of the present invention. The descriptions of each state are as follows:

[0107] (1) Initialization state: Reset all control signals and status registers to ensure that the system is in the initial state and enters the threshold comparison state.

[0108] (2) Threshold comparison status: If the physical address permission detection error count is greater than the permission error threshold or the difference between the abnormal jump virtual address is greater than the jump difference threshold, the process will enter the process freeze processing status. If a process switching signal is received, the process will enter the initialization status.

[0109] (3) Process freeze processing status: Send a process freeze signal to the physical memory protection detection unit, send a TLB refresh signal to the page table cache module, enter the completion state, and if a process switching signal is received, jump to the initialization state.

[0110] (4) Adjustment complete state. If a process switching signal is received, jump to the initialization state.

[0111] This invention can be applied to MMU modules implemented in FPGAs or MMU modules designed in chip architectures. Figure 9 This is a diagram illustrating an MMU module implementation architecture provided in an embodiment of the present invention.

[0112] Apart from the physical memory protection detection unit, heap read / write frequency monitoring module, physical address permission detection error recording module, code exception jump monitoring module, physical address permission dynamic adjustment and process freeze control module, the other modules are no different from the original MMU design.

[0113] The physical memory protection detection unit has been modified, and the physical memory attributes have been designed to be dynamically adjusted based on the process.

[0114] Heap read / write frequency monitoring module: records the heap access frequency in virtual addresses; Physical address permission detection error recording module: records the number of permission errors; Code abnormal jump monitoring module: monitors abnormal code jumps.

[0115] The physical address permission dynamic adjustment and process freeze control module: Based on the data provided by the virtual address translation and physical memory protection detection and monitoring unit, it sends signals to the physical memory protection detection unit according to the control logic to dynamically adjust physical address permissions and freeze all address translations of the process.

[0116] This solution addresses the problems in existing MMU solutions, such as the inability to detect and block read / write permissions from being tampered with due to fixed page table permissions, and the inability of existing MMU solutions to resist side-channel attacks. These problems are solved by modifying the physical memory protection detection unit through modules for monitoring heap read / write frequency, recording errors in physical address permission detection, monitoring code exception jumps, dynamically adjusting physical address permissions, and controlling process freezes.

[0117] The permission adjustment device provided in the embodiments of the present invention will be described below. The permission adjustment device described below and the permission adjustment method described above can be referred to in correspondence.

[0118] Please refer to the details. Figure 10 , Figure 10 A schematic diagram of a permission adjustment device provided in an embodiment of the present invention may include:

[0119] The first acquisition module 100 is used to acquire the access frequency of the heap area in the virtual address; the access frequency is determined based on the shift statistics of the heap area record register, and the heap area record register is left-shifted and padded according to whether the virtual address is a heap area address;

[0120] The second acquisition module 200 is used to acquire the number of errors in physical address permission detection and the abnormal code jump situation; the number of errors is determined by the statistical results of the physical address permission detection error count register, and the abnormal code jump situation is determined by the difference between the virtual addresses of two consecutive instructions;

[0121] The control signal determination module 300 is used to determine the corresponding control signal based on the access frequency, the number of errors, and the abnormal code jump situation; the control signal includes a permission change signal and a process freeze signal;

[0122] The dynamic adjustment module 400 is used to dynamically adjust the physical memory permissions of the memory management unit according to the control signal; the dynamic adjustment includes adjusting the read, write or execute permissions of physical pages, and shuffling the access order of the translational backing buffer cache.

[0123] Furthermore, based on the above embodiments, the second acquisition module 200 may include:

[0124] The error count determination unit is used to increment the physical address permission detection error count register by 1 if the actual access behavior does not match the preset memory attributes, and determine the error count based on the value of the physical address permission detection error count register.

[0125] The abnormal jump virtual address difference determination unit is used to determine the abnormal jump virtual address difference value as follows: if the virtual address input by the instruction picking module is the first virtual address, the abnormal jump virtual address difference value is 0; if the virtual address is not the first virtual address, the abnormal jump virtual address difference value is equal to the absolute value of the difference between the current virtual address and the previous virtual address.

[0126] Furthermore, based on the above embodiments, the control signal determination module 300 may include:

[0127] The first comparison unit is used to compare the access frequency with a preset frequency threshold. If the access frequency is greater than the preset frequency threshold, the heap permissions are adjusted page by page according to the heap address range, and the address and permission change signal are output.

[0128] The second comparison unit is used to compare the number of errors with a preset error threshold. If the number of errors is greater than the preset error threshold, the process freeze signal is output.

[0129] The third comparison unit is used to compare the abnormal jump virtual address difference with a preset jump difference threshold. If the abnormal jump virtual address difference is greater than the preset jump difference threshold, the process freeze signal is output.

[0130] Furthermore, based on the above embodiments, the first acquisition module 100 may include:

[0131] The register configuration unit is used to set the heap record register, the heap range register, and the heap access frequency register; the heap range register is used to represent the virtual address range of the heap, and the heap record register and the heap access frequency register are initialized to all bits being 0;

[0132] The heap address determination unit is used to determine whether the virtual address is a heap address based on the heap range register when the instruction fetching module inputs a virtual address.

[0133] The first recording unit is used to increment the heap access frequency register by 1 and shift the entire heap record register to the left by 1 bit and fill the right side with 1 if the virtual address is a heap address and the highest bit of the heap record register is 0.

[0134] The second recording unit is used to increment the heap access frequency register by 0 and shift the entire heap record register to the left by 1 bit and fill the right side with 1 if the virtual address is a heap address and the highest bit of the heap record register is 1.

[0135] The third recording unit is used to increment the heap access frequency register by 0 and shift the entire heap record register to the left by 1 bit and fill the right side with 0 if the virtual address is not a heap address and the highest bit of the heap record register is 0.

[0136] The fourth recording unit is used to decrement the heap access frequency register by 1 and shift the entire heap record register to the left by 1 bit and fill the right side with 0 if the virtual address is not a heap address and the highest bit of the heap record register is 1.

[0137] The access frequency determination unit is used to determine the access frequency based on the value of the heap area access frequency register.

[0138] Furthermore, based on the above embodiments, the permission adjustment device may further include:

[0139] The reset module is used to reset the heap range register, the heap record register, and the heap access frequency register when the process switching instruction is received, and to terminate the judgment work of virtual address and heap record register.

[0140] The physical address permission detection error count register initialization module is used to reset the physical address permission detection error count register to zero when the process switching instruction is received.

[0141] The abnormal jump virtual address difference initialization module is used to set the abnormal jump virtual address difference to 0 if the process switching instruction is received.

[0142] Furthermore, based on the above embodiments, the dynamic adjustment module 400 may include:

[0143] The permission change unit is used to determine the corresponding target working register by querying the address register according to the address when the control signal is the permission change signal, read the value of the target working register, and change the permission.

[0144] The process freeze unit is used to configure all working registers to be unreadable and unwriteable when the control signal is the process freeze signal, and to send a translation backstop buffer refresh signal to the page table cache module.

[0145] Furthermore, based on the above embodiments, the permission adjustment device may further include:

[0146] An initialization module is used to update the working register in the configuration register to the value of the shadow register when the control signal is a process switching signal; the working register stores real-time physical address permissions, and the shadow register stores the same physical address permissions as the control status register.

[0147] It should be noted that the order of the modules and units in the aforementioned permission adjustment device can be changed without affecting the logic.

[0148] The permission adjustment device provided in this embodiment of the invention includes a first acquisition module 100 for acquiring the access frequency of the heap region in the virtual address; the access frequency is determined based on the shift statistics of the heap region record register, which is left-shifted and padded according to whether the virtual address is a heap region address; a second acquisition module 200 for acquiring the number of errors in physical address permission detection and the code abnormal jump situation; the number of errors is determined by the statistics of the physical address permission detection error count register, and the code abnormal jump situation is determined by the difference between the virtual addresses of two consecutive instructions; a control signal determination module 300 for determining the corresponding control signal according to the access frequency, the number of errors, and the code abnormal jump situation; the control signal includes a permission change signal and a process freeze signal; and a dynamic adjustment module 400 for dynamically adjusting the physical memory permissions of the memory management unit according to the control signal; the dynamic adjustment includes adjusting the read, write, or execute permissions of physical pages and shuffling the access order of the translational backing buffer cache. This device uses the shift and padding logic of the heap area record register to statistically analyze heap area access frequency, accurately capturing the behavioral characteristics of process memory access. This overcomes the limitation of traditional static permission configuration, which cannot adapt to the dynamic running state of processes. Simultaneously, it uses a physical address permission detection error counter register to count the number of permission errors and combines this with the virtual address difference of consecutive instructions to determine abnormal code jumps. This allows for timely identification of malicious code tampering with permissions, ROP attacks, and other illegal behaviors, solving the deficiency of existing MMUs in their inability to detect and block malicious attacks in real time. Based on the above multi-dimensional monitoring results, it outputs permission change signals and process freeze signals. This not only dynamically adjusts the read, write, and execute permissions of physical pages but also disrupts the access order of the TLB cache, breaking the predictability of memory access patterns and fundamentally resisting side-channel attacks. This achieves a dual improvement in the security and flexibility of MMU permission management.

[0149] Figure 11 This is a schematic diagram of the structure of a permission adjustment device provided in an embodiment of the present invention, as shown below. Figure 11 As shown, the access control device includes:

[0150] Memory 60 is used to store computer programs;

[0151] The processor 61 is used to implement the steps of the permission adjustment method as described in the above embodiments when executing a computer program.

[0152] The permission adjustment device provided in this embodiment may include, but is not limited to, smartphones, tablets, laptops, or desktop computers.

[0153] The processor 61 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 61 may be implemented using at least one hardware form selected from Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 61 may also include a main processor and a coprocessor. The main processor, also known as the Central Processing Unit (CPU), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 61 may integrate a Graphics Processing Unit (GPU), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 61 may also include an Artificial Intelligence (AI) processor, which handles computational operations related to machine learning.

[0154] The memory 60 may include one or more computer-readable storage media, which may be non-transitory. The memory 60 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 60 is used to store at least the following computer program 601, which, after being loaded and executed by the processor 61, is capable of implementing the relevant steps of the permission adjustment method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 60 may also include an operating system 602 and data 603, etc., and the storage method may be temporary storage or permanent storage. The operating system 602 may include Windows, Unix, Linux, etc. The data 603 may include, but is not limited to, the data in the permission adjustment method.

[0155] In some embodiments, the access control device may further include a display screen 62, an input / output interface 63, a communication interface 64, a power supply 65, and a communication bus 66.

[0156] Those skilled in the art will understand that Figure 11 The structure shown does not constitute a limitation on the access control device and may include more or fewer components than illustrated.

[0157] It is understood that if the permission adjustment method in the above embodiments is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the current technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods in the various embodiments of the present invention. The aforementioned storage medium includes: USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, magnetic disk, or optical disk, and other media capable of storing program code.

[0158] Based on this, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the permission adjustment method described above.

[0159] The following describes a computer program product provided by an embodiment of this application. The computer program product described below can be referred to in conjunction with other embodiments described herein.

[0160] A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of the aforementioned disclosed permission control method.

[0161] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0162] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0163] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0164] The foregoing has provided a detailed description of the permission adjustment method, apparatus, device, and computer-readable storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for adjusting permissions, characterized in that, Applied to the memory management unit, including: Obtain the access frequency of the heap region in the virtual address; the access frequency is determined based on the shift statistics of the heap region record register, which is left-shifted and padded according to whether the virtual address is a heap region address; The number of errors and abnormal code jumps in the physical address permission detection are obtained; the number of errors is determined by the statistical results of the physical address permission detection error count register, and the abnormal code jumps are determined by the difference between the virtual addresses of two consecutive instructions. Based on the access frequency, the number of errors, and the abnormal code jump, the corresponding control signals are determined; the control signals include permission change signals and process freeze signals. According to the control signal, the physical memory permissions of the memory management unit are dynamically adjusted; the dynamic adjustment includes adjusting the read, write or execute permissions of physical pages, and shuffling the access order of the translation back buffer cache.

2. The permission adjustment method according to claim 1, characterized in that, The number of errors and abnormal code redirects detected during physical address permission acquisition include: If the actual access behavior does not match the preset memory attributes, the physical address permission detection error count register is incremented by 1, and the number of errors is determined based on the value of the physical address permission detection error count register. If the virtual address input by the instruction picking module is the first virtual address, the difference between the abnormal jump virtual addresses is 0. If the virtual address is not the first virtual address, the difference between the abnormal jump virtual addresses is equal to the absolute value of the difference between the current virtual address and the previous virtual address.

3. The permission adjustment method according to claim 2, characterized in that, Based on the access frequency, the number of errors, and the code exception jump situation, the corresponding control signals are determined, including: The access frequency is compared with a preset frequency threshold. If the access frequency is greater than the preset frequency threshold, the heap permissions are adjusted page by page according to the heap address range, and the address and permission change signal are output. The number of errors is compared with a preset error threshold. If the number of errors is greater than the preset error threshold, the process freeze signal is output. The abnormal jump virtual address difference is compared with a preset jump difference threshold. If the abnormal jump virtual address difference is greater than the preset jump difference threshold, the process freeze signal is output.

4. The permission adjustment method according to claim 1, characterized in that, Obtain the access frequency of the heap region in the virtual address, including: Configure the heap region record register, heap region range register, and heap region access frequency register; the heap region range register is used to represent the virtual address range of the heap region, and the heap region record register and the heap region access frequency register are initialized to all bits being 0; When the instruction pickup module inputs a virtual address, it determines whether the virtual address is a heap address based on the heap range register. If the virtual address is a heap address and the highest bit of the heap record register is 0, then the heap access frequency register is incremented by 1, and the entire heap record register is shifted left by 1 bit and padded with 1 on the right. If the virtual address is a heap address and the highest bit of the heap record register is 1, then the heap access frequency register is incremented by 0, and the entire heap record register is shifted left by 1 bit and padded with 1 on the right. If the virtual address is not a heap address and the highest bit of the heap record register is 0, then the heap access frequency register is incremented by 0, and the entire heap record register is shifted left by 1 bit and padded with 0 on the right. If the virtual address is not a heap address and the highest bit of the heap record register is 1, then the heap access frequency register is decremented by 1, and the entire heap record register is shifted left by 1 bit and padded with 0s on the right. The access frequency is determined based on the value of the heap access frequency register.

5. The permission adjustment method according to any one of claims 2 and 4, characterized in that, Also includes: If the process switching instruction is received, the heap range register, the heap record register, and the heap access frequency register are reset, and the virtual address and heap record register judgment is terminated. If the process switching instruction is received, the physical address permission detection error counter register is reset to zero; If the process switching instruction is received, the abnormal jump virtual address difference is equal to 0.

6. The permission adjustment method according to claim 1, characterized in that, Based on the control signal, the physical memory permissions of the memory management unit are dynamically adjusted, including: When the control signal is the permission change signal, the corresponding target working register is determined by querying the address register, the value of the target working register is read, and the permission is changed. When the control signal is the process freeze signal, all working registers are configured to be unreadable and unwriteable, and a translation backstop buffer refresh signal is sent to the page table cache module.

7. The permission adjustment method according to claim 1, characterized in that, Also includes: If the control signal is a process switching signal, then the working register in the configuration register will be updated to the value of the shadow register; The working register stores real-time physical address permissions, and the shadow register stores the same physical address permissions as the control status register.

8. A permission adjustment device, characterized in that, Applied to the memory management unit, including: The first acquisition module is used to acquire the access frequency of the heap area in the virtual address; the access frequency is determined based on the shift statistics of the heap area record register, and the heap area record register is left-shifted and padded according to whether the virtual address is a heap area address; The second acquisition module is used to acquire the number of errors and abnormal code jumps in the physical address permission detection; the number of errors is determined by the statistical results of the physical address permission detection error count register, and the abnormal code jumps are determined by the difference between the virtual addresses of two consecutive instructions; The control signal determination module is used to determine the corresponding control signal based on the access frequency, the number of errors, and the abnormal code jump situation; the control signal includes permission change signal and process freeze signal; The dynamic adjustment module is used to dynamically adjust the physical memory permissions of the memory management unit according to the control signal; the dynamic adjustment includes adjusting the read, write or execute permissions of physical pages, and shuffling the access order of the translational backing buffer cache.

9. A permission adjustment device, characterized in that, include: Memory, used to store computer programs; A processor for implementing the permission control method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the permission adjustment method as described in any one of claims 1 to 7.

Images