WO2015131800A1 - 基于移动存储器的数据黑洞处理方法及移动存储器 - Google Patents

基于移动存储器的数据黑洞处理方法及移动存储器 Download PDF

Info

Publication number
WO2015131800A1
WO2015131800A1 PCT/CN2015/073556 CN2015073556W WO2015131800A1 WO 2015131800 A1 WO2015131800 A1 WO 2015131800A1 CN 2015073556 W CN2015073556 W CN 2015073556W WO 2015131800 A1 WO2015131800 A1 WO 2015131800A1
Authority
WO
WIPO (PCT)
Prior art keywords
instruction
address
data
black hole
storage
Prior art date
Application number
PCT/CN2015/073556
Other languages
English (en)
French (fr)
Inventor
汪家祥
Original Assignee
北京中天安泰信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京中天安泰信息技术有限公司 filed Critical 北京中天安泰信息技术有限公司
Priority to JP2016550598A priority Critical patent/JP6317821B2/ja
Priority to US15/116,193 priority patent/US20160350530A1/en
Publication of WO2015131800A1 publication Critical patent/WO2015131800A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1416—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights
    • G06F12/1425—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights the protection being physical, e.g. cell, word, block
    • G06F12/1441—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights the protection being physical, e.g. cell, word, block for a range
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/556—Detecting local intrusion or implementing counter-measures involving covert channels, i.e. data leakage between processes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/606—Protecting data by securing the transmission between two devices or processes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062—Securing storage systems
    • G06F3/0622—Securing storage systems in relation to access
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0638—Organizing or formatting or addressing of data
    • G06F3/0644—Management of space entities, e.g. partitions, extents, pools
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0653—Monitoring storage devices or systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/067—Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/10—Providing a specific technical effect
    • G06F2212/1052—Security improvement

Definitions

  • the present invention relates to the field of computer security, and in particular, to a data black hole processing method based on a mobile memory and a mobile memory.
  • the existing electronic information security areas include three sub-areas of system security, data security and device security.
  • Data content security technologies including data encryption and decryption technology and end-to-end data encryption technology, to ensure that data is not illegally read during storage and transmission;
  • Network blocking technology including technologies such as network physical blocking and setting network barriers.
  • the total effective detection capability of all hazards for computers is currently at most 50%; due to the above-mentioned technologies, the ability to cope with computer kernel viruses, Trojans, operating system vulnerabilities, system backdoors, and human leaks is insufficient. Malicious code may be present (including, for example, computers, laptops, handheld communication devices, etc.).
  • copy-protection technology cannot guarantee that confidential information is not illegally stored in the terminal.
  • Network-based filtering does not ensure that confidential information is not lost.
  • Confidential personnel can be compromised through malicious code or malicious tools, and may also be compromised due to loss of control of confidential devices or storage media.
  • the invention provides a data black hole processing method based on mobile memory and a mobile memory, which can improve data security.
  • a data black hole processing method based on a mobile memory including: deploying a data black hole system in a computing device to become a data black hole terminal; and a data black hole system refers to process data in a running process of the computing device and The system stores the result of the operation to a specific storage location and ensures that the computing device is operating normally; establishing a data black hole space, including a data storage area opened on the mobile storage, wherein the data storage area can only be accessed by the data black hole system, and cannot Accessed by the operating system or the application layer software, the mobile memory is coupled to the computing device; the user of the computing device is associated with the data black hole space or a part of the data black hole space; and the data generated by the user operating in the data black hole terminal is written.
  • a mobile storage device including: a mobile data security access unit and a secure storage space, wherein the mobile storage device itself carries an operating system, and the secure storage space is above the operating system and the operating system.
  • Software is not available and can only be accessed by the Mobile Data Security Access Unit; where, when the mobile storage device When coupled to the computing device, the CPU of the computing device is configured to execute an operating system carried by the mobile storage device itself, the user interacts with the mobile storage device through the I/O of the computing device, and the mobile data security access unit receives the mobile storage device The instruction of the operating system carried by itself and sent to the CPU of the computing device; wherein the mobile data security access unit comprises: a receiving unit adapted to receive the hardware instruction; and an instruction analyzing unit adapted to determine whether the hardware instruction is Storing or reading an instruction, generating a determination signal; the instruction modification unit, according to the determination signal, is adapted to modify the target address in the storage instruction to a corresponding storage in a secure storage space when the hardware instruction
  • the mobile storage device further includes: an update unit, configured to: after the instruction modification unit modifies the storage instruction, update a bit corresponding to the target address in the mapping bitmap.
  • the mobile storage device further includes: an encryption and decryption unit coupled to the secure storage space, and adapted to perform encryption and decryption operations on data entering and leaving the secure storage space.
  • an encryption and decryption unit coupled to the secure storage space, and adapted to perform encryption and decryption operations on data entering and leaving the secure storage space.
  • the above method and device improve the security of the data, and the black hole space corresponds to the user.
  • the hacker obtains the data permission through the malicious code such as the vulnerability, the back door, the Trojan, etc.
  • the data can be copied, dumped, sent, and intercepted.
  • all data forwarded to external devices, ports, users, and terminals will be redirected to the data black hole space (the black hole space corresponding to the user) and completed in the data black hole space (the black hole space corresponding to the user). Therefore, all data stealing, interception, output and other operations are implemented in the data black hole space.
  • a confidential (with data permission) person attempts to privately store data, privately back up, send, and output, all data processing operations are completed in the data black hole space (black space corresponding to the user), so that malicious operations cannot be compromised.
  • FIG. 1 is a system level diagram of a computing device in the prior art
  • FIG. 2 is a flow chart of a method for reorganizing a runtime command provided in an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a process of generating a reassembly instruction fragment provided in an embodiment of the present invention
  • step S102 of FIG. 2 provided in another embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for reorganizing a runtime instruction according to another embodiment of the present invention, where an instruction segment that has been reorganized is saved by using an address correspondence table;
  • FIG. 6 is a flowchart of a method for reorganizing a runtime instruction provided in another embodiment of the present invention, separately opening a storage location to save a target address of a first program branch instruction;
  • FIG. 7 is a flowchart of a runtime instruction recombination method provided in another embodiment of the present invention, which disassembles and assembles a non-fixed length instruction set;
  • FIG. 8 is a flowchart of a method for reorganizing a runtime instruction according to another embodiment of the present invention, in which a first program transfer instruction is replaced or recorded by a push instruction;
  • FIG. 9a is a flowchart of a method for reorganizing a runtime instruction provided in another embodiment of the present invention, wherein the runtime instruction recombination method synthesizes features in the previous embodiments;
  • FIG. 9b-9d are schematic diagrams showing the operation process of the runtime instruction recombination method in FIG. 9a when running on the X86 system processor;
  • FIG. 10 is a schematic structural diagram of a runtime instruction recombining apparatus provided in an embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of a runtime instruction recombining apparatus provided in another embodiment of the present invention.
  • FIG. 12 is a schematic structural diagram of an instruction reassembly unit according to another embodiment of the present invention.
  • FIG. 13 is a diagram of a structure of a runtime instruction reorganization apparatus according to another embodiment of the present invention. schematic diagram;
  • FIG. 14 is a schematic structural diagram of a runtime instruction recombining apparatus provided in another embodiment of the present invention.
  • FIG. 15 is a system hierarchy diagram of a computing device in accordance with an embodiment of the present invention.
  • 16 is a flowchart of an initialization process in a data secure access process provided in an embodiment of the present invention.
  • FIG. 17 is a schematic diagram of a Bitmap in an embodiment of the present invention.
  • 21 is a flowchart of a data security transmission method provided in an embodiment of the present invention.
  • FIG. 22 is a schematic diagram of a network environment in an embodiment of the present invention.
  • FIG. 23 is a schematic structural diagram of a data security storage device provided in an embodiment of the present invention.
  • 24 is a schematic structural diagram of a data security reading apparatus provided in an embodiment of the present invention.
  • 25 is a schematic structural diagram of a data security storage and reading apparatus provided in an embodiment of the present invention.
  • 26 is a schematic structural diagram of a data security storage and reading apparatus according to another embodiment of the present invention.
  • FIG. 27 is a schematic diagram of a data black hole space provided in another embodiment of the present invention.
  • 29a is a schematic diagram of an architecture of a computing device provided in an embodiment of the present invention, in which a data security storage and reading method of a stand-alone version is run;
  • 29b is a schematic structural diagram of a stand-alone data security storage and reading device provided in an embodiment of the present invention.
  • FIG. 30 is a schematic diagram of a black hole processing method for a stand-alone version provided in an embodiment of the present invention.
  • FIG. 31 is a schematic diagram of secure storage using a mobile memory provided in an embodiment of the present invention.
  • FIG. 32 is a schematic diagram showing a hierarchical structure of a mobile storage device according to an embodiment of the present invention.
  • FIG. 1 is a schematic diagram of a system hierarchy of a computing device in the prior art. From top to bottom, the computing device includes:
  • User interface layer 101 application layer 102, operating system kernel layer 103, hardware mapping layer 104, and hardware layer 105.
  • the user interface layer 101 is an interface between the user and the device through which the user interacts with the device (ie, other layers of the device, such as the application layer 102).
  • Application layer 102 refers to the application software layer.
  • the operating system kernel layer 103 is a software-based logic layer, generally composed of software data and software code. Compared to the interface layer 101 and the application layer 102, the code of the operating system kernel layer 103 has higher authority. Complete operations can be performed on various hardware and software resources in a computer system.
  • the hardware mapping layer 104 is a software-based logic layer that typically operates at the operating system kernel level and has the same permissions as the kernel layer.
  • the hardware mapping layer is mainly to solve the problem of mapping the operation modes of different types of hardware into a unified upper layer interface and shielding the hardware.
  • the hardware mapping layer is primarily used by the operating system kernel layer 103 to perform operations on various hardware.
  • Hardware layer 105 refers to all of the hardware components that make up a computer system.
  • the application layer 102 calls the corresponding code to convert the above user operation into an interface function provided by one or more operating systems (for example, an application programming interface of the Microsoft 32-bit platform, win32 API), and converts the "save" operation into A call to an interface function provided by a series of operating system kernel layers 103;
  • operating systems for example, an application programming interface of the Microsoft 32-bit platform, win32 API
  • the operating system kernel layer 103 converts each operating system interface function into an interface function provided by one or more hardware mapping layers 104; converting the "save" operation into a call to an interface function provided by a series of hardware mapping layers 104. ;
  • the hardware mapping layer 104 converts each of its own provided interface functions into one or more hardware instruction calls
  • the hardware layer 105 receives the above hardware instruction call and executes the hardware instruction.
  • the malicious code when it is intruded by malicious code, the malicious code can obtain the required data from the computing device, and the behavior patterns after stealing the data include:
  • the behavior patterns of internal leakage using a person of the above computing device or information device include:
  • a CPU address register is used to store the address of the next machine instruction to be run, such as pc (program counter).
  • the data in the register is obtained, and the next one or more machine instructions to be executed are read according to the address pointed to by the data, so that the purpose of capturing the machine instruction at runtime can be realized.
  • the machine instructions therein can also be analyzed and processed, so that not only the runtime instruction capture and reorganization can be realized, but also Achieve management of predetermined target instructions.
  • an embodiment of the present invention provides a runtime instruction reorganization method, which is called an instruction reorganization platform when it is running.
  • the method S100 includes:
  • S101 a cache instruction running environment
  • the instruction running environment includes an address register, and the address register stores an address of a next machine instruction to be run, and the address is a first address;
  • S102 Obtain a machine instruction segment to be scheduled, where a last instruction of the machine instruction segment to be scheduled is a first program branch instruction (eg, a first jump instruction);
  • a first program branch instruction eg, a first jump instruction
  • step S103 before the first program branch instruction, inserting a second program branch instruction to generate a reassembly instruction fragment having a second address; the second program branch instruction is directed to an entry address of the instruction reorganization platform, that is, executing the second program After the transfer instruction, step S101 is performed;
  • the cache instruction execution environment may include:
  • the CPU machine instruction is pressed into the cache stack to run the relevant register data.
  • the cache or save instruction runtime environment may also be performed in a specified, default other cache data structure and address.
  • the address register is a program counter, that is, a PC.
  • step S102 there is only one program transfer instruction in the machine instruction segment to be scheduled, and the machine instruction segment to be scheduled includes the first program transfer instruction and all previous machine instructions to be scheduled.
  • step S103 before the last instruction of the machine instruction segment to be scheduled (ie, the first program transfer instruction, abbreviated as JP1), a second program transfer instruction (referred to as JP2) is inserted, and the JP2 points to the instruction reorganization platform.
  • the entry address generates a reassembly instruction fragment having a second address (the address is represented by A").
  • Inserting the second program transfer instruction is to restart the operation of the instruction reorganization platform before the JP1 runs when the CPU runs the machine instruction segment to be scheduled, so that the instruction reorganization platform can continue to analyze the next segment of the machine to be scheduled.
  • the instruction fragment thus completing the reorganization of all runtime instructions by repeating this method.
  • step S105 restoring the instruction execution environment may include:
  • the pop-up instruction from the cache stack runs the relevant register data; wherein the target address of the program branch instruction saved by the address register has been modified to a new machine instruction fragment with the second address A" as the entry address.
  • step S105 the instruction execution environment is restored, the instruction reorganization platform completes a run, and the CPU executes the reassembly instruction segment, that is, the CPU executes the machine instruction segment with the second address A" as the entry address.
  • the instruction reorganization platform regains control of the CPU (ie, executing step S101), at which time the target address of the first program branch instruction has been obtained, and the target address is the new first address, and then Steps S101 to S105 are executed again.
  • the foregoing runtime instruction reorganization method is executed on a CPU of an X86 architecture; in other embodiments of the present invention, the foregoing runtime instruction reassembly method may also be executed on a MIPS processor or an ARM architecture-based processor. .
  • the above methods can be performed on any other type of instruction processing unit in a computing device.
  • Figure 3 includes a set of machine instructions 401 to be scheduled (e.g., already loaded into memory) a machine instruction of a program, wherein the instruction 4012 is a first program transfer instruction, if the target address of the instruction 4012 is a variable, first assume that the instruction 4012 points to the machine instruction 4013; and the first program transfer before the first program transfer instruction 4012 All of the machine instructions to be dispatched by instruction 4012 constitute a machine instruction segment 4011 (containing only one program branch instruction).
  • the instruction execution environment is first cached; then the machine instruction segment 4011 is obtained (eg, copied); the instruction reorganization platform inserts the second program transfer instruction 4113 before the first program transfer instruction 4012.
  • the second program branch instruction 4113 points to the instruction reorganization platform 411 itself, thereby generating a reassembly instruction fragment 4111, and the address of the reassembly instruction fragment is A"; the value A of the address register in the cache instruction execution environment is modified to the address A "; Finally restore the instruction running environment.
  • the CPU executes the reassembly instruction segment with the address A", and when executing the second program transfer instruction 4113, the instruction reorganization platform 411 regains the CPU control right.
  • the first program transfer instruction The target address 4013 of 4012 has been generated, and the target address is a new first address.
  • the instruction reorganization platform restarts execution of steps S101 to S105 according to the target address, and continues to analyze subsequent machine instructions to be scheduled, thereby completing the runtime instruction. The method of reorganization.
  • step S102 acquiring a machine instruction segment to be scheduled may include:
  • S1021 Read a machine instruction address to be scheduled from an address register (for example, a program counter);
  • a program transfer instruction for example, a jump instruction
  • the program transfer instruction refers to a machine instruction capable of changing a sequence execution sequence of a machine instruction, including a jump Program transfer instruction, Call call instruction, Return return instruction, etc.;
  • the first program branch instruction and all previous machine instructions to be scheduled are used as a segment of the machine instruction to be scheduled, and the machine instruction fragment is saved in the instruction reorganization platform, or can be read by another instruction reorganization platform. storage location.
  • acquiring the machine instruction segment to be scheduled may also use a non-program transfer instruction (eg, a write instruction, a read instruction, etc.) as a retrieval target to further segment the machine instruction segment.
  • a non-program transfer instruction eg, a write instruction, a read instruction, etc.
  • the runtime instruction recombining method may further include:
  • the instruction set includes an X86, MIPS, and ARM instruction set;
  • the target machine command is modified in a predetermined manner.
  • the to-be-scheduled instruction pointed to by the fixed address program branch instruction may be acquired together in step S102.
  • a runtime instruction recombination method is provided, and the method S300 includes:
  • the instruction running environment includes an address register, The address register holds the address of the next machine instruction to be run, the address being the first address;
  • step S303 before the first program branch instruction, inserting a second program branch instruction to generate a reassembly instruction fragment having a second address; the second program branch instruction is directed to an entry address of the instruction reorganization platform, that is, executing the second program After the transfer instruction, step S301 is performed;
  • step S302 a plurality of program branch instructions may be included in the machine instruction segment to be scheduled; and only one parameter address program branch instruction is included in the program branch instructions. It is called the first program transfer instruction.
  • the program branch instruction may include two types, a parameter address program branch instruction and a constant address program branch instruction, wherein the jump address of the constant address program branch instruction is a constant (ie, an immediate number), and the parameter address program branch instruction
  • the parameter address in the program is generally calculated in a machine instruction before the program branch instruction.
  • the last instruction of the machine instruction fragment to be scheduled is a first program branch instruction; the machine instruction fragment to be scheduled includes the first program branch instruction and all previous machine instructions to be scheduled.
  • a runtime instruction recombination method is provided. As shown as shown in Figure 5, the method S200 includes:
  • the instruction running environment includes an address register (for example, a program counter), and the address register stores an address of a next machine instruction to be executed, and the address is called a first address;
  • the instruction running environment includes All registers of the CPU, including general-purpose registers, status registers, address registers, etc.;
  • the address correspondence table is used to indicate whether the instruction segment to be scheduled pointed to by the first address (for example, address A) has a saved reassembly instruction fragment, and the data of the address correspondence table may be an address. Yes, related data can also be stored in other forms;
  • the first address A ie, the value A of the address register
  • the address of the saved reassembly instruction fragment for example, address A'
  • step S205 before the first program branch instruction, insert a second program branch instruction to generate a reassembly instruction fragment having a second address; the second program branch instruction points to an entry address of the instruction reorganization platform, that is, execute the second program After the transfer instruction, step S201 is performed;
  • step S206 further includes: establishing an address pair (or a record) in the address correspondence table with the first address A by using the second address A".
  • the reassembly instruction fragment having the address A" is saved in the reorganization instruction platform. Or reorganize the memory that the instruction platform can access for reuse.
  • the method utilizes an address correspondence table to save computing resources and improve the efficiency of command reorganization at runtime.
  • the above-mentioned reorganization method is generally completed by inserting a required program transfer instruction into the to-be-scheduled instruction segment.
  • the generation of the recombination instruction segment may also be completed by other means. The details will be described below in conjunction with the embodiments.
  • an instruction recombination method for separately opening a storage location to save a target address of a first program branch instruction includes:
  • the target address is read from the first storage location, and the machine instruction segment to be scheduled (ie, to be executed) is obtained according to the target address; wherein the last instruction of the machine instruction segment to be scheduled is the first program transfer instruction (for example, the first Jump instruction);
  • step S112 acquiring the machine instruction segment to be scheduled includes:
  • the program transfer instruction is a search target, and the machine instruction pointed to by the machine instruction address and subsequent instructions are retrieved until a first program transfer instruction (referred to as a first program transfer instruction) is found;
  • S1122 The first program branch instruction and all previous machine instructions to be scheduled are used as a piece of machine instruction to be scheduled, and the machine instruction segment is saved in an instruction reorganization platform or a storage that can be read by another instruction reorganization platform. position.
  • the target address is the target address parameter of the program branch instruction, which may be an immediate or variable parameter, and the value is saved for the immediate value, and the variable parameter is saved. Its address/reference.
  • the processor is about to execute a program branch instruction, its jump destination address has been calculated.
  • an instruction reassembly method for disassembly and assembly processing for a non-fixed length instruction set. As shown in FIG. 7, the method includes:
  • the target address is read from the first storage location, and the instruction segment to be scheduled is obtained according to the target address, including:
  • the program branch instruction (such as a jump instruction) is included, if If not included, continue to acquire the next machine instruction to be scheduled to repeat the above operation until the program branch instruction is matched, the program branch instruction is the first program branch instruction; the first program branch instruction and all previous instructions constitute the to-be-scheduled instruction fragment ;
  • the first storage location is used to save the address of the next machine instruction to be run
  • an instruction reassembly method for replacing or recording a first program branch instruction with a push instruction.
  • the method S130 includes:
  • S132 Perform a pop operation to obtain an operand, and calculate an address of an instruction to be run next, where the address is a first address; wherein the stack is used to save an address and a parameter of a program branch instruction (such as a jump instruction);
  • an instruction recombination method is provided, as shown in FIG. 9a, including:
  • the machine instruction fragment to be executed is obtained from the first address, and the end of the instruction fragment is a program branch instruction (the address of the program branch instruction is the third address);
  • the target address of the program branch instruction at the third address is a known amount (for example, an immediate number), and if so, setting the value of the first address to the first The target address of the three addresses, restart execution (3);
  • step (1) If not, at the end of the generated reassembled assembly code, add a push instruction to record the original address position of the current third address (ie, the value of the third address) and the operand, and join the jump after the push instruction. Going to the instruction to start the reorganization platform, the step (1) can be started again;
  • the generated reassembled assembly code is generated by the assembler to generate a corresponding machine code, and is stored in an address (second address) allocated in the reassembly address space, and the second address and the zeroth address are corresponding addresses.
  • the form is stored in the address correspondence table;
  • the first program branch instruction is analyzed to determine whether the jump destination address is a known quantity. If it is a known quantity, the search continues until the first parameter address program jump instruction is found, which is called the first program branch instruction.
  • the address of the instruction is the third address;
  • the generated assembly code (the machine instruction from the first address to the third address, excluding the first program branch instruction) is finally added to the stack instruction to record the original address position and the operand of the first jump of the current third address;
  • An instruction to jump to the start of the reorganization platform (second program branch instruction) is added after the push instruction.
  • the second address and the zeroth address are stored in the address correspondence table in the form of corresponding address pairs.
  • FIG. 9d The processor starts executing the instruction of the second address, and the program branch instruction in the previous instruction segment to be reassembled has been replaced with the push instruction and the instruction to jump to the reorganization platform.
  • the main purpose of the push instruction is to reorganize the platform. Provide input parameters.
  • FIG. 9d When the execution of the second program transfer instruction, the reorganization platform is re-executed, and the above step (1) is performed. By checking the address and parameters of the program transfer instruction saved in the push instruction, the next one to be executed is calculated.
  • the instruction address which is the first address.
  • the subsequent processing is the loop of the above process.
  • the runtime instruction full monitoring is implemented in the operation phase of the computing device.
  • the load instruction at the time of starting the computer is modified, and is called before the execution of the original load instruction.
  • the instruction reorganization platform provided by the invention executes the above-mentioned runtime instruction recombination method. Since the jump address of the load instruction is a known fixed address, the instruction reorganization platform can establish the address correspondence table and the first record in advance, and establish the first Reassembly instruction fragment.
  • a computer readable medium stores computer executable program code for executing the operation provided in the above embodiment.
  • the steps of the instruction reorganization method are provided.
  • a computer program comprises the steps of the runtime instruction recombination method provided in the above embodiment.
  • runtime instruction reorganization method provides the basis for further application.
  • the following embodiments provide various runtime instruction recombination methods for processing different machine instructions, including: store/read instructions, I/O instructions, and network transfer instructions:
  • a store/read instruction refers to all instructions or combinations of instructions in a computer system that store/read external storage devices, including but not limited to disk storage devices, flash memory devices, optical storage devices.
  • I/O instructions refer to the instruction of the address space of all operating peripherals in the computer system, which ultimately affect the peripheral input and output status, data, signals, and so on.
  • the address space of the peripheral includes but is not limited to the I/O address space and the memory mapped I/O device address space.
  • Network transmission instructions refer to all instructions in the computer system that affect the network equipment, which ultimately affect the transmission, status, data, and signals of the network equipment of the computer system. And all related features.
  • a runtime instruction reorganization method S400 for storing/reading instructions including:
  • the instruction running environment includes an address register, the address register stores an address of a next machine instruction to be run, the address is a first address; the address register is, for example, a program counter PC;
  • the method for generating the reassembly instruction fragment includes:
  • S4043 retrieve a target assembly instruction (that is, use a target assembly instruction as a retrieval target to retrieve an assembly instruction fragment), and the target assembly instruction is a storage/read instruction;
  • the JP2 points to the instruction reorganization platform (the instruction reorganization method is called an instruction reorganization platform, and can also be understood as the instruction reorganization method when running)
  • the instance is called the entry address of the instruction reorganization platform);
  • This embodiment performs instruction processing after the disassembly step; in other embodiments, disassembly and corresponding assembly steps may also be omitted to directly process the machine instructions.
  • step S4044 operations are performed on the store and read instructions, and the target and source addresses therein are modified to implement storage relocation/redirection to ensure data security.
  • a more specific method of secure storage/reading will be introduced in the following embodiments provided by the present invention.
  • a runtime instruction reorganization method S500 for an I/O instruction including:
  • S501 a cache instruction running environment
  • the instruction running environment includes an address register, and the address register stores an address of a next machine instruction to be executed, and the address is a first address;
  • the method for generating the recombination instruction fragment includes:
  • S5043 retrieve a target assembly instruction, where the target assembly instruction is an I/O instruction;
  • This embodiment performs instruction processing after the disassembly step; in other embodiments, disassembly and corresponding assembly steps may also be omitted to directly process the machine instructions.
  • step S5044 an operation is performed on the I/O instruction to block all the input instructions in the I/O instruction to completely block the write operation to the local hardware device; in combination with the storage instruction processing in the previous embodiment
  • the process can also implement blocking of input instructions other than storage instructions, and can improve data security in the computing device.
  • a runtime instruction reorganization method S600 for network transmission instructions including:
  • S601 a cache instruction running environment;
  • the instruction running environment includes an address register, and the address register stores an address of a next machine instruction to be run, and the address is a first address;
  • the method for generating the recombination instruction fragment includes:
  • S6043 retrieve a target assembly instruction, where the target assembly instruction is a network transmission instruction
  • the block/deny network transfer instruction may replace the own transfer instruction with "cancel the currently operated instruction” or directly replace it with the invalid instruction by inserting one or more instructions in the reassembled code, depending on the hardware. The difference depends on.
  • This embodiment performs instruction processing after the disassembly step; in other embodiments
  • the disassembly and corresponding assembly steps can also be omitted to directly process the machine instructions.
  • step S6044 the network transmission instruction is operated to check whether the remote computing device corresponding to the target address in the network transmission instruction is a secure address; if not, the network transmission instruction is blocked to implement data security transmission.
  • the address correspondence table in the foregoing multiple embodiments is established and maintained by the instruction reorganization platform, and may be a fixed length array structure, a variable length linked list structure, or other suitable data for storing binary data. structure. According to one embodiment of the invention, its length is adjustable and its footprint is releasable. The operation of releasing the address correspondence table may be performed randomly or periodically.
  • the address correspondence table may further include a record establishment time field for deleting the record according to the length of the setup time when the space is deleted.
  • the address correspondence table may further include a record usage count field. In the search address correspondence table step, if found, the value of the field is changed; the record usage count field is also used to delete the record in the release space. When you delete the record according to the number of uses.
  • the instruction reorganization device 500 include:
  • An instruction execution environment cache and recovery unit 501 is adapted to cache and restore an instruction execution environment;
  • the instruction execution environment includes an address register, and the address register (eg, program counter pc) stores an address of a next machine instruction to be executed, the address is First address;
  • the address register eg, program counter pc
  • the instruction fetching unit 502 is configured to obtain a machine instruction segment to be scheduled after the unit 501 caches the instruction execution environment; wherein the last instruction of the machine instruction segment to be scheduled is the first program transfer instruction (for example, the first jump instruction) );
  • the instruction reorganization unit 503 is adapted to parse and modify the machine instruction segment to be scheduled, including: inserting a second program transfer instruction to generate a recombination instruction segment having a second address A" before the first program branch instruction;
  • the second program branch instruction is directed to the device 500, that is, after executing the second program branch instruction, the instruction execution environment cache and recovery unit 501 of the device 500 performs the next processing;
  • the address replacement unit 504 is adapted to modify the value of the address register in the cached instruction execution environment to the address of the reassembly instruction fragment.
  • the instruction execution environment cache and recovery unit 501 is coupled to the instruction acquisition unit 502 and the address replacement unit 504, respectively.
  • the instruction acquisition unit 502, the instruction reassembly unit 503 and the address replacement unit 504 are coupled in sequence.
  • the process of apparatus 500 is as follows:
  • the instruction execution environment cache and recovery unit 501 caches the instruction execution environment, for example, by pushing the instruction to run the relevant register data into the cache stack;
  • the instruction acquisition unit 502 reads the machine instruction address to be scheduled from the CPU address register 511, and reads the machine instruction segment from the machine instruction address, and the last instruction of the machine instruction segment is a program transfer instruction;
  • the instruction acquisition unit 502 reads the machine instruction address to be scheduled from the CPU address register 511; retrieves the machine instruction address by using the program transfer instruction as a retrieval target. Corresponding machine instructions until the first program branch instruction (ie, control branch instruction, including unconditional branch instruction and conditional branch instruction) is found; the program branch instruction includes, for example, a Jump/JMP instruction, a Call instruction, a RET instruction, etc.; The first program branch instruction and all previous machine instructions are used as a segment of the machine instruction to be scheduled; the machine instruction segment is saved in the storage location of the device 500 or other device 500;
  • the first program branch instruction ie, control branch instruction, including unconditional branch instruction and conditional branch instruction
  • the program branch instruction includes, for example, a Jump/JMP instruction, a Call instruction, a RET instruction, etc.
  • the first program branch instruction and all previous machine instructions are used as a segment of the machine instruction to be scheduled; the machine instruction segment is saved in the storage location of the device 500 or other device 500;
  • the instruction reorganizing unit 503 inserts a second program branch instruction before the last instruction of the acquired machine instruction segment, the second program branch instruction pointing to the entry address of the device 500, and generating a reassembly instruction fragment having the address A" ;
  • the address replacement unit 504 modifies the value A of the address register in the cached instruction execution environment to the address A";
  • the instruction execution environment cache and recovery unit 501 restores the instruction execution environment, for example, popping an instruction from the cache stack to run the relevant register data.
  • the instruction acquisition unit 502 can use the first non-address program transfer instruction as the first program transfer instruction to improve the execution efficiency of the recombining apparatus.
  • a runtime instruction recombining apparatus which can fully utilize the repeatability of runtime instructions, improve efficiency, and save computing resources.
  • the instruction reorganization device 600 includes:
  • An instruction execution environment cache and recovery unit 601 is adapted to cache and restore an instruction execution environment; the instruction execution environment includes an address register, and the address register stores an address of a next machine instruction to be executed, the address being a first address;
  • the instruction fetching unit 602 is configured to acquire a segment of the machine instruction to be scheduled; wherein the last instruction of the segment of the machine instruction to be scheduled is the first program branch instruction;
  • the instruction reorganization unit 603 is adapted to parse and modify the segment of the machine instruction to be scheduled, including: inserting a second program branch instruction before the first program branch instruction to generate a reassembly instruction segment having a second address;
  • the program transfer instruction points to the device 600, that is, after executing the second program transfer instruction, the instruction execution environment cache and recovery unit 601 of the device 600 performs the next processing;
  • An address replacement unit 604 adapted to modify a value of an address register in the cached instruction execution environment to an address of a reassembly instruction fragment;
  • the instruction retrieval unit 605 is adapted to use the first address to look up an address correspondence table.
  • the address correspondence table is used to indicate whether the instruction segment to be scheduled pointed to by the first address A has a saved reassembly instruction fragment, and the data of the address correspondence table. For example, an address pair;
  • the instruction retrieval unit 605 is adapted to invoke the address replacement unit 604 to modify the first address A (ie, the value A of the address register) to the address A' of the saved reassembly instruction fragment; if no corresponding correspondence is found
  • the record retrieval unit is adapted to establish a record in the address correspondence table with the address A using the second address A".
  • the instruction execution environment cache and recovery unit 601 is coupled to the instruction retrieval unit 605 and the address replacement unit 604, respectively, and the instruction retrieval unit 605 is coupled to the instruction acquisition unit 602, the instruction reassembly unit 603, and the address replacement unit 604, respectively.
  • the instruction acquisition unit 602, the instruction reassembly unit 603, and the address replacement unit 604 are coupled in sequence.
  • the execution process of the device 600 is as follows:
  • the instruction execution environment cache and recovery unit 601 caches the instruction execution environment, for example, pushing the instruction to run the relevant register data into the cache stack;
  • the instruction retrieval unit 605 searches for the address correspondence table by using the value A of the address register in the cached instruction execution environment;
  • the instruction retrieval unit 605 calls the address replacement unit 604, which changes the value A of the address register to the value A' in the record; the address replacement unit 604 invokes the instruction execution environment cache and recovery unit 601. To restore the instruction execution environment, that is, popping the instruction from the cache stack to run the relevant register data, The second reorganization operation ends;
  • the instruction fetch unit 602 reads the machine instruction address to be scheduled from the CPU address register, and reads the machine instruction fragment from the machine instruction address, the last instruction of the machine instruction segment is a program transfer instruction.
  • the instruction obtaining unit 602 reads the machine instruction address to be scheduled from the CPU address register; retrieves the machine instruction corresponding to the machine instruction address by using the program branch instruction as a retrieval target until the first program branch instruction is found;
  • the program transfer instruction includes a Jump instruction, a Call instruction, and the like; the first program transfer instruction and all previous machine instructions are used as a segment of the machine instruction to be scheduled; the machine instruction segment is saved in the device 600, or other a storage location that the device 600 can read;
  • the instruction recomposing unit 603 inserts a second program branch instruction before the last instruction of the acquired machine instruction segment, the second program branch instruction pointing to the entry address of the device 600, and generating a reassembly instruction fragment having the address A" ;
  • the instruction reorganizing unit 603 sends the address A" to the instruction retrieval unit 605, and the instruction retrieval unit 605 creates a record in the address correspondence table in which the address A is located with the address A; in preparation for subsequent instruction reuse;
  • the address replacement unit 604 modifies the value A of the address register in the cached instruction execution environment to the address A";
  • the instruction execution environment cache and recovery unit 601 restores the instruction execution environment, that is, pops up the instruction from the cache stack to run the relevant register data.
  • the instruction reorganization unit 603 may further include:
  • the instruction parsing unit 6031 is adapted to match the machine instruction segment with the instruction set to obtain a target machine instruction to be processed (ie, retrieve a machine instruction segment to be scheduled by using a target instruction); the instruction set includes an X86, MIPS, and ARM instruction set. ;
  • the instruction modification unit 6032 is adapted to modify the target machine instruction in a predetermined manner.
  • the instruction parsing unit 6031 will be responsible for acquiring a store/read instruction in a machine instruction segment to be scheduled, the instruction modification unit 6032 modifying the storage and reading therein.
  • the address is the address on the secure storage device. Its function and effect are the same as the corresponding method embodiment S400 described above, and details are not described herein again.
  • the instruction parsing unit 6031 will be responsible for acquiring an I/O instruction in a machine instruction segment to be scheduled, and the instruction modification unit 6032 will be in the I/O instruction.
  • the input commands are all blocked.
  • the function and effect are the same as the corresponding method embodiment S500 described above, and are not described herein again.
  • the instruction parsing unit 6031 is responsible for acquiring a network transmission instruction in a machine instruction segment to be scheduled, and the instruction modification unit 6032 checks a target address in the network transmission instruction. Whether the corresponding remote computing device is a secure address; if not, the instruction modification unit is adapted to block the network from transmitting instructions. Its function and effect are the same as the corresponding method embodiment S600 described above, and are not described herein again.
  • the instruction reorganizing unit may further include a disassembly unit and an assembly unit.
  • the instruction reorganizing unit 703 includes: a disassembly unit 7031, an instruction parsing unit 7032, an instruction modification unit 7033, and an assembly unit 7034 that are sequentially coupled.
  • the disassembly unit 7031 is adapted to disassemble the machine instruction segment to be scheduled, parse the assembly instruction segment to be scheduled, and send it to the instruction parsing unit 7032 before parsing and modifying the machine instruction segment to be scheduled.
  • the assembly unit 7034 is adapted to assemble the reassembled assembly instruction fragment after parsing and modifying the machine instruction segment to be scheduled, and obtain a reassembly instruction fragment represented by the machine code, and send the instruction instruction unit to the instruction replacement unit.
  • the instruction parsing unit 7032 and the instruction modifying unit 7033 will The operation instruction method to be scheduled is similar to the above embodiment, and details are not described herein again.
  • the instruction reorganization device 800 includes:
  • An instruction execution environment cache and recovery unit 801 is adapted to cache an instruction execution environment
  • the instruction reorganizing unit 804 is adapted to save the target address of the first program branch instruction in the first storage location 803, replace the first program branch instruction with the second program branch instruction, and generate a recombination instruction fragment having the second address;
  • the second program branch instruction points to the entry address of device 800.
  • the instruction execution environment cache and recovery unit 801 is further adapted to resume the instruction execution environment after the instruction reorganization unit 804 replaces the instruction, and jump to the second address to continue execution.
  • the execution process of device 800 is as follows:
  • the instruction execution environment cache and recovery unit 801 caches the instruction execution environment
  • the instruction acquisition unit 802 reads the target address (to be scheduled instruction address) from the first storage location 803, and acquires a machine instruction segment to be scheduled according to the target address; wherein the last instruction of the machine instruction segment to be scheduled is the first program Transfer instruction
  • the instruction reorganizing unit 804 saves the target address of the first program branch instruction at the first storage location 803: (1) saves its value for the immediate value, (2) saves its address/reference for the variable parameter, for example, saves the float type variable destination_address Address or quote use;
  • the instruction reorganizing unit 804 replaces the first program branch instruction with the second program branch instruction to generate a recombination instruction fragment having the second address;
  • instruction execution environment cache and recovery unit 801 restores the instruction execution environment and jumps to the second address to continue execution.
  • a runtime command recombination apparatus that corresponds to the above method S130 and that includes features of the apparatus provided in some of the above embodiments.
  • the apparatus 900 includes:
  • the instruction execution environment cache and recovery unit 901 is adapted to cache and restore the instruction execution environment
  • the instruction obtaining unit 902 is adapted to perform a pop operation to acquire an operand, and use an operand to calculate an address of an instruction to be executed next, the address being a first address;
  • the instruction reorganizing unit 903 is adapted to replace the first program branch instruction as a push stack instruction, and record the address and the operand of the first program branch instruction in the push stack instruction;
  • the instruction retrieval unit 904 is adapted to use the first address to search for an address correspondence table.
  • the address correspondence table is configured to indicate whether the to-be-scheduled instruction segment pointed to by the first address has a saved reassembly instruction fragment, and the data of the address correspondence table is Address pair
  • the instruction retrieval unit 904 is adapted to invoke the instruction execution environment cache and recovery unit 901 to restore the cached instruction execution environment, and jump to the found corresponding address to continue execution (this reorganization operation is completed);
  • the instruction reorganization unit 903 is called to perform the reorganization operation.
  • the instruction reorganization unit 903 may further include a disassembly unit 9031, an instruction parsing unit 9032, an instruction modification unit 9033, and an assembly unit 9034.
  • the instruction execution environment cache and recovery unit 901 resumes the cached instruction execution environment, and jumps to the address of the reassembly instruction segment to continue execution (this reorganization operation is completed).
  • the disassembly unit 9031 may be located in the instruction acquisition unit 902, and perform a disassembly operation by the instruction segment to be scheduled.
  • runtime instruction recombination method and apparatus are described in detail above by some embodiments, which have the following advantages compared with the prior art:
  • the instruction reorganization method can monitor the instruction of the computing device in the running state of the instruction
  • the address correspondence table is used to improve the efficiency of instruction reorganization and save computing resources
  • Operate for storage and read instructions modify the target and source address to achieve storage relocation/redirection, and ensure data security
  • the network transmission instruction is operated to check whether the remote computing device corresponding to the target address in the network transmission instruction is a secure address; if not, the network transmission instruction is blocked to implement data security transmission.
  • Figure 15 is a system hierarchy diagram of a computing device in accordance with one embodiment of the present invention.
  • the computing device 200 includes a user interface layer 201, an application layer 202, an operating system kernel layer 203, a hardware mapping layer 204, a security layer 205, and a hardware layer 206.
  • the hardware layer 206 further includes a CPU 2061, a hard disk 2062 (ie, a local storage device), and a network card 2063.
  • computing device 200 is coupled to storage device 10 (also referred to as a secure storage device).
  • storage device 10 also referred to as a secure storage device.
  • the storage device 10 is a remote disk array, and the network card 2063 of the hardware layer 206 is connected through a network to exchange data with the computing device 200.
  • storage device 10 may also be other known or unknown types of storage devices.
  • the hard disk 2062 can also be replaced with other types of local storage devices, such as a USB flash drive and an optical disk, etc., which are merely illustrative and not limiting.
  • the embodiment provides a data security access process, including:
  • the foregoing initialization process S1000 includes:
  • S1010 Establish communication between the computer terminal system 200 and the secure storage device 10;
  • mapping bitmap (Bitmap) from the secure storage device 10 to the current computer terminal system 200, for example, in the memory of the computer terminal system 200; the mapping bitmap is used to indicate whether the data of the local storage device has been transferred and stored.
  • step S1030 If the synchronization operation of step S1020 fails, a Bitmap is established on the secure storage device 10 and initialized, and then synchronized to the computer terminal system 200.
  • the Bitmap on the computer terminal system 200 is referred to as a mapping bitmap or a first mapping bitmap, and the secure storage device is used.
  • the Bitmap on 10 is referred to as a second mapping bitmap (step S1030 can be summarized as first establishing a second mapping bitmap and initializing, and then synchronizing to the computer terminal system 200 as a first mapping bitmap).
  • step S1020 if the operation of synchronizing the second mapping bitmap from the storage device 10 to the current computer terminal system 200 fails, it is indicated that the first connection is between the storage device 10 and the computer terminal system 200.
  • the step S1030 may include: mapping the local storage space in the computer terminal system 200 to the storage device 10, and the mapping method/relationship is a one-to-one mapping in units of 1 sector (or other stored basic units), and establishing Map bitmaps (Bitmap).
  • Bitmaps on the local storage space to the storage device 100 may also be established using other base capacity units. For Bitmap, the following will be described in detail with reference to the accompanying drawings.
  • FIG. 17 is a schematic diagram of a Bitmap in an embodiment of the present invention.
  • the map includes local storage A storage medium 3000 on a storage device (such as the hard disk 2062 in FIG. 15), a storage medium 4000 on the storage device 10 connected to the local storage device through a network.
  • a storage space 4010 having the same size as the storage medium 3000 is created on the storage medium 4000 as a one-to-one mapping space.
  • the Bitmap 4020 is stored in the storage space 4010.
  • the Bitmap 4020 is a bitmap, wherein 1 bit represents 1 sector, and the data (0 or 1) of each bit identifies/indicates whether a sector on the storage medium 3000 has been dumped to
  • the storage space 4010 on the storage medium 4000 so the mapping bitmap can also be referred to as a dump table.
  • the Bitmap 4020 on the storage device 10 is synchronized to the computer terminal system 200 after the establishment is completed.
  • Bitmap 4020 the sectors that have been dumped are labeled 1 and the sectors that are not dumped are not marked; in other embodiments, the labels used by the dump and non-dump sectors are freely selectable.
  • an application or operating system saves a piece of data (such as a file)
  • the file system inside the operating system will open a certain amount of storage space on the storage medium 3000 of the local storage device, such as sector 3040 and sector 3050, and assign it to The file is used and the local file allocation table is overwritten.
  • sectors 4040 and 4050 are allocated at the same location on storage medium 4000, and dump data is stored therein. And the bit data corresponding to the sector 3040 and the sector 3050 in the Bitmap 4020 is changed to 1.
  • the data writing process S2000 further includes:
  • the application layer 202 issues a write file operation request through the file system of the operating system kernel layer 203, or the operating system kernel layer 203 directly issues a write file operation request; or
  • the application layer 202 directly issues a write data operation request to the hardware mapping layer 204, or the operating system kernel layer 203 directly issues a write data operation request to the hardware mapping layer 204;
  • the operating system kernel layer 203 parses the write file request into a hardware port instruction (ie, a hardware instruction), and sends it to the hardware mapping layer 204, where the port instruction includes a write location (eg, a sector);
  • step S2010 is to directly issue a write data operation request to the hardware mapping layer 204, the request is already a hardware port instruction;
  • the security layer 205 receives the hardware port instruction from the hardware mapping layer 204, and rewrites the write location (ie, the sector) in the port instruction to the corresponding storage address located on the storage device 10, and then updates the first mapping bitmap. For example, modifying the bit data corresponding to the sector to 1 indicates that the sector has been dumped; the security layer 205 sends the modified port command to the hardware layer 206.
  • the computer terminal system 200 does not store the written data, and the corresponding data has been relocated and stored on the secure storage device 10.
  • the writing process S2000 may further include:
  • the first mapping bitmap is synchronized to the storage device 10 and saved as a second mapping bitmap, thereby ensuring that the first mapping bitmap on the computer terminal system 200 is consistent with the second mapping bitmap on the storage device in real time.
  • the S2040 may also be uniformly performed before the local computer terminal system 200 is shut down.
  • the data reading process S3000 further includes:
  • the application layer 202 issues a read file operation request through the file system of the operating system kernel layer 203, or the operating system kernel layer 203 directly issues a read file operation request; or
  • the application layer 202 issues a read data operation request directly to the hardware mapping layer 204, or the operating system kernel layer 203 issues a read data operation request directly to the hardware mapping layer 204;
  • the operating system kernel layer 203 parses the read file request into a hardware port instruction, and sends it to the hardware mapping layer 204, where the port instruction includes a read address (for example, a sector);
  • the security layer 205 receives the data read instruction from the hardware mapping layer 204, obtains the read address (source address) therein, and searches for the first mapping bitmap, if the bit data in the first mapping bitmap indicates the reading The address is the dump address (data has been dumped), the security layer 205 modifies the read address of the port instruction to the address on the storage device 10; the security layer 205 sends the modified port command to the hardware layer 206.
  • An advantage of this embodiment is that the above-described reading process does not affect the existing operating mode of the user, and the reading of the data that has been dumped on the secure storage device (ie, the storage device 10) is realized.
  • step S3010 the process of synchronizing the second mapping bitmap from the storage device 10 to the local is to maintain the consistency of the local data with the data on the secure storage device after the computer terminal system 200 is restarted.
  • a data security storage method is provided; as shown in FIG. 18, the method includes the following steps:
  • S4040 sends the modified storage instruction to the hardware layer.
  • the hardware instructions are hardware instructions from a hardware mapping layer.
  • Receiving hardware instructions from the hardware mapping layer can 100% screen all hardware instructions (interface instructions) sent to the processor such as the CPU.
  • the computer can run the Windows operating system, and the hardware abstraction layer HAL in the Windows system is the hardware mapping layer 204 in FIG.
  • the computer terminal can also run other operating systems, such as Linux, Unix or embedded operating systems, etc., and the hardware mapping layer is a corresponding layer in Linux, Unix or other embedded operating systems.
  • the process of receiving the hardware instruction may include acquiring the hardware instruction by using a runtime instruction recombination method (for example, S101-S105).
  • a runtime instruction recombination method for example, S101-S105.
  • a store instruction a similar method such as S404, S504 or S604 when the runtime instruction reassembly method obtains a machine instruction.
  • the runtime instruction reorganization method not only can the final result of the calculation be relocated to the secure storage device, but also the intermediate process of the calculation (including the intermediate process generated by the operating system) can be relocated to the secure storage device; in this way
  • the terminal computing device is incomplete, and the information leakage prevention is further achieved by making the terminal computing device incomplete.
  • the hardware instructions may be of the X86 instruction, the ARM instruction, the MIPS instruction, etc.
  • the built-in analysis mechanism of the terminal computing device may be used to process different types of CPU instructions.
  • the method may further include:
  • S4050 Update the first mapping bitmap, set a corresponding “bit” of the target address (sector) in the first mapping bitmap to a dump flag, for example “1”; and synchronize the updated mapping bitmap to The secure storage device is saved as a second mapping bitmap.
  • the dump operation is completely transparent to the upper layer application and the user, and does not affect the workflow of the existing computer operation and the application system.
  • the foregoing method provided in this embodiment can be used not only in a computer terminal system, but also in any computing device and an intelligent terminal including an application layer, an operating system kernel layer, and a hardware layer, and real-time implementation of instruction level storage relocation/redirection. (ie storage relocation/redirection based on hardware storage instructions).
  • a data security reading method is provided; referring to FIG. 19, the method S5000 includes:
  • S5030 if it is a read instruction, acquires a source address (read address) in the read instruction, searches for a first mapped bitmap, and modifies a read address in the read instruction according to data of the mapped bitmap, thereby implementing a dump Reading of data and non-dump data; and
  • the method may further include: synchronizing the second mapping bitmap on the storage device to the computer terminal system 200, Save as the first map bitmap.
  • the hardware instructions are from a hardware mapping layer.
  • the process of receiving the hardware instruction may include acquiring the hardware instruction by using a runtime instruction recombination method (for example, S101-S105). To put it another way, it is possible to process a read instruction when the runtime instruction reorganizes the method to get the machine instruction.
  • a runtime instruction recombination method for example, S101-S105.
  • step S5020 if the hardware instruction is not a read instruction, the hardware instruction may be directly sent to the hardware layer for execution.
  • step S5030 can be further decomposed into:
  • S5031 if it is a read command, obtain a source address in the read command, and determine whether the source address is an address on the storage device;
  • step S5031 if the source address of the read command is already an address on the storage device, the computing device (for example, the security layer 205 in FIG. 15) does not need to look up the data in the first mapped bitmap again, and may directly Send hardware instructions to the hardware layer for execution.
  • the computing device for example, the security layer 205 in FIG. 15
  • secure storage device 10 may serve as a shared resource for a plurality of terminal systems.
  • a data secure access method is provided. As shown in FIG. 20, the method S6000 includes:
  • the target address is read from the first storage location, and the machine instruction segment to be scheduled/executed is obtained according to the target address.
  • the last instruction of the machine instruction segment to be scheduled is the first program transfer instruction (for example, the first jump instruction) );
  • modifying a target address in the storage instruction to a storage address on a corresponding storage device ie, a secure storage device
  • For the read instruction acquiring the source address in the read instruction, searching for the first mapping bitmap, and modifying the read address in the read instruction according to the data of the mapped bitmap;
  • the local hard disk command itself is different from the write network hard disk command, or the local hard disk command itself is different from the read network hard disk command, then not only the address needs to be modified, but also the storage instruction or the read command needs to be modified accordingly;
  • S6016 Restore the instruction running environment, and jump to the second address to continue execution.
  • Storage and reading are generally data exchanges for local storage devices; Generally refers to the exchange of data through network devices.
  • a data security transmission method including:
  • S7040 determining whether the target address is a secure address
  • the hardware layer sends a transmission instruction and data to a terminal system of the target address
  • the terminal system of the target address receives and utilizes the data secure storage method (described in the above embodiment) to save the data.
  • step S7040 a method of determining whether the target address is a secure address is as follows.
  • the security server 820 is connected to the terminal system 800, 810 through a network.
  • the terminal system 800, 810 has performed a registration operation to the security server 820 when deploying the data security transmission method provided in the above embodiment of the present invention.
  • the security server 820 internally maintains a secure address table that records all terminal systems that have been registered.
  • the security server 820 automatically sends the updated security address table to each terminal.
  • the architecture of the terminal system 800 includes an application layer 801, an operating system kernel layer 802, a security layer 803, and a hardware layer 804, and a security layer. 803 is responsible for maintaining the secure address table.
  • the security layer 803 will determine whether the target address is a secure address based on whether the target address is in the secure address table. That is, in step S7040, if the target address is included in the secure address Table, the target address is a secure address.
  • the implementation of the above secure transmission method enables Trojans or malicious tools to transmit the acquired information even if the confidential information is obtained.
  • any electronic device capable of providing file or data editing, saving or transmission such as a handheld device, an intelligent terminal, etc., may become the application of the present invention.
  • a carrier for providing data security access and transmission methods may become the application of the present invention.
  • Data security access device including storage and reading devices
  • a data security storage device is provided.
  • a data security storage device refers to: a device that implements a data security storage method in hardware form; and (2) a secure storage device refers to: used to dump information or data. Storage entities, such as disks.
  • the data security storage device 7100 includes: a receiving unit 7110, an instruction analyzing unit 7120, an instruction modifying unit 7130, and a sending unit 7140.
  • the receiving unit 7110 is coupled to the command analyzing unit 7120
  • the command analyzing unit is 7120 is coupled to the instruction modification unit 7130 and the transmission unit 7140, respectively
  • the transmission unit 7140 is also coupled to the instruction modification unit 7130.
  • the receiving unit 7110 is adapted to receive a hardware instruction, where the hardware instruction may come from a hardware mapping layer;
  • the instruction analysis unit 7120 is adapted to analyze the hardware instruction and determine whether the hardware instruction is a store instruction: if it is a store instruction, the instruction analysis unit 7120 is further adapted to send it to the instruction modification unit 7130, if not the store instruction, the instruction analysis Unit 7120 is further adapted to send it to the transmitting unit 7140;
  • the instruction modification unit 7130 is adapted to modify the target address in the storage instruction to be a corresponding storage address on the secure storage device, and then send the modified storage instruction to the sending unit 7140;
  • Transmitting unit 7140 is adapted to forward the received instructions to hardware layer 7200.
  • the data secure storage device may further include:
  • the updating unit 7150 and the synchronization unit 7160 are coupled to the instruction modification unit 7130, and the synchronization unit 7160 is coupled to the update unit 7150.
  • the update unit 7150 is adapted to update the bit corresponding to the target address in the mapping bitmap after the instruction modification unit 7130 modifies the storage instruction.
  • the sector included in the storage instruction target address is set to "1" in the corresponding "bit" data in the first mapping bitmap, indicating that the sector has been dumped.
  • the synchronization unit 7160 is adapted to establish communication between the terminal computing device system (ie, the terminal computing device) and the secure storage device, and perform mapping mapping between the terminal computing device system and the secure storage device. Synchronize.
  • the synchronization unit 7160 establishes communication between the terminal computing device system and the secure storage device, and synchronizes the second mapping bitmap on the secure storage device to the terminal computing device system. , saved as the first map bitmap.
  • the synchronization unit 7160 is in the computer terminal system.
  • the local storage space is mapped to the secure storage device, and a first mapping bitmap and a second mapping bitmap are established.
  • the second mapping bitmap is first established on the secure storage device, and then synchronized to the local, and saved as the first mapping bitmap.
  • mapping bitmap When the update unit 7150 updates the bit corresponding to the target address in the first mapping bitmap (ie, mapping bitmap), the synchronization unit 7160 will send the updated first mapping bitmap to the secure storage device, and on the secure storage device. Saved as a second map bitmap.
  • the location of the secure storage device is not limited and may be a remote storage device or a local storage device.
  • the remote storage device may serve only one computing device or may be shared by multiple computing devices.
  • the hardware instructions may be hardware port I/O instructions.
  • the data security reading apparatus 8100 includes:
  • Unit 8130 is also coupled to transmitting unit 8140.
  • the transmitting unit 8140 is coupled to the hardware layer 8200.
  • the receiving unit 8110 is adapted to receive a hardware instruction.
  • the hardware instruction is from a hardware mapping layer.
  • the instruction analyzing unit 8120 is adapted to analyze the hardware instruction and determine whether the hardware instruction is a read instruction. If the hardware instruction is a read instruction, obtain a source address of the read instruction and determine whether the source address is The address on the secure storage device.
  • the instruction analysis unit 8120 transmits the hardware instruction to the transmitting unit 8140.
  • the instruction modification unit 8130 looks up the mapped bitmap and modifies the read location in the read command according to the data of the mapped bitmap. site.
  • the map bitmap is also used to indicate whether the data of the local storage address is dumped to the secure storage device in the embodiment, and is not described here.
  • the instruction modification unit 8130 looks up the bit corresponding to the sector contained in the source address in the first mapped bitmap. If the "bit" data is displayed as 1, it means that a dump has occurred. If the "bit" data is displayed as 0 or NULL, it means that no dump has occurred. If the dump has occurred, the instruction modification unit 8130 changes the source address (read address) to the corresponding dump address, and transmits the modified hardware instruction to the transmitting unit 8140.
  • the data security reading device may further include a synchronization unit 8150 coupled to the instruction modification unit 8130.
  • the synchronization unit 8150 is adapted to establish communication between the terminal computing device system and the secure storage device and to synchronize the mapping bitmap between the terminal computing device system and the secure storage device. Specifically, the synchronization unit 8150 establishes communication between the terminal computing device system and the secure storage device when the terminal computing device system is started, and synchronizes the second mapping bitmap on the secure storage device to the terminal computing device system. , saved as a first mapping bitmap, provided by the instruction modification unit 8130.
  • the secure storage device may be a remote storage device, and the remote storage device may be shared by multiple terminal computing device systems. In other embodiments of the present invention, the secure storage device may also be a local storage device.
  • the data security reading device and the data security storage device may be combined into one device, wherein the instruction analyzing unit and the instruction modifying unit can process both the storage instruction and the read instruction, and the following examples are described in detail. .
  • a data secure storage and reading device As shown in FIG. 25, the data secure storage and reading device (referred to as data security access device) 9100 includes:
  • An instruction execution environment cache and recovery unit 9101 is adapted to cache and restore the instruction execution environment
  • the instruction obtaining unit 9102 is adapted to acquire an instruction address to be executed next, the address is a first address, and is further adapted to acquire a machine instruction segment to be scheduled/executed according to the first address; wherein, the last part of the machine instruction segment to be scheduled An instruction is a first program transfer instruction; a specific manner of obtaining a machine instruction fragment to be scheduled has been described in detail in the foregoing embodiments, and details are not described herein again;
  • the instruction retrieval unit 9104 is adapted to use the first address to find an address correspondence table:
  • the instruction retrieval unit 9104 is adapted to invoke the instruction execution environment cache and recovery unit 9101 to restore the cached instruction execution environment, and jump to the found corresponding address to continue execution (this reorganization is completed);
  • the instruction reorganization unit 9103 is called to perform the reorganization operation.
  • the address correspondence table is used to indicate whether the to-be-scheduled instruction segment pointed to by the first address has a saved reassembly instruction fragment, and the data of the address correspondence table may be an address pair.
  • the instruction reorganization unit 9103 further includes:
  • the instruction parsing unit 9111 is an organic combination of the above-mentioned instruction analyzing unit 7120 and the command analyzing unit 8120, and is adapted to analyze the hardware instruction and determine whether each hardware instruction in the machine instruction segment to be scheduled/executed is stored or read. Take instruction
  • the instruction modification unit 9112 if the instruction parsing unit 9111 finds a store or read instruction, the instruction modification unit 9112 is adapted to:
  • For the read instruction look up the mapped bitmap, and modify the read address in the read instruction according to the indication data of the mapped bitmap;
  • the updating unit 9113 is adapted to: after the instruction modifying unit 9112 modifies the storage instruction, update a bit corresponding to the target address in the mapping bitmap to reflect that the local data has been dumped;
  • the synchronization unit 9114 is adapted to establish communication between the terminal computing device system and the secure storage device, and synchronize the mapping bitmap between the terminal computing device system and the secure storage device.
  • the instruction recombining unit 9103 is adapted to replace the first program branch instruction as a push instruction, and the first program branch instruction in the push instruction Address and operand; further adapted to add a second program branch instruction after the push instruction to generate a reassembly instruction fragment having a second address; the second program branch instruction points to an entry address of the device 9100; The second address of the instruction fragment and the first address establish a record in the address correspondence table.
  • the instruction recombining unit 9103 and the instruction parsing unit 9111, the instruction modifying unit 9112, the updating unit 9113, and the synchronizing unit 9114 are juxtaposed units of the same hierarchy, and their functions are not described again.
  • the instruction reassembly unit 9103 obtains the reassembly instruction fragment, it is further adapted to invoke the instruction execution environment cache and recovery unit 9101 to restore the cached instruction execution environment, and jump to the address of the reassembly instruction fragment to continue execution (reorganization operation is completed).
  • the embodiment is only for the sake of illustration, and does not limit the manner in which the data security reading device, the data security storage device, and the instruction reorganization device are combined, and the various data security reading devices and data security storage described above are described.
  • the device and instruction reassembly devices can be combined in a variety of desired ways.
  • the above-mentioned secure storage method and device can also be combined with cloud technology to ensure the security of data in the cloud, thereby accelerating the application and popularization of cloud computing. Specific embodiments will be described below.
  • the data security storage method realizes the instruction-level data dumping, that is, the data dumping. Based on this, the data security storage method of the terminal computing device system full-running cycle is realized. On the one hand, even the Trojan or malicious tool is obtained.
  • the confidential information can not save the obtained information, so that the data always exists within the controllable security scope; on the other hand, the local data is no longer stored in the confidential state, thus preventing the active leakage of the secret person and Passive leak
  • the data security reading method and the data security storage method make the data always exist within the controllable security range, and ensure that the dump data can be read out after the data is safely stored (dumped); since the local will not be saved again Any data in a state of confidentiality, thus preventing the active disclosure and passive disclosure of secret persons;
  • the secure storage device When the secure storage device is a remote storage device, it can be shared by multiple terminals to improve the space usage efficiency of the secure storage device.
  • Data black hole system refers to a system that stores process data and operation results during the operation of a computing device to a specific storage location and can ensure the normal operation of the computing device;
  • the data black hole system undermines the integrity of the computing device and, by breaking the integrity of the computing device, implements a data security system that does not compromise data even when malicious code or secret persons have the highest data privileges.
  • Data black hole terminal refers to a computing device (such as a computer terminal) that deploys a data black hole system.
  • the data black hole terminal transfers the process data and the result data generated during the operation to a specific storage location.
  • Black hole storage area defined below.
  • a process A10 for improving data security including:
  • A11 Create a data black hole space for the user, including two modes (any one can be performed):
  • the data black hole terminal creates a data storage area on the local data storage device, where the data storage area is a target area for terminal data redirection, and the data storage area is called a black hole storage area;
  • the corresponding relationship between the data storage area and the user may be that one data storage area corresponds to multiple local (or local) users, or multiple storage areas correspond to multiple local (or local) users;
  • the data storage area can only be accessed by the data black hole system and cannot be accessed by the operating system or application layer (such as application software) of the terminal computing device;
  • A112 network deployment mode a data storage area is created in a storage location on the network, and the data storage area is a target area for terminal data redirection;
  • the correspondence between the data storage area and the users on the network terminal may be a one-to-one correspondence; the storage area may also correspond to a local (or local) user.
  • black hole space a data black hole space (referred to as black hole space) is established for the user.
  • the data black hole terminal When the terminal user logs in to the data black hole terminal for the first time, the data black hole terminal will establish a corresponding data black hole data storage area according to the user information.
  • A13 Redirecting all data persistence operations of the terminal computing device.
  • the data black hole terminal determines that the data black hole storage area exists and can establish a correspondence between the user and the black hole storage area, and the user is all on the local (data black hole terminal). The data write will be redirected to the datastore.
  • the black hole space corresponds to the user.
  • the hacker obtains the data permission through the malicious code such as the vulnerability, the back door, the Trojan, and the like, the data can be copied, dumped, sent, and intercepted.
  • all data forwarded to external devices, ports, users, and terminals will be redirected to the data black hole space (the black hole space corresponding to the user) and completed in the data black hole space (the black hole space corresponding to the user). Therefore, all data stealing, interception, output and other operations are implemented in the data black hole space.
  • a confidential (with data permission) person attempts to privately store data, privately back up, send, and output, all data processing operations are completed in the data black hole space (black space corresponding to the user), so that malicious operations cannot be compromised.
  • the computing device capable of executing the above process A10 is referred to as a data black hole server, and the data black hole server passes through the network and the computing terminal 1 (shown as terminal 1 in the figure) and computing terminal 2 (Fig. The data connection/coupling shown in terminal 2), ..., computing terminal N (shown as terminal N in the figure).
  • Data black hole server Each terminal deploys a data black hole system, so that each terminal becomes a data black hole terminal (shown as data black hole terminal 1, data black hole terminal 2, ..., data black hole terminal N).
  • the black hole storage area (shown as mapping block 1, mapping block 2, ..., mapping block N) is located on the data black hole server (or the disk array server to which the server is connected).
  • the data black hole space includes the black hole storage area of the data black hole server and the memory of each data black hole terminal, so that the calculation process data and the result data of the data black hole terminal are stored in the black hole storage area.
  • the data black hole system undermines the integrity of the computing device and, by breaking the integrity of the computing device, implements a data security system that does not compromise data even when malicious code or secret persons have the highest data privileges.
  • a data black hole processing method S90 is provided. As shown in FIG. 28, the method includes:
  • black hole storage area Open a data storage area (called black hole storage area) and local memory in a storage location of the network
  • the user of the computing device is associated with the data black hole space or a part of the data black hole space, for example, when the user logs in the data black hole terminal, the terminal user forms a one-to-one correspondence with the data black hole space;
  • the data black hole terminal redirects the “data write” generated by the user operation to the data black hole space corresponding to the user, for example, redirects to the black hole storage area corresponding to the user;
  • steps S91 and S92 - deploying a black hole system on a computing device and establishing a data black hole space for a user can be accomplished in one step.
  • step S93 may be performed only when the user logs in to the black hole terminal for the first time, or may be performed each time the user logs in to the black hole terminal.
  • step S93 and step S94 can be completed in one step, namely:
  • the “data write” of the user is all redirected to the data black hole space corresponding to the user according to a preset corresponding manner.
  • the preset corresponding manner may include a fixed correspondence. For example, each user corresponds to a certain capacity storage space in the black hole space.
  • the preset corresponding manner may include dynamic correspondence. For example, each user first corresponds to a preset capacity storage space in the black hole space, and if the user stores data exceeding the preset capacity, the user is allocated a larger (for example, a preset capacity). 2, 4 or 8 times, etc.) storage space.
  • a preset capacity for example, a preset capacity. 2, 4 or 8 times, etc.
  • the data black hole terminal determines that the data black hole storage area exists and can establish a correspondence relationship between the user and the black hole storage area, the user is in the local (data). All data writes on the black hole terminal will be redirected to the data store. Also, all data reads will be based on the version of the data or the user's own choice to read the bank data or local (or local) data.
  • a data security reading method S80 including:
  • the data security reading device in this embodiment can be adaptively modified.
  • the instruction modification unit 8130 in the data security reading device 8100 is modified to be further adapted to perform the operation of S83, and other units can refer to the data security read.
  • the device 8100 is taken, and details are not described herein.
  • the data black hole processing method executed by the computing device is a stand-alone data black hole processing method.
  • the computing device 70 includes: an application layer (or a unit corresponding to the application layer) 71, an operating system kernel layer (or a unit corresponding to the operating system kernel layer) 72, a hardware mapping layer (or a unit corresponding to the hardware mapping layer). 73) security layer (or security layer) Corresponding units 74, these levels or units correspond to the user interface layer 201, the application layer 202, the operating system kernel layer 203, the hardware mapping layer 204, the security layer 205, and the hardware layer 206 included in the computing device 200 of the previous embodiment. ,No longer.
  • Mobile computing device 70 also includes a hardware layer 75.
  • the hardware layer 75 includes devices or units as follows: CPU, network card, and hard disk 75a.
  • the hard disk 75a includes a normal storage area and a secure storage area 75a1.
  • the secure storage area 75a1 may also be an encrypted storage area, and the data needs to be encrypted and decrypted before or after data access.
  • the above data security reading method for example, S5000
  • storage method for example, S4000
  • the above method becomes a stand-alone version of data security storage and reading method;
  • the independent computing device for example, PC
  • stand-alone data security storage methods include:
  • the hardware instruction is a store instruction, modifying a target address in the store instruction to a corresponding storage address of a secure storage space on the computing device;
  • the modified storage instruction is sent to the hardware layer for execution.
  • the stand-alone version of the data security reading method includes:
  • the hardware instruction is a read instruction, acquire a source address in the read instruction, look up a first mapping bitmap, and modify a read address in the read instruction according to data of the mapped bitmap;
  • the unneeded units can be deleted as needed, and can be a stand-alone data secure storage and reading device.
  • the computing device includes: a separate local storage space 87 and a secure storage space 88, and a stand-alone data security storage and reading device 80; wherein the secure storage space is for the operating system Not available (eg, invisible or inaccessible), accessible only by the stand-alone data security storage and reading device 80;
  • the stand-alone data security storage and reading device 80 includes:
  • the receiving unit 81 is adapted to receive a hardware instruction
  • the instruction analyzing unit 82 is adapted to determine whether the hardware instruction is a storage or reading instruction, and generate a determination signal;
  • the instruction modification unit 83 is adapted to modify the target address in the storage instruction to a corresponding storage address in the secure storage space when the hardware instruction is a storage instruction; and is further adapted to be when the hardware instruction is a read At the time of instruction, looking up the mapping bitmap, and modifying the read address in the read instruction according to the data of the mapping bitmap; the mapping bitmap is used to indicate whether the data of the address of the local storage space is dumped to the secure storage Space, mapping bitmap has been described in detail in the foregoing embodiment, and will not be described again here;
  • the sending unit 84 is adapted to send the modified read or store instruction to the hardware layer for execution.
  • the above computing device may further include an updating unit 85 adapted to update the bit corresponding to the target address in the mapping bitmap after the instruction modifying unit 83 modifies the storage instruction.
  • the computing device may further include an encryption and decryption unit 86 adapted to encrypt and decrypt data entering and leaving the secure storage space 88.
  • a method for processing a black hole of a stand-alone data includes:
  • Sa1 deploying a data black hole system in a computing device (such as a computer, a handheld communication device, a smart terminal, etc.) to become a data black hole terminal;
  • a computing device such as a computer, a handheld communication device, a smart terminal, etc.
  • Sa2 the establishment of data black hole space, including: opening a data storage area (called black hole storage area) and local memory locally in the computing device, wherein the data storage area can only be accessed by the data black hole system, and cannot be operated by the terminal computing device operating system. Or application layer access;
  • the user of the computing device is associated with the data black hole space or a part of the data black hole space. For example, when the user logs in the data black hole terminal, the terminal user forms a one-to-one correspondence with the data black hole space;
  • the data black hole terminal redirects the “data write” generated by the user operation to the data black hole space corresponding to the user and encrypts, for example, redirects to the black hole storage area corresponding to the user;
  • Sa5 prevents data persistence operations on local storage devices (except black hole storage area), and prevents data output from non-data black hole terminals through local ports, thereby ensuring that data entering data black hole terminals or data black hole spaces is only in data black holes. Exist in space.
  • Sa1 represents step 1.
  • the mobile storage device When a thief is operating a mobile computing device (such as a laptop or tablet), if it is not convenient to connect to a remote secure storage device (used as a black hole storage area), the mobile storage device can be used as a secure storage device. Transform the security of computing devices, including mobile computing devices, into the security of mobile storage devices.
  • the designated mobile storage device can be used as a carrier for the confidential data, that is, the mobile storage device is used as a temporary secure storage device.
  • the mobile computing device 20 in the figure includes a user interface layer 21, an application layer 22, an operating system kernel layer 23, a hardware mapping layer 24, a security layer 25, and a hardware layer 26, and a user interface layer 201 included in the computing device 200 of the previous embodiment.
  • the application layer 202, the operating system kernel layer 203, the hardware mapping layer 204, the security layer 205, and the hardware layer 206 correspond to each other and will not be described again.
  • the data security reading and storage method provided in the above embodiments of the present invention can be integrated with a secure storage device in a mobile storage device and used as a portable device.
  • a mobile storage device ie, a mobile storage device 50 is provided, including: an application layer (or a unit corresponding to an application layer) 52, an operating system kernel layer (or an operating system). A unit corresponding to the kernel layer) 53, a hardware mapping layer (or a unit corresponding to the hardware mapping layer) 54, and a security layer (or a unit corresponding to the security layer) 55. These levels or units correspond to the user interface layer 201, the application layer 202, the operating system kernel layer 203, the hardware mapping layer 204, the security layer 205, and the hardware layer 206 included in the computing device 200 of the previous embodiment, and are not described again.
  • the mobile storage device 50 further includes a hardware layer (or a unit corresponding to the hardware layer) 56 including a data interface 56a and a secure storage area 56b.
  • the data interface 56a is used to connect other computing devices (via corresponding data interfaces), and the secure storage area 56b is used as a secure storage device (or as a black hole storage area) in the data secure storage and reading method.
  • the computing terminal 40 includes an application layer (or a unit corresponding to the application layer) 41, an operating system kernel layer (or a unit corresponding to the operating system kernel layer) 42, a hardware mapping layer (or a unit corresponding to the hardware mapping layer) 43, and a hardware layer ( Or the corresponding unit of the hardware layer) 44.
  • the hardware layer 44 includes hardware units such as a CPU 44a, a hard disk 44b, a network card 44c, and a data interface 44d (for example, a USB interface).
  • the data interface 56a is coupled/connected with the data interface 44d.
  • the secure storage area 56b is not available to the operating system on the removable storage device 50.
  • the mobile storage device 50 is connected to the computing terminal 40 through a data interface, and uses the computing resources of the computing terminal 40 to complete the operation of the mobile storage device itself system (including layers 52-55), and the data is stored in the secure storage area 56b.
  • the process of data storage performed by the mobile storage device 50 includes:
  • Step A1 The mobile storage device 50 is coupled to the computing terminal 40 through the data interfaces 56a and 44d;
  • Step A2 The computing terminal 40 is restarted, and the CPU 44a of the computing terminal 40 runs the system (including the application software and system software corresponding to the layers 52-55) carried by the mobile storage device 50;
  • Step A3 The user operates the system carried by the mobile storage device 50 by calculating the I/O (input and output device, such as the keyboard 44b) of the terminal 40;
  • Step A4 the security layer 55 receives the hardware instructions from the hardware mapping layer 54;
  • Step A5 If the hardware instruction is a store or read instruction, the security layer 55 modifies the target address in the storage instruction or the source address in the read instruction to correspond to the secure storage area 56b on the mobile storage device. Storage address in; and
  • Step A6 the modified storage instruction is sent to the CPU 44a of the computing terminal 40.
  • the data transfer storage process performed by the security layer 55 is the same as the data security storage and reading method provided in the previous embodiment, and will not be described again.
  • the data security reading and storing method provided in the above embodiments of the present invention can be integrated with a secure storage device in a mobile computing device (such as a notebook computer or a smart phone) for use as a portable device.
  • a mobile computing device such as a notebook computer or a smart phone
  • the foregoing mobile computing device and the mobile storage device may be combined with the secure storage device and the secure reading device (for example, the device 7100, the device 8100, the device 9100, and the like) provided in the foregoing embodiments, and the unnecessary units are deleted to complete the secure storage of the mobile data. And the reading method.
  • the combination of the above-described mobile computing device and mobile storage device with the secure storage device and the secure reading device can be designed as needed.
  • a mobile computing device eg, a laptop or smartphone
  • the mobile computing device includes: separate local and secure storage spaces; and data secure storage and reading devices.
  • the secure storage space is not available to the operating system (eg, invisible or inaccessible).
  • the data security storage and reading device includes:
  • a receiving unit adapted to receive a hardware instruction
  • the instruction analyzing unit is adapted to determine whether the hardware instruction is a storage or reading instruction, and generate a determination signal
  • An instruction modification unit configured to: when the hardware instruction is a storage instruction, modify a target address in the storage instruction to a corresponding storage address in a secure storage space; and further, when the hardware instruction is a read instruction And searching for a bitmap, and modifying a read address in the read instruction according to data of the mapped bitmap; the mapping bitmap is used to indicate whether data of an address of the local storage space is dumped to the secure storage space ;
  • the sending unit is adapted to send the modified read or store instruction to the hardware layer for execution.
  • the hardware instructions come from the hardware mapping layer.
  • the mobile computing device further includes: an updating unit, configured to: after the instruction modifying unit modifies the storage instruction, update a bit corresponding to the target address in the mapping bitmap.
  • the above mobile computing device (such as a notebook) is used to protect the data security protection of the external application authorization of the personal or enterprise user data.
  • the system assumes that personal or business users have confidential data on their PCs and laptops, but because the system has backdoors, vulnerabilities, Trojans, or other unknown malicious code, there is no guarantee that the data on the PC/notebook will not be compromised, and the device cannot be guaranteed. Data security after loss. Enterprises can use the protection and monitoring of the data usage process when data is exported from the intranet.
  • the mobile computing device e.g., notebook
  • a standalone computer e.g., a PC
  • a mobile storage device eg, a USB flash drive
  • the mobile storage device includes: a data interface, a secure storage space, and a data secure storage and reading device; the data interface is adapted to be coupled to a computing device; the computing device includes a local storage space for An operating system on the mobile storage device is run and used to provide computing resources for the data secure storage and reading device.
  • Data security storage and reading devices include:
  • a receiving unit adapted to receive a hardware instruction
  • the instruction analyzing unit is adapted to determine whether the hardware instruction is a storage or reading instruction, and generate a determination signal
  • An instruction modification unit configured to: when the hardware instruction is a storage instruction, modify a target address in the storage instruction to a corresponding storage address in a secure storage space; and further, when the hardware instruction is a read instruction Finding a mapping bitmap, and modifying a read address in the read instruction according to data of the mapped bitmap; the mapping bitmap is used to indicate local storage Whether the data of the address of the storage space is dumped to the secure storage space; and
  • a transmitting unit adapted to send the modified read or store instruction to a hardware layer of the computing device for execution.
  • the mobile storage device further includes: an updating unit, configured to: after the instruction modifying unit modifies the storage instruction, update a bit corresponding to the target address in the mapping bitmap.
  • the hardware instructions may come from a hardware mapping layer.
  • the above-mentioned mobile storage device uses a U disk/mobile hardware disk on which a data secure storage and reading device (or data secure storage and reading method) is deployed as an export data carrier for protecting the security of the exported data.
  • the core is to ensure that data exported to the outside world does not leave traces of data during use in an uncontrolled environment, while ensuring that data is not in an environment with system backdoors, vulnerabilities, Trojans, or other unknown malicious code. Being copied or intercepted.
  • mapping bitmap is used to indicate whether data of the address of the local storage space is dumped to the secure storage space.
  • a form of a file correspondence table may also be used, that is, local data is transferred and stored in the secure storage space in the form of a file.
  • the invention may be embodied as a system, method or computer program product as would be appreciated by one of ordinary skill in the art. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, microcode, etc.) or a combination of software and hardware aspects, which may be collectively referred to herein as " Circuit, "module” or "system”.
  • the present invention can take the form of a computer program product embodied in any tangible medium that expresses a computer-usable program code.
  • the computer usable or computer readable medium can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium.
  • a more specific example (non-exhaustive list) of computer readable media would include the following: electrical connections with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read only memory (ROM), A rewritable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, such as those supporting the Internet or an intranet, or magnetic storage devices.
  • the computer usable or computer readable medium may even be paper or another suitable medium that can print the program, as the program can be electrically captured, then edited, translated, or otherwise, via optical scanning, for example, on paper or other media.
  • a computer-usable or computer-readable medium can be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
  • the computer usable medium can include a propagated data signal containing computer usable program code, which can be in baseband or can be part of a carrier.
  • Computer usable program code may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical cable, RF, and so forth.
  • Computer program code for carrying out operations of the present invention can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, Smalltalk, C++, etc., and such as "C" A traditional procedural language such as a programming language or a similar programming language.
  • the program code may execute entirely on the user's computer, partly on the user's computer as a stand-alone software package, partly on the user's computer and partly on the remote computer, or all on the remote computer or server.
  • the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN) or a connection that can be connected to an external computer (eg, by using an Internet service provider) Internet).
  • LAN local area network
  • WAN wide area network
  • Internet Internet service provider

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Human Computer Interaction (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Databases & Information Systems (AREA)
  • Automation & Control Theory (AREA)
  • Storage Device Security (AREA)
  • Memory System Of A Hierarchy Structure (AREA)
  • Executing Machine-Instructions (AREA)

Abstract

一种基于移动存储器的数据黑洞处理方法，包括：在计算设备部署数据黑洞系统，使之成为数据黑洞终端（S91）；数据黑洞系统是指将计算设备运行过程中的过程数据和运行结果存储至特定存储位置并且能够确保计算设备正常运行的系统；建立数据黑洞空间（S92），包括在所述移动存储器上开辟的数据存储区域；为计算设备的用户与数据黑洞空间或数据黑洞空间的一部分建立对应关系（S93）；将用户在数据黑洞终端操作所产生的数据写重定向到与该用户对应的数据黑洞空间（S94）；阻止对于本地存储设备的数据持久化操作，并且阻止通过本地端口对非数据黑洞终端的数据输出（S95）。另外还提供一种移动存储器。基于移动存储器的数据黑洞处理方法及移动存储器提高数据防泄密的数据安全性。

Description

基于移动存储器的数据黑洞处理方法及移动存储器
本申请要求2014年3月4日提交中国专利局、申请号为201410076582.1、发明名称为“基于移动存储器的数据黑洞处理方法及移动存储器”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及计算机安全领域，尤其涉及一种基于移动存储器的数据黑洞处理方法及移动存储器。
背景技术
现有的电子信息安全领域包括系统安全、数据安全和设备安全三个子领域。
在数据安全领域内，一般采用下面三种技术确保数据安全：
(1)数据内容安全技术，包括数据加密解密技术和端到端数据加密技术，保障数据在存储和传输过程中内容不被非法读取；
(2)数据安全转移技术，包括防止非法拷贝、打印或其它输出，保障数据在使用和转移过程中的安全；
(3)网络阻断技术，包括网络物理阻断和设置网络屏障等技术。
根据相关分析，目前针对计算机的所有危害总有效侦测能力最多在50％左右；由于上述技术在应对计算机内核病毒、木马、操作系统漏洞、系统后门以及人为泄密时能力不足，事实上任何计算设备(包括例如计算机、笔记本电脑、手持通信设备等)都可能存在恶意代码。
一旦恶意代码进入终端系统，上述的加密技术、防拷贝技术以及网络阻断技术都将失去作用。现有的黑客技术可以利用系统漏洞或系统后门穿透上述安全技术并植入恶意代码，并利用恶意代码取得用户数据。上述技术更无法防范涉密人员的主动或被动泄密，例如，内部 人员可以携带存储设备，从内部网络或终端上下载所需的资料并带走存储设备，导致内部泄密；又例如，内部人员可以直接将计算设备带走。
综上，防拷贝技术无法保证涉密信息在终端不被非法存储。基于网络过滤无法确保涉密信息不丢失。涉密人员可通过恶意代码或恶意工具造成泄密，还可能因涉密设备或存储介质失控造成泄密。
发明内容
本发明提供了一种基于移动存储器的数据黑洞处理方法及移动存储器，可以提高数据安全性。
根据本发明一个方面，提供一种基于移动存储器的数据黑洞处理方法，包括：在计算设备部署数据黑洞系统，使之成为数据黑洞终端；数据黑洞系统是指将计算设备运行过程中的过程数据和运行结果存储至特定存储位置并且能够确保计算设备正常运行的系统；建立数据黑洞空间，包括在所述移动存储器上开辟的数据存储区域，其中，该数据存储区只能由数据黑洞系统访问，不能被操作系统或应用层软件访问，所述移动存储器与计算设备耦接；为计算设备的用户与数据黑洞空间或数据黑洞空间的一部分建立对应关系；将用户在数据黑洞终端操作所产生的数据写重定向到与该用户对应的数据黑洞空间；阻止对于本地存储设备的数据持久化操作，并且阻止通过本地端口对非数据黑洞终端的数据输出，从而保证进入数据黑洞终端或者数据黑洞空间的数据只在数据黑洞空间存在。
根据本发明另一个方面，提供一种移动存储设备，包括：移动版数据安全存取单元以及安全存储空间，其中，移动存储设备本身携带操作系统，安全存储空间对于操作系统及操作系统之上的软件是不可用的，只能由移动版数据安全存取单元访问；其中，当移动存储设备 与计算设备耦接时，计算设备的CPU用于执行移动存储设备本身携带的操作系统，用户通过计算设备的I/O与移动存储设备进行交互，移动版数据安全存取单元接收来自移动存储设备本身携带的操作系统的指令并将其发送给计算设备的CPU；其中，移动版数据安全存取单元包括：接收单元，适于接收硬件指令；指令分析单元，适于判断所述硬件指令是否为存储或读取指令，产生判断信号；指令修改单元，根据判断信号，适于当所述硬件指令为存储指令时，将所述存储指令中的目标地址修改为对应的在安全存储空间内的存储地址；还适于当所述硬件指令为读取指令时，查找映射位图，并根据映射位图的数据修改所述读取指令中的读取地址，其中，所述映射位图用于表示计算设备的本地存储空间的地址的数据是否转储到所述安全存储空间；发送单元，适于将修改后的读取或存储指令发送到硬件层执行。
可选的，移动存储设备还包括：更新单元，适于在指令修改单元修改所述存储指令之后，更新映射位图中所述目标地址对应的位。
可选的，移动存储设备还包括：加解密单元，与所述安全存储空间耦接，适于对进出安全存储空间的数据进行加解密操作。
上述方法和设备提高了数据的安全性，黑洞空间与用户对应，当黑客通过漏洞、后门、木马等恶意代码取得数据权限后将可以对数据进行复制、转储、发送、截留。但所有向外部设备、端口、用户、终端转发出的数据将被重定向到数据黑洞空间(与用户对应的黑洞空间)中，并在数据黑洞空间(与用户对应的黑洞空间)内完成。因此所有的数据窃取、截留、输出等作业都被在数据黑洞空间内实现。当涉密(有数据权限)人员试图将数据私自留存、私自备份、发送、输出时，所有的数据处理作业都在数据黑洞空间(与用户对应的黑洞空间)内完成，使恶意操作无法泄密。
附图说明
图1是现有技术中计算设备的系统层次示意图；
图2是本发明一个实施例中提供的运行时指令重组方法的流程图；
图3是本发明一个实施例中提供的重组指令片段的生成过程示意图；
图4是本发明另一个实施例中提供的图2中步骤S102的流程图；
图5是本发明另一个实施例中提供的运行时指令重组方法的流程图，利用地址对应表保存已经重组过的指令片段；
图6是本发明另一个实施例中提供的运行时指令重组方法的流程图，单独开辟存储位置保存第一程序转移指令的目标地址；
图7是本发明另一个实施例中提供的运行时指令重组方法的流程图，针对非固定长度指令集进行反汇编和汇编处理；
图8是本发明另一个实施例中提供的运行时指令重组方法的流程图，以压栈指令替代或记录第一程序转移指令；
图9a是本发明另一个实施例中提供的运行时指令重组方法的流程图，其中的运行时指令重组方法综合之前多个实施例中的特征；
图9b-9d是图9a中的运行时指令重组方法在X86体系处理器上运行时的操作过程示意图；
图10是本发明一个实施例中提供的运行时指令重组装置结构示意图；
图11是本发明另一个实施例中提供的运行时指令重组装置结构示意图；
图12是本发明另一个实施例中提供的指令重组单元结构示意图；
图13是本发明另一个实施例中提供的运行时指令重组装置结构 示意图；
图14是本发明另一个实施例中提供的运行时指令重组装置结构示意图；
图15是本发明一个实施例中计算设备的系统层次示意图；
图16是本发明一个实施例中提供的数据安全存取过程中的初始化过程的流程图；
图17是本发明一个实施例中的Bitmap示意图；
图18是本发明一个实施例中提供的数据安全存储方法的流程图；
图19是本发明一个实施例中提供的数据安全读取方法的流程图；
图20是本发明一个实施例中提供的数据安全存取方法的流程图；
图21是本发明一个实施例中提供的数据安全传输方法的流程图；
图22是本发明一个实施例中网络环境示意图；
图23是本发明一个实施例中提供的数据安全存储装置的结构示意图；
图24是本发明一个实施例中提供的数据安全读取装置的结构示意图；
图25是本发明一个实施例中提供的数据安全存储和读取装置的结构示意图；
图26是本发明另一个实施例中提供的数据安全存储和读取装置的结构示意图；
图27是本发明另一个实施例中提供的数据黑洞空间示意图；
图28是本发明一个实施例中提供的数据黑洞处理方法的流程图；
图29a是本发明一个实施例中提供的计算设备的体系架构示意图，其中运行单机版的数据安全存储和读取方法；
图29b是本发明一个实施例中提供的单机版数据安全存储和读取装置的结构示意图；
图30是本发明一个实施例中提供的单机版数据黑洞处理方法；
图31是本发明一个实施例中提供的使用移动存储器进行安全存储的示意图；
图32是本发明一个实施例中提供的移动存储设备的层次结构示意图。
具体实施方式
为了使本发明的目的、技术方案及优点更加清楚明白，以下结合附图，对本发明进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。另外，在不冲突的前提下，本发明的实施例和实施例中技术特征可以相互结合。
分析
如图1所示为现有技术中计算设备的系统层次示意图，从上至下，计算设备包括：
用户界面层101，应用层102，操作系统内核层103，硬件映射层104以及硬件层105。
其中，用户界面层101是用户与设备之间的接口，用户通过该层与设备(即设备的其他层次，例如应用层102)进行交互。应用层102 指应用软件层。
操作系统内核层103是一种基于软件的逻辑层，一般来讲是由软件数据和软件代码组成，相比于界面层101和应用层102，操作系统内核层103的代码拥有更高的权限，可以对计算机系统中的各种软硬件资源进行完整的操作。
硬件映射层104是一种基于软件的逻辑层，它一般工作在操作系统内核层，拥有与内核层相同的权限。硬件映射层主要是为了解决将不同类型的硬件的操作模式映射为一种统一的上层接口，向上屏蔽硬件的特殊性。一般来说，硬件映射层主要被操作系统内核层103使用，来完成对各种硬件的操作。
硬件层105是指构成计算机系统的所有硬件部件。
对于上述计算设备的系统层次的工作过程，下面以保存数据的操作为例进行说明，包括：
(1)用户通过某应用程序提供的用户界面101，选择执行“保存”功能；
(2)应用层102调用对应代码，将上述用户操作转化为一个或多个操作系统提供的接口函数(例如，Microsoft 32位平台的应用程序编程接口，win32 API)，即将“保存”操作转化成为对一系列操作系统内核层103提供的接口函数的调用；
(3)操作系统内核层103将每一个操作系统接口函数转化为一个或多个硬件映射层104提供的接口函数；即将“保存”操作转化成为对一系列硬件映射层104提供的接口函数的调用；
(4)硬件映射层104将每一个自己提供的接口函数转化为一个或多个硬件指令调用；最后，
(5)硬件层105(例如CPU)接收上述硬件指令调用并执行硬件指令。
针对该计算设备，当其被恶意代码侵入后，恶意代码可以从计算设备中取得所需数据，窃取数据后其行为模式包括：
(1)存储行为：将目标数据内容保存到某个存储位置；
(2)传输行为：将窃取的数据直接通过网络传输到指定的目标地址。
另外，使用上述计算设备或信息设备的人员进行内部泄密的行为模式包括：
(1)主动泄密：涉密人员通过主动拷贝、通过恶意工具穿透安全系统、置入木马等手段直接取得涉密数据，并进行泄密；
(2)被动泄密：涉密人员使用的电脑或存储介质因保管不善丢失或使用不当(例如将涉密装备直接接入Internet)造成的泄密。
上述多种泄密方式使得该计算设备的数据安全无法保障。
发明人经研究发现，计算机运行过程中，一CPU地址寄存器用于保存下一条将要运行的机器指令的地址，例如pc(program counter，程序计数器)。获取该寄存器中的数据，并按照该数据指向的地址，读取下一条或者多条将要运行的机器指令，可以实现运行时捕获机器指令的目的。
并且，通过修改所述一条或多条机器指令所组成的待调度指令片段(例如在其中插入额外的程序转移指令，本文称为指令重组)，使得在该段指令运行完毕之前重新获得CPU执行权，并再次捕获下一个待调度指令片段，可以实现运行时连续捕获机器指令的目的。
并且，在获取到待调度指令片段后，还可以对其中的机器指令进行分析以及处理，从而不仅可以实现运行时指令捕获、重组，还可以 实现对预定的目标指令的管理。
指令重组或指令追踪
基于上述分析和发现，本发明的一个实施例中提供了一种运行时指令重组方法，该方法运行时称为指令重组平台。如图2所示，该方法S100包括：
S101，缓存指令运行环境；所述指令运行环境包括地址寄存器，地址寄存器保存下一条将要运行的机器指令的地址，该地址为第一地址；
S102，获取待调度的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令(例如第一跳转指令)；
S103，在所述第一程序转移指令前，插入第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址，即执行该第二程序转移指令后，执行步骤S101；
S104，将所述地址寄存器中的第一地址修改为第二地址；和
S105，恢复所述指令运行环境。
其中，在步骤S101中，所述缓存指令运行环境可以包括：
向缓存栈中压入CPU机器指令运行相关的寄存器数据。
在本发明的其他实施例中，缓存或保存指令运行环境也可以在指定的、默认的其他缓存数据结构和地址中进行。
在步骤S101中，所述地址寄存器为程序计数器即PC。
在步骤S102中，待调度的机器指令片段中只有一条程序转移指令，待调度的机器指令片段包括所述第一程序转移指令以及其之前的所有待调度的机器指令。
在步骤S103中，在所述待调度的机器指令片段的最后一条指令(即第一程序转移指令，简称JP1)前，插入第二程序转移指令(简称JP2)，所述JP2指向指令重组平台的入口地址，生成具有第二地址(该地址以A"表示)的重组指令片段。
插入第二程序转移指令是为了在CPU运行所述待调度的机器指令片段时，在JP1运行前，重新开始运行所述指令重组平台，这样，指令重组平台就可以继续分析下一段待调度的机器指令片段，从而通过重复本方法来完成对所有运行时指令的重组。
在步骤S105中，恢复所述指令运行环境可以包括：
从缓存栈中弹出指令运行相关的寄存器数据；其中地址寄存器保存的程序转移指令的目标地址已经修改为以第二地址A"为入口地址的新的机器指令片段。
步骤S105执行后，恢复了所述指令运行环境，指令重组平台完成一次运行，CPU执行所述重组指令片段，即CPU将执行以第二地址A"为入口地址的机器指令片段。重组指令片段执行到第二程序转移指令JP2时，所述指令重组平台重新得到CPU控制权(即执行步骤S101)，此时第一程序转移指令的目标地址已经得到，该目标地址为新的第一地址，继而重新执行步骤S101～步骤S105。
在本实施例中，上述运行时指令重组方法在X86架构的CPU上执行；在本发明的其他实施例中，上述运行时指令重组方法也可以在MIPS处理器或基于ARM架构的处理器上执行。本领域普通技术人员可以理解，上述方法可以在计算设备中的任何其他类型的指令处理单元上执行。
下面结合图3，进一步说明指令重组过程和重组指令片段的生成过程。
图3中包括待调度的机器指令集合401(例如已经载入内存中的 某程序的机器指令)，其中指令4012为第一程序转移指令，如果指令4012的目标地址为变量，则首先假设指令4012指向机器指令4013；从第一程序转移指令4012以前的包括第一程序转移指令4012的所有待调度的机器指令构成了机器指令片段4011(只包含一个程序转移指令)。
当指令重组方法运行后(成为指令重组平台411)，首先缓存指令运行环境；然后获取(例如拷贝)机器指令片段4011；指令重组平台在第一程序转移指令4012前插入了第二程序转移指令4113，第二程序转移指令4113指向指令重组平台411本身，从而生成了重组指令片段4111，重组指令片段的地址为A"；将所述缓存的指令运行环境中的地址寄存器的值A修改为地址A"；最后恢复所述指令运行环境。
指令重组平台411结束运行后，CPU执行以A"为地址的重组指令片段，当执行到第二程序转移指令4113时，指令重组平台411会重新获得CPU控制权。此时，第一程序转移指令4012的目标地址4013已经生成，该目标地址为新的第一地址，指令重组平台根据该目标地址重新开始执行步骤S101～步骤S105，继续分析后续的待调度的机器指令，从而完成了运行时指令重组的方法。
根据本发明另一个实施例，如图4所示，在步骤S102中，获取待调度的机器指令片段可以包括：
S1021，从地址寄存器(例如程序计数器)读取待调度的机器指令地址；
S1022，以程序转移指令(例如跳转指令)为检索目标，检索所述机器指令地址指向的机器指令及其后续指令，直到发现第一个程序转移指令(称为第一程序转移指令，例如第一跳转指令)；所述程序转移指令指能够改变机器指令顺序执行流程的机器指令，包括Jump 程序转移指令、Call调用指令、Return返回指令等；
S1023，将所述第一程序转移指令以及其之前的所有待调度的机器指令作为一个待调度的机器指令片段，将该机器指令片段保存在指令重组平台中，或其他指令重组平台能够读取的存储位置。
在本发明的其他实施例中，获取待调度的机器指令片段也可以以非程序转移指令(例如写入指令、读取指令等)为检索目标，进一步切分机器指令片段。由于在这样的实施例中，也需要保证在调度程序转移指令执行后指令重组平台仍能够获取CPU控制权或执行权，所以程序转移指令需要作为第二检索目标，从而得到粒度更小的机器指令片段。
根据本发明另一个实施例，在步骤S102和S103之间，所述运行时指令重组方法还可以包括：
利用指令集匹配所述待调度的机器指令片段，得到目标机器指令；所述指令集包括X86，MIPS和ARM指令集；和
按照预定的方式，修改所述目标机器指令。
不仅可以完成运行时指令监控，还可以进行其他处理过程，相关实施例将在后面详细介绍。
进一步的，为了提高指令重组方法的效率，可以将固定地址程序转移指令所指向的待调度指令在步骤S102中一并获取。
根据本发明另一个实施例，提供一种运行时指令重组方法，该方法S300包括：
S301，缓存指令运行环境；所述指令运行环境包括地址寄存器， 地址寄存器保存下一条将要运行的机器指令的地址，该地址为第一地址；
S302，获取待调度的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令，该程序转移指令为参数地址程序转移指令；
S303，在所述第一程序转移指令前，插入第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址，即执行该第二程序转移指令后，执行步骤S301；
S304，将所述地址寄存器中的第一地址修改为第二地址；
S305，恢复所述指令运行环境。
与之前的实施例中所提供的方法相比，区别在于：在步骤S302中，待调度的机器指令片段中可以包括多条程序转移指令；并且这些程序转移指令中只有一条参数地址程序转移指令，称为第一程序转移指令。
需要说明的是，程序转移指令可以包括两类，参数地址程序转移指令和常数地址程序转移指令，其中，常数地址程序转移指令的跳转地址为常数(即立即数)，而参数地址程序转移指令中的参数地址一般在程序转移指令之前的一条机器指令中计算得到。
相似地，待调度的机器指令片段的最后一条指令为第一程序转移指令；待调度的机器指令片段包括所述第一程序转移指令以及其之前的所有待调度的机器指令。
进一步的，由于程序运行过程中所生成的机器指令具有很高的重复性，为了提高指令重组方法的效率，节省计算设备的计算资源(例如CPU资源)，可以利用少量的存储空间来保存重组指令片段。
根据本发明另一个实施例，提供一种运行时指令重组方法。如图 5所示，该方法S200包括：
S201，缓存指令运行环境；所述指令运行环境包括地址寄存器(例如程序计数器)，地址寄存器保存下一条将要运行的机器指令的地址，该地址称为第一地址；一般来说，指令运行环境包括CPU的所有寄存器，包括通用寄存器、状态寄存器、地址寄存器等；
S202，利用第一地址查找地址对应表；所述地址对应表用于表示第一地址(例如地址A)指向的待调度指令片段是否具有已保存的重组指令片段，地址对应表的数据可以为地址对，也可以以其他形式存储相关数据；
S203，如果找到相应的记录，将所述第一地址A(即地址寄存器的值A)修改为已保存的重组指令片段的地址(例如地址A’)；
S204，如果没有找到相应的记录，获取待调度的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令(例如第一跳转指令)；
S205，在所述第一程序转移指令前，插入第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址，即执行该第二程序转移指令后，执行步骤S201；
S206，将所述地址寄存器中的第一地址修改为第二地址；
S207，恢复所述指令运行环境。
进一步的，步骤S206还包括：利用第二地址A"与第一地址A在所述地址对应表中建立地址对(或一条记录)。具有地址A"的重组指令片段被保存在重组指令平台中或重组指令平台能够访问的存储器中，以供重用。
本方法利用地址对应表，节省计算资源，提高运行时指令重组的效率。
上述重组方法一般通过在待调度指令片段之中插入所需程序转移指令完成，在本发明其他实施例中，也可以通过其他方式完成重组指令片段的生成。下面将结合实施例详细介绍。
根据本发明另一个实施例，提供一种指令重组方法，单独开辟存储位置保存第一程序转移指令的目标地址。如图6所示，该方法S110包括：
S111，缓存指令运行环境；
S112，从第一存储位置读取目标地址，根据目标地址获取待调度(即待执行)的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令(例如第一跳转指令)；
S113，在第一存储位置保存第一程序转移指令的目标地址；
S114，将第一程序转移指令替换为第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址，即执行该第二程序转移指令后，执行步骤S111；
S115，恢复所述指令运行环境，并跳转到第二地址继续执行。
其中，在步骤S112中，获取待调度的机器指令片段包括：
S1121、以程序转移指令为检索目标，检索所述机器指令地址指向的机器指令及其后续指令，直到发现第一个程序转移指令(称为第一程序转移指令)；
S1122、将所述第一程序转移指令以及其之前的所有待调度的机器指令作为一个待调度的机器指令片段，将该机器指令片段保存在指令重组平台中或其他指令重组平台能够读取的存储位置。
在步骤S113中，目标地址即程序转移指令的目标地址参数，其可以是立即数或变量参数，对于立即数保存其值，对于变量参数保存 其地址/引用。当处理器即将执行某程序转移指令时，其跳转目标地址已经计算完毕。
根据本发明另一个实施例，提供一种指令重组方法，针对非固定长度指令集进行反汇编和汇编处理。如图7所示，该方法包括：
S121，缓存指令运行环境；
S122，从第一存储位置读取目标地址，根据目标地址获取待调度指令片段，包括：
从目标地址开始，获取待调度的一段机器指令，将该段机器指令进行反汇编，并将反汇编结果通过一个词法分析器进行处理并匹配是否其中包含程序转移指令(例如跳转指令)，如果不包含则继续获取下一段待调度的机器指令重复上述操作，直到匹配到程序转移指令为止，该程序转移指令为第一程序转移指令；第一程序转移指令以及之前的所有指令组成待调度指令片段；
其中，第一存储位置用于保存下一条将要运行的机器指令的地址；
S123，在第一存储位置保存第一程序转移指令的目标地址；
S124，将第一程序转移指令替换为第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址；本实施例中，该第一程序转移指令和第二程序转移指令皆为汇编指令；
S125，将生成的重组后的汇编代码通过汇编器生成对应的机器码；和
S126，恢复所述指令运行环境，并跳转到第二地址继续执行。
根据本发明另一个实施例，提供一种指令重组方法，以压栈指令替代或记录第一程序转移指令。如图8所示，该方法S130包括：
S131，缓存指令运行环境；
S132，执行出栈操作获取操作数，计算下一条即将运行的指令地址，该地址为第一地址；其中，栈用于保存程序转移指令(例如跳转指令)的地址和参数；
S133，根据第一地址获取待调度/执行的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令；
S134，替换第一程序转移指令为压栈指令，在压栈指令中记录第一程序转移指令的地址和参数；
S135，在压栈指令之后加入第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址；和
S136，恢复所述指令运行环境，并跳转到第二地址继续执行。
本领域普通技术人员可以理解，上述各个实施例中提供的功能或特征可以根据实际的需要叠加在同一个实施例中，这里就不再一一组合给出，下面只举一个例子进行示例性说明。
根据本发明另一个实施例，提供一种指令重组方法，如图9a所示，包括：
(1)缓存指令运行环境，所述指令运行环境包括全部的CPU寄存器；
执行出栈操作获取操作数，计算下一条即将运行的指令地址(称为第零地址)，设置第一地址的值为第零地址；其中，栈用于保存程序转移指令的地址和参数；
(2)利用第一地址来查找地址对应表(也称为地址查找表)，如果找到记录，恢复所缓存的指令运行环境，并跳转到找到的对应地址(例如地址对应表中的地址对)继续执行；
(3)如果没有找到记录，从第一地址开始获取待执行的机器指令片段，指令片段的结尾为程序转移指令(程序转移指令所在地址为第三地址)；
(4)从第一地址开始，将机器码进行反汇编，并将反汇编结果通过一个词法分析器进行处理，生成重组后的汇编代码，直到第三地址为止；
(5)判断第三地址处的代码是否可以进一步处理，即第三地址处的程序转移指令的目标地址为已知量(例如，立即数)，如果可以，将第一地址的值设置为第三地址的目标地址，重新开始执行(3)；
(6)如果不可以，在生成的重组后的汇编代码最后，加入压栈指令记录当前第三地址的原始地址位置(即第三地址的值)和操作数，并在压栈指令之后加入跳转至重组平台开始的指令，即能够使步骤(1)再次开始执行；
(7)将生成的重组后的汇编代码通过汇编器生成对应的机器码，并存储于重组地址空间中分配出的地址(第二地址)，并将第二地址和第零地址以对应地址对的形式存储于地址对应表中；
(8)恢复环境，并跳转到第二地址继续执行。
为了方便理解，现以X86体系处理器运行该实施例提供的方法进行说明，参考图9b-9d，指令重组的一个示例过程如下：
(1)重组平台开始工作后，首先缓存当前指令运行环境；获取栈中保存的程序转移指令的地址和参数，计算下一条即将运行的指令地址，该地址为第零地址，将第一地址的值设置为第零地址。
(2)利用第一地址来查找地址对应表，如果找到记录，恢复所缓存的指令运行环境，并跳转到找到的对应地址继续执行(图9b)；如果没有找到记录，进行如下操作(图9c)。
(3)-(6)从第一地址开始，将机器码进行反汇编，并将反汇编结果通过一个词法分析器进行处理，生成重组代码；
对该段汇编代码进行检索，检查是否包含程序转移指令；
对第一个程序转移指令进行分析，判断其跳转目标地址是否为已知量，如果是已知量，则继续寻找，直到找到第一条参数地址程序转移指令，称为第一程序转移指令，该指令的地址为第三地址；
在生成的汇编代码(从第一地址到第三地址的机器指令，不包括第一程序转移指令)最后加入压栈指令记录当前第三地址的第一跳转的原始地址位置和操作数；
在压栈指令之后加入跳转至重组平台开始的指令(第二程序转移指令)。
(7)将生成的汇编代码通过汇编器生成对应的机器码，并存储于重组地址空间中分配出的地址(第二地址)；
将第二地址和第零地址以对应地址对的形式存储于地址对应表中。
(8)恢复环境，并跳转到第二地址继续执行
(图9d)处理器开始执行第二地址的指令，之前的待重组指令片段中的程序转移指令已经替换为压栈指令和跳转去重组平台的指令，压栈指令主要的目的是向重组平台提供输入参数。(图9d)当执行到第二程序转移指令时，重组平台重新得到执行，进行上述的步骤(1)，通过查看压栈指令中保存的程序转移指令的地址和参数，计算下一条即将运行的指令地址，该地址为第一地址。
之后的处理即上述过程的循环。
进一步的，为了从系统启动后即执行运行时的指令监控，实现计算设备运行阶段的运行时指令全监控，本发明另一个实施例中，修改计算机启动时的load指令，在原load指令执行前调用本发明提供的指令重组平台，执行上述运行时指令重组方法，由于load指令跳转地址为已知的固定地址，指令重组平台可以事先建立好地址对应表及第一条记录，并建立好第一个重组指令片段。
进一步的，根据本发明另一个实施例，提供一种计算机可读介质，其中，所述可读介质中存储有计算机可执行的程序代码，所述程序代码用于执行上述实施例中提供的运行时指令重组方法的步骤。
进一步的，根据本发明另一个实施例，提供一种计算机程序，其中，所述计算机程序包含上述实施例中提供的运行时指令重组方法的步骤。
针对数据安全的指令重组
上述的运行时指令重组方法为进一步的应用提供了基础。下面的实施例中提供了各种针对不同机器指令进行处理的运行时指令重组方法，其中包括：存储/读取指令、I/O指令以及网络传输指令：
(1)存储/读取指令指计算机系统中所有对外部存储设备(包括但不限于磁盘存储设备、闪存设备、光存储设备)进行存储/读取的指令或指令组合。
(2)I/O指令指计算机系统中所有操作外设的地址空间的指令，这些指令最终会影响外设输入输出状态、数据、信号等。外设的地址空间包括但不限于I/O地址空间、内存映射I/O设备地址空间。
(3)网络传输指令指计算机系统中所有影响网络设备的指令，这些指令最终会影响计算机系统网络设备的传输、状态、数据、信号 等所有相关特性。
其中，存储/读取指令与I/O指令之间可以存在交集。
根据本发明一个实施例，提供一种针对存储/读取指令的运行时指令重组方法S400，包括：
S401，缓存指令运行环境；所述指令运行环境包括地址寄存器，地址寄存器保存下一条将要运行的机器指令的地址，该地址为第一地址；地址寄存器例如为程序计数器PC；
S402，利用所述第一地址查找地址对应表；
S403，如果找到相应的记录，将所述第一地址A修改为已保存的重组指令片段的地址A’；
S404，如果没有找到相应的记录，重组指令片段的生成方法包括：
S4041，获取待调度的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令；与步骤S102相同；
S4042，反汇编所述待调度的机器指令片段，得到汇编指令片段；
S4043，检索目标汇编指令(即用目标汇编指令作为检索目标，检索汇编指令片段)，所述目标汇编指令为存储/读取指令；
S4044，如果检索得到所述汇编指令片段中的存储/读取指令，修改其中的存储和读取地址为安全存储设备上的地址；修改方式可以为本地地址空间和安全存储设备地址空间之间的直接映射；
S4045，在所述第一程序转移指令JP1前，插入第二程序转移指令JP2，所述JP2指向指令重组平台(指令重组方法运行时称为指令重组平台，也可以理解为指令重组方法运行时的实例称为指令重组平台)的入口地址；
S4046，汇编修改过的汇编指令片段，生成具有地址A"的重组机器指令片段；
S4047，利用重组机器指令片段地址A"与第一地址A在所述地址对应表中建立一条记录(或地址对)，具有地址A"的重组指令片段被保存在重组指令平台中；
S4048，将第一地址A修改为第二地址A"；
S405，恢复所述指令运行环境。
本实施例是在反汇编步骤之后进行指令处理的；在其他实施例中，也可以省略反汇编和对应的汇编步骤，直接处理机器指令。
在步骤S4044中，针对存储和读取指令进行操作，修改其中的目标和源地址，以实现存储重定位/重定向，确保数据安全。更具体的安全存储/读取的方法将在本发明提供的下面的实施例中介绍。
根据本发明一个实施例，提供一种针对I/O指令的运行时指令重组方法S500，包括：
S501，缓存指令运行环境；所述指令运行环境包括地址寄存器，地址寄存器保存下一条将要运行的机器指令的地址，该地址为第一地址；
S502，利用所述第一地址查找地址对应表；
S503，如果找到相应的记录，将所述第一地址A修改为已保存的重组指令片段的地址A’；
S504，如果没有找到相应的记录，重组指令片段的生成方法包括：
S5041，获取待调度的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令；与步骤S102相同；
S5042，反汇编所述机器指令片段，得到汇编指令片段；
S5043，检索目标汇编指令，所述目标汇编指令为I/O指令；
S5044，如果检索得到所述汇编指令片段中的I/O指令，将所述I/O指令中的输入指令全部阻止；
S5045，在所述第一程序转移指令JP1前，插入第二程序转移指令JP2，所述JP2指向指令重组平台的入口地址；
S5046，汇编修改过的汇编指令片段，生成具有地址A"的重组机器指令片段；
S5047，利用重组机器指令片段地址A"与第一地址A在所述地址对应表中建立一条记录(或地址对)，具有地址A"的重组指令片段被保存在重组指令平台中；
S5048，将第一地址A修改为第二地址A"；
S505，恢复所述指令运行环境。
本实施例是在反汇编步骤之后进行指令处理的；在其他实施例中，也可以省略反汇编和对应的汇编步骤，直接处理机器指令。
在步骤S5044中，针对I/O指令进行操作，将所述I/O指令中的输入指令全部阻止，以实现彻底阻断对本地硬件设备的写操作；结合上一个实施例中的存储指令处理过程，还可以实现对除存储指令之外的输入指令的阻止，可以提高计算设备中的数据安全性。
根据本发明一个实施例，提供一种针对网络传输指令的运行时指令重组方法S600，包括：
S601，缓存指令运行环境；所述指令运行环境包括地址寄存器，地址寄存器保存下一条将要运行的机器指令的地址，该地址为第一地址；
S602，利用所述第一地址查找地址对应表；
S603，如果找到相应的记录，将所述第一地址A修改为已保存的重组指令片段的地址A’；
S604，如果没有找到相应的记录，重组指令片段的生成方法包括：
S6041，获取待调度的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令；与步骤S102相同；
S6042，反汇编所述待调度的机器指令片段，得到汇编指令片段；
S6043，检索目标汇编指令，所述目标汇编指令为网络传输指令；
S6044，如果检索得到所述汇编指令片段中的网络传输指令，检验所述网络传输指令中的目标地址对应的远端计算设备是否为安全地址(例如白名单)，如果不是，阻止所述网络传输指令；
S6045，在所述第一程序转移指令JP1前，插入第二程序转移指令JP2，所述JP2指向指令重组平台的入口地址；
S6046，汇编修改过的汇编指令片段，生成具有地址A"的重组机器指令片段；
S6047，利用重组机器指令片段地址A"与第一地址A在所述地址对应表中建立一条记录(或地址对)，具有地址A"的重组指令片段被保存在重组指令平台中；
S6048，将第一地址A修改为第二地址A"；
S605，恢复所述指令运行环境。
在步骤S6044中，阻止/拒绝网络传输指令可以通过在重组后的代码中插入一到多条指令来将本身的传输指令替换为“取消当前操作的指令”或直接替换为无效指令，要视硬件的不同而定。
本实施例是在反汇编步骤之后进行指令处理的；在其他实施例 中，也可以省略反汇编和对应的汇编步骤，直接处理机器指令。
在步骤S6044中，针对网络传输指令进行操作，检验所述网络传输指令中的目标地址对应的远端计算设备是否为安全地址；如果不是，阻止所述网络传输指令，以实现数据安全传输。
上述多个实施例中的地址对应表是由指令重组平台建立并维护的，可以是固定长度的数组结构，也可以是可变长度的链表结构，还可以是其他存储二元数据的适当的数据结构。根据本发明一个实施例，其长度可调节，并且其占用空间可释放。释放地址对应表的操作可以随机进行，也可以周期进行。根据本发明一个实施例，地址对应表还可以包括记录建立时间字段，用于在释放空间删除记录时，按照建立时间的长短删除记录。根据本发明一个实施例，地址对应表还可以包括记录使用次数字段，在查找地址对应表步骤中，如果找到，将改变该字段的值；所述记录使用次数字段也用于在释放空间删除记录时，按照使用次数的多少删除记录。
另外，本领域的技术人员可以理解，上述指令重组方法(即运行时指令重组方法)可使用软件或硬件的方法实现：
(1)如果以软件实现，则上述方法对应的步骤以软件代码的形式存储在计算机可读介质上，成为软件产品；
(2)如果以硬件实现，则上述方法对应的步骤以硬件代码(例如Verilog)描述，并固化(经过物理设计/布局布线/晶圆厂流片等过程)成为芯片产品(例如处理器产品)。下面将详细介绍。
指令重组装置
与上述运行时指令重组方法S100相对应，根据本发明一个实施例，提供一种运行时指令重组装置。如图10所示，指令重组装置500 包括：
指令运行环境缓存和恢复单元501，适于缓存和恢复指令运行环境；所述指令运行环境包括地址寄存器，该地址寄存器(例如程序计数器pc)保存下一条将要运行的机器指令的地址，该地址为第一地址；
指令获取单元502，适于在单元501缓存指令运行环境后，获取待调度的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令(例如，第一跳转指令)；
指令重组单元503，适于解析、修改所述待调度的机器指令片段，包括：在第一程序转移指令前，插入第二程序转移指令，生成具有第二地址A"的重组指令片段；所述第二程序转移指令指向装置500，即执行该第二程序转移指令后，装置500的指令运行环境缓存和恢复单元501进行下一次处理；和
地址替换单元504，适于将所述缓存的指令运行环境中的地址寄存器的值修改为重组指令片段的地址。
所述指令运行环境缓存和恢复单元501分别与指令获取单元502以及地址替换单元504耦接，所述指令获取单元502，指令重组单元503和地址替换单元504依次耦接。
装置500执行过程如下：
首先，指令运行环境缓存和恢复单元501缓存指令运行环境，例如向缓存栈中压入指令运行相关的寄存器数据；
然后，所述指令获取单元502从CPU地址寄存器511读取待调度的机器指令地址，并从所述机器指令地址读取机器指令片段，所述机器指令片段最后一条指令为程序转移指令；
例如，指令获取单元502从CPU地址寄存器511读取待调度的机器指令地址；以程序转移指令为检索目标，检索所述机器指令地址 对应的机器指令，直到发现第一个程序转移指令(即控制转移指令，包括无条件转移指令和条件转移指令)；所述程序转移指令包括例如Jump/JMP指令、Call指令、RET指令等；将所述第一个程序转移指令及其之前的所有机器指令作为一个待调度的机器指令片段；将该机器指令片段保存在装置500中或其他的装置500能够读取的存储位置；
然后，指令重组单元503在所述获取的机器指令片段的最后一条指令前，插入第二程序转移指令，所述第二程序转移指令指向装置500的入口地址，生成具有地址A"的重组指令片段；
然后，地址替换单元504将所述缓存的指令运行环境中的地址寄存器的值A修改为地址A"；
最后，指令运行环境缓存和恢复单元501恢复所述指令运行环境，例如从缓存栈中弹出指令运行相关的寄存器数据。
与上述运行时指令重组方法S300相对应，所述指令获取单元502可以将第一个非常数地址程序转移指令作为第一程序转移指令，以提高重组装置的执行效率。
与上述运行时指令重组方法S200相对应，根据本发明另一个实施例，提供一种运行时指令重组装置，能够充分利用运行时指令重复性，提高效率，节省计算资源。
如图11所示，指令重组装置600包括：
指令运行环境缓存和恢复单元601，适于缓存和恢复指令运行环境；所述指令运行环境包括地址寄存器，地址寄存器保存下一条将要运行的机器指令的地址，该地址为第一地址；
指令获取单元602，适于获取待调度的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令；
指令重组单元603，适于解析、修改所述待调度的机器指令片段，包括：在第一程序转移指令前插入第二程序转移指令，以生成具有第二地址的重组指令片段；所述第二程序转移指令指向装置600，即执行该第二程序转移指令后，装置600的指令运行环境缓存和恢复单元601进行下一次处理；
地址替换单元604，适于将所述缓存的指令运行环境中的地址寄存器的值修改为重组指令片段的地址；和
指令检索单元605，适于利用所述第一地址查找地址对应表；所述地址对应表用于表示第一地址A指向的待调度指令片段是否具有已保存的重组指令片段，地址对应表的数据例如为地址对；
如果找到相应的记录，指令检索单元605适于调用地址替换单元604，将所述第一地址A(即地址寄存器的值A)修改为已保存的重组指令片段的地址A’；如果没有找到相应的记录，指令检索单元适于利用第二地址A"与地址A在所述地址对应表中建立一条记录。
所述指令运行环境缓存和恢复单元601分别与指令检索单元605以及地址替换单元604耦接，所述指令检索单元605分别与指令获取单元602，指令重组单元603和地址替换单元604耦接，所述指令获取单元602、指令重组单元603和地址替换单元604依次耦接。
装置600的执行过程如下：
首先，指令运行环境缓存和恢复单元601缓存指令运行环境，例如向缓存栈中压入指令运行相关的寄存器数据；
然后，指令检索单元605利用所述缓存的指令运行环境中的地址寄存器的值A查找地址对应表；
如果找到相应的记录，指令检索单元605调用地址替换单元604，地址替换单元604将所述地址寄存器的值A修改为记录中的值A’；地址替换单元604调用指令运行环境缓存和恢复单元601，以恢复所述指令运行环境，即从缓存栈中弹出指令运行相关的寄存器数据，本 次重组操作结束；
如果没有找到相应的记录，所述指令获取单元602从CPU地址寄存器读取待调度的机器指令地址，并从所述机器指令地址读取机器指令片段，所述机器指令片段最后一条指令为程序转移指令。具体的，指令获取单元602从CPU地址寄存器读取待调度的机器指令地址；以程序转移指令为检索目标，检索所述机器指令地址对应的机器指令，直到发现第一个程序转移指令；所述程序转移指令包括Jump指令和Call指令等；将所述第一个程序转移指令及其之前的所有机器指令作为一个待调度的机器指令片段；将该机器指令片段保存在装置600中，或其他的装置600能够读取的存储位置；
然后，指令重组单元603在所述获取的机器指令片段的最后一条指令前，插入第二程序转移指令，所述第二程序转移指令指向装置600的入口地址，生成具有地址A"的重组指令片段；
然后，指令重组单元603将地址A"发送给指令检索单元605，指令检索单元605利用地址A"与地址A在其中的地址对应表中建立一条记录；以备后续指令重用；
然后，地址替换单元604将所述缓存的指令运行环境中的地址寄存器的值A修改为地址A"；
最后，指令运行环境缓存和恢复单元601恢复所述指令运行环境，即从缓存栈中弹出指令运行相关的寄存器数据。
继续参考图11，其中，指令重组单元603还可以包括：
指令解析单元6031，适于利用指令集匹配所述机器指令片段，得到待处理的目标机器指令(即利用目标指令检索待调度的机器指令片段)；所述指令集包括X86，MIPS和ARM指令集；
指令修改单元6032，适于按照预定的方式，修改所述目标机器指令。
例如，如果所述目标指令为存储/读取指令，所述指令解析单元6031将负责获取待调度的机器指令片段中的存储/读取指令，所述指令修改单元6032修改其中的存储和读取地址为安全存储设备上的地址。其作用和效果与上述对应的方法实施例S400相同，这里不再赘述。
又例如，如果所述目标指令为I/O指令，所述指令解析单元6031将负责获取待调度的机器指令片段中的I/O指令，所述指令修改单元6032将所述I/O指令中的输入指令全部阻止。其作用和效果与上述对应的方法实施例S500相同，这里不再赘述。
又例如，如果所述目标指令为网络传输指令，所述指令解析单元6031将负责获取待调度的机器指令片段中的网络传输指令，所述指令修改单元6032检验所述网络传输指令中的目标地址对应的远端计算设备是否为安全地址；如果不是，所述指令修改单元适于阻止所述网络传输指令。其作用和效果与上述对应的方法实施例S600相同，这里不再赘述。
根据本发明另一个实施例，上述指令重组单元还可以包括反汇编单元和汇编单元。如图12所示，指令重组单元703包括：依次耦接的反汇编单元7031、指令解析单元7032、指令修改单元7033和汇编单元7034。
其中，反汇编单元7031适于在解析、修改所述待调度的机器指令片段之前，反汇编所述待调度的机器指令片段，生成待调度的汇编指令片段，发送给指令解析单元7032。
汇编单元7034适于在解析、修改所述待调度的机器指令片段之后，汇编重组后的汇编指令片段，得到机器码表示的重组指令片段，发送给指令替换单元。
在该实施例中，所述指令解析单元7032和指令修改单元7033将 操作待调度的汇编指令片段，操作方法与上述实施例相似，这里不再赘述。
与上述运行时指令重组方法S110相对应，根据本发明另一个实施例，提供一种运行时指令重组装置。如图13所示，指令重组装置800包括：
指令运行环境缓存和恢复单元801，适于缓存指令运行环境；
指令获取单元802和第一存储位置803，其中，指令获取单元802适于从第一存储位置803读取目标地址，并根据目标地址获取待调度/执行的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令；以及
指令重组单元804，适于在第一存储位置803保存第一程序转移指令的目标地址，将第一程序转移指令替换为第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向装置800的入口地址。
其中，指令运行环境缓存和恢复单元801还适于在指令重组单元804替换指令之后，恢复所述指令运行环境，并跳转到第二地址继续执行。
装置800的执行过程如下：
首先，指令运行环境缓存和恢复单元801缓存指令运行环境；
然后，指令获取单元802从第一存储位置803读取目标地址(待调度指令地址)，根据目标地址获取待调度的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令；
然后，指令重组单元804在第一存储位置803保存第一程序转移指令的目标地址：(1)对于立即数保存其值，(2)对于变量参数保存其地址/引用，例如保存float类型变量destination_address的地址或引 用；
然后，指令重组单元804将第一程序转移指令替换为第二程序转移指令，生成具有第二地址的重组指令片段；
最后，指令运行环境缓存和恢复单元801恢复所述指令运行环境，并跳转到第二地址继续执行。
根据本发明另一个实施例，提供一种运行时指令重组装置，与上述方法S130相对应，并且包含上述某些实施例中提供的装置的特征。如图14所示，该装置900包括：
指令运行环境缓存和恢复单元901，适于缓存和恢复指令运行环境；
指令获取单元902，适于执行出栈操作获取操作数，并利用操作数计算下一条即将运行的指令地址，该地址为第一地址；
还适于根据第一地址获取待调度/执行的机器指令片段，其中，待调度的机器指令片段的最后一条指令为第一程序转移指令；
指令重组单元903，适于替换第一程序转移指令为压栈指令，在压栈指令中记录第一程序转移指令的地址和操作数；
还适于在压栈指令之后加入第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向装置900的入口地址；
还适于将重组指令片段的第二地址与第一地址在地址对应表中建立一条记录；
指令检索单元904，适于利用所述第一地址查找地址对应表；所述地址对应表用于表示第一地址指向的待调度指令片段是否具有已保存的重组指令片段，地址对应表的数据为地址对；
如果找到相应的记录，指令检索单元904适于调用指令运行环境缓存和恢复单元901恢复所缓存的指令运行环境，并跳转到找到的对应地址继续执行(本次重组操作完成)；
如果没有找到相应的记录，调用指令重组单元903进行重组操作。
其中，指令重组单元903还可以包括反汇编单元9031，指令解析单元9032，指令修改单元9033，和汇编单元9034。
其中，当指令重组单元903完成重组后，适于调用指令运行环境缓存和恢复单元901恢复所缓存的指令运行环境，并跳转到重组指令片段的地址继续执行(本次重组操作完成)。
根据本发明另一个实施例，上述反汇编单元9031可以位于指令获取单元902之中，在获取待调度的指令片段时由其进行反汇编操作。
本领域技术人员可以理解，上述装置实施例的附图中的数据流的箭头只是为了便于解释上述实施例中的具体操作流程，并不限定图中各个单元之间的数据流向，装置中各个单元之间为耦接关系。
上面通过一些实施例详细的介绍了运行时指令重组方法和装置，其与现有技术相比，具有以下优点：
通过指令重组方法，可以在指令运行状态下监控计算设备的指令；
利用地址对应表，提高了指令重组效率，节省了计算资源；
针对存储和读取指令进行操作，修改其中的目标和源地址，以实现存储重定位/重定向，确保数据安全；
针对I/O指令进行操作，将所述I/O指令中的输入指令全部阻止，以实现彻底阻断对本地硬件设备的写操作；还可以实现对除存储指令之外的输入指令的阻止，可以提高计算设备中的数据安全性；
针对网络传输指令进行操作，检验所述网络传输指令中的目标地址对应的远端计算设备是否为安全地址；如果不是，阻止所述网络传输指令，以实现数据安全传输。
数据安全存取过程
图15是本发明一个实施例中计算设备的系统层次示意图。
其中，计算设备(例如计算机终端系统)200包括：用户界面层201，应用层202，操作系统内核层203，硬件映射层204，安全层205，和硬件层206。
其中，硬件层206进一步包括CPU 2061，硬盘2062(即本地存储设备)以及网卡2063。
另外，计算设备200与存储设备10(又称为安全存储设备)耦接。
本实施例中，存储设备10为远程磁盘阵列，通过网络连接硬件层206的网卡2063，与计算设备200交换数据。在本发明的其他实施例中，存储设备10也可以是其他已知或未知类型的存储设备。
其中，硬盘2062也可以替换为其他类型的本地存储设备，例如u盘和光盘等，这里只是举例说明，并无限制目的。
结合上述层次结构，本实施例提供一种数据安全存取过程，包括：
S1000，初始化；
S2000，数据写入；和
S3000，数据读取。
参考图16，根据本发明一个实施例，上述的初始化过程S1000包括：
S1010，建立计算机终端系统200与安全存储设备10的通讯；
S1020，从安全存储设备10上同步一映射位图(Bitmap)至当前计算机终端系统200，例如保存在计算机终端系统200内存中；所述映射位图用于表示本地存储设备的数据是否已经转移存储到安全存储设备；
S1030，如果步骤S1020的同步操作失败，在安全存储设备10上建立Bitmap并初始化，然后同步到计算机终端系统200。
其中，为了区分计算机终端200上的Bitmap与存储设备10上的Bitmap，下文中，除非另有说明，将计算机终端系统200上的Bitmap称为映射位图或第一映射位图，将安全存储设备10上的Bitmap称为第二映射位图(步骤S1030可以概括为先建立第二映射位图并初始化，然后再同步到计算机终端系统200保存为第一映射位图)。
其中，在步骤S1020中，如果从存储设备10上同步第二映射位图至当前计算机终端系统200的操作失败，说明存储设备10与计算机终端系统200之间是第一次连接。
其中，步骤S1030可以包括：将计算机终端系统200中的本地存储空间映射到存储设备10上，映射方法/关系为以1扇区(或其他存储的基本单位)为单位的一一映射，并且建立映射位图(Bitmap)。在本发明的其他实施例中，也可以使用其他基本容量为单位建立本地存储空间到存储设备100上的Bitmap。对于Bitmap，下面将结合附图详细描述。
图17为本发明一个实施例中的Bitmap示意图。图中包括本地存 储设备(例如图15中的硬盘2062)上的存储介质3000，与本地存储设备通过网络连接的存储设备10上的存储介质4000。
(1)建立Bitmap的过程描述如下：
在存储介质4000上建立与存储介质3000大小相同的存储空间4010，作为一一映射空间。在存储空间4010中保存Bitmap 4020，Bitmap 4020为一位图，其中1位代表1扇区，每一位的数据(0或1)标识/指示存储介质3000上的某扇区是否已经转储到存储介质4000上的存储空间4010，所以映射位图也可以称为转储表。存储设备10上的Bitmap 4020建立完成之后同步到计算机终端系统200中。
(2)更新Bitmap的过程描述如下：
例如，在Bitmap 4020中，已经转储的扇区标记为1，未转储的扇区没有标记；在其他实施例中，转储扇区和非转储扇区所使用的标记可以自由选择。当应用程序或操作系统保存一个数据(例如文件时)，操作系统内部的文件系统将在本地存储设备的存储介质3000上开辟一定量的存储空间，例如扇区3040和扇区3050，并分配给该文件使用，并改写本地的文件分配表。该文件转储时(即写入扇区3040和扇区3050的数据被存储到存储设备10上时)，在存储介质4000上相同的位置分配扇区4040和4050，并在其中保存转储数据，并将Bitmap 4020中扇区3040和扇区3050对应的位数据改为1。
结合附图15，根据本发明一个实施例，上述的数据写入过程S2000进一步包括：
S2010，应用层202通过操作系统内核层203的文件系统发出写文件操作请求，或操作系统内核层203直接发出写文件操作请求；或
应用层202直接向硬件映射层204发出写数据操作请求，或操作系统内核层203直接向硬件映射层204发出写数据操作请求；
S2020，操作系统内核层203将写文件请求解析成硬件端口指令(即硬件指令)，下发至硬件映射层204，端口指令包含写入位置(例如扇区)；
需要注意的是，如果步骤S2010是直接向硬件映射层204发出写数据操作请求，则该请求已经为硬件端口指令；
S2030，安全层205接收来自硬件映射层204的硬件端口指令，并且将端口指令中的写入位置(即扇区)改写为位于存储设备10上的对应存储地址，然后更新第一映射位图，例如将所述扇区对应的位数据修改为1，表示该扇区已经转储；安全层205将修改后的端口指令发送给硬件层206。
写入过程执行完成之后，计算机终端系统200并没有存储写入的数据，相应的数据已经重定位存储在安全存储设备10上。
需要注意的是，如果写本地硬盘指令本身与写网络硬盘指令不同，那么不仅需要改地址，还需要改存储指令。
根据本发明另一个实施例，写入过程S2000还可以包括：
S2040，将第一映射位图同步到存储设备10上，保存为第二映射位图，从而确保计算机终端系统200上的第一映射位图与存储设备上的第二映射位图实时一致。
在本发明的其他实施例中，为了节省系统资源，S2040也可以在本地的计算机终端系统200关机前统一进行一次。
结合附图15，根据本发明一个实施例，上述的数据读取过程S3000进一步包括：
S3010，将存储设备10上的第二映射位图同步到计算机终端系统 200上，保存为第一映射位图；
S3020，应用层202通过操作系统内核层203的文件系统发出读文件操作请求，或操作系统内核层203直接发出读文件操作请求；或
应用层202直接向硬件映射层204发出读数据操作请求，或操作系统内核层203直接向硬件映射层204发出读数据操作请求；
S3030，操作系统内核层203将读文件请求解析成硬件端口指令，下发至硬件映射层204，端口指令包含读取地址(例如扇区)；
S3040，安全层205接收来自硬件映射层204的数据读取指令，获取其中的读取地址(源地址)，查找第一映射位图，如果第一映射位图中的位数据表示所述读取地址为转储地址(数据已经转储)，安全层205修改端口指令的读取地址为存储设备10上的地址；安全层205将修改后的端口指令发送给硬件层206。
本实施例的优点在于，上述读取过程没有影响用户既有的操作模式，实现了对于安全存储设备(即存储设备10)上已经转储的数据的读取。
在步骤S3010中，从存储设备10同步第二映射位图到本地的过程是为了在计算机终端系统200重新启动了以后，保持本地数据与安全存储设备上的数据的一致性。
本领域技术人员可以理解，对于上述的数据写入、读取过程以及初始化过程，可以根据实际需要执行所需步骤。
数据安全存取方法
基于上述数据写入过程和读取过程，下面详细描述本发明提供的数据安全存储和读取方法。
本领域技术人员可以理解，上面结合图15来说明数据的读取和 存储过程是为了方便理解，并不是限定，在本发明其他实施例中，可以在计算设备的适合层次上执行以上描述的各个步骤。
根据本发明一个实施例，提供一种数据安全存储方法；如图18所示，该方法包括如下步骤：
S4010，接收硬件指令；
S4020，分析并判断该硬件指令是否为存储指令；
S4030，如果该硬件指令是存储指令，修改存储指令中的目标地址为对应的安全存储设备上的存储地址；
S4040，将修改后的存储指令发送到硬件层。
根据本发明一个实施例，在步骤S4010中，所述硬件指令是来自硬件映射层的硬件指令。接收来自硬件映射层的硬件指令可以100％的筛查所有发送到CPU等处理器的硬件指令(接口指令)。
计算机可以运行Windows操作系统，Windows系统中的硬件抽象层HAL为附图15中的硬件映射层204。在其他实施例中，计算机终端也可以运行其他操作系统，例如Linux，Unix或嵌入式操作系统等，硬件映射层为Linux、Unix或其他嵌入式操作系统中的对应层次。
在步骤S4010中，结合上述运行时指令重组方法，接收硬件指令的过程可以包括：采用运行时指令重组方法(例如S101-S105)获取硬件指令。换句话说，就是可以在运行时指令重组方法获取到机器指令时，处理存储指令(相似的方法例如S404，S504或S604)。通过运行时指令重组方法，可以不仅将计算最终结果重定位存储到安全存储设备，还能够将计算的中间过程(包括操作系统产生的中间过程)全部重定位存储到安全存储设备；通过这样的方式使终端计算设备不完整，并且进一步通过使终端计算设备不完整来达到信息防泄密的目的。
另外，在步骤S4010和S4020中，硬件指令可以为X86指令、ARM指令、MIPS指令等类型，可以在终端计算设备内置分析机制，以处理不同类型的CPU指令。
根据本发明另一个实施例，在步骤S4030之后，还可以包括：
S4050、更新第一映射位图，将目标地址(扇区)在第一映射位图中对应的“位”设置为转储标记，例如“1”；并且，将已经更新的映射位图同步到所述安全存储设备，保存为第二映射位图。
本实施例中，转储操作对于上层应用以及用户完全透明，不影响现有计算机操作、应用系统的工作流程。
本实施例提供的上述方法不仅可以在计算机终端系统中使用，还可以应用在任何包含应用层、操作系统内核层、硬件层的计算设备和智能终端上，实时实现指令级存储重定位/重定向(即基于硬件存储指令的存储重定位/重定向)。
根据本发明一个实施例，提供一种数据安全读取方法；参考图19，该方法S5000包括：
S5010，接收硬件指令；
S5020，分析并判断该硬件指令是否为读取指令；
S5030，如果是读取指令，获取读取指令中的源地址(读取地址)，查找第一映射位图，并根据映射位图的数据修改读取指令中的读取地址，实现对转储数据和非转储数据的读取；和
S5040，将修改后的硬件指令发送到硬件层。
根据本发明另一个实施例，在步骤S5010之前，该方法还可以包括：将存储设备上的第二映射位图同步到计算机终端系统200上，保 存为第一映射位图。
根据本发明另一个实施例，步骤S5010中，所述的硬件指令来自硬件映射层。
根据本发明另一个实施例，在步骤S5010中，结合上述运行时指令重组方法，接收硬件指令的过程可以包括：采用运行时指令重组方法(例如S101-S105)获取硬件指令。换一种说法，就是可以在运行时指令重组方法获取到机器指令时，处理读取指令。
根据本发明另一个实施例，在步骤S5020中，如果该硬件指令不是读取指令，则可以直接将硬件指令发送给硬件层去执行。
根据本发明另一个实施例，步骤S5030还可以进一步分解为：
S5031，如果是读取指令，获取读取指令中的源地址，判断所述源地址是否为存储设备上的地址；
S5032，如果所述源地址不是存储设备上的地址，查找第一映射位图，并根据映射位图的数据修改读取指令中的读取地址。
即：在步骤S5031中，如果该读取指令的源地址已经为存储设备上的地址，则计算设备(例如图15中的安全层205)不用再次查找第一映射位图中的数据，可以直接将硬件指令发送给硬件层去执行。
根据本发明另一个实施例，为了节约网络资源，在本发明的一些实施例中，安全存储设备10可以作为多个终端系统的共享资源。
上面多次提到可以将数据安全存储和读取方法与指令重组方法结合，为了方便理解，下面通过实施例详细介绍。
根据本发明一个实施例，提供一种数据安全存取方法。如图20所示，该方法S6000包括：
S6010，缓存指令运行环境；
S6011，从第一存储位置读取目标地址，根据目标地址获取待调度/执行的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令(例如第一跳转指令)；
S6012，在第一存储位置保存第一程序转移指令的目标地址；
S6013，分析并判断待调度机器指令中的每一条指令是否为存取指令；
S6014，如果是存取指令(包括存储指令和读取指令)：
对于存储指令，修改存储指令中的目标地址为对应的存储设备(即安全存储设备)上的存储地址，并修改第一映射位图；
对于读取指令，获取读取指令中的源地址，查找第一映射位图，并根据映射位图的数据修改读取指令中的读取地址；
如果写本地硬盘指令本身与写网络硬盘指令不同，或者读取本地硬盘指令本身与读取网络硬盘指令不同，那么不仅需要修改地址，还需要相应的修改存储指令或读取指令；
S6015，将第一程序转移指令替换为第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址；
S6016，恢复所述指令运行环境，并跳转到第二地址继续执行。
本领域技术人员可以理解，该实施例只是为了说明而举例，并不限制安全读取方法、安全存储方法和指令重组方法的组合方式，上述介绍的各种安全读取方法、安全存储方法和指令重组方法可以以各种所需的方式组合使用。
数据安全传输方法
存储和读取一般是针对本地的存储设备进行的数据交换；传输一 般是指通过网络设备进行的数据交换。
如图21所示，根据本发明一个实施例，提供一种数据安全传输方法，包括：
S7010，接收(例如来自硬件映射层的)硬件指令；
S7020，分析并判断该硬件指令是否为网络传输指令；
S7030，如果该硬件指令是传输指令，读取目标地址；
S7040，判断目标地址是否为安全地址；
S7050，如果是安全地址，将硬件指令发送到硬件层；如果不是安全地址，拒绝该指令；
S7060，硬件层发送传输指令和数据到目标地址的终端系统；
S7070，目标地址的终端系统接收并利用数据安全存储方法(在上面实施例中描述)保存数据。
根据本发明另一个实施例，在步骤S7040中，判断目标地址是否为安全地址的方法如下。
参考图22，安全服务器820通过网络与终端系统800、810连接，终端系统800、810在部署本发明上述实施例中提供的数据安全传输方法时，都已经向安全服务器820进行了注册操作。安全服务器820内部维护一个安全地址表，记录了已经注册的所有终端系统。
当安全地址表有更改的时候，安全服务器820自动将更新的安全地址表发送给各个终端，终端系统800的架构包括应用层801，操作系统内核层802，安全层803以及硬件层804，安全层803负责维护该安全地址表。
安全层803将根据目标地址是否在安全地址表中，判断目标地址是否为安全地址。即在步骤S7040中，如果目标地址列入了安全地址 表，则目标地址为安全地址。
上述安全传输方法的实施，使木马或恶意工具即使取得了涉密信息也无法传输所取得的信息。
虽然本发明一些实施例中以计算机终端系统作为应用本发明提供的方法的主体，但是，任何手持设备、智能终端等能够提供文件或数据编辑、保存或传输的电子设备，都可以成为应用本发明提供的数据安全存取及传输方法的载体。
数据安全存取装置(包括存储、读取装置)
与上述的数据安全存储方法相对应，根据本发明一个实施例，提供一种数据安全存储装置。
需要注意的是，为了避免混淆，在本发明中：(1)数据安全存储装置指：以硬件形式来实现数据安全存储方法的装置；(2)安全存储设备指：用于转储信息或数据的存储实体，例如磁盘等。
参考图23，本实施例提供的数据安全存储装置7100包括：接收单元7110，指令分析单元7120，指令修改单元7130和发送单元7140；所述接收单元7110与指令分析单元7120耦接，指令分析单元7120分别与指令修改单元7130以及发送单元7140耦接，发送单元7140还与指令修改单元7130耦接。
其中，接收单元7110适于接收硬件指令，所述硬件指令可以来自硬件映射层；
指令分析单元7120适于分析所述硬件指令并判断所述硬件指令是否为存储指令：如果是存储指令，指令分析单元7120还适于将其发送给指令修改单元7130，如果不是存储指令，指令分析单元7120还适于将其发送给发送单元7140；
指令修改单元7130适于修改所述存储指令中的目标地址为对应的在安全存储设备上的存储地址，然后将修改后的存储指令发送给发送单元7140；
发送单元7140适于将接收到的指令转发给硬件层7200。
进一步的，根据本发明另一个实施例，该数据安全存储装置还可以包括：
更新单元7150和同步单元7160，更新单元7150与指令修改单元7130耦接，同步单元7160与更新单元7150耦接。
其中，更新单元7150适于在指令修改单元7130修改所述存储指令之后，更新映射位图中所述目标地址对应的位。本实施例中，将存储指令目标地址包含的扇区在第一映射位图中对应的“位”数据置“1”，表示已经转储。
其中，同步单元7160适于建立终端计算设备系统(即终端计算设备)与所述安全存储设备之间的通讯，并将映射位图在所述终端计算设备系统和所述安全存储设备之间进行同步。
具体的，在终端计算设备系统启动时，同步单元7160建立终端计算设备系统与所述安全存储设备的通讯，并将所述安全存储设备上的第二映射位图同步到所述终端计算设备系统，保存为第一映射位图。
如果将所述安全存储设备上的第二映射位图同步到所述终端计算设备系统失败，表示终端计算设备系统与安全存储设备是第一次建立连接并通讯，同步单元7160将计算机终端系统中的本地存储空间映射到所述安全存储设备上，并建立第一映射位图和第二映射位图。例如在本实施例中，先在安全存储设备上建立第二映射位图，然后同步到本地，保存为第一映射位图。
当更新单元7150更新了第一映射位图(即映射位图)中所述目标地址对应的位，同步单元7160将把更新后的第一映射位图发送给安全存储设备，并在安全存储设备上保存为第二映射位图。
所述安全存储设备的位置不限定，可以为远程存储设备或本地存储设备。所述远程存储设备可以只为一个计算设备服务，也可以被多个计算设备共享。
根据本发明一个实施例，所述硬件指令可以为硬件端口I/O指令。
与上述的数据安全读取方法相对应，根据本发明另一个实施例，提供一种数据安全读取装置，参考图24，数据安全读取装置8100包括：
接收单元8110，指令分析单元8120，指令修改单元8130以及发送单元8140；其中，接收单元8110与指令分析单元8120耦接，指令分析单元8120分别与指令修改单元8130以及发送单元8140耦接，指令修改单元8130还与发送单元8140耦接。发送单元8140与硬件层8200耦接。
所述接收单元8110适于接收硬件指令，本实施例中，所述硬件指令来自硬件映射层。
所述指令分析单元8120适于分析所述硬件指令并判断所述硬件指令是否为读取指令，如果所述硬件指令是读取指令，获取读取指令的源地址并判断所述源地址是否为安全存储设备上的地址。
如果所述硬件指令不是读取指令，或者所述源地址是安全存储设备上的地址，指令分析单元8120将所述硬件指令发送到发送单元8140。
如果所述源地址不是安全存储设备上的地址，指令修改单元8130查找映射位图，并根据映射位图的数据修改所述读取指令中的读取地 址。
与上述实施例中的映射位图相同，本实施例中所述映射位图也用于表示本地存储地址的数据是否转储到所述安全存储设备，这里不再赘述。例如，指令修改单元8130查找源地址包含的扇区在第一映射位图中对应的位。如果“位”数据显示为1，表示已经发生转储，如果“位”数据显示为0或NULL(空)，表示没有发生转储。如果已经发生转储，指令修改单元8130将所述源地址(读取地址)改为对应的转储地址，并将修改后的硬件指令发送给发送单元8140。
进一步的，根据本发明另一个实施例，所述数据安全读取装置还可以包括同步单元8150，与指令修改单元8130耦接。
同步单元8150适于建立终端计算设备系统与所述安全存储设备的通讯，并将映射位图在所述终端计算设备系统和所述安全存储设备之间进行同步。具体的，同步单元8150在终端计算设备系统启动时，建立终端计算设备系统与所述安全存储设备的通讯，并将所述安全存储设备上的第二映射位图同步到所述终端计算设备系统，保存为第一映射位图，提供指令修改单元8130使用。
本实施例中，所述安全存储设备可以为远程存储设备，所述远程存储设备可以被多个终端计算设备系统共享。在本发明的其他实施例中，所述的安全存储设备也可以为本地存储设备。
根据本发明另一个实施例，上述数据安全读取装置和数据安全存储装置可以合并为一个装置，其中指令分析单元和指令修改单元既能处理存储指令又能处理读取指令，下面举例进行详细说明。
根据本发明另一个实施例，提供一种数据安全存储和读取装置。如图25，数据安全存储和读取装置(简称数据安全存取装置)9100包括：
指令运行环境缓存和恢复单元9101，适于缓存和恢复指令运行环境；
指令获取单元9102，适于获取下一条即将运行的指令地址，该地址为第一地址；还适于根据第一地址获取待调度/执行的机器指令片段；其中，待调度的机器指令片段的最后一条指令为第一程序转移指令；获取待调度的机器指令片段的具体方式在前面的实施例中已经详细描述，这里不再赘述；
指令检索单元9104，适于利用所述第一地址查找地址对应表：
如果找到相应的记录，指令检索单元9104适于调用指令运行环境缓存和恢复单元9101恢复所缓存的指令运行环境，并跳转到找到的对应地址继续执行(本次重组完成)；
如果没有找到相应的记录，调用指令重组单元9103进行重组操作。
其中，地址对应表用于表示第一地址指向的待调度指令片段是否具有已保存的重组指令片段，地址对应表的数据可以为地址对。
其中，指令重组单元9103进一步包括：
指令解析单元9111，是上述指令分析单元7120和指令分析单元8120的有机结合，适于分析所述硬件指令并判断所述待调度/执行的机器指令片段中的每一条硬件指令是否为存储或读取指令；
指令修改单元9112，如果指令解析单元9111发现存储或读取指令，指令修改单元9112适于：
对于存储指令，修改所述存储指令中的目标地址为对应的在安全存储设备上的存储地址；
对于读取指令，查找映射位图，并根据映射位图的指示数据来修改所述读取指令中的读取地址；
更新单元9113，适于在指令修改单元9112修改所述存储指令之后，更新映射位图中所述目标地址对应的位，以体现本地数据已经转储；
同步单元9114，适于建立终端计算设备系统与所述安全存储设备的通讯，并将映射位图在所述终端计算设备系统和所述安全存储设备之间进行同步。
在指令解析单元9111、指令修改单元9112、更新单元9113和同步单元9114操作完成后，指令重组单元9103适于替换第一程序转移指令为压栈指令，在压栈指令中记录第一程序转移指令的地址和操作数；还适于在压栈指令之后加入第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向装置9100的入口地址；还适于将重组指令片段的第二地址与第一地址在地址对应表中建立一条记录。
根据本发明另一个实施例，如图26所示，指令重组单元9103与指令解析单元9111、指令修改单元9112、更新单元9113和同步单元9114作为同一层次的并列单元，其功能不再赘述。继续参考图25，指令重组单元9103获得重组指令片段后，还适于调用指令运行环境缓存和恢复单元9101恢复所缓存的指令运行环境，并跳转到重组指令片段的地址继续执行(重组操作完成)。
本领域技术人员可以理解，该实施例只是为了说明而举例，并不限制数据安全读取装置、数据安全存储装置和指令重组装置合并方式，上述介绍的各种数据安全读取装置、数据安全存储装置和指令重组装置可以以各种所需的方式合并。
另外，上述安全存储方法和装置还可以与云技术结合，确保云内数据的安全，从而加快云计算(cloud computing)的应用和普及。具体实施例在下面将给予介绍。
本领域技术人员可以理解，在安全层实现的上述方法也可以在操作系统内核层至硬件层中的各个层内完成。具体功能的实现位置并不脱离本发明的精神和范围。
上述实施例中详细的介绍了本发明提供的安全存储方法和装置，与现有技术相比，具有如下优点：
1、数据安全存储方法实现了指令级数据转储即数据全转储，以此为基础，实现了终端计算设备系统全运行周期的数据安全存储方法，一方面，使木马或恶意工具即使取得了涉密信息也无法保存所取得的信息，使数据始终存在于可控的安全范围内；另一方面，本地不再保存在涉密状态下的任何数据，因此防止了涉密人员的主动泄密和被动泄密；
2、接收来自硬件映射层的硬件指令可以100％的筛查所有指令，进一步提高数据安全性。
上述实施例中还详细的介绍了本发明提供的安全读取方法和装置，与现有技术相比，具有如下优点：
1、数据安全读取方法配合数据安全存储方法使数据始终存在于可控的安全范围内，并且保证在安全存储数据(转储)之后，可以将转储数据读出；由于本地将不再保存在涉密状态下的任何数据，因此防止了涉密人员的主动泄密和被动泄密；
2、安全存储设备为远程存储设备时，可以为多个终端共享，提高安全存储设备的空间使用效率。
数据黑洞处理方法
定义：
1、数据黑洞系统：是指将计算设备运行过程中的过程数据和运行结果存储至特定存储位置并且能够确保计算设备正常运行的系统；
数据黑洞系统破坏了计算设备的完整性，并且通过破坏计算设备的完整性实现了即使在恶意代码或涉密人员具有最高数据权限时也不会让数据泄密的数据安全系统。
2、数据黑洞终端：是指部署了数据黑洞系统的计算设备(例如计算机终端)，数据黑洞终端将其运行过程中所产生的过程数据和结果数据全部转移存储至一特定的存储位置。
3、重定向：指计算机在运行过程中所产生的过程数据或结果根据计算机运行要求进行持久化时，在不对计算机任何逻辑和代码进行修改的情况下，将持久化的位置定向至一个特定存储位的处理方法。
4、数据写：一种数据持久化操作。
5、数据黑洞空间：在下文中定义。
6、黑洞存储区：在下文中定义。
根据本发明一个实施例，提供一种提高数据安全性的过程A10，包括：
A11、为用户建立一个数据黑洞空间，包括两种模式(可以任选一种进行)：
A111本地部署模式：数据黑洞终端在本地的数据存储设备上创建一个数据存储区，该数据存储区为终端数据重定向的目标区域，该数据存储区称为黑洞存储区；
此数据存储区与用户的对应关系可以是一个数据存储区对应多个本机(或本地)用户，也可以是多个存储区对应多个本机(或本地)用户；
该数据存储区只能由数据黑洞系统访问，不能被终端计算设备的操作系统或应用层(例如应用软件)访问；
A112网络部署模式：在网络上的存储位置创建一个数据存储区，此数据存储区为终端数据重定向的目标区域；
此数据存储区与网络终端上的用户的对应关系可以是一一对应关系；该存储区也可以对应本机(或本地)用户。
经过上述本地部署模式或者网络部署模式部署，为用户建立了数据黑洞空间(简称黑洞空间)。
A12、建立用户与重定向存储空间之间的对应关系。
当终端用户第一次登录数据黑洞终端时，数据黑洞终端将根据用户信息为其建立对应的数据黑洞的数据存储区。
A13、重定向终端计算设备所有的数据持久化操作。
根据本发明一个实施例，用户登录到数据黑洞终端后，数据黑洞终端确定数据黑洞存储区存在并能建立用户与黑洞存储区之间的对应关系，该用户在本机(数据黑洞终端)上所有的数据写将被重定向至数据存储区。
采用上述过程A10后，黑洞空间与用户对应，当黑客通过漏洞、后门、木马等恶意代码取得数据权限后将可以对数据进行复制、转储、发送、截留。但所有向外部设备、端口、用户、终端转发出的数据将被重定向到数据黑洞空间(与用户对应的黑洞空间)中，并在数据黑洞空间(与用户对应的黑洞空间)内完成。因此所有的数据窃取、截留、输出等作业都被在数据黑洞空间内实现。当涉密(有数据权限)人员试图将数据私自留存、私自备份、发送、输出时，所有的数据处理作业都在数据黑洞空间(与用户对应的黑洞空间)内完成，使恶意操作无法泄密。
根据本发明一个实施例，如图27所示，能够执行上述过程A10的计算设备称为数据黑洞服务器，数据黑洞服务器通过网络与计算终端1(图中显示为终端1)、计算终端2(图中显示为终端2)、…、计算终端N(图中显示为终端N)数据连接/耦接。数据黑洞服务器向 各个终端部署数据黑洞系统，使各个终端成为数据黑洞终端(图中显示为数据黑洞终端1、数据黑洞终端2、…、数据黑洞终端N)。
并且，黑洞存储区(图中显示为映射块1、映射块2、…、映射块N)位于数据黑洞服务器上(或服务器所连接的磁盘阵列服务器)。这样，数据黑洞空间包括数据黑洞服务器的黑洞存储区与各个数据黑洞终端的内存，从而，数据黑洞终端的计算过程数据和结果数据都会被存储到黑洞存储区中。数据黑洞系统破坏了计算设备的完整性，并且通过破坏计算设备的完整性实现了即使在恶意代码或涉密人员具有最高数据权限时也不会让数据泄密的数据安全系统。
根据上述过程A10，根据本发明一个实施例，提供一种数据黑洞处理方法S90，如图28所示，包括：
S91，在计算设备(例如计算机、手持通信设备、智能终端等)部署数据黑洞系统，成为数据黑洞终端；
S92，建立数据黑洞空间，包括：
1)在计算设备本地开辟一个数据存储区(称为黑洞存储区)，以及本地内存；和/或
2)在网络一个存储位置开辟一个数据存储区(称为黑洞存储区)，以及本地内存；
S93，为计算设备的用户与数据黑洞空间或数据黑洞空间的一部分建立对应关系，例如当用户登录数据黑洞终端，使终端用户与数据黑洞空间形成一一对应关系；
S94，数据黑洞终端将用户操作所产生的“数据写”重定向到与该用户对应的数据黑洞空间，例如重定向到与该用户对应的黑洞存储区；
S95，阻止对于本地存储设备的数据持久化操作，并且阻止通过 本地端口对非数据黑洞终端的数据输出，从而保证进入数据黑洞终端或者数据黑洞空间的数据只在数据黑洞空间中存在。
根据本发明的另一个实施例，步骤S91和S92的内容——在计算设备上部署黑洞系统和为用户建立数据黑洞空间可以在一个步骤内完成。
根据本发明的另一个实施例，步骤S93可以只在用户第一次登陆黑洞终端时进行，也可以在用户每次登陆黑洞终端时进行。
根据本发明的另一个实施例，步骤S93与步骤S94的内容可以在一个步骤中完成，即：
当用户发生“数据写”时，按照预设的对应方式，将该用户的“数据写”全部重定向到与该用户对应的数据黑洞空间。
其中，预设的对应方式可以包括固定对应，例如，每个用户在黑洞空间对应一定容量的存储空间。预设的对应方式可以包括动态对应，例如，每个用户在黑洞空间先对应预设容量的存储空间，如果用户存储数据超过该预设的容量，为用户分配更大的(例如为预设容量的2、4或8倍等)存储空间。本领域普通技术人员可以理解，用户与存储空间之间的对应方式和分配方式可以按需选择。
根据本发明一个实施例，基于上述过程A10，用户登录到数据黑洞终端后，数据黑洞终端确定数据黑洞存储区存在并能建立用户与黑洞存储区之间的对应关系，该用户在本机(数据黑洞终端)上所有的数据写将被重定向至数据存储区。并且，所有的数据读将根据数据的版本或由用户自行选择读取存储区数据或本机(或本地)数据。
根据上述实施例中提供的数据安全读取方法(例如S5000)和装置(数据安全读取装置8100)，为了提供用户选择功能，可以做适应 性修改。
根据本发明一个实施例，提供一种数据安全读取方法S80包括：
S81，接收硬件指令；
S82，分析并判断该硬件指令是否为读取指令；
S83，如果是读取指令，根据映射位图的知识数据的值，如果欲读取的数据已经被转储，则：
为用户提供选择操作机会，让用户选择是读取存储区数据还是读取本机(或本地)数据；
根据用户的选择来读取存储区数据或本机(或本地)数据，即如果用户选择读取存储区域；
S84，将修改后的硬件指令发送到硬件层。
上述数据安全读取方法S80的其他方面和步骤可以参考数据安全读取方法S5000，这里不再赘述。
同理，本实施例中的数据安全读取装置可以适应性修改，例如，将数据安全读取装置8100中的指令修改单元8130修改为还适于执行S83的操作，其他单元可以参考数据安全读取装置8100，这里不再赘述。
单机版数据黑洞处理方法
在上述步骤S92中，当建立数据黑洞空间为在计算设备本地开辟一个数据存储区(称为黑洞存储区)，则该计算设备所执行的数据黑洞处理方法为单机版数据黑洞处理方法。
如图29a所示，计算设备70包括：应用层(或者应用层对应的单元)71、操作系统内核层(或者操作系统内核层对应的单元)72、硬件映射层(或者硬件映射层对应的单元)73、安全层(或者安全层 对应的单元)74，这些层次或单元与之前的实施例的计算设备200所包括的用户界面层201、应用层202、操作系统内核层203、硬件映射层204、安全层205以及硬件层206对应，不再赘述。
移动计算设备70还包括：硬件层75。
硬件层75包括设备或单元如下：CPU、网卡和硬盘75a。
硬盘75a包括：普通存储区域和安全存储区域75a1。
该安全存储区域75a1也可以为加密存储区域，在数据存取之前或之后需要对数据进行加解密处理。
另外，当上述数据安全读取方法(例如S5000)和存储方法(例如S4000)应用在独立的计算设备时，上述方法成为单机版的数据安全存储和读取方法；该独立计算设备(例如PC)包括相互独立的本地存储空间和安全存储空间。
例如，单机版数据安全存储方法包括：
接收硬件指令；
如果所述硬件指令是存储指令，将所述存储指令中的目标地址修改为对应的在所述计算设备上的安全存储空间的存储地址；和
将修改后的存储指令发送到硬件层执行。
例如，单机版数据安全读取方法包括：
接收硬件指令；
如果所述硬件指令是读取指令，获取读取指令中的源地址，查找第一映射位图，并根据映射位图的数据修改读取指令中的读取地址；和
将修改后的硬件指令发送到硬件层执行。
结合前述实施例中提供的安全存储装置和安全读取装置(例如装置7100、装置8100、装置9100等)，按需要删减其中不需要的单元，可以成为单机版数据安全存储和读取装置。
根据本发明一个实施例，如图29b所示，计算设备包括：相互独立的本地存储空间87和安全存储空间88，以及单机版数据安全存储和读取装置80；其中安全存储空间对于操作系统是不可用的(例如不可见或者不可访问)，只能由单机版数据安全存储和读取装置80访问；
其中，所述单机版数据安全存储和读取装置80包括：
接收单元81，适于接收硬件指令；
指令分析单元82，适于判断所述硬件指令是否为存储或读取指令，产生判断信号；
指令修改单元83，适于当所述硬件指令为存储指令时，将所述存储指令中的目标地址修改为对应的在安全存储空间内的存储地址；还适于当所述硬件指令为读取指令时，查找映射位图，并根据映射位图的数据修改所述读取指令中的读取地址；所述映射位图用于表示本地存储空间的地址的数据是否转储到所述安全存储空间，映射位图已经在前述实施例中详细描述，这里不再赘述；
发送单元84，适于将修改后的读取或存储指令发送到硬件层执行。
上述计算设备还可以包括：更新单元85，适于在指令修改单元83修改所述存储指令之后，更新映射位图中所述目标地址对应的位。
上述计算设备还可以包括：加解密单元86，适于对进出安全存储空间88的数据进行加密和解密。
结合图29a，根据本发明一个实施例，提供一种单机版数据黑洞处理方法，如图30所示，包括：
Sa1，在计算设备(例如计算机、手持通信设备、智能终端等)部署数据黑洞系统，成为数据黑洞终端；
Sa2，建立数据黑洞空间，包括：在计算设备本地开辟一个数据存储区(称为黑洞存储区)以及本地内存，其中，数据存储区只能由数据黑洞系统访问，不能被终端计算设备的操作系统或应用层访问；
Sa3，为计算设备的用户与数据黑洞空间或数据黑洞空间的一部分建立对应关系，例如，当用户登录数据黑洞终端，使终端用户与数据黑洞空间形成一一对应关系；
Sa4，数据黑洞终端将用户操作所产生的“数据写”重定向到与该用户对应的数据黑洞空间并加密，例如，重定向到与该用户对应的黑洞存储区；
Sa5，阻止对于本地存储设备(除黑洞存储区外)的数据持久化操作，并且阻止通过本地端口对非数据黑洞终端的数据输出，从而保证进入数据黑洞终端或者数据黑洞空间的数据只在数据黑洞空间中存在。
其中，Sa1表示步骤1。
基于移动存储器的数据黑洞处理方法
在涉密人员操作移动计算设备(例如笔记本电脑或平板电脑)时，如果不方便与远程安全存储设备(用作黑洞存储区)连接，可以使用移动存储设备作为安全存储设备。将计算设备(包括移动计算设备)的安全性转化为移动存储设备的安全性。
根据本发明一个实施例，如图31所示，其中涉密人员通过移动计算设备20操作涉密数据，由于涉密数据不能存放在本地，而且位 于网络的安全存储设备不方便连接，此时可以利用指定的移动存储设备作为涉密数据的载体，即利用移动存储设备作为临时的安全存储设备。
图中移动计算设备20包括：用户界面层21、应用层22、操作系统内核层23、硬件映射层24、安全层25以及硬件层26与之前的实施例的计算设备200所包括的用户界面层201、应用层202、操作系统内核层203、硬件映射层204、安全层205以及硬件层206对应，不再赘述。
为了方便涉密人员的工作，本发明上述实施例中提供的数据安全读取和存储方法可以与安全存储设备整合在一个移动存储设备中，作为便携式设备使用。
如图32所示，根据本发明一个实施例，提供一种移动存储设备(即移动存储设备)50，其中包括：应用层(或者应用层对应的单元)52、操作系统内核层(或者操作系统内核层对应的单元)53、硬件映射层(或者硬件映射层对应的单元)54、安全层(或者安全层对应的单元)55。这些层次或单元与之前的实施例的计算设备200所包括的用户界面层201、应用层202、操作系统内核层203、硬件映射层204、安全层205以及硬件层206对应，不再赘述。
移动存储设备50还包括：硬件层(或者硬件层对应的单元)56，其中包括数据接口56a以及安全存储区域56b。数据接口56a用于连接其他计算设备(通过相应的数据接口)，安全存储区域56b用于作为数据安全存储和读取方法中的安全存储设备(或者用作黑洞存储区)。
计算终端40包括：应用层(或者应用层对应的单元)41、操作系统内核层(或者操作系统内核层对应的单元)42、硬件映射层(或者硬件映射层对应的单元)43以及硬件层(或者硬件层对应的单元) 44。其中，硬件层44包括CPU 44a、硬盘44b、网卡44c、数据接口44d(例如USB接口)等硬件单元。
其中，数据接口56a与数据接口44d耦接/连接。安全存储区域56b对移动存储设备50上的操作系统是不可用的。
移动存储设备50通过数据接口与计算终端40连接，利用计算终端40的计算资源完成移动存储设备本身系统(包括层52～55)的工作，数据保存在安全存储区域56b中。
其中，移动存储设备50进行的数据存储的过程包括：
步骤A1、移动存储设备50通过数据接口56a、44d与计算终端40耦接；
步骤A2、计算终端40重新启动，计算终端40的CPU 44a运行移动存储设备50携带的系统(包括层52～55对应的应用软件和系统软件)；
步骤A3、用户通过计算终端40的I/O(输入输出设备，例如键盘44b)操作移动存储设备50携带的系统；
步骤A4、安全层55接收来自硬件映射层54的硬件指令；
步骤A5、如果所述硬件指令是存储或者读取指令，安全层55修改所述存储指令中的目标地址或者读取指令中的源地址为对应的在所述移动存储设备上的安全存储区域56b中的存储地址；和
步骤A6、将修改后的存储指令发送到计算终端40的CPU 44a。
在步骤A4-A5中，安全层55所进行的数据转移存储的过程与之前的实施例中提供数据安全存储和读取方法相同，不再赘述。
本实施例中，在安全存储区域56b与计算终端40的本地存储设备44b之间建立映射关系和映射表(即位图)的过程在之前描述的数 据安全存储方法中也有详细的记载，不再赘述。
另外，本发明上述实施例中提供的数据安全读取和存储方法可以与安全存储设备整合在一个移动计算设备(例如笔记本电脑或者智能手机)中，作为便携式设备使用。
基于移动存储器的数据黑洞处理装置
上述移动计算设备和移动存储设备可以结合前述实施例中提供的安全存储装置和安全读取装置(例如装置7100、装置8100、装置9100等)，删减其中不需要的单元，完成移动数据安全存储和读取方法。本领域技术人员可以理解，上述移动计算设备和移动存储设备与安全存储装置和安全读取装置的结合方式可以根据需要来设计。
根据本发明一个实施例，提供一种移动计算设备。该移动计算设备(例如笔记本电脑或者智能手机)包括：相互独立的本地存储空间和安全存储空间；和数据安全存储和读取装置。其中安全存储空间对于操作系统是不可用的(例如不可见或者不可访问)。
其中，所述数据安全存储和读取装置包括：
接收单元，适于接收硬件指令；
指令分析单元，适于判断所述硬件指令是否为存储或读取指令，产生判断信号；
指令修改单元，适于当所述硬件指令为存储指令时，将所述存储指令中的目标地址修改为对应的在安全存储空间内的存储地址；还适于当所述硬件指令为读取指令时，查找映射位图，并根据映射位图的数据修改所述读取指令中的读取地址；所述映射位图用于表示本地存储空间的地址的数据是否转储到所述安全存储空间；
发送单元，适于将修改后的读取或存储指令发送到硬件层执行。
本实施例中，硬件指令来自硬件映射层。根据本发明另一个实施例，上述的移动计算设备还包括：更新单元，适于在指令修改单元修改所述存储指令之后，更新映射位图中所述目标地址对应的位。
上述移动计算设备(例如笔记本)，用于保护个人或企业用户数据外部应用授权后的数据安全保护。系统假定个人或企业用户在PC、笔记本上存有涉密数据，但因为系统有后门、漏洞、木马或其它未知的恶意代码而无法保障PC/笔记本上数据不会被泄密，同时也无法保证设备丢失后的数据安全保护。企业可用在数据从内网导出数据时，实现对数据的使用过程的保护和监控。
本领域技术人员可以理解，上述移动计算设备(例如笔记本)也可以是独立计算机(例如PC)。
根据本发明一个实施例，提供一种移动存储设备。该移动存储设备(例如U盘)包括：数据接口，安全存储空间，以及数据安全存储和读取装置；所述数据接口适于与计算设备耦接；所述计算设备包括本地存储空间，用于运行移动存储设备上的操作系统，并用于为所述数据安全存储和读取装置提供计算资源。
数据安全存储和读取装置包括：
接收单元，适于接收硬件指令；
指令分析单元，适于判断所述硬件指令是否为存储或读取指令，产生判断信号；
指令修改单元，适于当所述硬件指令为存储指令时，将所述存储指令中的目标地址修改为对应的在安全存储空间内的存储地址；还适于当所述硬件指令为读取指令时，查找映射位图，并根据映射位图的数据修改所述读取指令中的读取地址；所述映射位图用于表示本地存 储空间的地址的数据是否转储到所述安全存储空间；和
发送单元，适于将修改后的读取或存储指令发送到计算设备的硬件层执行。
根据本发明另一个实施例，上述移动存储设备还包括：更新单元，适于在指令修改单元修改所述存储指令之后，更新映射位图中所述目标地址对应的位。
根据本发明另一个实施例，硬件指令可以来自硬件映射层。
上述移动存储设备(例如U盘)，以部署了数据安全存储和读取装置(或数据安全存储和读取方法)的U盘/移动硬件盘作为导出数据载体，用于保护导出数据的安全。核心是确保导出到外部的数据在非可控环境中使用时不会在数据使用过程中留下数据痕迹，同时确保在有系统后门、漏洞、木马或其它未知的恶意代码的环境中，数据不被复制或截留。
上述实施例中，映射位图用于表示本地存储空间的地址的数据是否转储到所述安全存储空间。在本发明其他实施例中，也可以使用文件对应表的形式，即本地数据以文件的形式被转移存储到所述安全存储空间。
本发明提供的上述方法和装置，相对于现有技术，具有如下优点：
A.可实现数据操作的过程追踪，具有对恶意代码、后门和木马数据操作的追踪能力；
B.具有在安全域内部实现文件操作授权，并确保文件授权后仍具有完全的监控能力；
C.能实现安全域间的文件授权，在授权后仍具有完全监控能力， 并可对授权文件的实现定期、定次使用、定期销毁的能力；
D.可实现终端使用与服务器数据的全加密。
本领域的技术人员(本领域的普通技术人员)可以理解，上述的数据安全存储方法、读取方法及传输方法可使用软件或硬件的形式来实现：
(1)如果以软件实现，则上述方法对应的步骤以软件代码的形式存储在计算机可读介质上，成为软件产品；
(2)如果以硬件实现，则上述方法对应的步骤以硬件代码(例如Verilog)的形式描述，并固化(经过物理设计/布局布线/晶圆厂流片等过程)成为芯片产品(例如处理器产品)。
具体的，如本领域的普通技术人员将意识到的那样，本发明可以具体实现成一种系统、方法或计算机程序产品。因此，本发明可以采用完全硬件实施例、完全软件实施例(包括固件、驻留软件、微码等)的形式、或者组合了软件和硬件方面的实施例的形式，它们在此可以总称为“电路”、“模块”或“系统”。
此外，本发明可以采用在表达有计算机可用的程序代码的任何有形的介质中具体实现的计算机程序产品的形式。
一个或多个计算机可用或计算机可读介质的任何组合都可以被使用。计算机可用或计算机可读介质可以是(但不限于)例如电子的、磁的、光的、电磁的、红外的或半导体的系统、装置、设备或传播介质。计算机可读介质的更为具体的例子(非穷举列表)将包括以下：具有一个或多个导线的电气连接、便携式计算机磁盘、硬盘、随机访问存储器(RAM)、只读存储器(ROM)、可擦写可编程只读存储器(EPROM或闪存)、光纤、便携式致密盘只读存储器(CD-ROM)、光存储设备、诸如支持因特网或内部网的那些传输介质，或者磁存储设备。
注意，计算机可用或计算机可读介质甚至可以是纸或可以打印程序的另外的合适的介质，因为程序可以经由例如对纸或其他介质的光学扫描而被电气捕获、接着被编辑、被翻译或者以合适的方式来进行其他处理，如果必要，并且接着被存储在计算机存储器中。在本文档的上下文中，计算机可用的或计算机可读的介质可以是可以包含、存储、通信、传播或传送程序以供由指令执行系统、装置或设备或结合其来使用的任意介质。计算机可用介质可以包括其中包含计算机可用程序代码的传播的数据信号，其可以是在基带中或者可以作为载波的一部分。计算机可用程序代码可以通过使用任何合适的介质来传输，这些介质包括但不限于无线、有线、光缆、RF等等。
用于执行本发明的操作的计算机程序代码可以用一种或多种编程语言的任何组合来编写，这些语言包括诸如Java、Smalltalk、C++等等之类的面向对象的编程语言和诸如“C”编程语言或类似的编程语言之类的传统过程语言。程序代码可全部在用户的计算机上、部分地在用户的计算机上作为单机软件包执行、部分地在用户计算机上且部分地在远程计算机上执行、或者全部在远程计算机或服务器上执行。在后面这种情况下，远程计算机可以经由任何类型的网络连接到用户计算机，这些网络包括局域网(LAN)或广域网(WAN)或者可以连接到外面计算机的连接(例如，通过使用因特网服务提供商的因特网)。
应该注意到并理解，在不脱离后附的权利要求所要求的本发明的精神和范围的情况下，能够对上述详细描述的本发明做出各种修改和改进。因此，要求保护的技术方案的范围不受所给出的任何特定示范教导的限制。

Claims (17)

  1. 一种基于移动存储器的数据黑洞处理方法，包括：
    在计算设备部署数据黑洞系统，使之成为数据黑洞终端；所述数据黑洞系统是指将所述计算设备运行过程中的过程数据和运行结果存储至特定存储位置并且能够确保所述计算设备正常运行的系统；
    建立数据黑洞空间，包括在所述移动存储器上开辟的数据存储区域，其中，所述数据存储区只能由数据黑洞系统访问，不能被操作系统或应用层软件访问，所述移动存储器与所述计算设备耦接；
    为所述计算设备的用户与所述数据黑洞空间或所述数据黑洞空间的一部分建立对应关系；
    将所述用户在所述数据黑洞终端操作所产生的数据写重定向到与所述该用户对应的所述数据黑洞空间；
    阻止对于本地存储设备的数据持久化操作，并且阻止通过本地端口对非数据黑洞终端的数据输出，保证进入所述数据黑洞终端或者所述数据黑洞空间的数据只在所述数据黑洞空间存在。
  2. 如权利要求1所述的基于移动存储器的数据黑洞处理方法，其中，部署所述数据黑洞系统包括部署数据安全存储方法，将用所述户在所述数据黑洞终端操作所产生的数据写重定向到与所述用户对应的所述数据黑洞空间通过所述数据安全存储方法实现，所述数据安全存储方法包括：
    接收硬件指令；
    如果该硬件指令是存储指令，则修改所述存储指令中的目标地址 为当前用户对应的所述数据黑洞空间的存储地址；和
    将修改后的存储指令发送到硬件层执行。
  3. 如权利要求2所述的基于移动存储器的数据黑洞处理方法，其中，部署所述数据黑洞系统包括部署数据安全读取方法，所述数据安全读取方法包括：
    接收硬件指令；
    如果该硬件指令是读取指令并且其欲读取的数据已经被存储到所述数据黑洞空间，更改读取指令的源地址为当前用户对应的所述数据黑洞空间的存储地址；
    将修改后的读取指令发送到硬件层执行。
  4. 如权利要求2所述的基于移动存储器的数据黑洞处理方法，其中，部署所述数据黑洞系统包括部署数据安全读取方法，所述数据安全读取方法包括：
    接收硬件指令；
    如果该硬件指令是读取指令并且其欲读取的数据已经被存储到所述数据黑洞空间，为所述用户提供一种选择：读取本地数据或所述数据黑洞空间数据，并根据用户的选择来读取所述本地数据或所述数据黑洞空间数据；
    将修改后的读取指令发送到硬件层执行。
  5. 如权利要求4所述的基于移动存储器的数据黑洞处理方法，其中，读取所述数据黑洞空间数据包括：
    更改所述读取指令的源地址为当前用户对应的所述数据黑洞空 间的存储地址。
  6. 如权利要求3或4所述的基于移动存储器的数据黑洞处理方法，其中，接收所述硬件指令包括：
    接收来自硬件抽象层的硬件指令。
  7. 如权利要求1所述的基于移动存储器的数据黑洞处理方法，其中，部署所述数据黑洞系统包括部署数据安全存储方法，将所述用户在所述数据黑洞终端操作所产生的数据写重定向到与所述用户对应的所述数据黑洞空间通过数据安全存储方法实现，所述数据安全存储方法包括：
    缓存指令运行环境，包括地址寄存器，所述地址寄存器用于保存下一条将要运行的机器指令的地址，该地址为第一地址；
    获取待调度的机器指令片段，其中，所述待调度的机器指令片段的最后一条指令为第一程序转移指令；
    分析所述待调度的机器指令片段中的每一条指令，如果其为存储指令，则修改所述存储指令中的目标地址为对应的数据黑洞空间的存储地址；
    在所述第一程序转移指令前，插入第二程序转移指令，生成具有第二地址的重组指令片段，其中，所述第二程序转移指令指向指令重组平台的入口地址；
    将所述地址寄存器中的所述第一地址修改为第二地址；和
    恢复所述指令运行环境。
  8. 如权利要求1所述的基于移动存储器的数据黑洞处理方法， 其中，部署所述数据黑洞系统包括部署数据安全存储方法，将所述用户在所述数据黑洞终端操作所产生的数据写重定向到与该用户对应的所述数据黑洞空间通过所述数据安全存储方法实现，所述数据安全存储方法包括：
    缓存指令运行环境；
    从第一存储位置读取目标地址，根据所述目标地址获取待调度的机器指令片段；所述待调度的机器指令片段的最后一条指令为第一程序转移指令；
    在所述第一存储位置保存所述第一程序转移指令的目标地址；
    分析所述待调度的机器指令片段中的每一条指令，如果其为存储指令，则修改所述存储指令中的目标地址为对应的所述数据黑洞空间的存储地址；
    将所述第一程序转移指令替换为第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址；和
    恢复所述指令运行环境，并跳转到所述第二地址继续执行。
  9. 如权利要求1所述的基于移动存储器的数据黑洞处理方法，其中，部署所述数据黑洞系统包括部署数据安全存储方法，将所述用户在所述数据黑洞终端操作所产生的数据写重定向到与该用户对应的所述数据黑洞空间通过数据安全存储方法实现，所述数据安全存储方法包括：
    缓存指令运行环境；
    获取栈中保存的程序转移指令的地址和参数，计算下一条即将运行的指令地址，该地址为第一地址；
    根据所述第一地址获取待调度的机器指令片段；其中，所述待调度的机器指令片段的最后一条指令为第一程序转移指令；
    分析所述待调度机器指令片段中的每一条指令，如果其为存储指令，则修改所述存储指令中的目标地址为对应的所述数据黑洞空间的存储地址；
    替换所述第一程序转移指令为压栈指令，在所述压栈指令中记录所述第一程序转移指令的地址和操作数；
    在所述压栈指令之后加入第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址；和
    恢复所述指令运行环境，并跳转到所述第二地址继续执行。
  10. 如权利要求7所述的基于移动存储器的数据黑洞处理方法，其中，部署所述数据黑洞系统包括部署数据安全读取方法，所述数据安全读取方法包括：
    缓存指令运行环境；所述指令运行环境包括地址寄存器，所述地址寄存器保存下一条将要运行的机器指令的地址，该地址为第一地址；
    获取待调度的机器指令片段；其中，所述待调度的机器指令片段的最后一条指令为第一程序转移指令；
    分析所述待调度的机器指令片段中的每一条指令，如果该硬件指 令是读取指令并且其欲读取的数据已经被存储到所述数据黑洞空间，更改所述读取指令的源地址为对应的所述数据黑洞空间的存储地址；
    在所述第一程序转移指令前，插入第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址；
    将所述地址寄存器中的所述第一地址修改为所述第二地址；和
    恢复所述指令运行环境。
  11. 如权利要求8所述的基于移动存储器的数据黑洞处理方法，其中，部署所述数据黑洞系统包括部署数据安全读取方法，所述数据安全读取方法包括：
    缓存指令运行环境；
    从第一存储位置读取目标地址，根据所述目标地址获取待调度的机器指令片段；所述待调度的机器指令片段的最后一条指令为第一程序转移指令；
    在所述第一存储位置保存所述第一程序转移指令的目标地址；
    分析所述待调度的机器指令片段中的每一条指令，如果该硬件指令是读取指令并且其欲读取的数据已经被存储到所述数据黑洞空间，更改所述读取指令的源地址为对应的所述数据黑洞空间的存储地址；
    将所述第一程序转移指令替换为第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址；和
    恢复所述指令运行环境，并跳转到所述第二地址继续执行。
  12. 如权利要求9所述的基于移动存储器的数据黑洞处理方法，其中，部署所述数据黑洞系统包括部署数据安全读取方法，所述数据安全读取方法包括：
    缓存指令运行环境；
    获取栈中保存的程序转移指令的地址和参数，计算下一条即将运行的指令地址，该地址为第一地址；
    根据所述第一地址获取待调度的机器指令片段；其中，所述待调度的机器指令片段的最后一条指令为第一程序转移指令；
    分析所述待调度的机器指令片段中的每一条指令，如果该硬件指令是读取指令并且其欲读取的数据已经被存储到所述数据黑洞空间，更改所述读取指令的源地址为对应的所述数据黑洞空间的存储地址；
    替换所述第一程序转移指令为压栈指令，在所述压栈指令中记录所述第一程序转移指令的地址和操作数；
    在所述压栈指令之后加入第二程序转移指令，生成具有第二地址的重组指令片段；所述第二程序转移指令指向指令重组平台的入口地址；和
    恢复所述指令运行环境，并跳转到所述第二地址继续执行。
  13. 如权利要求7-12中任一项所述的基于移动存储器的数据黑洞处理方法，其中，所述获取待调度的机器指令片段包括：
    从所述地址寄存器读取待调度的机器指令地址；
    以程序转移指令为检索目标，检索所述机器指令地址指向的机器指令及其后续指令，直到发现第一个程序转移指令，称为第一程序转 移指令；所述程序转移指令指能够改变机器指令顺序执行流程的机器指令；
    将所述第一程序转移指令以及其之前的所有待调度的机器指令作为一个待调度的机器指令片段。
  14. 如权利要求7-12中任一项所述的基于移动存储器的数据黑洞处理方法，其中，所述获取待调度的机器指令片段包括：
    从所述地址寄存器读取待调度的机器指令地址；
    以程序转移指令为检索目标，检索所述机器指令地址指向的机器指令及其后续指令，直到发现第一个参数地址程序转移指令，称为第一程序转移指令；所述程序转移指令指能够改变机器指令顺序执行流程的机器指令；
    将所述第一程序转移指令以及其之前的所有待调度的机器指令作为一个待调度的机器指令片段。
  15. 一种移动存储设备，包括：移动版数据安全存取单元以及安全存储空间，其中，所述移动存储设备本身携带操作系统，安所述全存储空间对于所述操作系统及所述操作系统之上的软件是不可用的，只能由所述移动版数据安全存取单元访问；
    其中，当所述移动存储设备与所述计算设备耦接时，所述计算设备的CPU用于执行所述移动存储设备本身携带的操作系统，用户通过所述计算设备的I/O与所述移动存储设备进行交互，所述移动版数据安全存取单元接收来自所述移动存储设备本身携带的操作系统的指令并将其发送给所述计算设备的CPU；
    其中，移动版数据安全存取单元包括：
    接收单元，适于接收硬件指令；
    指令分析单元，适于判断所述硬件指令是否为存储或读取指令，产生判断信号；
    指令修改单元，根据所述判断信号，适于当所述硬件指令为存储指令时，将所述存储指令中的目标地址修改为对应的在所述安全存储空间内的存储地址；还适于当所述硬件指令为读取指令时，查找映射位图，并根据映射位图的数据修改所述读取指令中的读取地址，其中，所述映射位图用于表示所述计算设备的本地存储空间的地址的数据是否转储到所述安全存储空间；
    发送单元，适于将修改后的读取或存储指令发送到硬件层执行。
  16. 如权利要求15所述的移动存储设备，还包括：
    更新单元，适于在所述指令修改单元修改所述存储指令之后，更新所述映射位图中所述目标地址对应的位。
  17. 如权利要求15所述的移动存储设备，还包括：
    加解密单元，与所述安全存储空间耦接，适于对进出所述安全存储空间的数据进行加解密操作。
PCT/CN2015/073556 2014-03-04 2015-03-03 基于移动存储器的数据黑洞处理方法及移动存储器 WO2015131800A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
JP2016550598A JP6317821B2 (ja) 2014-03-04 2015-03-03 データブラックホール処理方法及びモバイルストレージデバイス
US15/116,193 US20160350530A1 (en) 2014-03-04 2015-03-03 Data blackhole processing method based on mobile storage device, and mobile storage device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410076582.1 2014-03-04
CN201410076582.1A CN103942499B (zh) 2014-03-04 2014-03-04 基于移动存储器的数据黑洞处理方法及移动存储器

Publications (1)

Publication Number Publication Date
WO2015131800A1 true WO2015131800A1 (zh) 2015-09-11

Family

ID=51190165

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/073556 WO2015131800A1 (zh) 2014-03-04 2015-03-03 基于移动存储器的数据黑洞处理方法及移动存储器

Country Status (4)

Country Link
US (1) US20160350530A1 (zh)
JP (1) JP6317821B2 (zh)
CN (1) CN103942499B (zh)
WO (1) WO2015131800A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109325354A (zh) * 2017-07-31 2019-02-12 阿里巴巴集团控股有限公司 数据的存储、处理及读取方法、数据存储设备和系统
US11721806B2 (en) 2020-08-28 2023-08-08 Echion Technologies Limited Active electrode material

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103942499B (zh) * 2014-03-04 2017-01-11 中天安泰（北京）信息技术有限公司 基于移动存储器的数据黑洞处理方法及移动存储器
US10454619B2 (en) * 2016-11-08 2019-10-22 Microsoft Technology Licensing, Llc Advanced retry mechanism for transmitting large datasets
CN106919853A (zh) * 2017-03-01 2017-07-04 中天安泰（北京）信息技术有限公司 一种计算设备配置装置及配置方法
CN106874797A (zh) * 2017-03-01 2017-06-20 中天安泰（北京）信息技术有限公司 一种计算设备配置方法及计算设备配置装置
CN106874790A (zh) * 2017-03-01 2017-06-20 中天安泰（北京）信息技术有限公司 一种计算设备运行方法及计算设备
CN106960159A (zh) * 2017-05-09 2017-07-18 深圳市夏日晨光数码有限公司 具有安全加密功能的安全盘及安全加密方法
CN107240408B (zh) * 2017-05-11 2019-05-10 中国科学院信息工程研究所 针对cd-rom光盘介质的读写管控系统
JP6310125B1 (ja) * 2017-08-17 2018-04-11 九州電力株式会社 データ保護システム、データ保護方法及びプログラム
CN111222119A (zh) * 2019-12-27 2020-06-02 武汉船舶通信研究所（中国船舶重工集团公司第七二二研究所） 转储分析终端及机车运行数据的安全转储分析方法
CN114385067B (zh) * 2020-10-19 2023-07-18 澜起科技股份有限公司 用于存储器系统的数据更新方法和存储器控制器
TWI780696B (zh) * 2021-05-10 2022-10-11 創鑫智慧股份有限公司 查找表壓縮方法與查找表讀取方法及其計算設備、主機與裝置
US11481134B1 (en) * 2021-05-24 2022-10-25 Sap Se Adaptive caching for hybrid columnar databases with heterogeneous page sizes

Citations (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101082886A (zh) * 2006-05-30 2007-12-05 松下电器产业株式会社 存储器数据保护装置及ic卡用lsi
WO2012145916A1 (zh) * 2011-04-29 2012-11-01 北京中天安泰信息科技有限公司 数据安全存储方法及装置
WO2012145915A1 (zh) * 2011-04-29 2012-11-01 北京中天安泰信息科技有限公司 数据安全读取方法及装置
WO2012145917A1 (zh) * 2011-04-29 2012-11-01 北京中天安泰信息科技有限公司 运行时指令重组方法及装置
CN103679039A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 数据安全存储方法及装置
CN103679041A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 数据安全读取方法及装置
CN103677746A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 指令重组方法及装置
CN103677769A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 指令重组方法及装置
CN103679040A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 数据安全读取方法及装置
CN103677770A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 指令重组方法及装置
CN103679042A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 数据安全存储方法及装置
CN103927493A (zh) * 2014-03-04 2014-07-16 北京中天安泰信息科技有限公司 数据黑洞处理方法
CN103942492A (zh) * 2014-03-04 2014-07-23 北京中天安泰信息科技有限公司 单机版数据黑洞处理方法及计算设备
CN103942499A (zh) * 2014-03-04 2014-07-23 北京中天安泰信息科技有限公司 基于移动存储器的数据黑洞处理方法及移动存储器

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7058973B1 (en) * 2000-03-03 2006-06-06 Symantec Corporation Network address translation gateway for local area networks using local IP addresses and non-translatable port addresses
GB2398134A (en) * 2003-01-27 2004-08-11 Hewlett Packard Co Applying a data handing policy to predetermined system calls
JP4347582B2 (ja) * 2003-02-04 2009-10-21 パナソニック株式会社 情報処理装置
CN1926616B (zh) * 2004-01-19 2011-09-14 特科2000国际有限公司 使用存储器地址映射表的便携式数据存储设备
US20050261857A1 (en) * 2004-05-21 2005-11-24 Clark Jones System and method for linking and loading compiled pattern data
US7467272B2 (en) * 2004-12-16 2008-12-16 International Business Machines Corporation Write protection of subroutine return addresses
US20060149918A1 (en) * 2004-12-30 2006-07-06 Rudelic John C Memory with modifiable address map
JP4806557B2 (ja) * 2005-10-18 2011-11-02 株式会社日立製作所 ログを管理するストレージ装置及び計算機システム
US8898802B2 (en) * 2005-10-24 2014-11-25 Science Park Corporation Electronic computer data management method, program, and recording medium
US7882365B2 (en) * 2006-12-22 2011-02-01 Spansion Llc Systems and methods for distinguishing between actual data and erased/blank memory with regard to encrypted data
JP4287485B2 (ja) * 2007-07-30 2009-07-01 日立ソフトウエアエンジニアリング株式会社 情報処理装置及び方法、コンピュータ読み取り可能な記録媒体、並びに、外部記憶媒体
JP2009043133A (ja) * 2007-08-10 2009-02-26 Hitachi Software Eng Co Ltd 情報処理装置
US8578124B2 (en) * 2009-12-18 2013-11-05 Symantec Corporation Storage systems and methods with pre-reserve allocation
US20110153944A1 (en) * 2009-12-22 2011-06-23 Klaus Kursawe Secure Cache Memory Architecture
JP2011150388A (ja) * 2010-01-19 2011-08-04 Hitachi Solutions Ltd 機密区分情報に基づいたファイル保存先パス変換システム及び方法
CN102023817A (zh) * 2010-12-03 2011-04-20 深圳市江波龙电子有限公司 一种存储设备数据的读写控制方法及系统
CN103620613B (zh) * 2011-03-28 2018-06-12 迈克菲股份有限公司 用于基于虚拟机监视器的反恶意软件安全的系统和方法
US9015853B2 (en) * 2012-06-15 2015-04-21 The Regents Of The University Of California Concealing access patterns to electronic data storage for privacy
KR102139327B1 (ko) * 2012-11-15 2020-07-29 삼성전자주식회사 불휘발성 메모리 장치 및 불휘발성 메모리 장치의 동작 방법

Patent Citations (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101082886A (zh) * 2006-05-30 2007-12-05 松下电器产业株式会社 存储器数据保护装置及ic卡用lsi
WO2012145916A1 (zh) * 2011-04-29 2012-11-01 北京中天安泰信息科技有限公司 数据安全存储方法及装置
WO2012145915A1 (zh) * 2011-04-29 2012-11-01 北京中天安泰信息科技有限公司 数据安全读取方法及装置
WO2012145917A1 (zh) * 2011-04-29 2012-11-01 北京中天安泰信息科技有限公司 运行时指令重组方法及装置
CN103679039A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 数据安全存储方法及装置
CN103679041A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 数据安全读取方法及装置
CN103677746A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 指令重组方法及装置
CN103677769A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 指令重组方法及装置
CN103679040A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 数据安全读取方法及装置
CN103677770A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 指令重组方法及装置
CN103679042A (zh) * 2012-09-06 2014-03-26 北京中天安泰信息科技有限公司 数据安全存储方法及装置
CN103927493A (zh) * 2014-03-04 2014-07-16 北京中天安泰信息科技有限公司 数据黑洞处理方法
CN103942492A (zh) * 2014-03-04 2014-07-23 北京中天安泰信息科技有限公司 单机版数据黑洞处理方法及计算设备
CN103942499A (zh) * 2014-03-04 2014-07-23 北京中天安泰信息科技有限公司 基于移动存储器的数据黑洞处理方法及移动存储器

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109325354A (zh) * 2017-07-31 2019-02-12 阿里巴巴集团控股有限公司 数据的存储、处理及读取方法、数据存储设备和系统
CN109325354B (zh) * 2017-07-31 2022-06-28 阿里云计算有限公司 数据的存储、处理及读取方法、数据存储设备和系统
US11721806B2 (en) 2020-08-28 2023-08-08 Echion Technologies Limited Active electrode material

Also Published As

Publication number Publication date
JP2017514196A (ja) 2017-06-01
JP6317821B2 (ja) 2018-04-25
US20160350530A1 (en) 2016-12-01
CN103942499A (zh) 2014-07-23
CN103942499B (zh) 2017-01-11

Similar Documents

Publication Publication Date Title
WO2015131800A1 (zh) 基于移动存储器的数据黑洞处理方法及移动存储器
US9989043B2 (en) System and method for processor-based security
CN107977573B (zh) 用于安全的盘访问控制的方法和系统
KR101626424B1 (ko) 가상 머신 모니터 기반 안티 악성 소프트웨어 보안 시스템 및 방법
WO2015131801A1 (zh) 数据黑洞处理方法
CN103299284B (zh) 数据安全读取方法及装置
US10091213B2 (en) Systems and methods to provide secure storage
WO2008039241A1 (en) Methodology, system and computer readable medium for detecting and managing malware threats
JP2014515858A (ja) 実行中の命令を再結合する方法および装置
JP6255336B2 (ja) 安全なデータ格納方法およびデバイス
CN103488919A (zh) 一种可执行程序的保护方法及装置
Tian et al. A practical intel sgx setting for linux containers in the cloud
Zhao et al. TEE-aided write protection against privileged data tampering
WO2015131799A1 (zh) 单机版数据黑洞处理方法及计算设备
Hong et al. Personal privacy protection framework based on hidden technology for smartphones
KR20220085786A (ko) 랜섬웨어 방지
Καράμπορος File system security and protection from software-based fault injection attacks
Sun et al. Design and Implementation Considerations for a Virtual File System Using an Inode Data Structure
Yang et al. An Android Data Protection Scheme for System-as-Root Architectures
Surie et al. Rapid trust establishment for transient use of unmanaged hardware
Butler et al. SwitchBlade: Policy-Driven Disk Segmentation
Palm et al. Security Analysis of the Palm Operating System and its Weaknesses Against Malicious Code Threats

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15758276

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15116193

Country of ref document: US

ENP Entry into the national phase

Ref document number: 2016550598

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15758276

Country of ref document: EP

Kind code of ref document: A1