WO2017113781A1

WO2017113781A1 - Virtual memory data protection method and system

Info

Publication number: WO2017113781A1
Application number: PCT/CN2016/092339
Authority: WO
Inventors: 张维超
Original assignee: 福建联迪商用设备有限公司
Priority date: 2015-12-30
Filing date: 2016-07-29
Publication date: 2017-07-06
Also published as: CN105653980B; CN105653980A

Abstract

Provided are a virtual memory data protection method and system. The method comprises: setting the attribute of a virtual memory disk to be read-only; pre-setting a valid function, and a valid write operation of the virtual memory disk calling the valid function; calling a write function; and intercepting the write function, and modifying an address of the write function to be an address of the valid function. The present invention uses a protection principle of the read-write attribute of a virtual memory disk of an operating system, so as to establish a protection wall for memory data by means of modifying the attribute of the disk, so that virtual memory data is protected from the source, and any invalid write operation is prohibited; and meanwhile, the data of the virtual memory disk is validly modified or written by means of providing a unique valid access entry, the proceeding of a valid writing operation is ensured, and the valid modification and valid write are both realised.

Description

Description: A method for protecting virtual memory data and its system

[0001] The present invention relates to the field of disk storage, and more specifically to a method and system for protecting virtual memory data [0002]

Background technique

[0003] A virtual memory disk refers to the use of a portion of computer memory to simulate a hard disk, using HOOK API technology to operate on-disk data. An application needs to call an API function, then the application needs to know the address of the function; the HOOK API technology refers to replacing the address of the API function to be called with the address of another function MyCreateFileW, then whenever the program calls CreateFileW吋, will call MyCreateFileW.

[0004] Without the protection of the virtual memory data, the program can modify or write the virtual memory disk data without being allowed, including unpredictable errors (such as array out of bounds, etc.), which will The problem that the memory data is directly modified is invalid, so that the virtual memory disk cannot guarantee the security of the data.

[0005] Most of the existing memory disk technology is implemented based on the underlying system. The protection method of the memory data is to identify the memory attribute. By marking the block memory address with different identifiers, it is readable and writable or executable. . Based on the application layer's memory data protection, the current practice is to verify the memory data. The specific method is to calculate the memory data through some algorithms after the data is written in the memory block, and save the calculated result; In order to ensure the correctness of the data, it is necessary to recalculate the data of the protected memory, and then compare the calculated result with the saved result. If the data is consistent, it has not been modified.

[0006] The patent application with the application number 201210108928.2 discloses a data backup method, a server and a hot backup system, and judges the virtual according to the flag of the virtual memory area in the process of backing up the virtual memory area of the process address space. Whether the physical memory page corresponding to the memory area contains a dirty page of the memory, and if there is a flaw, the corresponding memory page is traversed, and the content of the internal physical dirty page is saved. [0007] The above patent application can only detect and back up a virtual memory disk that may have undergone data tampering, and the memory data protection effect is not good, and the protection cannot be performed from the root source.

technical problem

[0008] The technical problem to be solved by the present invention is: Providing a method and a system for protecting virtual memory data, which can effectively prevent memory data from being illegally falsified, and can be legally written at the same time.

Problem solution

Technical solution

[0009] In order to solve the above technical problem, the technical solution adopted by the present invention is:

[0010] A method for protecting virtual memory data, including

[0011] setting the attribute of the virtual memory disk to read-only;

[0012] preset legal function, the legal write operation of the virtual memory disk calls the legal function;

[0013] calling a write function;

[0014] intercepting the write function, modifying an address of the write function to an address of the legal function.

[0015] Another technical solution provided by the present invention is:

[0016] A virtual memory data protection system, including

[0017] a setting module, configured to set a virtual memory disk attribute to read-only;

[0018] a preset module, configured to preset a legal function, where the legal write operation of the virtual memory disk calls the normal function;

[0019] a calling module, configured to call a write function;

[0020] an intercepting module, configured to intercept the write function, and modify an address of the write function to be an address of the legal function.

Advantageous effects of the invention

Beneficial effect

[0021] The beneficial effects of the present invention are as follows: The virtual memory data protection based on the application layer in the prior art needs to be verified by the calculation of the memory data, the verification process is complicated, and the post-mortem verification is performed, and the protection effect is poor. The invention provides a method for protecting virtual memory data, by setting the attribute of the virtual memory disk to read-only, thereby preventing the illegal molecule from performing any modification operation on the data in the disk, and protecting the virtual memory disk from the root source; Preset legal function, providing an entry for legally writing data, It is enough to legally call the write function, use the interception technology, and modify the address of the write function to the address of the legal function to implement the data write operation to the virtual memory disk. The invention establishes a protection wall for memory data by modifying the attributes of the disk, protects the virtual memory data from the root source, and prohibits any illegal write operation; the same does not affect the legal write operation, achieving both .

Brief description of the drawing

DRAWINGS

1 is a schematic flow chart of a method for protecting virtual memory data according to the present invention;

2 is a schematic flowchart of a method for protecting virtual memory data according to an embodiment of the present invention;

3 is a schematic structural diagram of a virtual memory data protection system according to the present invention;

4 is a schematic structural diagram of an intercepting module in a virtual memory data protection system according to Embodiment 2 of the present invention;

5 is a schematic diagram of a method for protecting virtual memory data and a system thereof according to the present invention;

6 is a schematic diagram of a method for protecting virtual memory data and a legal write function in the system according to the present invention.

[0028] Description of the label:

[0029] 1. setting module; 2. preset module; 3. calling module; 4. intercepting module;

[0030] 41, a first modifying unit; 42, an operating unit; 43, a second modifying unit.

detailed description

[0031] The most critical idea of the present invention is: setting the attribute of the virtual memory disk to read-only, prohibiting illegal write operations; presetting the legal function, and implementing the legal write operation by the interception technology.

Referring to FIG. 1, FIG. 2, and FIG. 3 and FIG. 4, the present invention provides a method for protecting virtual memory data, including

[0033] setting the attribute of the virtual memory disk to read-only;

[0034] preset legal function, the legal write operation of the virtual memory disk calls the legal function;

[0035] calling a write function;

[0036] intercepting the write function, modifying an address of the write function to an address of the legal function.

[0037] Further, after the “intercepting the write function and modifying the address of the write function to the legal function address”, the method further includes:

[0038] modifying the attributes of the virtual memory disk to be readable and writable; [0039] performing a write operation on the virtual memory disk according to the write function;

[0040] Modify the properties of the virtual memory disk to read-only.

[0041] As can be seen from the above description, the replacement of the function address is implemented by the interception technology, and the legal write to the virtual memory disk is realized.

[0042] Further, the “calling write function; intercepting the write function, modifying an address of the write function to an address of the legal function” is specifically:

[0043] legally calling the write function through the virtual memory disk module;

[0044] The virtual memory disk intercepts the write function, modifies an address of the write function to an address of the legal function, and acquires write data corresponding to the write operation according to the write function, thereby forming an interception The function, the intercepting function corresponding to the operation of modifying the virtual memory disk attribute and writing the corresponding data.

[0045] As can be seen from the above description, the legal write operation of the virtual memory data is performed by the virtual memory disk module, and the legality of the operation identity can be ensured, and the efficiency of the function call and the legal data writing can be improved.

[0046] Further, the attribute of the virtual memory disk is set by a VirtualProtectEx function.

[0047] Further, the write function is intercepted by the HOOK API technology, and the address of the write function is modified to be the address of the legal function.

[0048] Referring to FIG. 3 and FIG. 4, another technical solution provided by the present invention is:

[0049] A virtual memory data protection system, including

[0050] setting module 1, the attribute for setting the virtual memory disk is read-only;

[0051] The preset module 2 is configured to preset a legal function, and the legal write operation of the virtual memory disk invokes the legal function;

[0052] calling module 3, used to call a write function;

[0053] The intercepting module 4 is configured to intercept the write function, and modify an address of the write function to be an address of the legal function.

[0054] As can be seen from the above description, the beneficial effects of the present invention are: setting the virtual memory disk by setting the module 1 to prohibit any illegal write operation; configuring the legal function by the preset module 2 to provide a legal entry for the legal write operation A write operation based on a legal entry is implemented by calling module 3 and intercepting the module. The protection of the virtual memory data system to protect the memory data from the root source, the same will not Legal write operations have an impact.

[0055] Further, the intercepting module 4 includes:

[0056] The first modifying unit 41 is configured to modify the attributes of the virtual memory disk to be readable and writable;

[0057] the operation unit 42 is configured to perform a write operation on the virtual memory disk according to the write function;

[0058] The second modification unit 43 is configured to modify the attribute of the virtual memory disk to be read-only.

[0059] Further, the virtual memory disk module includes the calling module 3 and the intercepting module 4;

[0060] the calling module is specifically configured to legally invoke a write function by using a virtual memory disk module;

[0061] The intercepting module is specifically configured to intercept the write function by the virtual memory disk, modify an address of the write function to be an address of the legal function, and obtain a write operation according to the write function. Corresponding write data constitutes an intercept function, and the intercept function corresponds to an operation of modifying a virtual memory disk attribute and writing corresponding data.

[0062] Further, the setting module 1 is specifically configured to set an attribute of the virtual memory disk by using a VirtualProtectEx function.

[0063] Further, the intercepting module 4 is specifically configured to intercept the write function by using a HOOK API technology, and modify an address of the write function to be the legal function address.

[0064] Embodiment 1

[0065] Referring to FIG. 1-4, a method for protecting virtual memory data is provided, and a call of a write function is implemented based on an application layer. Specifically, it may include:

[0066] In the virtual memory of the windows system process, a virtual memory space is requested in the virtual memory as a virtual memory disk by the VirtualAlloc or VirtualAlocEx function to save the virtual memory data. After obtaining the address of the virtual memory disk, use the VirtualProtectEx function to set the protection attribute of the virtual memory space to a read-only attribute; that is, to protect the virtual memory disk by using the protection attribute of the virtual memory space itself, when the attribute of the virtual memory disk is only Read attribute 吋, any write operation of the program will cause access violation; this feature can prevent unintended (such as array out of bounds) errors after the illegal molecules perform write operations on the virtual memory disk, resulting in the virtual memory data being modified. The resulting access violation caused the system process to be forced to end.

[0067] The above operation has been able to prohibit any writing operation of illegal molecules, and to ensure legal identity The legal write operation can be performed normally. In this embodiment, the call entry (legal function address) of the legal function is set, and only the entry that the legal identity can know can perform the operation of modifying the protection attribute on the virtual memory disk. Specifically, the legal write operation is implemented by the following methods:

[0068] Presetting a legal function, the legal write operation of the virtual memory disk calls the legal function, and the address of the legal function is only obtained by a legal identity; the legal function includes an operation of modifying a virtual memory disk protection attribute. ;

[0069] The legal identity performs a legal write operation on the virtual memory disk through the virtual memory disk module; optionally, by calling a WriteFile write function in the system API; then the virtual memory disk module writes the function to the WriteFile The interception is performed, and the address of the WriteFile write function is modified by the interception technology to be the address of the legal function, and is preferably intercepted by the HOOK API technology. The specific application of the interception technology in the embodiment includes: replacing the WriteFile write function address with a preset legal function address, and acquiring the data that needs to be written by the WriteFile write function to perform a write operation. The interception function includes performing an operation of modifying a virtual memory disk attribute and performing a write corresponding data, and the intercepted WriteFile write function is as shown in FIG. 4;

[0070] When the program calls the WriteFile write function after the above operation, it will automatically jump to the intercept function according to the modified address, and firstly modify the protection attribute of the virtual memory disk to a read/write attribute according to the operation pointed to by the intercept function. , ie, PAGE_EXECUTE_READWRITE; according to the data to be written obtained from the WriteFile write function, write or modify the virtual memory data in the virtual memory disk; after the write operation is completed, the intercept function is called The VirtualProtectEx function restores the previously readable and writable virtual memory disk to a read-only property, PAGE_READONLY, which closes the only legal entry for write operations, preventing memory data from being accidentally modified.

Embodiment 2

[0072] Referring to FIG. 5 and FIG. 6, the embodiment provides a protection system for virtual memory data based on the first embodiment, including:

[0073] setting module 1, the property for setting the virtual memory disk is read-only; optionally set by the VirtualProtectEx function;

[0074] The preset module 2 is configured to preset a legal function, and the legal write operation of the virtual memory disk invokes the legal function; [0075] calling module 3, for calling a write function;

[0076] The intercepting module 4 is configured to intercept the write function, and modify an address of the write function to be an address of the legal function;

An API technology interception or other interception technology is implemented. The intercepting module 4 specifically includes a first modifying unit 41, configured to modify a property of the virtual memory disk to be readable and writable, and an operating unit 42, configured to perform, according to the writing function, The virtual memory disk performs a write operation; the second modifying unit 43 is configured to modify the attribute of the virtual memory disk to be read-only.

[0077] Optionally, further comprising a virtual memory disk module, the virtual memory disk module comprising the calling module 3 and the intercepting module 4;

[0078] The calling module 3 is specifically configured to legally invoke a write function by using a virtual memory disk module;

[0079] The intercepting module 4 is specifically configured to intercept the write function by the virtual memory disk, modify an address of the write function to be an address of the legal function, and obtain a write according to the write function. The corresponding write data is operated to form an intercept function, and the intercept function corresponds to an operation of modifying the virtual memory disk attribute and writing the corresponding data.

[0080] In summary, the present invention provides a method and system for protecting virtual memory data, which can prohibit any illegal write operation on a virtual memory disk, and prevent the program from being destroyed due to unpredictable errors. The peer reserves the write operation entry of the legal identity to ensure the legal modification of the virtual memory data. Further, the HOOK API interception technology implements legal writing, which is simple in operation and high in security. The invention is based on the protection principle of the virtual memory disk read/write attribute, establishes a protection wall for the memory data, protects the virtual memory data from the root source, and prohibits any illegal write operation; the same does not affect the legal write operation. Achieve both.

Claims

Claim

[Claim 1] A method for protecting virtual memory data, comprising:

Set the properties of the virtual memory disk to read-only;

Presetting a legal function, the legal write operation of the virtual memory disk calls the legal function to call a write function;

Intersecting the write function, modifying an address of the write function to an address of the legal function, and a method for protecting virtual memory data according to claim 1, wherein the intercepting the write The function, after modifying the address of the write function to the address of the legal function, further includes:

Modify the properties of the virtual memory disk to be readable and writable;

Performing a write operation on the virtual memory disk according to the write function;

Modify the properties of the virtual memory disk to read-only.

A method for protecting virtual memory data according to claim 1, wherein: said "calling a write function; intercepting said write function, modifying an address of said write function to an address of said legal function "Specifically:

The write function is legally called by the virtual memory disk module;

The virtual memory disk intercepts the write function, modifies an address of the write function to an address of the legal function, and obtains a write data corresponding to the write operation according to the write function, thereby forming an intercept function. The interception function corresponds to an operation of modifying a virtual memory disk attribute and writing corresponding data.

The method for protecting virtual memory data according to claim 1, wherein the attribute of the virtual memory disk is set by a VirtualProtectEx function.

A method for protecting virtual memory data according to claim 1, wherein the write function is intercepted by a HOOK API technique, and an address of the write function is modified to be an address of the legal function.

A virtual memory data protection system, characterized in that Setting a module, the attribute for setting the virtual memory disk is read-only;

a preset module, configured to preset a legal function, wherein the legal write function of the virtual memory disk invokes the legal function;

Calling a module for calling a write function;

And an intercepting module, configured to intercept the write function, and modify an address of the write function to be an address of the legal function.

The protection system of the virtual memory data according to claim 6, wherein the intercepting module comprises:

a first modifying unit, configured to modify a property of the virtual memory disk to be readable and writable;

An operation unit, configured to perform a write operation on the virtual memory disk according to the write function;

The second modification unit is configured to modify the attribute of the virtual memory disk to be read-only.

A virtual memory data protection system according to claim 6, further comprising a virtual memory disk module, wherein the virtual memory disk module comprises the calling module and the intercepting module;

The calling module is specifically configured to legally invoke a write function by using a virtual memory disk module; the intercepting module is specifically configured to intercept the write function by the virtual memory disk, and modify an address of the write function to be the legal function. The address, the peer obtains the write data corresponding to the write operation according to the write function, and constitutes an intercept function, and the intercept function corresponds to an operation of modifying the virtual memory disk attribute and writing the corresponding data.

A protection system for virtual memory data according to claim 6, wherein the setting module is specifically configured to set an attribute of the virtual memory disk by a VirtualProtectEx function.

The protection system of the virtual memory data according to claim 6, wherein the intercepting module is specifically configured to intercept the write function by using a HOOK API technology, and modify an address of the write function to The address of the legal function.