Data processing method and apparatus

Patent metadata

Field	Value
Publication number	US-12475233-B2
Application number	US-202318691837-A
Country	US
Kind code	B2
Filing date	Feb 3, 2023
Priority date	Feb 15, 2022
Publication date	Nov 18, 2025
Grant date	Nov 18, 2025

Abstract

A data processing method, applied to a target device in which a Linux operating system is running. A first program is deployed in the Linux operating system. The method includes: loading a target loading and invasion machine into a first memory space of the first program, and acquiring a vulnerability repair library for the first program through the target loading and invasion machine; creating, in the first memory space, a second memory space for the target loading and invasion machine, and configuring a second runtime environment isolated from a first runtime environment of the first program; and loading the vulnerability repair library in the second memory space based on the second runtime environment, and performing a vulnerability repair on the first program by using the vulnerability repair library.

First claim

What is claimed is:

1 . A data processing method, applied to a target device in which a Linux operating system is running, wherein a first program is deployed in the Linux operating system, and the method comprises:
loading a target loading and invasion machine into a first memory space of the first program, and acquiring a vulnerability repair library for the first program through the target loading and invasion machine; creating, in the first memory space, a second memory space for the target loading and invasion machine, and configuring a second runtime environment isolated from a first runtime environment of the first program, wherein the second memory space is simply available to the target loading and invasion machine and to a program loadable by the target loading and invasion machine; loading the vulnerability repair library in the second memory space based on the second runtime environment, and performing a vulnerability repair on the first program by using the vulnerability repair library.

2 . The method according to claim 1 , wherein before performing the vulnerability repair on the first program by using the vulnerability repair library, the method further comprises:
invading target location content in the first program according to invasion and mounting guidance information in the vulnerability repair library, and establishing a mounting relation between the target location content and the vulnerability repair library, wherein the performing the vulnerability repair on the first program by using the vulnerability repair library comprises: performing the vulnerability repair on the first program by performing, when the first program calls the target location content, a guidance to the vulnerability repair library according to the mounting relation.

3 . The method according to claim 2 , further comprising:
returning to an execution flow of the first program after the vulnerability repair is completed.

4 . The method according to claim 2 , wherein before invading the target location content in the first program according to the invasion and mounting guidance information in the vulnerability repair library, and establishing the mounting relation between the target location content and the vulnerability repair library, the method further comprises:
performing signature verification on the vulnerability repair library by using preset public key information; after the signature verification is passed, rendering executions of invading the target location content in the first program according to the invasion and mounting guidance information in the vulnerability repair library and establishing the mounting relation between the target location content and the vulnerability repair library.

5 . The method according to claim 1 , wherein the target loading and invasion machine comprises: an invader for performing invasion and mounting for the first program; and a loader for creating the second memory space, configuring the second runtime environment, and loading the vulnerability repair library.

6 . The method according to claim 1 , wherein the vulnerability repair library is acquired by the target loading and invasion machine from a cloud.

7 . The method according to claim 1 , wherein the target device is an Internet of Things device, and the first program is a user mode program.

8 . A data processing apparatus, applied to a target device in which a Linux operating system is running, wherein a first program is deployed in the Linux operating system, and the apparatus comprises:
a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, causes the processor to: load a target loading and invasion machine into a first memory space of the first program, and acquire a vulnerability repair library for the first program through the target loading and invasion machine; create, in the first memory space, a second memory space for the target loading and invasion machine, and configure a second runtime environment isolated from a first runtime environment of the first program, wherein the second memory space is simply available to the target loading and invasion machine and to a program loadable by the target loading and invasion machine; load the vulnerability repair library in the second memory space based on the second runtime environment, and perform a vulnerability repair on the first program by using the vulnerability repair library.

9 . A non-transitory computer-readable storage medium, having a computer program stored thereon, wherein the computer program, when executed by a processor, causes the processor to implement the following:
loading a target loading and invasion machine into a first memory space of a first program; acquiring a vulnerability repair library for the first program through the target loading and invasion machine; creating, in the first memory space, a second memory space for the target loading and invasion machine; configuring a second runtime environment isolated from a first runtime environment of the first program, wherein the second memory space is simply available to the target loading and invasion machine and to a program loadable by the target loading and invasion machine; loading the vulnerability repair library in the second memory space based on the second runtime environment; and performing a vulnerability repair on the first program by using the vulnerability repair library.

10 . The apparatus according to claim 8 , wherein before performing the vulnerability repair on the first program by using the vulnerability repair library, the processor is further caused to:
invade target location content in the first program according to invasion and mounting guidance information in the vulnerability repair library; establish a mounting relation between the target location content and the vulnerability repair library; and perform the vulnerability repair on the first program by performing, when the first program calls the target location content, a guidance to the vulnerability repair library according to the mounting relation.

11 . The apparatus according to claim 10 , wherein the processor is further caused to:
return to an execution flow of the first program after the vulnerability repair is completed.

12 . The apparatus according to claim 10 , wherein before invading the target location content in the first program according to the invasion and mounting guidance information in the vulnerability repair library, and establishing the mounting relation between the target location content and the vulnerability repair library, the processor is further caused to:
perform signature verification on the vulnerability repair library by using preset public key information; and after the signature verification is passed, render executions of invading the target location content in the first program according to the invasion and mounting guidance information in the vulnerability repair library and establish the mounting relation between the target location content and the vulnerability repair library.

13 . The apparatus according to claim 8 , wherein the target loading and invasion machine comprises:
an invader for performing invasion and mounting for the first program; and a loader for creating the second memory space, configuring the second runtime environment, and loading the vulnerability repair library.

14 . The apparatus according to claim 8 , wherein the vulnerability repair library is acquired by the target loading and invasion machine from a cloud.

Assignees

• Hangzhou Alicloud Feitian Information Tech Co Ltd

Inventors

• Zhou Hao
• Liu Ruichao
• Shi Fei
• Dong Kan

Classifications

• G06F11/0793

  Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40) · CPC title

• G06F21/74

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title