CN118377734A - Memory data security enhancement method and system based on physical and memory address conversion - Google Patents

Abstract

The present invention proposes a memory data security enhancement method and system based on physical and memory access address conversion, including: converting the physical address issued by the processor in the computer system into a memory access address through a memory access address conversion component, and accessing the memory in the computer system with the memory access address. The present invention provides a memory data security enhancement method based on physical address and memory access address conversion, which requires adding an address conversion component to realize the conversion of physical address and memory access address. The component mainly includes a mapping table of physical address mapping interval and memory access address mapping interval, as well as table item matching and memory access address conversion logic, and has the advantages of low hardware overhead and fast address conversion speed.

Description

Memory data security enhancement method and system based on physical and memory address conversion

Technical Field

The present invention relates to the field of computer security technology, and in particular to a method and system for strengthening memory data security based on physical and memory access address conversion.

Background technique

The security of computer systems is receiving increasing attention. The security of data stored in the memory of computer systems is challenged. When a protected system is exposed to a malicious environment, physical attacks become possible, and security technologies need to be used to improve system security.

Physical attacks (hardware attacks) are an important form of attack on memory data, which endangers the confidentiality and integrity of data. Physical attackers can directly read or destroy data in memory, or intercept or modify data when the memory bus is used to transmit data. Common physical attack methods are to directly attack the memory bus outside the CPU, and implement active or passive attacks. For example, by connecting a device to the bus between the CPU and the memory chip, you can directly monitor or modify the data transmitted on the bus; or use the device to directly read and write memory. Active attacks mainly refer to modifying the content of memory data, including spoofing attacks, relocation attacks, and replay attacks. Spoofing attacks refer to malicious attackers using forged information to replace memory block information; relocation attacks refer to replacing the content of memory block A with the content of memory block B (assuming A≠B); replay attacks refer to recording the content of a memory block at a given address and then inserting it into the memory block access to the address later, that is, replacing the current data of the memory block with the old data of the memory block. Passive attacks mainly monitor the content of memory data, causing information leakage and destroying data integrity.

In order to deal with the above-mentioned attack methods, the prior art proposes the following memory data security enhancement method:

(1) Memory Verification Technology

Memory authentication refers to verifying that the value read by the processor from a given address is the last value written to the address. It is an important method to deal with active attacks that damage the integrity of memory data. Memory authentication technology based on integrity tree is mainly based on cryptographic technology. It is necessary to build an integrity tree and save it in the memory (on-chip memory or memory of the processor). There are three main methods: Merkle Tree uses hash functions; PAT tree (Parallelizable Authentication Tree) uses MAC function; TEC-Tree (Tamper-Evident Counter Tree) uses block-level AREA. The TEC-Tree method can parallelize the verification and update processes of the integrity tree, has the characteristics of fast speed, and can not only deal with attacks on data integrity, but also attacks on data confidentiality.

This paper mainly introduces the TEC-Tree method, which uses Block-Level AREA. First, we introduce the AREA (Added Redundancy Explicit Authentication) technology (as shown in Figure 1), which adds integrity verification capabilities to block encryption algorithms. The specific process is as follows:

(a) Linking a redundant number (an n-bit random number N (nonce) used only once) with data D to form plaintext data P, denoted as P = D||N; encrypting P using the ECB (Electronic Code Book) mode of a block encryption algorithm (such as AES ECB) to generate ciphertext C;

(b) When the receiver receives the ciphertext C’, it decrypts it to generate the plaintext P’, checks the n-bit redundant number N’ in P’ (P’=D’||N’), and verifies whether N=N’ holds. If they are equal, it means that the integrity is maintained.

Tamper-Evident Counter Tree (TEC-Tree):

As shown in Figure 2, the verification function f of TEC-Tree uses Block-Level AREA. The verification primitive uses a random number N (nonce) that is used only once to mark the input data Dy, and then encrypts it using the ECB mode of the block encryption algorithm. The secret key K is stored on the processor chip. The Block-level AREA function is first used on a memory block stored outside the processor chip, and then recursively applied to the group A results generated by the previous iteration. The generated ciphertext blocks are stored in memory, and the nonce used for the last encryption is stored on the processor chip (so that the attacker cannot modify it). The attacker cannot create tree nodes without the key, and cannot replay the root node of the tree without the root nonce on the chip. During the verification process of data block D, the nodes in the branch where D is located are taken to the processor and decrypted. D passes the integrity check if: the mark of each decrypted node is consistent with the nonce in the data after the node is decrypted; the nonce obtained by decrypting the highest level node is consistent with the nonce stored on the processor chip.

(2) Memory encryption technology

Memory encryption technology encrypts memory data to ensure the confidentiality of memory data, which is a good way to resist passive attacks. AMD's Secure Memory Encryption SME (Secure Memory Encryption) technology is a typical memory encryption technology, which is used in its Zen processor series. This technology mainly sets up special encryption hardware on the memory controller integrated on the processor. Each memory controller contains a high-performance AES (Advanced Encryption Standard) hardware engine, which encrypts when writing data to the memory and decrypts when reading data from the memory. The process is shown in Figure 3. Data encryption uses a 128-bit key. The key is randomly generated each time the system starts, and the key is invisible to the software running on the CPU. The key is generated by the integrated hardware random number generator and stored in a special register, which is invisible to the outside. Controlling which memory pages are encrypted is achieved by setting the page table through the operating system. Setting the 47th bit (referred to as C-bit) of the physical address to 1 in the page table entry (PTE) indicates that the page is to be encrypted and decrypted; if it is set to 0, it indicates normal access.

However, the above memory verification technology TEC-Tree has disadvantages: large hardware overhead, requiring hardware to implement block encryption algorithm modules (such as AES); large storage overhead, for a 2-fork TEC-Tree, the storage overhead is twice as much. In addition, since integrity verification is required when reading memory, the corresponding nodes of the integrity tree need to be updated when writing memory, which affects the performance of the computer system running programs.

The disadvantages of memory encryption technology, such as AMD's SME technology, require the integration of a hardware security encryption and decryption AES engine on the memory controller on the processor chip, which has a high hardware cost and uses AES to encrypt and decrypt the memory, which increases the latency of accessing the memory and affects the performance of program execution. In addition, memory encryption technology can only defend against passive attacks that destroy the confidentiality of memory data, but cannot defend against active attacks that destroy the integrity of memory data.

Summary of the invention

The existing method of resisting physical attacks on memory data based on cryptographic technology has the disadvantages of high hardware cost and affecting the performance of computer system program execution. A method and device for strengthening memory data security based on physical address and memory access address conversion are proposed.

Specifically, the present invention proposes a method for strengthening memory data security based on physical and memory access address conversion, which includes:

The physical address issued by the processor in the computer system is converted into a memory access address through a memory access address conversion component, and the memory in the computer system is accessed with the memory access address.

The memory data security enhancement method based on physical and memory access address conversion, wherein the memory access address conversion component includes a mapping table from a physical address interval to a memory access address interval, so as to realize the conversion of the physical address into the memory access address actually used to access the memory.

The memory data security enhancement method based on physical and memory access address conversion, wherein the memory access address conversion component determines whether the physical address belongs to the mapping area, and if so, converts the physical address into the memory access address to access the memory, otherwise directly accesses the memory with the physical address.

The method for strengthening memory data security based on physical and memory access address conversion randomly sets the mapping relationship between the physical address interval and the memory access address interval of the memory access address conversion component when the computer system is started.

The memory data security enhancement method based on physical and memory access address conversion, wherein the random setting includes generating random numbers r1 and r2, and mapping the physical address interval r1 mod i to the memory access address interval r2 mod i.

The method for strengthening memory data security based on physical and memory access address conversion, wherein the random setting is run in the BIOS started by the computer system.

The method for strengthening memory data security based on physical and memory address conversion, wherein the mapping table is organized using the memory in the computer system, the processor can linearly map the contents of the mapping table to a specified memory address space, and the processor converts the read and write operations falling on the specified memory address space into read and write operations for the mapping table in the memory address conversion component.

The present invention also proposes a memory data security enhancement system based on physical and memory access address conversion, which includes:

The memory access address conversion component is used to convert the physical address issued by the processor in the computer system into a memory access address, and use the memory access address to access the memory in the computer system.

The present invention also proposes a storage medium for storing a program for executing any one of the memory data security enhancement methods based on physical and memory access address conversion.

The present invention also proposes a client, which is used for the memory data security enhancement system based on physical and memory access address conversion.

It can be seen from the above scheme that the advantages of the present invention are:

The present invention discloses a method for strengthening memory data security based on conversion of physical address and memory access address. It is necessary to add an address conversion component to realize conversion of physical address and memory access address. The component mainly includes a mapping table of physical address mapping interval and memory access address mapping interval, as well as table item matching and memory access address conversion logic. It has the advantages of low hardware overhead and fast address conversion speed.

The technology of protecting data integrity and security based on cryptographic technology requires the integration of a hardware-implemented secure encryption and decryption AES engine, as well as large storage overhead and high hardware cost. In addition, the encryption and decryption of memory data seriously affects the performance of program execution on the critical path of memory access.

Compared with the technology of protecting data integrity and security based on cryptographic technology, the present invention has the advantages of low hardware cost and little impact on the performance of computer system running programs.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is an introduction diagram of the prior art AREA technology;

Figure 2 is an introduction diagram of TEC-Tree;

Figure 3 is an introduction diagram of memory encryption technology;

FIG4 is an execution block diagram of the present invention;

FIG5 is a schematic diagram of randomly establishing a mapping relationship according to the present invention.

Detailed ways

Memory data security is an important research topic in computer security. When we studied the defense technology against physical attacks on memory data, we found that cryptographic technology is currently mainly used to protect the confidentiality and integrity of memory data. The advantage of using cryptographic technology is good effect, but the disadvantage is that the hardware cost is high (it is necessary to implement a hardware encryption and decryption engine, which may require a large memory overhead), and the encryption and decryption operations occur on the path of data reading and writing, which affects the program running performance of the computer system.

The present invention finds that physical attacks against memory data need to be carried out against a given physical address. For a given physical address, it is generally known through a priori knowledge that the virtual address corresponding to the physical address is sensitive information, and then an effective attack is carried out. The traditional memory management method establishes a mapping relationship between virtual addresses and physical addresses, translates the virtual address given by the program into a physical address, and then directly accesses the content in the memory according to the physical address. However, for some address spaces (such as the operating system kernel space), the mapping relationship between the virtual address and the physical address is fixed. Therefore, the content of the corresponding virtual address can be known based on the physical address. If the content of the virtual address is sensitive information (such as a key), an attack can be implemented.

Based on the above findings, the present invention adds another layer of mapping relationship to the traditional memory management mechanism, first converting the physical address into a memory access address, and then using the memory access address to access the memory. The mapping relationship between the physical address and the memory access address is set by the BIOS or other underlying software when the computer is started, and has a certain degree of randomness. A physical attacker can monitor the memory access address, but cannot match the memory access address with the virtual address, and cannot determine what kind of information the memory content corresponding to the current memory access address is, so it is difficult to implement an effective memory data attack.

The conversion between the physical address and the memory address is performed by hardware, so the speed is fast, the impact on program performance is small, and the hardware overhead of the conversion mechanism is small. In order to achieve the above technical effects, the present invention includes the following ten key technologies:

Key point 1, design a memory access address conversion component, convert the physical address for memory access issued by the processor into a memory access address through the memory access address conversion component, and then access the memory. In the case of a physical attack, the attacker can only detect the bus interconnecting the CPU and the memory, and therefore can only detect the final memory access address. Therefore, the technology of the present invention makes it difficult to derive the corresponding program virtual address based on the memory access address monitored by the physical attack, thereby making it difficult to effectively carry out a physical memory attack, and has the advantages of low overhead and high performance, thereby improving the security of the computer system.

Key point 2, a design of a memory access address conversion component based on an address mapping table, setting a mapping table from a physical address range to a memory access address range, to realize the conversion of a physical address into a memory access address actually used to access the memory.

Key point 3, the design of the mapping table in the memory address conversion component, including the design of the mapping table entry content, the access to the table entry, and the conversion method between the physical address and the memory address, can realize the conversion between the physical address and the memory address more efficiently.

Key point 4, a method for converting physical addresses and memory access addresses based on mapping table entries, including: hit determination logic of address intervals, logic for generating memory access addresses if hit, etc. The physical address can be converted to the memory access address more efficiently, and has the characteristics of low hardware overhead and high speed.

Key point 5, a method for establishing a mapping relationship between a physical address interval and a memory access address interval. If all addresses are converted uniformly, it is not flexible. Set the interval, and configure the mapping table to make the address conversion flexible and more secure. Therefore, the physical address space is divided into a mapping area and an unmapped area, where the mapping area is composed of a mapping interval, and there may be multiple discontinuous mapping intervals (the size of the mapping interval is 2SIZE bytes), or there may be multiple discontinuous unmapped intervals. For the unmapped area, the memory access address is the same as the physical address. For the mapping interval in the mapping area of the physical address space, each mapping interval needs to be mapped to a memory access address interval of the same size, and this mapping relationship is recorded by an item in the mapping table. And the above technology can also play a role in protecting specific address information. The relationship between the virtual address and the physical address of the operating system kernel area is often determined, so it needs to be set as a mapping area. The space of the user program can be set as an unmapped area.

Key point 6, a method for establishing a mapping relationship between a physical address interval and a memory access address interval based on randomization, so that the mapping relationship between i physical address mapping intervals of the same size and i memory access address mapping intervals of the same size can be randomized when the system is started to improve security. This can make the mapping relationship between the physical address interval and the memory access address interval different when the same computer system is started at different times, further increasing security.

Key point 7, a random setting algorithm for the physical address interval and the memory access address interval based on a random number generator is proposed, which mainly uses a random number generator to obtain two random numbers r1 and r2. Map the physical address interval r1 mod i to the memory access address interval r2 mod i; map the physical address interval (r1+1) mod i to the memory access address interval (r2+1) mod i; ...; map the physical address interval (r1+i-1) mod i to the memory access address interval (r2+i-1) mod i. Using this algorithm, the random setting of the physical address interval and the memory access address interval can be realized. The meaning of mod i is to divide by i and take the remainder.

Key point 8, a memory-based mapping table organization method, using memory to organize the mapping table, including the contents of each table item and the access method. The processor can linearly map the contents of the mapping table to a special memory address space, and the processor converts the read and write operations falling on this address space into read and write operations for the mapping table in the memory address conversion component, instead of sending them to the memory. With the mapping table configured in this way, ordinary memory access instructions (load, store) can be directly used to access this special memory address space. Otherwise, a special design is required to configure the mapping table.

Key point 9, a register-based mapping table organization method, using registers to organize the mapping table, including the content of each table entry and the access method. The use of registers to organize the mapping method enables fast access to the mapping table, but the scale is limited.

Key point 10: The configuration of the mapping table can be run in the BIOS when the system is started, or in other high-security underlying startup codes. The security of the BIOS or other high-security underlying startup codes can be protected by trusted startup technology based on hardware trusted roots. In this way, security can be protected even if the operating system is compromised.

In order to make the above features and effects of the present invention more clearly understood, embodiments are given below and described in detail with reference to the accompanying drawings.

1. Overall processing flow of data access control:

The overall processing flow of memory access is: the physical address issued by the processor core is converted into a memory access address through the memory access address conversion component, and then the row address and column address are obtained according to the memory access address to access the memory. Accessing the memory can be reading and writing the memory and fetching instructions from the memory.

2. Memory address conversion component:

Set up a mapping table from physical address range to memory access address range to convert physical addresses into memory access addresses actually used to access memory.

Each entry in the mapping table can determine a continuous address area of 2 ^SIZE (the specific range of SIZE depends on the requirements of the implementation) with a starting address aligned to a 2 ^SIZE size boundary. Each entry contains the following configuration information: valid bits, starting address of the physical address interval, interval size mask, and starting address of the memory access address interval.

Assume that the width of the physical address and the memory access address are both N bits. The starting address of the physical address interval, the interval size mask, and the starting address of the memory access address interval are all N bits, and the valid bit is 1 bit.

in:

Valid bit (VALID): 1 bit, when it is 1, it means the content of the table entry is valid; when it is 0, it means the content of the table entry is invalid;

Physical address interval start address (PHY_STARTADDR): The start address of the continuous address area targeted by each table entry. The address must be aligned to the size boundary. For example, when the address area size is 256 bytes, the lowest 8 bits of the address must be all 0;

Mask (MASK): The mask is related to the interval size. Due to the exponential characteristics of the interval size, the size of the continuous address interval targeted by each table entry is 2SIZE bytes. Then the mask is: all high bits are 1, and the low bits are SIZE 0 bits. For example, when the area size is 256 bytes, the value here is: all high bits are 1, and the low 8 bits are 0;

The starting address of the memory access address area (MEM_STARTADDR): The converted starting address of the continuous address area targeted by each table entry. This address must also be aligned to the size boundary. For example, when the address area size is 256 bytes, the lowest 8 bits of the address must be all 0.

The physical address (PHY_ADDR) is hit determined with all entries in the mapping table:

The hit determination logic of the address range is as follows:

VALID&&(PHY_ADDR&MASK==PHY_STARTADDR)

If the result of a table entry is 1, it means that the physical address is within the corresponding address range of the table entry, and the memory access address is set to:

MEM_ADDR＝(PHY_ADDR&～MASK)|MEM_STARTADDR

If the determination results of all entries are not 1, it means that the physical address is not within the address range corresponding to all entries, then:

MEM_ADDR＝PHY_ADDR

The above address conversion process is completed automatically by hardware without the involvement of software.

3. Establish the mapping relationship between the physical address range and the memory access address range:

By setting the content of the mapping table between the physical address interval and the memory access address interval, the mapping relationship between the physical address interval and the memory access address interval can be established. The size of the physical address space and the memory access address space is the same. How to determine the mapping relationship between the physical address interval and the memory access address interval is the key. As shown in the figure below. The physical address space is divided into a mapping area and an unmapped area, where the mapping area is composed of mapping intervals. There can be multiple discontinuous mapping intervals, or there can be multiple discontinuous unmapped intervals. For the unmapped area, the memory access address is the same as the physical address. For the mapping intervals in the mapping area of the physical address space, each mapping interval needs to be mapped to a memory access address interval of the same size, and this mapping relationship is recorded by an item in the mapping table.

The specific mapping interval of a physical address space to which the mapping interval of the memory address space is mapped is determined by the system designer and recorded by setting the content of the mapping table in the BIOS, etc. This needs to be done according to some rules.

For a mapping interval of a physical address space, the designer needs to find a space of the same size in the mapping area of the memory access address for mapping. For i physical address mapping intervals of the same size, it is necessary to find i memory access address mapping intervals of the same size for mapping. For any of the physical address mapping intervals, it can be mapped to any of the i memory access address mapping intervals.

In this way, system security can be improved through randomization. That is, in the BIOS every time the computer system starts, the mapping relationship between i physical address mapping intervals of the same size and i memory access address mapping intervals of the same size is randomly set to improve security. As shown in the figure below, one of the schemes is that physical address mapping interval 1 is mapped to memory access address mapping interval 4, physical address mapping interval 2 is mapped to memory access address mapping interval 1, and physical address mapping interval 4 is mapped to memory access address mapping interval 2. In fact, for the case of i=4 in the figure, there are 4*3*2=24 schemes. For i physical address mapping intervals of the same size, there are i! schemes. Through randomization design, one of them is randomly set in the BIOS every time the system starts.

The following is a feasible randomization method for establishing a mapping relationship, which is determined by running the software. As shown in Figure 5

Step 1: For i physical address mapping intervals of the same size, first determine the starting addresses of i physical address mapping intervals, and then determine the starting addresses of i memory access address spaces.

Step 2: Use a random number generator to obtain two random numbers r1 and r2. Map the physical address interval r1 mod i to the memory access address interval r2 mod i; map the physical address interval (r1+1) mod i to the memory access address interval (r2+1) mod i; ...; map the physical address interval (r1+i-1) mod i to the memory access address interval (r2+i-1) mod i.

4. Mapping table configuration:

The mapping table can be organized in a variety of ways. One feasible mapping table organization method is to organize it in a register manner, and another is to organize it in a memory manner.

After the processor is reset, all table entries in the memory address translation unit are invalid, and the corresponding table entries are filled in by the underlying software such as BIOS as needed.

Assume that the mapping table has M entries, and the width of the physical address and the memory address are both N bits. For the register method:

Assume that there are M groups of registers, and one group of registers corresponds to an item in the mapping table. One group of registers includes: valid bit register Valid_r (1 bit), physical address interval start address register PHY_STARTADDR_r (N bits), mask register Mask_r (N bits), and memory access address interval start address register MEM_STARTADDR_r (N bits).

Registers are accessed using register group number register_index. In BIOS or other low-level boot software, after determining the mapping relationship between the physical address mapping interval and the memory access address mapping interval, the contents of the registers are written item by item according to the register group number register_index (assigned from 0 to M-1).

As for the memory organization, a special memory is set in the memory access address conversion unit to store the mapping table. The processor can linearly map the contents of the mapping table to a special memory address space, and the processor converts the read and write operations falling on this address space into read and write operations for the mapping table in the memory access address conversion unit instead of sending them to the memory.

The following is a specific example to illustrate the linear mapping method used. For the sake of simplicity, each field in the table entry is clearly defined:

Assume that the mapping table has M entries, and the width of the physical address and the memory access address are both N bits (assuming N=64 bits).

For the sake of simplicity, each field in the table entry is clearly defined: Valid bit is 1 bit (occupies 1 byte), PHY_STARTADDR (64 bits), MASK (64 bits), MEM_STARTADDR (64 bits). Assuming that the mapping table has a total of M items, the mapping relationship is as follows:

Valid information of item n in the mapping table (n=0..M-1)

Mapped address: lookup table base address + 0x19×n

name Bit Functional Description Valid 0 The valid bit of this entry, 1 means valid

Mapping table item n PHY_STARTADDR information (n=0..M-1)

Mapped address: lookup table base address + 0x19×n + 0x1

name Bit Functional Description PHY_STARTADDR 63:0 The starting address of the physical address mapping range

Mapping table item n MASK information (n=0..M-1)

Mapped address: lookup table base address + 0x19×n + 0x9

name Bit Functional Description MASK 63:0 Interval size mask

Mapping table item n MEM_STARTADDR information (n=0..M-1)

Mapped address: lookup table base address + 0x19×n + 0x11

name Bit Functional Description MEM_STARTADDR 63:0 The starting address of the memory address mapping range

In the BIOS or other low-level startup software, after determining the mapping relationship between the physical address mapping interval and the memory access address mapping interval, the processor writes the mapping table content in the manner of reading and writing memory.

The following is a system embodiment corresponding to the above method embodiment. This embodiment can be implemented in conjunction with the above embodiment. The relevant technical details mentioned in the above embodiment are still valid in this embodiment. In order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the above embodiment.

The present invention also proposes a memory data security enhancement system based on physical and memory access address conversion, including a memory access address conversion component for converting a physical address issued by a processor in a computer system into a memory access address, and using the memory access address to access the memory in the computer system.

The memory data security enhancement system based on physical and memory access address conversion, wherein the memory access address conversion component includes a mapping table from a physical address range to a memory access address range, so as to realize the conversion of the physical address into the memory access address actually used to access the memory.

The memory data security enhancement system based on physical and memory access address conversion, wherein the memory access address conversion component determines whether the physical address belongs to the mapping area, and if so, converts the physical address into the memory access address to access the memory, otherwise directly accesses the memory with the physical address.

1. The memory data security enhancement system based on physical and memory access address conversion, wherein the mapping relationship between the physical address interval and the memory access address interval of the memory access address conversion component is randomly set when the computer system is started.

The memory data security enhancement system based on physical and memory access address conversion, wherein the random setting includes generating random numbers r1 and r2, and mapping the physical address interval r1 mod i to the memory access address interval r2 mod i.

The memory data security enhancement system based on physical and memory access address conversion runs the random setting in the BIOS started by the computer system.

The memory data security enhancement system based on physical and memory address conversion, wherein the mapping table is organized using the memory in the computer system, the processor can linearly map the contents of the mapping table to a specified memory address space, and the processor converts the read and write operations falling on the specified memory address space into read and write operations for the mapping table in the memory address conversion component.

Claims (10)

1. A method for strengthening memory data security based on physical and memory access address conversion, characterized by comprising: The physical address issued by the processor in the computer system is converted into a memory access address through a memory access address conversion component, and the memory in the computer system is accessed with the memory access address. 2. The memory data security enhancement method based on physical and memory access address conversion as described in claim 1 is characterized in that the memory access address conversion component includes a mapping table from a physical address range to a memory access address range to realize the conversion of the physical address into the memory access address actually used to access the memory. 3. The memory data security enhancement method based on physical and memory access address conversion as described in claim 1 is characterized in that the memory access address conversion component determines whether the physical address belongs to the mapping area. If so, the physical address is converted into the memory access address to access the memory, otherwise the memory is directly accessed with the physical address. 4. The memory data security enhancement method based on physical and memory access address conversion as described in claim 1 is characterized in that the mapping relationship between the physical address range and the memory access address range of the memory access address conversion component is randomly set when the computer system is started. 5. The memory data security enhancement method based on physical and memory access address conversion as claimed in claim 4, characterized in that the random setting includes generating random numbers r1 and r2, and mapping the physical address interval r1 mod i to the memory access address interval r2 mod i. 6. The memory data security enhancement method based on physical and memory access address translation as claimed in claim 5, characterized in that the random setting is run in the BIOS started by the computer system. 7. The memory data security enhancement method based on physical and memory address conversion as described in claim 2 is characterized in that the mapping table is organized using the memory in the computer system, the processor can linearly map the contents of the mapping table to a specified memory address space, and the processor converts the read and write operations falling on the specified memory address space into read and write operations for the mapping table in the memory address conversion component. 8. A memory data security enhancement system based on physical and memory access address conversion, characterized by comprising: The memory access address conversion component is used to convert the physical address issued by the processor in the computer system into a memory access address, and use the memory access address to access the memory in the computer system. 9. A storage medium for storing a program for executing any one of the memory data security enhancement methods based on physical and memory access address conversion as claimed in claims 1 to 7. 10. A client, used in the memory data security enhancement system based on physical and memory access address conversion as claimed in claim 8.