Data processing device, data processing method, and data processing program

Abstract

A data processing device 10 includes a processing logic execution management unit 11 that, by using an isolation function of an operating system in a virtual machine in a node, causes a plurality of processing logics to operate in an isolated environment in the node, and calls the plurality of processing logics in such a manner that the plurality of processing logics are isolated from each other.

Description

Data processing device, data processing method, and data processing program

[0001] The present disclosure relates to a data processing device, a data processing method, and a data processing program.

[0002] Initiatives in which multiple companies collaborate to solve social issues, such as realizing a resource-circulating society, are becoming more active. Data distribution between companies that supports these initiatives is also beginning to take place, but there are concerns that data held by each company may be leaked after it is provided.

[0003] To address this issue, a technology called a data sandbox is known (see Non-Patent Document 1). A data sandbox is an isolated environment created within a node (a virtual machine and / or physical machine that constitutes a cluster), and is a technology that allows important data such as know-how and trade secrets owned by one company X and processing logic filled with know-how owned by another company Y to be combined and mutually used without disclosing the data to each other.

[0004] By using this data sandbox, data can be circulated not only between companies, but also between organizations and users without concerns about the leakage of important data or unexpected use of processing logic.

[0005] Inoue, et al., "Trusted Data Space Technology for Data Governance in the IOWN Era," NTT Technical Journal, February 2023, pp. 41-44

[0006] To prevent unintended execution of processing logic, one data sandbox generally stores one processing logic or processing logic of only consenting users. Therefore, if you want to increase the number of processing logics, you can consider building multiple data sandboxes on one node.

[0007] However, because there is a physical limit to the number of data sandboxes that can be built on a single node, the amount of processing logic could not be increased sufficiently, and it was not possible to meet the demand to accommodate a large number of users on a single node.

[0008] To solve this problem, it is possible to use FaaS (Function as a Service), a serverless architecture. However, because FaaS employs a format in which processing is called on a function-by-function basis within a program, it is difficult for existing programs (data sandboxes) to easily use FaaS. In addition, because input and output data is not encrypted, data could be stolen if a system administrator has malicious intent.

[0009] The present disclosure has been made in consideration of the above circumstances, and the purpose of the present disclosure is to provide technology that can realize a secure computing environment that achieves both an increased user capacity and secure processing in an isolated environment within a node.

[0010] A data processing device of one aspect of the present disclosure includes a processing logic execution management unit that uses the isolation function of an operating system in a virtual machine in a node to operate multiple processing logics in an isolated environment within the node and calls the multiple processing logics in isolation from each other.

[0011] A data processing method of one aspect of the present disclosure is a data processing method performed by a data processing device equipped with a processing logic execution management unit, in which the processing logic execution management unit uses an isolation function of an operating system in a virtual machine in a node to operate multiple processing logics in an isolated environment within the node, and calls the multiple processing logics in isolation from each other.

[0012] A data processing program according to one aspect of the present disclosure causes a computer to function as the data processing device.

[0013] According to the present disclosure, it is possible to provide a technology that can realize a secure computing environment that can accommodate an increased number of users and ensure secure processing in an isolated environment within a node.

[0014] Fig. 1 is a diagram showing an example of the configuration of a data processing system. Fig. 2 is a diagram showing an example of the operation of the data processing system. Fig. 3 is a diagram showing an example of the hardware configuration of a data processing device. Fig. 4 is a diagram showing an image of a data sandbox.

[0015] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the description of the drawings, the same parts are designated by the same reference numerals and the description thereof will be omitted.

[0016] [Data Sandbox] Fig. 4 is a diagram showing an image of a data sandbox. A data sandbox is an isolated environment prepared as a special execution environment for software, in which access to the outside is strictly restricted.

[0017] For example, a data sandbox executes processing in a secure computing area (TEE: Trusted Execution Environment) provided in a CPU within a node, and is constructed using virtual machine (VM) protection technology.

[0018] Specifically, for example, it is constructed using AMD's SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging) technology. AMD's SEV-SNP is a technology that turns the entire VM into a TEE, so the VM is equal to the TEE. However, it can also be constructed using other technologies, and the VM does not have to be equal to the TEE.

[0019] In addition, the data sandbox implements several measures as shown in Figure 4.

[0020] Countermeasure 1 is to prevent unintended execution of processing logic by having users agree on the important data and processing logic to be used and processing the important data and processing logic based on the agreed-upon policy.

[0021] Countermeasure 2 is to prevent data from being taken outside using processing logic by using a container that restricts external communication.

[0022] As a third measure, the processing result data is encrypted and output from the container so that only users permitted by the policy can decrypt it.

[0023] As a fourth measure, important data and processing logic to be input into the container should also be encrypted so that they can only be decrypted within the container.

[0024] Thanks to the above-mentioned isolated environment and multiple measures, in the data sandbox, the important data owned by user X and the processing logic owned by user Y can be processed using user Y's processing logic, and the processing result data can be output to user Z, who is authorized to receive the processing result data, without disclosing the important data owned by user X and the processing logic owned by user Y to each other's counterparts.

[0025] [Summary of the Disclosure] Hereinafter, it is assumed that the data sandbox is constructed using AMD's SEV-SNP technology.

[0026] (1. Separation of processing logic) In this embodiment, in addition to separation at the VM level including the TEE (SEV-SNP), multiple processing logics running within the VM are separated at the system level using the separation function of the OS (Operating System) (including functions such as containers that achieve system separation using OS functions), and then the processing logic is called.

[0027] Previously, VM-level isolation using TEE (SEV-SNP) protected data within the VM from external threats such as the hypervisor and host OS, and prevented data from being taken outside using the functions of the OS within the VM.

[0028] In addition, in this embodiment, the isolation function of the OS in the VM is used to isolate the processing logics running in the VM so that they cannot access each other's processing logic information within the TEE. This allows multiple processing logics to run safely within one TEE.

[0029] (2. Verification of Separation of Processing Logic) In this embodiment, a user can verify whether separation of processing logic is operating correctly using an attestation report of SEV-SNP and information linked to the attestation report.

[0030] For example, the SEV-SNP attestation report includes the hash value of the "functional unit that calls the processing logic." This makes it possible to verify the operation of the "functional unit that calls the processing logic," and thus the operation of the separation of the processing logic.

[0031] An attestation report is TEE configuration information signed by the hardware module, which is the root of trust. In the case of a SEV-SNP attestation report, the signed information includes information such as the Linux kernel running inside the TEE, and by verifying this, it can be confirmed that the TEE is operating in a secure environment.

[0032] In the data sandbox, the attestation report includes a hash value of the information required for the execution of the data sandbox in the attestation report or in the information linked to the attestation report, and the user can verify the security of the data sandbox by using the hash value. Note that verifying security using this attestation report is called remote attestation.

[0033] (3. Execution of Processing Logic) In this embodiment, each time a processing logic is executed, the processing logic is called and terminated. This makes it possible to reduce resource consumption when the processing logic is not yet executed.

[0034] In this case, the execution format of the processing logic is not a functional unit format, but a format that can be executed by an OS such as Linux. This allows processing logic developers to generate processing logic using existing general skills and tools, without having to learn new technologies such as FaaS.

[0035] By combining these with the processing logic isolation technology using the OS isolation function mentioned above, application-level security, which was a drawback of FaaS, is also ensured.

[0036] [Configuration of Data Processing System] FIG. 1 is a diagram showing an example of the configuration of a data processing system 1 according to this embodiment.

[0037] The data processing system 1 includes one data processing device 10 in which a data sandbox is constructed, and three user terminals 20X, 20Y, and 20Z used by users X, Y, and Z, respectively. The data processing device 10 and the three user terminals 20X, 20Y, and 20Z are connected via a communication network 30 so as to be able to communicate with each other.

[0038] (Data Processing Device) The data processing device 10 executes a process of combining important data with processing logic in an isolated environment called a data sandbox, and outputs the processing result data.

[0039] The data processing device 10 comprises a processing logic execution management unit 11 that operates within a data sandbox and calls processing logic, and an isolated environment management unit 12 that operates within a TEE and manages the data sandbox, which is an isolated environment.

[0040] In addition to separation at the VM level including TEE (SEV-SNP), the processing logic execution management unit 11 has the function of separating multiple processing logics running within a VM at the system level using the OS separation function (including functions such as containers that achieve system separation using OS functions) and then calling the processing logic.

[0041] In other words, the processing logic execution management unit 11 has a function of running multiple processing logics in a data sandbox using the isolation function of the OS in the VM and isolating and calling the multiple processing logics from one another. The OS isolation function is a function of separating users who execute processing logics and restricting access to each user's area using an access control function such as an ACL (Access Control List) to prevent access.

[0042] In addition, the processing logic execution management unit 11 has a function that allows the user to verify whether the separation of processing logic is operating correctly using the SEV-SNP attestation report and information linked to the attestation report.

[0043] That is, the processing logic execution management unit 11 has a function of issuing information for verifying whether the separation of multiple processing logics is functioning properly. For example, the processing logic execution management unit 11 issues the information by including a hash value of the processing logic execution management unit 11.

[0044] The processing logic execution management unit 11 also has a function of calling and terminating the processing logic every time it receives an execution request for the processing logic from the user terminal 20. The processing logic is executed in a format that can be executed by an OS such as Linux.

[0045] The isolated environment management unit 12 has a function of generating users corresponding to individual processing logics in the data sandbox.

[0046] (User Terminal) The user terminal 20 is, for example, a personal computer, a tablet, a smartphone, a software program, or an application program.

[0047] 2 is a diagram showing an example of the operation of the data processing system 1. Here, attention is focused on a user X. It is also assumed that the processing logic X related to the user X is separated from the other processing logics Y and Z.

[0048] Step S1: The isolated environment management unit 12 of the data processing device 10 adds user X, who has a one-to-one correspondence with the execution of processing logic X, to the data sandbox. The isolated environment management unit 12 of the data processing device 10 also creates an area in the data sandbox that is readable and writable only by user X and inaccessible to other users Y and Z.

[0049] Step S2: In response to a request from the user terminal 20X, the processing logic execution management unit 11 of the data processing device 10 issues an attestation report of SEV-SNP. The issued attestation report includes a hash value of the processing logic execution management unit 11.

[0050] By verifying the attestation report of the SEV-SNP and the information linked to the attestation report, user X of user terminal 20X can verify, for example, that the TEE is operating correctly, that the Linux kernel etc. has not been tampered with, that the processing logic execution management unit 11 is implemented correctly, and that the separation of the processing logic is operating correctly. Note that the method for verifying the operation of the separation function using hash values ​​is arbitrary.

[0051] Step S3: If the normality of operation is confirmed, the user terminal 20X transmits to the processing logic execution management unit 11 of the data processing device 10 a common key for decrypting important data used when executing the processing logic X and for encrypting the processing result data.

[0052] Step S4: The user terminal 20X encrypts the important data of the user X with the common key and transmits it to the processing logic execution management unit 11 of the data processing device 10, and instructs the processing logic execution management unit 11 of the data processing device 10 to execute the processing logic X.

[0053] Step S5: The processing logic execution management unit 11 of the data processing device 10 decrypts the encrypted important data using the common key, calls the processing logic X as the user X, and passes the decrypted important data to the processing logic X.

[0054] Step S6: The processing logic execution management unit 11 of the data processing device 10 receives the processing result data of the important data from the processing logic X, encrypts the processing result data with a common key, and transmits the encrypted processing result data to the user terminal 20X.

[0055] [Effects] According to this embodiment, multiple processing logics are separated and called at the system level using the separation function of the OS in the VM, so that multiple processing logics can be safely operated within one TEE.

[0056] Furthermore, according to the embodiment, information for verifying whether the separation of a plurality of processing logics is functioning is issued, so that it is possible to verify the operation of the separation of the processing logics.

[0057] Furthermore, according to the embodiment, the processing logic is called and terminated each time it is executed, so that it is possible to reduce resource consumption when the processing logic is not yet executed.

[0058] Furthermore, according to the embodiment, the execution format of the processing logic is a format executable by the OS, so that the processing logic can be generated by utilizing existing general skills and tools.

[0059] Data sandboxes have the unique advantage of enabling important data and processing logic held by different companies and organizations to be shared while protecting each other in various fields such as smart cities and smart factories.

[0060] Specifically, in the field of smart cities, by combining surveillance camera footage, traffic data, building management data, people flow and gradient data in a data sandbox with health analysis processing logic cultivated through experience and proven results, and sophisticated and highly accurate video detection processing logic, it will be possible to safely develop resident services such as health promotion using personal data, and to accurately detect and predict accidents by analyzing a variety of cameras and sensors.

[0061] In the field of smart factories, by combining surveillance camera footage, 3D blueprints, line operation data, and order data in a data sandbox with processing time prediction processing logic packed with many years of corporate know-how and authorized carbon emission calculation processing logic, it becomes possible to safely formulate optimized production plans based on highly accurate processing time predictions, accurately calculate total CO2 emissions across the supply chain, and globally trace scarce resources throughout their lifecycles.

[0062] By combining this embodiment with a data sandbox that has such unique effects, an additional effect can be obtained in that it is possible to achieve both an increase in the number of users that can be accommodated and safe processing.

[0063] [Additional Information] Additional information regarding AMD's SEV-SNP technology and data sandbox.

[0064] AMD's SEV-SNP is a technology that creates a TEE (Teleconnect Environment) by encrypting memory and making it inaccessible from the outside. For more details, see Reference 1.

[0065] Reference 1: “AMD SEV-SNP: Strengthening VM Isolation with Integrity Protection and More”, January 2020.

[0066] AMD's SEV-SNP is a technology that allows users to verify whether TEE configuration information (e.g., CPU chip identifier, boot firmware for VM, initialization RAM disk, kernel image file, command line executed by kernel) has been tampered with by using an attestation report signed by a hardware module that is the root of trust. For more details, see Reference 2.

[0067] Reference 2: “AMD SEV-SNP Attestation: Establishing Trust in Guests”, September 2022.

[0068] Based on AMD's SEV-SNP, the data sandbox includes in the attestation report hash values ​​(verification information) of information required for data sandbox execution, such as module information within the TEE (e.g., file information, processing logic, and data contained in the VM), public keys generated within the TEE, and execution rules within the data sandbox (e.g., correspondence information between the processing logic and data to be multiplied), making it possible to verify that the agreed-upon important data and processing logic can be multiplied in a secure environment.

[0069] [Others] The present disclosure is not limited to the above-described embodiments, and various modifications are possible within the scope of the gist of the present disclosure.

[0070] The data processing device 10 of the present embodiment described above can be realized, for example, by using a general-purpose computer system including a CPU 901, a memory 902, a storage 903, a communication device 904, an input device 905, and an output device 906, as shown in Fig. 3. The memory 902 and the storage 903 are storage devices. In this computer system, the CPU 901 executes a predetermined program loaded onto the memory 902, thereby realizing each function of the data processing device 10.

[0071] The data processing device 10 may be implemented by one computer, or by multiple computers, or may be a virtual machine implemented in a computer.

[0072] The program for the data processing device 10 can be stored in a computer-readable recording medium such as a HDD, SSD, USB memory, CD, or DVD. The computer-readable recording medium is, for example, a non-transitory recording medium. The program for the data processing device 10 can also be distributed via a communication network.

[0073] REFERENCE SIGNS LIST 1 Data processing system 10 Data processing device 11 Processing logic execution management unit 12 Isolated environment management unit 20 User terminal 30 Communication network 901 CPU 902 Memory 903 Storage 904 Communication device 905 Input device 906 Output device

Claims

1. A data processing device comprising a processing logic execution management unit that uses the isolation function of an operating system in a virtual machine in a node to run multiple processing logics in an isolated environment within the node, and that calls the multiple processing logics in isolation from each other.

2. The data processing device according to claim 1, wherein the processing logic execution management unit issues information for verifying whether the separation of the plurality of processing logics is functioning.

3. The data processing device according to claim 1, wherein the processing logic execution management unit calls processing logic related to the user each time it receives a processing logic execution request from the user.

4. The data processing device according to claim 3, wherein said processing logic is in a form executable by said operating system.

5. A data processing method performed by a data processing device equipped with a processing logic execution management unit, wherein the processing logic execution management unit uses an isolation function of an operating system in a virtual machine in a node to run multiple processing logics in an isolated environment within the node, and calls the multiple processing logics in isolation from each other.

6. A data processing program that causes a computer to function as the data processing device according to any one of claims 1 to 4.

Images