Processing method and device of application program, cloud environment and storage medium

Abstract

Embodiments of the present application provide a processing method and device of an application program, a cloud environment and a storage medium. The method comprises: receiving a start request sent by a first client, the start request being used to start an application program. According to the start request, a manifest file of the application program and a dependency relationship between an enclave entry function of the application program and a static dependent class are loaded in a high-level language runtime environment of an enclave. The manifest file comprises: description information of the enclave entry function of the application program, and / or description information of an enclave exit function of the application program. According to the manifest file and the dependency relationship between the enclave entry function and the static dependent class, a static dependent class of the enclave entry function of the application program is loaded. The method of the embodiments of the present application can run a trusted part of the application program in the enclave while keeping a small TCB and attack surface and reducing the workload of manually rewriting the code.

Description

Technical Field

[0001] This application relates to communication technology, and more particularly to a method, apparatus, cloud environment, and storage medium for processing an application. Background Technology

[0002] Cloud computing is a type of distributed computing. Through cloud computing technology, high-performance data processing applications (such as Spark applications) can be remotely deployed to cloud environments, allowing users to access these applications remotely via cloud services. Cloud computing technology makes the widespread deployment of high-performance data processing applications possible. Applications deployed in cloud environments typically require high stability and security. For example, these applications need to be able to withstand heavy requests without easily crashing, and they must not leak user privacy data in the event of an attack by an external attacker. Because the Java programming language possesses characteristics such as simplicity, object-oriented programming, distributed computing, robustness, security, platform independence and portability, multithreading, and dynamism, many applications deployed in cloud environments are written in Java.

[0003] Applications deployed in cloud environments are vulnerable to privileged attacks. Since the Java language cannot prevent privileged attacks in cloud environments, trusted execution environments (TEEs), which operate in isolation from untrusted environments, have become an important tool for protecting applications in recent years. Intel's Software Guard Extensions (SGX) are currently the most popular TEE product. SGX provides an abstraction of enclave execution; applications running in the enclave and data stored in a memory region isolated from the normal execution environment prevent privileged attackers who can control the operating system and basic input / output system (BIOS) from extracting or tampering with their data.

[0004] Currently, the enclave provides a C / C++ execution environment. Due to the limited memory area of ​​the enclave, application developers need to manually divide the application's original code into trusted and untrusted parts, and manually rewrite the trusted code from Java to C / C++. The trusted part of the application runs within the enclave to ensure the application has a small trusted computing base (TCB) and attack surface. However, this manual code rewriting method results in a large amount of code modification and low efficiency.

[0005] Therefore, how to run the trusted part of the application in an enclave while maintaining a small TCB and attack surface, and reducing the amount of manual code rewriting, is an urgent problem to be solved. Summary of the Invention

[0006] This application provides a method, apparatus, cloud environment, and storage medium for processing applications, which addresses the problem of running trusted parts of an application in an enclave while maintaining a small TCB and attack surface and reducing the workload of manually rewriting code.

[0007] In a first aspect, embodiments of this application provide a method for processing an application. The method includes: first, receiving a startup request sent by a first client, the startup request being used to start the application. Second, according to the startup request, in a high-level language runtime environment of an enclave, loading the application's manifest file and the dependency relationships between the application's enclave entry function and static dependency classes. The manifest file includes: description information of the application's enclave entry function, and / or, description information of the application's enclave exit function. Then, according to the manifest file and the dependency relationships between the enclave entry function and the static dependency classes, loading the static dependency classes of the application's enclave entry function.

[0008] This method allows trusted portions of an application's code to be loaded within the enclave's high-level language runtime environment, based on the application's manifest file, the enclave's entry function, and the dependencies of static dependent classes. This enables the direct execution of a portion of the application's code (i.e., the enclave's entry function and static dependent classes) within the enclave, improving the security of the application's trusted portions, maintaining a smaller TCB and attack surface, increasing the application's execution efficiency within the enclave, reducing the amount of manual code rewriting, and enhancing the ease of running the application within the enclave.

[0009] As one possible implementation, before loading the dependencies between the application's enclave entry function and static dependent classes, the following methods can be used to obtain these dependencies: First method: Based on the application code, obtain the description file of the class marked with the first annotation. The first annotation indicates that the class marked with the first annotation is an enclave entry function. Based on the description file of the class marked with the first annotation, obtain the dependencies between the application's enclave entry function and static dependent classes. Second method: Receive the dependencies between the application's enclave entry function and static dependent classes sent by the first client. Third method: Obtain the dependencies between the application's enclave entry function and static dependent classes from a storage database. These possible implementation methods improve the flexibility of obtaining the dependencies between the application's enclave entry function and static dependent classes.

[0010] As one possible implementation, before loading the application's manifest file, it can be obtained by either receiving the application's manifest file sent by the first client, or retrieving the application's manifest file from a storage database. This possible implementation improves the flexibility of obtaining the application's manifest file.

[0011] As one possible implementation, a high-level language runtime environment (LLU) may be pre-running in the aforementioned enclave. Alternatively, before loading the application's manifest file and the dependencies between the application's enclave entry function and static dependent classes, the process may include: loading the LLU in the enclave and verifying its integrity. This possible implementation expands the ways to run a high-level language runtime environment in an enclave, as well as the ways to run an application in an enclave.

[0012] As one possible implementation, after loading the static dependency classes of the enclave entry function of the application as described above, the method may further include: verifying the integrity of the loaded static dependency classes of the enclave entry function. After the integrity verification of the static dependency classes of the enclave entry function passes, a hash value of the application is generated based on the hash value of the static dependency classes of the enclave entry function and the manifest file. The hash value of the application is sent to the first client, and the hash value of the application is used by the first client to verify the integrity of the static dependency classes of the enclave entry function loaded in the enclave. Through this possible implementation, the computing device and the client can respectively verify the integrity of the static dependency classes of the enclave entry function loaded in the enclave.

[0013] It should be understood that the integrity verification operation can be performed at any time after the application's enclave entry function and its static dependent classes are loaded, and before the application's enclave entry function is run, without any restriction.

[0014] As one possible implementation, the method may further include: after the integrity verification of the static dependent class of the enclave entry function passes, when the first enclave entry function of the application is called by the first thread, switching to allocate a first memory region for the first thread in the enclave. An object of the static dependent class of the first enclave entry function is created and executed in the first memory region. Through this possible implementation, memory can be allocated for the application running in the enclave using a thread-independent memory management method without operating system involvement, thereby avoiding manual memory management by the application developer and improving memory management efficiency.

[0015] As one possible implementation, if the first enclave entry function also includes a first dynamic dependency class, the method further includes: obtaining the dependency relationship between the first dynamic dependency class and the static dependency class; dynamically loading the first dynamic dependency class according to the dependency relationship between the first dynamic dependency class and the static dependency class; verifying the integrity of the first dynamic dependency class; and creating and executing an object of the first dynamic dependency class in the first memory area after the integrity verification of the first dynamic dependency class passes. Through this possible implementation, when the enclave entry function of the application is running in the enclave, the required class functions can be dynamically loaded.

[0016] As one possible implementation, the first enclave entry function and the first enclave exit function have a calling relationship. The method further includes: switching from the enclave's high-level language runtime environment to a non-enclave environment, executing the first enclave exit function in the non-enclave environment, and returning to the enclave's high-level language runtime environment. Through this possible implementation, when the application's enclave entry function is running in the enclave, the enclave exit function called by the enclave entry function can be executed.

[0017] As one possible implementation, the method further includes: after the first enclave entry function exits execution, if the objects of the first enclave entry function have not been accessed by other threads, then clearing the mapping relationship between the first thread and the first memory region. Through this possible implementation, after the first enclave entry function completes execution, the first memory region allocated to the first thread can be promptly cleaned up, allowing the memory pages included in the first memory region to be allocated to other threads, thereby releasing the enclave memory in a timely manner and improving the efficiency of garbage collection in the enclave memory.

[0018] As one possible implementation, the method further includes: after the first enclave entry function exits execution, if the first object of the first enclave entry function is accessed by other threads, then the execution of all enclave entry functions called by threads in the enclave is synchronously stopped. At least one second thread accessing the first object is identified. The first object is copied according to the number of at least one second thread. The mapping relationship between the first thread and the first memory region is cleared. For example, copying the first object according to the number of at least one second thread may include: if the number of second threads is 1, then copying the first object to the second memory region corresponding to the second thread; or, if the number of second threads is greater than 1, then copying the first object to the global memory region of the enclave. Through this possible implementation, after the first enclave entry function is executed, the first memory region allocated to the first thread can be cleaned up in a timely manner, so that the memory pages included in the first memory region can be allocated to other threads for use, thereby releasing the enclave memory in a timely manner and improving the efficiency of garbage collection in the enclave memory.

[0019] Secondly, embodiments of this application provide a method for processing an application. The method includes: first, obtaining, based on the application's code, classes in the application that contain a first annotation and / or classes that contain a second annotation. The first annotation indicates that the class with the first annotation is an enclave entry function, and the second annotation indicates that the class with the second annotation is an enclave exit function. Then, based on the classes containing the first annotation and / or the classes containing the second annotation, generating a manifest file for the application. The manifest file includes: description information of the application's enclave entry functions and / or description information of the application's enclave exit functions.

[0020] Using this method, any device capable of obtaining the application's code (e.g., the application developer's device, or a client using the application) can generate the application's manifest file based on classes annotated with a first annotation and / or classes annotated with a second annotation.

[0021] As one possible implementation, the method may further include: obtaining the static dependency classes of the application's enclave entry function based on the description file of the class containing the first annotation; generating the application's hash value based on the hash value of the static dependency classes of the enclave entry function and the manifest file; this application hash value is used to verify the integrity of the static dependency classes. Through this possible implementation, the application's hash value can be obtained. Subsequently, when a user uses the application remotely, they can verify the integrity of the code running in the enclave within the cloud environment based on this hash value and the hash value returned by the cloud environment.

[0022] As one possible implementation, the method may further include: obtaining the dependency relationship between the application's enclave entry function and static dependent classes based on the description file of the class containing the first annotation.

[0023] Thirdly, embodiments of this application provide an application processing apparatus, comprising: a receiving module and a processing module. The receiving module is configured to receive a startup request sent by a first client, the startup request being used to start the application. The processing module is configured to, according to the startup request, load the application's manifest file and the dependency relationships between the application's enclave entry function and static dependency classes in the enclave's high-level language runtime environment; and, according to the manifest file and the dependency relationships between the enclave entry function and static dependency classes, load the static dependency classes of the application's enclave entry function. The manifest file includes: description information of the application's enclave entry function, and / or, description information of the application's enclave exit function.

[0024] As one possible implementation, the processing module is also used to, before loading the dependency relationship between the application's enclave entry function and the static dependent class, obtain the description file of the class marked with the first annotation in the application based on the application's code; and obtain the dependency relationship between the application's enclave entry function and the static dependent class based on the description file of the class marked with the first annotation in the application; wherein, the first annotation is used to indicate that the class marked with the first annotation is an enclave entry function.

[0025] As one possible implementation, the processing module is also used to receive the dependency relationship between the application's enclave entry function and static dependency classes sent by the first client through the receiving module before loading the dependency relationship between the application's enclave entry function and static dependency classes; or, the processing module is also used to obtain the dependency relationship between the application's enclave entry function and static dependency classes from the storage database before loading the dependency relationship between the application's enclave entry function and static dependency classes.

[0026] As one possible implementation, the processing module is also used to receive the application's manifest file sent by the first client via the receiving module before loading the application's manifest file; or, the processing module is also used to retrieve the application's manifest file from the storage database before loading the application's manifest file.

[0027] As one possible implementation, the processing module is also used to load the high-level language runtime environment in the enclave before loading the application's manifest file and the dependencies of the application's enclave entry function and static dependent classes, and to verify the integrity of the high-level language runtime environment.

[0028] As one possible implementation, the apparatus may further include: a sending module; a processing module, further configured to verify the integrity of the loaded static dependency classes of the enclave entry function after loading them; and, after the integrity verification of the static dependency classes of the enclave entry function passes, generate a hash value of the application based on the hash value of the static dependency classes of the enclave entry function and the manifest file; and a sending module, configured to send the hash value of the application to a first client; the hash value of the application is used by the first client to verify the integrity of the static dependency classes of the enclave entry function loaded in the enclave.

[0029] As one possible implementation, the processing module is also used to, after the integrity verification of the static dependent class of the enclave entry function passes, switch to the enclave to allocate a first memory region for the first thread when the first thread calls the first enclave entry function of the application, and create and execute an object of the static dependent class of the first enclave entry function in the first memory region.

[0030] As one possible implementation, the first enclave entry function also includes a first dynamic dependency class. The processing module is further configured to obtain the dependency relationship between the first dynamic dependency class and the static dependency class; dynamically load the first dynamic dependency class according to the dependency relationship between the first dynamic dependency class and the static dependency class; verify the integrity of the first dynamic dependency class; and after the integrity verification of the first dynamic dependency class is passed, create and execute an object of the first dynamic dependency class in the first memory area.

[0031] As one possible implementation, the first enclave entry function and the first enclave exit function have a calling relationship. The processing module is also used to switch from the high-level language runtime environment of the enclave to the non-enclave environment; execute the first enclave exit function in the non-enclave environment; and return to the high-level language runtime environment of the enclave.

[0032] As one possible implementation, the processing module is also used to clear the mapping relationship between the first thread and the first memory region if the objects of the first enclave entry function have not been accessed by other threads after the first enclave entry function exits execution.

[0033] As one possible implementation, the processing module is also used to, after the first enclave entry function exits execution, if the first object of the first enclave entry function is accessed by other threads, synchronously stop the execution of all enclave entry functions called by threads in the enclave; identify at least one second thread accessing the first object; perform a copy operation on the first object according to the number of at least one second thread; and clear the mapping relationship between the first thread and the first memory region. For example, the processing module is specifically used to copy the first object to the second memory region corresponding to the second thread when the number of second threads is 1; or, when the number of second threads is greater than 1, copy the first object to the global memory region of the enclave.

[0034] The beneficial effects of the application processing apparatus provided by the third aspect and its various possible implementations can be seen from the beneficial effects of the first aspect and its various possible implementations, and will not be repeated here.

[0035] Fourthly, embodiments of this application provide an application processing apparatus, comprising: a processing module. The processing module is configured to: obtain, based on the application's code, classes in the application containing a first annotation and / or classes containing a second annotation; and generate a manifest file for the application based on the classes containing the first annotation and / or the classes containing the second annotation; wherein the first annotation is used to characterize the class with the first annotation as an enclave entry function, and the second annotation is used to characterize the class with the second annotation as an enclave exit function, and the manifest file includes: description information of the application's enclave entry functions, and / or description information of the application's enclave exit functions.

[0036] As one possible implementation, the processing module is also used to obtain the static dependency classes of the application's enclave entry function based on the description file of the class containing the first annotation; and to generate the application's hash value based on the hash value of the static dependency classes of the enclave entry function and the manifest file, the application's hash value being used to verify the integrity of the static dependency classes.

[0037] As one possible implementation, the processing module is also used to obtain the dependency relationship between the application's enclave entry function and static dependent classes based on the description file of the class containing the first annotation.

[0038] The beneficial effects of the application processing apparatus provided by the fourth aspect and its various possible implementations can be seen from the beneficial effects of the second aspect and its various possible implementations, and will not be repeated here.

[0039] Fifthly, embodiments of this application provide a processing apparatus for an application, the processing apparatus comprising: a processor and a memory. The memory stores computer-executable program code, the program code including computer-executable instructions; when the processor executes the computer-executable instructions, the computer-executable instructions cause the processing apparatus of the application to perform the methods provided by the first aspect or various possible implementations of the first aspect.

[0040] Sixthly, embodiments of this application provide a processing apparatus for an application, the processing apparatus comprising: a processor and a memory. The memory stores computer-executable program code, the program code including computer-executable instructions; when the processor executes the computer-executable instructions, the computer-executable instructions cause the processing apparatus of the application to perform the methods provided by the second aspect or various possible implementations of the second aspect.

[0041] In a seventh aspect, embodiments of this application provide an application processing apparatus, including a unit, module, or circuit for performing the methods provided in the first aspect or various possible implementations of the first aspect. The application processing apparatus can be a computing device in a cloud environment, or a module applied to a computing device in a cloud environment, for example, a chip applied to a computing device in a cloud environment.

[0042] Eighthly, embodiments of this application provide a processing apparatus for an application, including a unit, module, or circuit for performing the methods provided in the second aspect or various possible implementations of the second aspect. The processing apparatus for this application can be a client in a cloud environment, or a module applied to a client in a cloud environment; for example, it can be a chip applied to a client in a cloud environment.

[0043] Ninthly, embodiments of this application provide a network device that stores a computer program, which, when executed by the network device, implements the methods provided by the first aspect or its possible implementations, or the second aspect or its possible implementations. The network device may, for example, be a chip.

[0044] In a tenth aspect, embodiments of this application provide a network device including a processor and an interface circuit. The interface circuit is configured to receive computer execution instructions and transmit them to the processor; the processor executes the computer execution instructions to perform the methods provided by the first aspect or its possible implementations, or the second aspect or its possible implementations. The network device may, for example, be a chip.

[0045] Eleventhly, embodiments of this application provide a network device including a processor and a memory. The memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to cause the network device to perform the methods provided by the first aspect or its possible implementations, or the second aspect or its possible implementations. The network device may, for example, be a chip.

[0046] In a twelfth aspect, embodiments of this application provide a network device including a processor, a memory, and a transceiver. The transceiver is used to receive or transmit signals; the memory is used to store a computer program; and the processor is used to retrieve the computer program from the memory to execute methods provided by the first aspect or its possible implementations, or the second aspect or its possible implementations. The network device may, for example, be a chip.

[0047] In a thirteenth aspect, embodiments of this application provide a computer program product comprising computer program code that, when executed on a computer, causes the computer to perform the methods provided by the first aspect or various possible implementations of the first aspect, or the second aspect or various possible implementations of the second aspect.

[0048] In a fourteenth aspect, embodiments of this application provide a computer-readable storage medium for storing a computer program or computer execution instructions that, when executed on a computer, cause the computer to perform the methods provided by the first aspect or various possible implementations of the first aspect, or the second aspect or various possible implementations of the second aspect.

[0049] In a fifteenth aspect, embodiments of this application provide a cloud environment comprising: a processing apparatus for an application as described in any of the third aspects and a processing apparatus for an application as described in any of the fourth aspects. Alternatively, the cloud environment comprises: a processing apparatus for an application as described in any of the fifth aspects and a processing apparatus for an application as described in any of the sixth aspects.

[0050] The application processing method, apparatus, cloud environment, and storage medium provided in this application embodiment, in the high-level language runtime environment running in the enclave, can load the trusted part of the application's code based on the application's manifest file, the application's enclave entry function, and the dependency relationship of static dependency classes. This allows a portion of the application's code written in a high-level language (i.e., the enclave entry function and static dependency classes) to be run directly in the enclave, which can improve the security of the trusted part of the application, maintain a small TCB and attack surface, improve the application's execution efficiency in the enclave, and at the same time reduce the amount of manual code rewriting, thus improving the ease of running the application in the enclave. Attached Figure Description

[0051] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of this application;

[0052] Figure 2 A schematic diagram of a programming model provided for an embodiment of this application;

[0053] Figure 3 A flowchart illustrating an application processing method provided in an embodiment of this application;

[0054] Figure 4 A schematic diagram illustrating memory management as provided in an embodiment of this application;

[0055] Figure 5 A flowchart illustrating another application processing method provided in this application embodiment;

[0056] Figure 6 A flowchart illustrating another application processing method provided in this application embodiment;

[0057] Figure 7 A flowchart illustrating another application processing method provided in this application embodiment;

[0058] Figure 8 A flowchart illustrating another application processing method provided in this application embodiment;

[0059] Figure 9 A flowchart illustrating another application processing method provided in this application embodiment;

[0060] Figure 10 A flowchart illustrating another application processing method provided in this application embodiment;

[0061] Figure 11 A schematic diagram of the structure of an application processing device provided in an embodiment of this application;

[0062] Figure 12 This is a schematic diagram of the structure of a processing device for another application provided in an embodiment of this application. Detailed Implementation

[0063] Figure 1 This is a schematic diagram illustrating an application scenario provided by an embodiment of this application. For example... Figure 1 As shown, applications can be deployed in a cloud environment. A cloud environment is an entity that provides cloud services to users using basic resources under the cloud computing model. A cloud environment includes cloud data centers and cloud service platforms. The cloud data center includes a large number of basic resources (including computing resources, storage resources, and network resources) owned by the cloud service provider. The computing resources included in the cloud data center can be a large number of computing devices (e.g., servers). For example, taking servers running virtual machines as an example, the application can be deployed independently on servers or virtual machines (VMs) in the cloud data center. Alternatively, the application can be deployed distributedly on multiple servers in the cloud data center, or distributedly on multiple VMs in the cloud data center, or distributedly on servers and VMs in the cloud data center.

[0064] Applications can be abstracted into cloud services by cloud service providers on cloud service platforms and offered to users. After a user purchases the cloud service on the platform (e.g., pre-payment with settlement based on final resource usage), the cloud environment utilizes the application deployed in the cloud data center to provide the cloud service to the user. When a user uses the application remotely, they can specify the operations that the application should perform through an application program interface (API) or GUI. The application in the cloud environment performs the corresponding operations and returns the results to the user through the API or GUI.

[0065] In some embodiments, the applications deployed in the cloud environment described above can also be referred to as applications using a user-server model. That is, the server running the application is a server in the cloud environment.

[0066] Applications deployed in cloud environments may be vulnerable to privileged attacks, such as external privileged attackers exploiting operating system vulnerabilities to gain control of the cloud environment's operating system, thereby attacking applications running on that system. This could include extracting and tampering with data from applications running on the operating system. Alternatively, internal privileged attackers (such as staff of the cloud provider) could physically attack applications running in the cloud environment.

[0067] Currently, the Java language cannot prevent privileged attacks in cloud environments. Therefore, to avoid privileged attacks in cloud environments, trusted runtime environments (TRUs), which operate in isolation from untrusted runtime environments, have become an important tool for protecting cloud applications in recent years. Intel's SGX is currently the most popular TRU product. SGX provides an abstraction of enclave execution. Enclaves have the following characteristics:

[0068] 1. Enclaves can provide two security features: confidentiality and integrity.

[0069] Specifically, because the memory areas storing data and code within an enclave are isolated from ordinary, untrusted memory, data and code running within the enclave cannot be spied on, extracted, or tampered with by privileged attackers. Therefore, an enclave can guarantee the confidentiality and integrity of applications running on it.

[0070] 2. Enclaves can provide a remote attestation mechanism.

[0071] Specifically, this remote verification mechanism can measure the integrity of the runtime environment running in the enclave and generate a verification report (such as the hash value of the runtime environment) to be provided to remote clients using the application, enabling the clients to verify the runtime environment running in the enclave. The measurement mentioned here can also be referred to as verification.

[0072] 3. The enclave can provide two interfaces for the application: the enclave entry function (ECall) and the enclave exit function (OCall).

[0073] Specifically, an enclave entry function is a trusted function defined by the application and executed within the enclave. An enclave exit function is a function called by the enclave entry function during execution within the enclave and executed in an untrusted execution environment. Enclave exit functions are typically used to execute privileged instructions, such as operating system functions (System Calls). It should be understood that an enclave entry function may have at least one enclave exit function with a calling relationship, or it may have no enclave exit function, depending on whether the enclave entry function needs to execute privileged instructions.

[0074] For example, when an application's enclave entry function is called by an untrusted environment, the enclave entry function is executed in the enclave's execution environment to decrypt the encrypted data provided by the user and perform calculations. During the calculation process, if the enclave entry function needs to call an enclave exit function, it exits the enclave's execution environment, and the corresponding enclave exit function is executed in the untrusted execution environment. After execution is complete, it returns to the enclave's execution environment to continue executing the enclave entry function. Finally, the result calculated by the enclave entry function is encrypted, the enclave's execution environment is exited, and the encrypted result is returned to the user.

[0075] 4. Enclaves can reduce TCB and attack surface.

[0076] Specifically, traditional systems trust system software, operating systems, and BIOS. Therefore, the TCB (Target Block) of a traditional system includes all of these software and hardware components, making the interactions between these system software components and untrusted users an attack surface. In contrast, the enclave provided by a TEE (Trusted Enclave Environment) only trusts all code running within the enclave (i.e., the TCB), and the attack surface is limited to the interactions between the enclave and the untrusted environment (such as enclave exit and entry functions). Therefore, the number of TCBs and the attack surface can be reduced.

[0077] 5. Flying execution can reduce computational and storage overhead.

[0078] Specifically, traditional trusted computing uses homomorphic encryption of trusted user data, allowing cloud environments to directly perform operations on the encrypted data. These operations are typically limited, such as addition, multiplication, and exponentiation. Furthermore, homomorphic encryption / decryption computations are time-consuming, resulting in significant computational costs (10X to 1000X) for applications. Additionally, supporting different computations requires different homomorphic encryption methods, incurring additional storage overhead (2X-4X). Enclave computing, on the other hand, can support all computational operations, thus reducing computational and storage overhead.

[0079] Currently, the execution environment provided by the enclave is a C / C++ language execution environment; that is, the enclave's entry and exit functions are C / C++ interface functions. Therefore, existing technology provides the following method to enable applications to run in the enclave:

[0080] The application developers manually divided the application's source code into trusted and untrusted parts. The trusted part handles decrypted sensitive data, while the untrusted part manages encrypted data, operating system calls, and the enclave. Then, the developers manually rewrote the trusted part's code from Java to C / C++, adding encryption and decryption logic, allowing the trusted part to run within the enclave. Operating system calls are then passed to the untrusted environment for execution and verification via an enclave exit function written by the application developers.

[0081] By manually partitioning and rewriting the code as described above, a portion of the application's code can run in an enclave to process and store sensitive data. Therefore, this approach helps maintain a smaller TCB and attack surface. However, rewriting the trusted code from Java to C / C++ requires rewriting all trusted Java code and all its dependent Java library functions into C / C++, and rewriting all operating system functions as enclave exit functions. A single Java library can contain tens of thousands of lines of code; therefore, this method results in a large amount of rewriting and low efficiency, compromising the usability of running the application in an enclave.

[0082] Furthermore, since C / C++ does not have the ability to automatically manage memory, the method described above for rewriting the trusted part of the application from Java to C / C++ requires manual management of the memory used by the trusted part of the application when it is running in the enclave.

[0083] Considering the significant amount of rewriting required, some solutions propose running the entire application in an enclave. For example, multiple systems (such as Graphene-SGX and SCONE) combined with a library OS or container can run the entire application within the enclave. Specifically, a modified library OS or container daemon runs in the enclave, then measures, loads, and runs a complete, unmodified application or container image within it. The hash value generated during the loading process is used by the user to verify the integrity of the application running in the enclave.

[0084] While running a complete application in an enclave eliminates the need to manually distinguish between trusted and untrusted parts of the application, and avoids rewriting the trusted parts, this method introduces new problems, as follows:

[0085] (1) Creates a large TCB and attack surface.

[0086] Specifically, the application's TCB includes the application and its dependent libraries, the library system (or container daemon), and the trusted hardware itself. The library system (or container daemon) may contain hundreds of thousands of lines of code. Any vulnerability in the code within the TCB could cause the application to crash or become vulnerable to attack, compromising its confidentiality and integrity.

[0087] (2) The application has low execution efficiency in the enclave.

[0088] Specifically, enclave execution typically offers limited memory capacity, for example, a maximum of approximately 100MB. Currently, when enclave memory is insufficient, page swapping, which is 1000X faster than in-memory execution, is used to process data. That is, data is stored in untrusted memory using page swapping, and when the data is needed, it is read from that untrusted memory into the enclave.

[0089] When running a complete, unmodified application in an enclave using the above method, all application data and code, regardless of whether they handle sensitive data, need to be stored in the enclave's memory. Therefore, running an application in an enclave in this way may result in low application execution efficiency due to frequent page swapping. For example, the Java Virtual Machine (JVM) occupies more than 100MB of memory after initialization; therefore, running a complete JVM using the above method may lead to low JVM execution efficiency due to frequent page swapping.

[0090] Therefore, how to run the trusted part of the application in an enclave while maintaining a small TCB and attack surface, and reducing the amount of manual code rewriting, is an urgent problem to be solved.

[0091] As mentioned earlier, the execution environment currently provided by the enclave is a C / C++ language execution environment; that is, the enclave's entry and exit functions are C / C++ interface functions. This low-level C / C++ interface function leads to security issues in the trusted parts of the application. Specifically, C / C++ is not memory-safe, therefore, privileged attackers can exploit C / C++ vulnerabilities to attack it. C / C++ is also untype-safe, which can easily affect the confidentiality and integrity of the application. For example, a trusted part written in C / C++ might contain a buffer overflow error, which could pollute the application's execution stack, thereby affecting the application's execution control flow.

[0092] Therefore, considering the security, efficiency, and usability issues of the aforementioned methods, and taking into account the memory safety and type safety features of object-oriented high-level languages ​​(such as Java), as well as the fact that most current applications are written in object-oriented high-level languages, this application proposes a method of running a high-level language runtime environment in an enclave, and directly running a portion of the application code written in the high-level language within the enclave. That is, the high-level language runtime environment running in the enclave, and the trusted code of the application, are trusted, while other parts (such as the operating system, BIOS, and other runtime environments running outside the enclave) are untrusted. The high-level language mentioned here can be any object-oriented high-level language, such as Java, Scala, etc.

[0093] This method has the following effects:

[0094] 1) High-level languages ​​have good type safety and memory safety features, which make it easy to protect trusted parts of the application from traditional memory attacks and prevent memory errors, thus improving the security of trusted parts of the application.

[0095] 2) After dividing the application into trusted and untrusted code, if the trusted part of the application does not have encryption / decryption logic, the application developer only needs to manually add encryption / decryption logic to the trusted part. If the trusted part of the application itself has encryption / decryption logic, there is no need to manually rewrite the application, which reduces the amount of manual code rewriting and improves the ease of use of running the application in an enclave.

[0096] 3) Running a portion of the application's code in an enclave can keep the application's TCB and attack surface smaller, while also preventing it from consuming too much memory in the enclave during runtime, thus improving the application's execution efficiency in the enclave.

[0097] To achieve the above method, the embodiments of this application propose the following improvements:

[0098] Firstly, two annotation-based programming interfaces are provided: the first interface `JECall` and the second interface `JOCall`. The first interface `JECall` corresponds to the first annotation `@JECall`, and the second interface `JOCall` corresponds to the second annotation `@JOCall`. The first annotation `@JECall` indicates that the class annotated with `@JECall` is the enclave entry function, and the second annotation `@JOCall` indicates that the class annotated with `@JOCall` is the enclave exit function. That is, the class annotated with `@JECall` is the class running in the enclave, and the class annotated with `@JOCall` is the class running in the enclave that calls the class running in the enclave in a non-enclave environment (e.g., an operating system call). This non-enclave environment can also be called an untrusted environment.

[0099] Application developers can annotate classes in their application using the first annotation `@JECall` and the second annotation `@JOCall`. Classes annotated with `@JECall` and their dependent classes will automatically run in the enclave, while classes annotated with `@JOCall` will exit the enclave execution process when running in the enclave.

[0100] It should be understood that JECall, JOCall, @JECall, and @JOCall are only used to describe the first interface, the second interface, the first annotation, and the second annotation. The specific names used for the first interface, the second interface, the first annotation, and the second annotation in this application embodiment are not limited.

[0101] For example, Figure 2 This is a schematic diagram of a programming model provided in an embodiment of this application. For example... Figure 2 As shown, taking the application of the programming model to a key-value database application as an example, the application developer can use the first and second comments mentioned above to divide the application's code into trusted and untrusted parts in the programming model.

[0102] For example, Figure 2The application includes the functions `handle_request`, `decrypt`, and `store`. The `handle_request` function calls both the `decrypt` and `store` functions during execution. Assuming the application developer labels `handle_request` as `JECall` and `store` as `JOCall`, both `handle_request` and its call to `decrypt` will run in an enclave. The `store` function, called by `handle_request`, will run in an untrusted environment. That is, when `handle_request` is called in an untrusted environment, execution will switch to the enclave. During execution of `handle_request` in the enclave, the decryption function can be used to decrypt encrypted data provided by the client. When the `store` function is called, execution will switch from the enclave to the untrusted environment and return the result. When `JECall` completes execution, it exits the enclave and returns the encrypted computation result.

[0103] Figure 2 While this programming model illustrates how to use the aforementioned first and second comments to divide the application's code into trusted and untrusted parts, it should be understood that application developers may use other methods to divide the application's code into trusted and untrusted parts using the first and second comments; this is not a limitation.

[0104] Secondly, taking the high-level language Java as an example, Java applications use dynamic class loading for code loading. However, using dynamic class loading in an enclave (i.e., a trusted runtime environment) will leak the code control flow information of the enclave. For example, if a sensitive piece of information executes function A when the value is 0, and otherwise executes function B, the loading of functions A and B will expose the sensitive information. Furthermore, dynamic loading in an enclave (i.e., a trusted runtime environment) prevents trusted users from knowing or verifying all potentially executable code.

[0105] Therefore, considering this problem, embodiments of this application provide a code loading method that can guarantee code integrity. This code loading method can load trusted parts of the application's code based on the application's manifest, the application's enclave entry function, and the dependency relationships of static dependent classes. In this way, only a small portion of the code (i.e., the enclave entry function and static dependent classes) needs to be loaded when the application starts.

[0106] As one possible implementation, after the application developer has annotated the application using the first and second annotations mentioned above, the application's manifest file can be obtained in the following way. Figure 3 This is a flowchart illustrating an application processing method provided in an embodiment of this application. The executing entity of this method can be any device capable of obtaining the application's code, such as the application developer's device, or a client using the application. Figure 3 As shown, the method includes:

[0107] S101. Based on the application's code, obtain the classes in the application that contain the first annotation and / or the classes that contain the second annotation.

[0108] For example, you can iterate through the application's code to see if there is a first comment and a second comment, in order to obtain the classes in the application that contain the first comment and / or the classes that contain the second comment.

[0109] S102. Generate the application manifest file based on the classes containing the first annotation and / or the classes containing the second annotation.

[0110] The application's manifest file may include: descriptions of the application's enclave entry functions, and / or descriptions of the application's enclave exit functions. For example, the descriptions may include: function names, lists of parameters called (e.g., parameter types and execution order), return types, etc.

[0111] Furthermore, the static dependency classes of the application's enclave entry function can be obtained from the description file of the class containing the first annotation. Then, based on the hash value of the static dependency class of each enclave entry function of the application and the manifest file, a hash value H0 for the application is generated. This hash value H0 is used to verify the integrity of the static dependency classes. The hash value H0 mentioned here can be obtained using any hash algorithm, such as a SHA256 hash value, and this embodiment of the application does not limit it.

[0112] Specifically, a class description file typically describes information about the class's static dependent classes. Therefore, based on the description file of a class containing the first annotation, the static dependent classes of that class can be obtained. Then, based on the description files of these static dependent classes, the static dependent classes of those static dependent classes can be obtained, and so on, until all static dependent classes are obtained.

[0113] For example, taking class A1, which contains the first annotation, as an example, assume that according to the description file of class A1, class A has static dependencies of classes B and C; according to the description file of class B, class B has static dependencies of classes B1 and B2; according to the description file of class B2, class B2 has static dependencies of classes B21 and B22; according to the description file of class B1, class B1 has no static dependencies; and according to the description file of class C, class C has no static dependencies. The specific dependency relationships can be shown in Table 1 below:

[0114] Table 1

[0115]

[0116] In this example, class A1 is an enclave entry function of the application, and the static dependent classes of class A1 are class B, class B1, class B2, class B21, class B22, and class C.

[0117] Assuming the application has five enclave entry functions, namely classes A1, A2, A3, A4, and A5, a hash value H0 for the application can be obtained by hashing the hash values ​​of each static dependent class of class A1, class A2, class A3, class A4, and class A5, along with the manifest file obtained in step S102. Subsequently, when users remotely use the application, they can verify the integrity of the code running in the enclave using the hash value H0. Details on how to verify this will be provided later.

[0118] Alternatively, as a possible implementation, the dependency relationship between the application's enclave entry function and static dependent classes can be obtained from the description file of the class containing the first annotation. This dependency relationship can be represented, for example, using an adjacency list or a dependency graph, without limitation.

[0119] Thirdly, it provides a memory management method that is independent of the operating system and threads, thereby avoiding the need for application developers to manually manage memory. Figure 4 This is a schematic diagram illustrating memory management as provided in an embodiment of this application. Figure 4 As shown, the embodiments of this application allocate memory regions in the following way: when a thread calls the enclave entry function of the application, an independent and expandable memory region can be allocated for that thread in the enclave. That is to say, the memory regions of each thread are independent of each other.

[0120] For example, Figure 4This illustrates the memory regions allocated for thread 1 and thread 2 within the enclave memory when thread 1 and thread 2 respectively call the application's enclave entry function. These memory regions are independent of each other. In this example, the enclave entry functions called by thread 1 and thread 2 can be the same or different.

[0121] The following detailed description of how to load the application code is illustrated with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0122] Figure 5 This is a flowchart illustrating another application processing method provided in an embodiment of this application. The executing entity of this method can be a computing device in a cloud environment, such as... Figure 5 As shown, the method includes:

[0123] S201. Receive a startup request sent by the first client, wherein the startup request is used to start the application.

[0124] For example, when a user needs to use the application, the user can remotely send a launch request to start the application through a first client.

[0125] S202. Based on the startup request, in the enclave's high-level language runtime environment, load the application's manifest file and the application's enclave entry function and its static dependency classes' dependencies.

[0126] It should be understood that the high-level language runtime environment of the enclave mentioned here is the same as the language used to develop the application. For example, if the application is written in the high-level language Java, then the high-level language runtime environment of the enclave is the Java language runtime environment.

[0127] This high-level language runtime environment can have the following functions:

[0128] 1) Load the trusted part of the application and transmit it to the enclave, generating a corresponding hash value H′. o It is used by the client to verify the integrity of the trusted parts it loads.

[0129] 2) Switching from execution of the untrusted part of the application to execution of the trusted part. That is, switching from the untrusted environment to the trusted environment of the enclave to execute the application's trusted code. During the switch, the function descriptions and required call parameters of the trusted part are copied from the untrusted memory to the trusted enclave memory.

[0130] 3) Compile the functions running in the enclave into binary executable code and run them in the enclave.

[0131] Optionally, the high-level language runtime environment may be pre-running in the enclave, or the computing device may load the high-level language runtime environment in the enclave after receiving the startup request and verify its integrity. For example, a pre-defined trusted runtime environment remote verification protocol may be invoked to verify the integrity of the high-level language runtime environment.

[0132] For example, the computing device can generate a hash value Hx for the high-level language runtime environment and send this hash value to the first client. Correspondingly, the first client stores a hash value Hx'. If the hash value Hx' is the same as the hash value Hx, the integrity verification of the high-level language runtime environment loaded in the enclave passes. Then, the computing device and the first client can exchange keys. In this way, subsequent communication between the computing device and the first client can be encrypted using the exchanged key.

[0133] The hash value Hx' stored in the first client can be a hash value generated by the first client running its own high-level language runtime environment, or it can be a trusted hash value obtained by other means and used to verify the high-level language runtime environment loaded in the enclave. This application embodiment does not limit this.

[0134] The manifest file of the application loaded in the high-level language runtime environment of the enclave can be used to utilize the aforementioned Figure 3 The manifest file is generated offline as shown. This embodiment does not limit the method by which the computing device obtains the manifest file. As an optional method, the computing device may receive the manifest file sent by the first client before loading the manifest file. For example, the first client may send the manifest file to the computing device in a startup request, or the first client may send the manifest file together with the startup request, or the first client may send the manifest file and the startup request to the computing device separately.

[0135] As an alternative approach, the computing device can retrieve the application's manifest file from the cloud environment's storage database before loading the manifest file. In this case, the application's manifest file stored in the storage database could be pre-stored in the database by cloud environment maintainers, application developers, etc., or it could be stored in the storage database by a computing device in the cloud environment when it historically launched the application.

[0136] The dependency relationships between the enclave entry function and static dependency classes of the application loaded in the enclave's high-level language runtime environment can be generated offline using the methods described above. This embodiment does not limit the method by which the computing device obtains the dependency relationships between the application's enclave entry function and static dependency classes. As an optional method, the computing device can receive the dependency relationships between the application's enclave entry function and static dependency classes sent by the first client before loading them. For details on how to send the dependency relationships between the application's enclave entry function and static dependency classes, please refer to the description of sending manifest files above; further details will not be repeated here.

[0137] As an alternative approach, before loading the application's enclave entry function and static dependency class dependencies, the computing device can retrieve the application's enclave entry function and static dependency class dependencies from the cloud environment's storage database. In this case, the dependencies stored in the storage database can be pre-stored in the database by cloud environment maintainers, application developers, etc., or, alternatively, stored by a computing device in the cloud environment during a previous application launch.

[0138] The dependencies between the enclave entry function and static dependent classes of an application loaded in the enclave's high-level language runtime environment can be generated online. That is, the computing device generates them online after receiving the startup request. Alternatively, before loading the enclave entry function and static dependent classes, the computing device can obtain the description files of the classes marked with the first annotation in the application's code. Then, the computing device can obtain the dependencies between the enclave entry function and static dependent classes based on the description files of the classes marked with the first annotation.

[0139] S203. Based on the manifest file and the dependency relationship between the enclave entry function and the static dependency class, load the static dependency class of the application's enclave entry function.

[0140] As one possible implementation, the application code can be stored in a cloud environment, such as a cloud storage database. After obtaining the manifest file and the dependency relationships between the enclave entry function and the static dependent classes, the computing device can load the static dependent classes of the application's enclave entry function into the enclave based on these relationships.

[0141] Continue to refer to Figure 5As one possible implementation, after loading the static dependency classes of the application's enclave entry function, the following operations can be performed:

[0142] S204. Verify the integrity of the static dependency classes of the loaded enclave entry function.

[0143] For example, a computing device can verify the integrity of the static dependency class of the enclave entry function and the validity of its hash value within the enclave. If both the content and hash value of the static dependency class are valid, the integrity verification of the static dependency class is deemed successful. After the integrity verification of the static dependency class of the enclave entry function is successful, step S205 can be executed. If the content or hash value of the static dependency class is invalid, the integrity verification of the static dependency class is deemed to have failed. After the integrity verification of the static dependency class of the enclave entry function fails, a message indicating that the trusted part of the application failed to load can be returned to the first client, for example.

[0144] S205. Generate the application's hash value H0' based on the hash value of the static dependency class of the enclave entry function and the manifest file.

[0145] It should be understood that the calculation method for the hash value H0' described above can be the same as the calculation method for obtaining the hash value H0 described above. This hash value H0' can identify all the code loaded into the enclave by the application.

[0146] S206. Send the hash value H0' of the application to the first client. The hash value H0' of the application is used by the first client to verify the integrity of the static dependency class of the enclave entry function loaded in the enclave.

[0147] For example, the first client stores a hash value H0 generated offline using the aforementioned method. When the first client receives a hash value H0' from the application sent by the computing device, it can compare the hash value H0' with the hash value H0. If they are the same, the integrity verification of the static dependency class of the enclave entry function loaded in the enclave passes; if they are different, the integrity verification of the static dependency class of the enclave entry function loaded in the enclave fails.

[0148] It should be understood that steps S204-S206 can be executed at any time after loading the static dependency classes of the application's enclave entry function and before running the application's enclave entry function, without any limitation.

[0149] The method of this embodiment will be illustrated below with a specific example, in which a JVM runs on the computing device and an application written in Java is deployed on the JVM enclave. Figure 6This is a flowchart illustrating another application processing method provided in an embodiment of this application. Figure 6 As shown, after receiving the application startup request sent by the client, the JVM of the computing device can perform the following steps:

[0150] ① Load the high-level language runtime environment in the enclave.

[0151] ② Based on the manifest file of the loaded application and the dependency relationship between the application's enclave entry function and static dependent classes, load the static dependent classes of the application's enclave entry function into the enclave.

[0152] ③ Verify the integrity of the static dependency classes of the loaded enclave entry function, and after the integrity verification is passed, generate the application's hash value H0' based on the hash value of the static dependency classes of the enclave entry function and the manifest file.

[0153] ④ Verify the high-level language runtime environment with the client, and exchange keys.

[0154] It should be understood that the action shown in ④ can also be performed at any time after ① and before ⑤.

[0155] ⑤ Send the application's hash value H0' to the client so that the client can verify the integrity of the static dependency classes of the enclave entry function loaded in the enclave based on the stored hash value H0 and hash value H0'.

[0156] ⑥ After the client completes the integrity verification of the trusted part of the application, the static dependency classes of the loaded enclave entry function are compiled into binary executable code and run in the enclave.

[0157] The method of this application embodiment, in the runtime environment of a high-level language running in an enclave, can load the trusted part of the application's code based on the application's manifest file, the application's enclave entry function, and the dependency relationship between static dependency classes. This allows a portion of the application's code written in a high-level language (i.e., the enclave entry function and static dependency classes) to run directly in the enclave, thereby improving the security of the trusted part of the application, maintaining a smaller TCB and attack surface, improving the application's execution efficiency in the enclave, and reducing the amount of manual code rewriting, thus improving the ease of running the application in the enclave.

[0158] The above describes how to run a portion of an application's code (i.e., the enclave entry function and static dependency classes) written in a high-level language within an enclave. The following describes in detail how the computing device calls the enclave entry function after the integrity verification of the enclave entry function and static dependency classes has passed.

[0159] Figure 7 This is a flowchart illustrating another application processing method provided in an embodiment of this application. Figure 7 As shown, the method includes:

[0160] S301. When the first enclave entry function of the application is called through the first thread, switch to the enclave and allocate the first memory area for the first thread. That is, switch from the non-enclave environment to the high-level language runtime environment of the enclave.

[0161] The aforementioned first enclave entry function can be any enclave entry function of the application.

[0162] Optionally, the first memory region may include at least one memory page, each memory page being, for example, 32 kilobytes (KB) of memory.

[0163] For example, the computing device can initially allocate a memory page for the first memory region. During the execution of the first enclave entry function called by the first thread, if memory allocation is required, memory pages can be added for that thread. That is, the size of the first memory region is dynamically expanded. For example, a free memory page can be found among the memory pages closest to the first memory region and allocated to the first thread to ensure the contiguousness of the first memory region. If the memory page closest to the first memory region cannot meet the memory requirements of the first thread, multiple contiguous memory pages can be found in the enclave's memory to serve as the first memory region.

[0164] S302. Create and execute an object of the static dependent class of the first enclave entry function in the first memory region.

[0165] After allocating a first memory region for the first thread using the method described above, the computing device can create and execute an object of the statically dependent class of the first enclave entry function within that first memory region. For details on how to create such an object, please refer to the description in the prior art; further details will not be provided here.

[0166] It should be understood that in some embodiments, the first enclave entry function may also contain static dependency classes that can be executed without creating an object. For this type of static dependency class, execution can be performed directly when the first enclave entry function is executed, and this will not be elaborated further. In addition to static dependency classes, there may also be dynamic dependency classes and / or a first enclave exit function with a calling relationship. The following explains how dynamic dependency classes and enclave exit functions are executed during the execution of the first enclave entry function:

[0167] For dynamic dependency classes:

[0168] Figure 8This is a flowchart illustrating another application processing method provided in an embodiment of this application. Taking a first dynamic dependency class as an example, the first enclave entry function further includes the first dynamic dependency class. Figure 8 As shown, the computing device can perform the following operations:

[0169] S401. Obtain the dependency relationship between the first dynamic dependency class and the static dependency class.

[0170] For example, a computing device can determine the dynamic class to be executed by the first enclave entry function based on the operation requested by the first thread when it calls the first enclave entry function, thereby obtaining the dependency relationship between this dynamic dependency class and the static dependency classes. It should be understood that the dependency relationship referred to here includes the dependency relationship between the dynamic dependency class and all its static dependency classes.

[0171] Taking Java as an example, the dynamic dependency class mentioned here could be a class file that is dynamically invoked by reflection from the first enclave entry function.

[0172] For details on how to obtain the dependency relationship between this dynamic dependency class and the static dependency class, please refer to the aforementioned description on obtaining static dependency classes online, which will not be repeated here.

[0173] S402. Based on the dependency relationship between the first dynamic dependency class and the static dependency class, dynamically load the first dynamic dependency class.

[0174] As one possible implementation, the application code can be stored in a cloud environment, such as a cloud storage database. After obtaining the dependency relationship between the first dynamic dependency class and the static dependency class, the computing device can load the first dynamic dependency class into the enclave based on this dependency relationship.

[0175] For example, an interface for loading dynamically dependent classes can be provided, such as `loadClass(classname)`, where `classname` is the name of the dynamically dependent class to be loaded. This allows the computing device to load `classname` into the enclave via this interface.

[0176] S403. Verify the integrity of the first dynamic dependency class.

[0177] For example, a computing device can verify the content of the static dependency class of the loaded first dynamic dependency class and the validity of its hash value in an enclave to determine the integrity of the first dynamic dependency class. If both the content of the static dependency class and its hash value are valid, the integrity verification of the first dynamic dependency class is deemed successful. After the integrity verification of the first dynamic dependency class is successful, step S404 can be executed. If the content of the static dependency class is invalid, or the hash value of the static dependency class is invalid, the integrity verification of the first dynamic dependency class is deemed to have failed. After the integrity verification of the first dynamic dependency class fails, a message indicating that the loading of the first dynamic dependency class failed can be returned to the first client, for example.

[0178] Optionally, after the integrity verification of the first dynamic dependency class passes, a hash value Hc of the first dynamic dependency class can be generated based on the hash value of the static dependency class it depends on, and this hash value Hc can be sent to the client that calls the first enclave entry function through the first thread, so that the client can verify the integrity of the first dynamic dependency class loaded in the enclave. For details on how to verify this, please refer to the aforementioned method for client verification of the static dependency class of the enclave entry function; its implementation is similar and will not be repeated here.

[0179] S404. Create and execute an object of the first dynamic dependency class in the first memory region.

[0180] For details on how to create objects of dynamic dependency classes, please refer to the description of existing technologies, which will not be repeated here.

[0181] For the enclave exit function called by the first enclave entry function:

[0182] Taking the first enclave entry function calling the first enclave exit function as an example, during the execution of the first enclave entry function in the enclave, the computing device can also perform the following operations:

[0183] The computing device can first switch from the high-level language runtime environment of the enclave to a non-enclave environment, i.e., an untrusted environment. Then, the computing device can execute the first enclave exit function in the non-enclave environment. Finally, it returns to the high-level language runtime environment of the enclave to continue executing the first enclave entry function. The implementation of how to switch to the non-enclave environment to execute the enclave exit function is similar to the existing technology and will not be elaborated further.

[0184] The above describes how a computing device, during the execution of an application, calls the application's first enclave entry function through the first thread. The following explains and illustrates how garbage collection (i.e., cleaning up the first memory area allocated to the first thread) occurs after the first enclave entry function call is completed, i.e., after the first enclave entry function is executed:

[0185] Figure 9 This is a flowchart illustrating another application processing method provided in an embodiment of this application. Figure 9 As shown, after the first enclave entry function exits execution, the computing device can perform the following operations:

[0186] S501. Determine whether the object of the first enclave entry function is accessed by other threads. If not, execute S505; if so, execute S503.

[0187] The object mentioned here can be an object of a statically dependent class of the first enclave entry function, or an object of a dynamically dependent class of the first enclave entry function. The other threads mentioned here refer to threads within the enclave that are calling the application's enclave entry function. These other threads can be calling the same enclave entry function as the first thread, or they can be calling a different enclave entry function.

[0188] In this embodiment, if the object of the first enclave entry function is not accessed by any thread, it means that the object of the first enclave entry function is not shared with other threads. In this case, the first memory area is an independent memory area for the first thread, and directly clearing the first memory area will not affect other threads. If the object of the first enclave entry function is accessed by at least one other thread, it means that the object of the first enclave entry function is shared with other threads. In this case, the first memory area is not an independent memory area for the first thread, that is, directly clearing the first memory area will affect other threads. In some embodiments, being accessed by other threads can also be described as being accessed by the enclave entry function of the application called by other threads, and this embodiment does not limit this.

[0189] Continue to refer to Figure 4 For example, if an object from thread 1 is accessed by thread 2, it means that the object is shared by thread 2. In this case, the memory area of ​​thread 1 is not an independent memory area of ​​thread 1. That is, directly cleaning up the memory area of ​​thread 1 will affect thread 2.

[0190] S502. Synchronously stop all threads in the enclave from calling the enclave entry function.

[0191] It should be understood that "all threads that stop execution" as mentioned here refers to all threads within the enclave that call the application's enclave entry function (i.e., the other threads mentioned above). These threads may call the same enclave entry function, or they may call different enclave entry functions, or some threads may call the same enclave entry function while others call different enclave entry functions.

[0192] S503, Determine at least one second thread that accesses the first object.

[0193] S504. Copy the first object according to the number of at least one second thread.

[0194] Continue to refer to Figure 4 In this embodiment of the application, the memory region in the enclave may also include a global memory region, which can be used to store static variables and objects with a lifespan longer than one thread.

[0195] For example, if the number of second threads is 1, the first object is copied to the second memory area corresponding to the second thread. If the number of second threads is greater than 1, the first object is copied to the global memory area of ​​the enclave, so that multiple second threads can access the first object by accessing the global memory area, thus saving memory space in the enclave.

[0196] After performing step S504, step S505 can be performed to clean up the first memory region allocated for the first thread.

[0197] S505. Clear the mapping relationship between the first thread and the first memory region.

[0198] After the mapping relationship between the first thread and the first memory region is cleared, the memory pages included in the first memory region can be allocated to other threads in the enclave, thereby releasing the memory of the enclave in a timely manner and improving the efficiency of garbage collection.

[0199] By using the above method, after the first enclave entry function is executed, the first memory region allocated to the first thread can be cleaned up in a timely manner, so that the memory pages included in the first memory region can be allocated to other threads for use. This can release the enclave memory in a timely manner and improve the efficiency of garbage collection in the enclave memory.

[0200] Since big data processing applications typically share few objects across multiple threads during big data computation, and the lifecycle of most enclave objects usually resides within a single enclave entry function, this approach can improve the efficiency of garbage collection in big data processing applications.

[0201] As one possible implementation, this application proposes a multi-threaded garbage collection synchronization method without operating system involvement. This method captures whether an object of an enclave entry function escapes its original memory region, i.e., whether it is accessed by other threads, by recording whether different threads have cross-region write operations.

[0202] When an escaped object exists in the enclave entry function (i.e., an object accessed by other threads), all threads need to be stopped synchronously, and the escaped object should be reclaimed along with other useless objects (i.e., objects not accessed by other threads). This way, after the enclave entry function exits, the memory area allocated to the thread that called it is automatically cleaned up.

[0203] Specifically, in this embodiment of the application, to detect whether an escape object exists in the enclave entry function, the computing device inserts a check on a global variable in the trusted part of the application code, and uses this global variable to detect whether an escape object exists in the enclave entry function.

[0204] Taking the implementation of this method by a computing device through a single thread that uses a multi-threaded synchronization mechanism to reclaim escaped objects as an example, the global variables involved here can be, for example, as shown in Table 2 below:

[0205] Table 2

[0206] Variable name Meaning of variables needGC GC is being invoked. nThd Total number of threads executed in the enclave nGCThd Total number of threads that stopped executing in the enclave.

[0207] In this way, when an object (let's call it the target object) is written to a member variable of another object, the computing device can check the memory region to which the target object belongs. If the identifier of the memory region to which the target object belongs (e.g., the ID or index of the memory region) is different from the identifier of the memory region to which the writing is done, then the record containing the memory region to which the target object belongs and the memory region to which the writing is done is written to the escape object list of the thread to which the target object belongs, and also to the escape object list of the thread corresponding to the memory region to which the writing is done is written.

[0208] When the thread to which the target object belongs exits, the computing device can determine whether an escaped object exists based on the escaped object list. If no escaped object exists (i.e., the list is empty), the mapping between the thread and the allocated memory region is cleared. If an escaped object exists (i.e., the list is not empty), the multi-threaded synchronization mechanism is invoked to reclaim the escaped object (i.e., the GC thread).

[0209] Specifically, first, all threads are synchronously stopped to prevent other threads from accessing these escaped objects simultaneously. Once all threads have stopped, the execution stacks and escaped object lists of all threads are scanned to find all objects belonging to the current thread's memory area. For each escaped object, if it escapes to the memory area of ​​another thread, it is copied to that thread's memory area. If the escaped object escapes to the memory areas of multiple threads, it is copied to the enclave's global memory area.

[0210] For example, taking the global variables shown in Table 2 as an example, assuming that when the computing device calls GC to perform multi-threaded synchronization for the first thread, it can first try setting the global variable needGC from 0 to 1.

[0211] 1) If needGC is set successfully, it indicates a successful multi-threaded synchronization call. Then, the computing device atomically increments the global variable nGCThd. Correspondingly, nThd is atomically incremented when the first thread begins executing the first enclave function. When nGCThd equals nThd, it means all threads in the enclave have stopped executing, and escaped objects can be reclaimed. After the escaped objects are reclaimed, nGCThd and nThd are decremented, and needGC is set to 0, indicating that threads other than the first thread can resume execution.

[0212] 2) If needGC fails to be set, it means that another thread is calling the multi-threaded synchronization mechanism. In this case, increase the value of nGCThd, and after needGC becomes 0, decrease the value of nGCThd and return to the step of trying to set the global variable needGC from 0 to 1.

[0213] For threads running in the enclave, the computing device inserts non-atomic checks for `needGC` into the loop checks and function entry points of the generated application's trusted code. When `needGC` is 1, the thread stops executing until `needGC` becomes 0. Simultaneously, the thread increments the value of `nGCThd` to notify the GC that the thread has stopped executing. When `needGC` is 0, the thread resumes execution.

[0214] By using the above method, after the first enclave entry function is executed, the first memory region allocated to the first thread can be cleaned up in a timely manner, so that the memory pages included in the first memory region can be allocated to other threads for use. This can release the enclave memory in a timely manner and improve the efficiency of garbage collection in the enclave memory.

[0215] Furthermore, since the above garbage collection method does not require the participation of the operating system, that is, it eliminates the dependency between garbage collection operations and operating system calls. Thus, there is no need to interact with the operating system during garbage collection, thereby protecting garbage collection from side-channel attacks and iago attacks in privileged attacks.

[0216] It should be understood that the side-channel attack mentioned here refers to an attack method in which an attacker guesses the private data of an application running in an enclave by observing side-channel events (such as execution time, enclave exit functions, etc.). For example, when a sensitive data value is 1, two enclave exit functions are executed; when the sensitive data value is 0, only one enclave exit function is executed. An attacker can observe the number of times the enclave exit functions are executed to guess the value of the sensitive data.

[0217] The EGO attack mentioned here refers to an attack method where an attacker manipulates an untrusted operating system to provide input to an application running in an enclave, thereby altering the control flow of the application. For example, suppose the application running in the enclave depends on a file for input, and this file contains an integer. When the integer is 1, the application executes the `do_one` function; when the integer is 0, it executes the `do_zero` function. Therefore, when an attacker manipulates the untrusted operating system to change the input provided to the application running in the enclave, the integrity of the enclave application will be compromised.

[0218] The following example briefly illustrates the memory management and garbage collection process during the first thread's call to the first enclave entry function:

[0219] Figure 10 This is a flowchart illustrating another application processing method provided in an embodiment of this application. Figure 10 As shown, the method includes:

[0220] S601, Switch from a non-enclave environment to an enclave.

[0221] S602, Allocate the first memory region for the first thread.

[0222] For example, a computing device may initially allocate a memory page for a first memory region. This memory page may, for example, be 32KB of memory.

[0223] S603, Execute the first enclave entry function.

[0224] During the execution of the first enclave entry function, the following operations are performed:

[0225] S6031. When creating an object, determine whether there is sufficient free memory in the first memory region. If not, execute S6032; if yes, execute S6033.

[0226] The object mentioned here can be an object of a statically dependent class or an object of a dynamically dependent class.

[0227] S6032, Expand the size of the first memory region.

[0228] S6033. Create and execute the object in the first memory region.

[0229] Return to continue executing the first enclave entry function.

[0230] S604. After the first thread exits the enclave environment, determine whether the first enclave entry function has an escape object. If yes, execute S605; otherwise, execute S606.

[0231] This step is executed after the first enclave entry function has finished executing.

[0232] S605: Invoke the multi-threaded synchronization mechanism to reclaim the escaped object.

[0233] S606. Clear the mapping relationship between the first thread and the first memory region.

[0234] This completes the memory management and garbage collection during the process of the first thread calling the first enclave entry function.

[0235] It should be understood that the above Figure 10 This is only to illustrate the process logic of memory management and garbage collection, and the content unrelated to memory management in the actual execution process is omitted, such as the content of the enclave exit function being called during the execution of the first enclave entry function. For details, please refer to the detailed description of each part in the aforementioned embodiments, which will not be repeated here.

[0236] It should be noted that although this application uses a trusted operating environment enclave as an example to illustrate how to run an application written in a high-level language within a trusted operating environment, those skilled in the art will understand that the methods of this application embodiment can also be applied to other trusted operating environments, and are not limited thereto.

[0237] Figure 11 This is a schematic diagram of the structure of an application processing device provided in an embodiment of this application. Figure 11As shown, the processing device of the application can be the aforementioned computing device or a chip of that computing device. The processing device of the application includes a receiving module 11 and a processing module 12. Optionally, in some embodiments, the processing device of the application may further include a sending module 13.

[0238] The receiving module 11 is used to receive a startup request sent by the first client, which is used to start the application.

[0239] Processing module 12 is used to, based on the startup request, load the application's manifest file and the dependency relationships between the application's enclave entry function and static dependency classes in the enclave's high-level language runtime environment; and load the static dependency classes of the application's enclave entry function based on the manifest file and the dependency relationships between the enclave entry function and static dependency classes. The manifest file includes: description information of the application's enclave entry function, and / or, description information of the application's enclave exit function.

[0240] As one possible implementation, the processing module 12 is further configured to, before loading the dependency relationship between the application's enclave entry function and the static dependent class, obtain the description file of the class marked with the first annotation in the application based on the application's code; and obtain the dependency relationship between the application's enclave entry function and the static dependent class based on the description file of the class marked with the first annotation in the application; wherein, the first annotation is used to indicate that the class marked with the first annotation is an enclave entry function.

[0241] As one possible implementation, the processing module 12 is further configured to receive the dependency relationship between the application's enclave entry function and the static dependency class sent by the first client through the receiving module 11 before loading the dependency relationship between the application's enclave entry function and the static dependency class; or, the processing module 12 is further configured to obtain the dependency relationship between the application's enclave entry function and the static dependency class from the storage database before loading the dependency relationship between the application's enclave entry function and the static dependency class.

[0242] As one possible implementation, the processing module 12 is also configured to receive the application's manifest file sent by the first client via the receiving module 11 before loading the application's manifest file; or, the processing module 12 is also configured to retrieve the application's manifest file from the storage database before loading the application's manifest file.

[0243] As one possible implementation, the processing module 12 is also used to load the high-level language runtime environment in the enclave before loading the application's manifest file and the dependencies between the application's enclave entry function and static dependency classes, and to verify the integrity of the high-level language runtime environment.

[0244] As one possible implementation, processing module 12 is further configured to verify the integrity of the loaded static dependency classes of the enclave entry function after loading them; and after the integrity verification of the static dependency classes of the enclave entry function passes, generate the hash value of the application based on the hash value of the static dependency classes of the enclave entry function and the manifest file. Sending module 13 is configured to send the hash value of the application to the first client; the hash value of the application is used by the first client to verify the integrity of the static dependency classes of the enclave entry function loaded in the enclave.

[0245] As one possible implementation, the processing module 12 is also used to, after the integrity verification of the static dependent class of the enclave entry function passes, when the first thread calls the first enclave entry function of the application, switch to allocate a first memory region for the first thread in the enclave, and create and execute an object of the static dependent class of the first enclave entry function in the first memory region.

[0246] As one possible implementation, the first enclave entry function also includes a first dynamic dependency class. The processing module 12 is further configured to obtain the dependency relationship between the first dynamic dependency class and the static dependency class; dynamically load the first dynamic dependency class according to the dependency relationship between the first dynamic dependency class and the static dependency class; verify the integrity of the first dynamic dependency class; and after the integrity verification of the first dynamic dependency class is passed, create and execute an object of the first dynamic dependency class in the first memory area.

[0247] As one possible implementation, the first enclave entry function and the first enclave exit function have a calling relationship. Processing module 12 is also used to switch from the high-level language runtime environment of the enclave to the non-enclave environment; execute the first enclave exit function in the non-enclave environment; and return to the high-level language runtime environment of the enclave.

[0248] As one possible implementation, the processing module 12 is also used to clear the mapping relationship between the first thread and the first memory region if the objects of the first enclave entry function have not been accessed by other threads after the first enclave entry function exits execution.

[0249] As one possible implementation, processing module 12 is further configured to: after the first enclave entry function exits execution, if the first object of the first enclave entry function is accessed by other threads, synchronously stop the execution of all enclave entry functions called by threads in the enclave; determine at least one second thread accessing the first object; perform copy processing on the first object according to the number of at least one second thread; and clear the mapping relationship between the first thread and the first memory region. For example, processing module 12 is specifically configured to: copy the first object to the second memory region corresponding to the second thread when the number of second threads is 1; or copy the first object to the global memory region of the enclave when the number of second threads is greater than 1.

[0250] It should be understood that the receiving module 11 and the transmitting module 13 described above can be integrated into the transceiver module or they can be separated.

[0251] The application processing device provided in this application embodiment can execute the method embodiment described above. Figures 5 to 10 The operation of the computing device shown is similar in principle and technical effect, and will not be described in detail here.

[0252] Optionally, the processing device of the above application may further include at least one storage module, which may include data and / or instructions. The processing module and / or transceiver module (or receiving module and sending module) may read the data and / or instructions in the storage module to implement the corresponding method.

[0253] This application embodiment also provides a schematic diagram of the structure of an application processing device. The application processing device can be the aforementioned device capable of acquiring the application code, or it can be a chip of that device. The application processing device includes: a processing module 21.

[0254] Processing module 21 is used to obtain, based on the application code, classes in the application that contain a first annotation and / or classes that contain a second annotation; and to generate a manifest file for the application based on the classes that contain the first annotation and / or classes that contain the second annotation; wherein, the first annotation is used to indicate that the class with the first annotation is an enclave entry function, and the second annotation is used to indicate that the class with the second annotation is an enclave exit function, and the manifest file includes: description information of the application's enclave entry functions, and / or description information of the application's enclave exit functions.

[0255] As one possible implementation, the processing module 21 is also used to obtain the static dependency class of the application's enclave entry function based on the description file of the class containing the first annotation; and to generate the hash value of the application based on the hash value of the static dependency class of the enclave entry function and the manifest file, the hash value of the application being used to verify the integrity of the static dependency class.

[0256] As one possible implementation, the processing module 21 is also used to obtain the dependency relationship between the application's enclave entry function and the static dependent classes based on the description file of the class containing the first annotation.

[0257] As one possible implementation, the processing device of the above application may also include a transceiver module (or a receiving module and a sending module). The processing module can communicate with other peripherals through the transceiver module (or the receiving module and the sending module). This application embodiment does not limit this.

[0258] The application processing device provided in this application embodiment can execute the method embodiment described above. Figure 3 The actions of the device shown, which can obtain the application's code, are implemented in a similar way and have similar technical effects, so they will not be described in detail here.

[0259] Optionally, the processing device of the above application may further include at least one storage module, which may include data and / or instructions. The processing module 21 may read the data and / or instructions in the storage module to implement the corresponding method.

[0260] It should be noted that the receiving module can be implemented as a receiver or a communication interface, and the transmitting module can be implemented as a transmitter or a communication interface. The processing module can be implemented in software via a processing element or in hardware. For example, the processing module can be a separate processing element, integrated into a chip in the device, or stored as program code in the device's memory, invoked and executed by a processing element. Furthermore, these modules can be integrated in whole or in part, or implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In implementation, each step of the above method or each module can be completed through integrated logic circuits in the processor element or through software instructions.

[0261] For example, these modules can be one or more integrated circuits configured to implement the above methods, such as one or more application-specific integrated circuits (ASICs), one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs). As another example, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together to implement a system-on-a-chip (SOC).

[0262] Figure 12 This is a schematic diagram of the structure of a processing device for another application provided in an embodiment of this application. Figure 12 As shown, the processing device of the application may include: a processor 31 (e.g., CPU) and a memory 32; the memory 32 may include high-speed random-access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device. The memory 32 may store various instructions for performing various processing functions and implementing the method steps of this application. Optionally, the processing device of the application involved in this application may further include: a power supply 33, a communication bus 34, and a communication port 35. The communication bus 34 is used to realize communication connections between components. The communication port 35 is used to realize communication between the application processing device and other peripherals.

[0263] In this embodiment, the memory 32 is used to store computer-executable program code, which includes instructions. When the processor 31 executes the instructions, the instructions cause the application's processing device to perform the actions of the computing device in the above method embodiment; or, when the processor 31 executes the instructions, the instructions cause the application's processing device to perform the actions of the device capable of obtaining the application's code in the above method embodiment. The implementation principle and technical effects are similar and will not be repeated here.

[0264] This application also provides a computer-readable storage medium storing computer instructions for implementing the methods executed by a computing device or by a device capable of obtaining the code of an application program in the above-described method embodiments.

[0265] For example, when the computer instruction is executed, it enables the processing device of the application to implement the method executed by the computing device in the above method embodiments, or the method executed by a device capable of obtaining the code of the application.

[0266] This application also provides a computer program product containing instructions that, when executed, cause the computer to implement the method executed by the computing device in the above method embodiments, or the method executed by a device capable of obtaining the application code.

[0267] This application also provides a cloud environment, which includes the computing devices and clients described above in the embodiments.

[0268] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0269] The term "multiple" in this article refers to two or more. The term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Furthermore, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects; in formulas, the character " / " indicates a "division" relationship between the preceding and following related objects.

[0270] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application.

[0271] It is understood that, in the embodiments of this application, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

Claims

1. A method for processing an application, characterized in that, The method includes: Receive a startup request sent by a first client, the startup request being used to start the application; According to the startup request, in the high-level language runtime environment of the enclave, the manifest file of the application and the dependency relationship between the enclave entry function and the static dependent class of the application are loaded; wherein, the manifest file includes: description information of the enclave entry function of the application, and / or, description information of the enclave exit function of the application; Based on the manifest file and the dependency relationship between the enclave entry function and the static dependency class, load the static dependency class of the application's enclave entry function.

2. The method according to claim 1, characterized in that, Before loading the dependency relationship between the application's enclave entry function and the static dependency class, the method further includes: Based on the application code, obtain the description file of the class in the application containing the first annotation, wherein the first annotation is used to characterize the class marked by the first annotation as an enclave entry function; Based on the description file of the class containing the first annotation in the application, obtain the dependency relationship between the enclave entry function of the application and the static dependent classes.

3. The method according to claim 1, characterized in that, Before loading the dependency relationship between the application's enclave entry function and the static dependency class, the method further includes: Receive the dependency relationship between the application's enclave entry function and static dependency classes sent by the first client; or, Retrieve the dependency relationships between the application's enclave entry function and static dependency classes from the storage database.

4. The method according to any one of claims 1-3, characterized in that, Before loading the manifest file of the application, the method further includes: Receive the manifest document sent by the first client; or, The manifest file is retrieved from the storage database.

5. The method according to any one of claims 1-3, characterized in that, Before loading the manifest file of the application and the dependency relationship between the application's enclave entry function and the static dependency class, the method further includes: Load a high-level language runtime environment in the enclave; Verify the integrity of the high-level language runtime environment.

6. The method according to any one of claims 1-3, characterized in that, After loading the static dependency class of the application's enclave entry function, the method further includes: Verify the integrity of the static dependency classes of the loaded enclave entry function; After the integrity verification of the static dependency class of the enclave entry function passes, the hash value of the application is generated based on the hash value of the static dependency class of the enclave entry function and the manifest file. The hash value of the application is sent to the first client; the hash value of the application is used by the first client to verify the integrity of the static dependency class of the enclave entry function loaded in the enclave.

7. The method according to claim 6, characterized in that, The method further includes: After the integrity verification of the static dependent class of the enclave entry function passes, when the first enclave entry function of the application is called by the first thread, the system switches to the enclave and allocates a first memory area for the first thread. Create and execute an object of the static dependent class of the first enclave entry function in the first memory region.

8. The method according to claim 7, characterized in that, The first enclave entry function also includes a first dynamic dependency class, and the method further includes: Obtain the dependency relationship between the first dynamic dependency class and the static dependency class; Based on the dependency relationship between the first dynamic dependency class and the static dependency class, the first dynamic dependency class is dynamically loaded; Verify the integrity of the first dynamic dependency class; After the integrity verification of the first dynamic dependency class is passed, an object of the first dynamic dependency class is created and executed in the first memory area.

9. The method according to claim 7 or 8, characterized in that, The first enclave entry function and the first enclave exit function have a calling relationship, and the method further includes: Switch from the high-level language runtime environment of the enclave to the non-enclave environment; The first enclave exit function is executed in the non-enclave environment; Return to the high-level language runtime environment of the enclave.

10. The method according to claim 7 or 8, characterized in that, The method further includes: After the first enclave entry function exits execution, if the objects of the first enclave entry function have not been accessed by other threads, the mapping relationship between the first thread and the first memory region is cleared.

11. The method according to claim 7 or 8, characterized in that, The method further includes: If the first object of the first enclave entry function is accessed by other threads after the first enclave entry function exits execution, then all enclave entry functions called by threads in the enclave will be stopped synchronously. Identify at least one second thread that accesses the first object; The first object is copied according to the number of at least one second thread; Clear the mapping relationship between the first thread and the first memory region.

12. The method according to claim 11, characterized in that, The step of copying the first object according to the number of the at least one second thread includes: If the number of the second thread is 1, then copy the first object to the second memory area corresponding to the second thread; or, If the number of the second thread is greater than 1, then the first object is copied to the global memory area of ​​the enclave.

13. A method for processing an application, characterized in that, The method includes: Based on the application code, obtain the classes in the application that contain a first annotation and / or a second annotation, wherein the first annotation is used to indicate that the class with the first annotation is an enclave entry function and the second annotation is used to indicate that the class with the second annotation is an enclave exit function. Based on the class containing the first annotation and / or the class containing the second annotation, a manifest file for the application is generated, wherein the manifest file includes: description information of the application's enclave entry function and / or description information of the application's enclave exit function, and the manifest file is used to load the static dependency classes of the application's enclave entry function.

14. The method according to claim 13, characterized in that, The method further includes: Based on the description file of the class containing the first annotation, obtain the static dependency class of the application's enclave entry function; The hash value of the application is generated based on the hash value of the static dependency class of the enclave entry function and the manifest file. The hash value of the application is used to verify the integrity of the static dependency class.

15. The method according to claim 13 or 14, characterized in that, The method further includes: Based on the description file of the class containing the first annotation, obtain the dependency relationship between the application's enclave entry function and the static dependent classes.

16. A processing apparatus for an application, characterized in that, The device includes: A receiving module is used to receive a startup request sent by a first client, the startup request being used to start an application; The processing module is configured to, based on the startup request, load the application's manifest file and the dependency relationships between the application's enclave entry function and static dependency classes in the enclave's high-level language runtime environment; and load the static dependency classes of the application's enclave entry function based on the manifest file and the dependency relationships between the enclave entry function and static dependency classes; wherein, the manifest file includes: description information of the application's enclave entry function, and / or, description information of the application's enclave exit function.

17. The apparatus according to claim 16, characterized in that, The processing module is further configured to, before loading the dependency relationship between the application's enclave entry function and the static dependent class, obtain the description file of the class marked with the first annotation in the application based on the application's code; and obtain the dependency relationship between the application's enclave entry function and the static dependent class based on the description file of the class marked with the first annotation in the application; wherein, the first annotation is used to characterize the class marked with the first annotation as an enclave entry function.

18. The apparatus according to claim 16, characterized in that, The processing module is further configured to receive, via the receiving module, the dependency relationship between the application's enclave entry function and static dependency classes sent by the first client before loading the dependency relationship between the application's enclave entry function and static dependency classes; or, The processing module is further configured to retrieve the dependency relationship between the application's enclave entry function and static dependency classes from the storage database before loading the dependency relationship between the application's enclave entry function and static dependency classes.

19. The apparatus according to any one of claims 16-18, characterized in that, The processing module is further configured to receive the manifest file sent by the first client via the receiving module before loading the manifest file of the application; or, The processing module is also configured to retrieve the manifest file from the storage database before loading the manifest file of the application.

20. The apparatus according to any one of claims 16-18, characterized in that, The processing module is further configured to load a high-level language runtime environment in the enclave before loading the manifest file of the application and the dependency relationship between the enclave entry function and the static dependency class of the application, and to verify the integrity of the high-level language runtime environment.

21. The apparatus according to any one of claims 16-18, characterized in that, The device further includes: a transmitting module; The processing module is further configured to verify the integrity of the loaded static dependency class of the enclave entry function after loading the static dependency class of the enclave entry function of the application; and after the integrity verification of the static dependency class of the enclave entry function passes, generate the hash value of the application based on the hash value of the static dependency class of the enclave entry function and the manifest file. The sending module is used to send the hash value of the application to the first client; the hash value of the application is used by the first client to verify the integrity of the static dependency class of the enclave entry function loaded in the enclave.

22. The apparatus according to claim 21, characterized in that, The processing module is further configured to, after the integrity verification of the static dependency class of the enclave entry function passes, when the first enclave entry function of the application is called by the first thread, switch to the enclave to allocate a first memory region for the first thread, and create and execute an object of the static dependency class of the first enclave entry function in the first memory region.

23. The apparatus according to claim 22, characterized in that, The first enclave entry function also includes the first dynamic dependency class; The processing module is further configured to obtain the dependency relationship between the first dynamic dependency class and the static dependency class; dynamically load the first dynamic dependency class according to the dependency relationship between the first dynamic dependency class and the static dependency class; verify the integrity of the first dynamic dependency class; and after the integrity verification of the first dynamic dependency class is passed, create and execute an object of the first dynamic dependency class in the first memory area.

24. The apparatus according to claim 22 or 23, characterized in that, The first enclave entry function and the first enclave exit function have a calling relationship; The processing module is further configured to switch from the high-level language runtime environment of the enclave to the non-enclave environment; execute the first enclave exit function in the non-enclave environment; and return to the high-level language runtime environment of the enclave.

25. The apparatus according to claim 22 or 23, characterized in that, The processing module is further configured to, after the first enclave entry function exits execution, if the objects of the first enclave entry function have not been accessed by other threads, clear the mapping relationship between the first thread and the first memory region.

26. The apparatus according to claim 22 or 23, characterized in that, The processing module is further configured to, after the first enclave entry function exits execution, if the first object of the first enclave entry function is accessed by other threads, synchronously stop the execution of all enclave entry functions called by threads in the enclave; determine at least one second thread accessing the first object; and perform copy processing on the first object according to the number of the at least one second thread. Clear the mapping relationship between the first thread and the first memory region.

27. The apparatus according to claim 26, characterized in that, The processing module is specifically used to copy the first object to the second memory area corresponding to the second thread when the number of the second thread is 1; or, when the number of the second thread is greater than 1, copy the first object to the global memory area of ​​the enclave.

28. A processing apparatus for an application, characterized in that, The device includes: The processing module is configured to obtain, based on the application's code, classes in the application that contain a first annotation and / or classes that contain a second annotation; and generate a manifest file for the application based on the classes containing the first annotation and / or the classes containing the second annotation; wherein the first annotation is used to characterize the class with the first annotation as an enclave entry function, the second annotation is used to characterize the class with the second annotation as an enclave exit function, and the manifest file includes: description information of the application's enclave entry function and / or description information of the application's enclave exit function, and the manifest file is used to load the static dependency classes of the application's enclave entry function.

29. The apparatus according to claim 28, characterized in that, The processing module is further configured to obtain the static dependency class of the enclave entry function of the application based on the description file of the class containing the first annotation; generate the hash value of the application based on the hash value of the static dependency class of the enclave entry function and the manifest file, and the hash value of the application is used to verify the integrity of the static dependency class.

30. The apparatus according to claim 28 or 29, characterized in that, The processing module is further configured to obtain the dependency relationship between the application's enclave entry function and static dependent classes based on the description file of the class containing the first annotation.

31. A cloud environment, characterized in that, The cloud environment is an entity that provides cloud services to users using basic resources under the cloud computing model. The cloud environment includes the apparatus as described in any one of claims 16-27, and the apparatus as described in any one of claims 28-30.

32. A network device, characterized in that, Including processor and interface circuitry; The interface circuit is configured to receive computer execution instructions and transmit them to the processor; the processor executes the computer execution instructions to perform the method as described in any one of claims 1-15.

33. A network device, characterized in that, Including processor and memory; The memory is used to store computer-executed instructions; The processor is configured to execute computer execution instructions stored in the memory to cause the network device to perform the method as described in any one of claims 1-15.

34. A network device, characterized in that, Includes processor, memory, and transceiver; The transceiver is used to receive or send signals; The memory is used to store computer programs; The processor is configured to invoke the computer program from the memory to perform the method as described in any one of claims 1-15.

35. A computer-readable storage medium, characterized in that, Used to store computer programs or computer execution instructions, which, when run on a computer, cause the computer to perform the method described in any one of claims 1 to 15.

Images