Data processing method and device

Abstract

An embodiment of the present application provides a data processing method and apparatus, the method comprising: creating an isolated environment in a processing device. Creating a first instance object corresponding to a first program in the isolated environment, and creating a second instance object corresponding to a second program in the host environment of the processing device, the first program and the second program being written in a target language. Obtaining a compiled file of the first program in the isolated environment, the compiled file being obtained by compiling the first program using a static compilation tool. Determine the running result corresponding to the first target function in the first program in the host environment through the first instance object, the second instance object and the compiled file. Writing the first program in the isolated environment in a high-level programming language, and using a static compilation tool to compile the first program in the isolated environment to obtain a compiled file, thereby effectively improving the speed and efficiency of confidential computing application development.

Description

Technical Field

[0001] The present invention relates to computer technology, and more particularly to a data processing method and apparatus. Background Art

[0002] SGX (Software Guard Extensions) is a CPU architecture extension technology that implements a trusted execution environment with a very high level of security. Therefore, confidential computing applications with a high level of security can be built based on SGX technology.

[0003] At present, when developing confidential computing applications based on SGX in the existing technology, low-level programming languages ​​such as C or C++ are usually used for development. The reason for not using high-level programming languages ​​for development is that high-level programming languages ​​usually need to rely on complex language virtual machines and underlying support platforms. However, the SGX execution environment has many capability limitations and is therefore insufficient to support the normal operation of high-level programming languages.

[0004] However, development based on low-level programming languages ​​requires users to perform a lot of additional development work due to language limitations, which leads to inefficient development of confidential computing applications. Summary of the Invention

[0005] Embodiments of the present application provide a data processing method and device to overcome the problem of low development efficiency of confidential computing applications.

[0006] In a first aspect, an embodiment of the present application provides a data processing method, applied to a processing device, comprising:

[0007] creating an isolated environment in the processing device;

[0008] Creating a first instance object corresponding to a first program in the isolation environment, and creating a second instance object corresponding to a second program in a host environment of the processing device, wherein the first program and the second program are written in a target language;

[0009] Obtaining a compiled file of the first program in the isolated environment, where the compiled file is obtained by compiling the first program using a static compilation tool;

[0010] An execution result corresponding to a first target function in the first program is determined in the host environment through the first instance object, the second instance object, and the compiled file.

[0011] In one possible design, determining, in the host environment, a running result corresponding to the first target function in the first program using the first instance object, the second instance object, and the compiled file includes:

[0012] Obtaining a compiled file of the second program in the host environment;

[0013] calling a second target function in the compiled file of the second program through the second instance object to write the function name and parameters of the second target function into the memory of the isolated environment, where the function name of the first target function is the same as the function name of the first target function;

[0014] In the isolated environment, processing the function name, the parameters, and the compiled file through the first instance object to obtain an execution result corresponding to the first target function;

[0015] The running result is written into the memory of the host environment to obtain the running result corresponding to the first objective function in the host environment.

[0016] In one possible design, calling the second target function in the compiled file of the second program through the second instance object to write the function name and parameters of the second target function into the memory of the isolated environment includes:

[0017] Calling the second target function in the compiled file of the second program through the second instance object to obtain a function name and parameters of the second target function;

[0018] Serializing the function name and parameters of the second objective function to obtain first serialization information corresponding to the function name and parameters;

[0019] Write the first serialization information corresponding to the function name and parameters into the memory of the isolation environment.

[0020] In a possible design, in the isolated environment, processing the function name, the parameters, and the compiled file by the first instance object to obtain an execution result corresponding to the first target function includes:

[0021] In the isolated environment, deserialize the first serialized information to obtain the function name and the parameters;

[0022] The first target function corresponding to the function name is called in the compiled file of the first program through the first instance object, so as to process the parameters through the first target function and obtain the running result corresponding to the first target function.

[0023] In one possible design, writing the execution result into the memory of the host environment to obtain the execution result corresponding to the first objective function in the host environment includes:

[0024] In the isolated environment, serializing the operation result to obtain second serialization information corresponding to the operation result;

[0025] Writing the second serialization information corresponding to the running result into the memory of the host environment;

[0026] In the host environment, the second serialization information is deserialized to obtain an operating result corresponding to the first objective function in the host environment.

[0027] In one possible design, there is a mapping relationship between the first instance object and the second instance object;

[0028] After writing the running result into the memory of the host environment to obtain the running result corresponding to the first objective function in the host environment, the method further includes:

[0029] If it is determined that the memory of the second instance object in the host environment is reclaimed, the memory of the first instance object in the isolation environment is reclaimed according to the mapping relationship between the first instance object and the second instance object.

[0030] In one possible design, before obtaining the compiled file of the first program in the isolated environment, the method further includes:

[0031] Obtaining a second program corresponding to the host environment, and compiling the second program using a native compilation tool corresponding to the second program to obtain a compiled file corresponding to the second program;

[0032] Obtain a first program corresponding to the isolation environment, compile the first program using a static compilation tool, and obtain a compiled file corresponding to the first program.

[0033] In one possible design, the compiled file corresponding to the second program is a static library;

[0034] After obtaining the first program corresponding to the isolation environment and compiling the first program using a static compilation tool to obtain a compiled file corresponding to the second program, the method further includes:

[0035] Obtaining a dependency library corresponding to the second program and a software development kit for a trusted execution environment;

[0036] The static library, the dependency library corresponding to the second program, and the software development kit are linked to obtain a runtime library corresponding to the isolation environment, wherein the runtime library is used to complete the calculation processing of the first objective function.

[0037] In a second aspect, an embodiment of the present application provides a data processing apparatus, applied to a processing device, comprising:

[0038] A creation module, configured to create an isolated environment in the processing device;

[0039] The creation module is further configured to create a first instance object corresponding to a first program in the isolation environment, and to create a second instance object corresponding to a second program in the host environment of the processing device, wherein the first program and the second program are written in the target language;

[0040] an acquisition module, configured to acquire a compiled file of the first program in the isolated environment, the compiled file being obtained by compiling the first program using a static compilation tool;

[0041] A processing module is used to determine, in the host environment, an operating result corresponding to the first target function in the first program through the first instance object, the second instance object, and the compiled file.

[0042] In one possible design, the processing module is specifically configured to:

[0043] Obtaining a compiled file of the second program in the host environment;

[0044] calling a second target function in the compiled file of the second program through the second instance object to write the function name and parameters of the second target function into the memory of the isolated environment, where the function name of the first target function is the same as the function name of the first target function;

[0045] In the isolated environment, processing the function name, the parameters, and the compiled file through the first instance object to obtain an execution result corresponding to the first target function;

[0046] The running result is written into the memory of the host environment to obtain the running result corresponding to the first objective function in the host environment.

[0047] In one possible design, the processing module is specifically configured to:

[0048] Calling the second target function in the compiled file of the second program through the second instance object to obtain a function name and parameters of the second target function;

[0049] Serializing the function name and parameters of the second objective function to obtain first serialization information corresponding to the function name and parameters;

[0050] Write the first serialization information corresponding to the function name and parameters into the memory of the isolation environment.

[0051] In one possible design, the processing module is specifically configured to:

[0052] In the isolated environment, deserialize the first serialized information to obtain the function name and the parameters;

[0053] The first target function corresponding to the function name is called in the compiled file of the first program through the first instance object, so as to process the parameters through the first target function and obtain the running result corresponding to the first target function.

[0054] In one possible design, the processing module is specifically configured to:

[0055] In the isolated environment, serializing the operation result to obtain second serialization information corresponding to the operation result;

[0056] Writing the second serialization information corresponding to the running result into the memory of the host environment;

[0057] In the host environment, the second serialization information is deserialized to obtain an operating result corresponding to the first objective function in the host environment.

[0058] In one possible design, there is a mapping relationship between the first instance object and the second instance object;

[0059] The processing module is further configured to:

[0060] After writing the running result into the memory of the host environment to obtain the running result corresponding to the first objective function in the host environment, if it is determined that the memory of the second instance object in the host environment is reclaimed, the memory of the first instance object in the isolated environment is reclaimed according to the mapping relationship between the first instance object and the second instance object.

[0061] In one possible design, the processing module is further configured to:

[0062] Before obtaining the compiled file of the first program in the isolated environment, obtaining a second program corresponding to the host environment, and compiling the second program using a native compilation tool corresponding to the second program to obtain a compiled file corresponding to the second program;

[0063] Obtain a first program corresponding to the isolation environment, compile the first program using a static compilation tool, and obtain a compiled file corresponding to the first program.

[0064] In one possible design, the compiled file corresponding to the second program is a static library;

[0065] The processing module is further configured to:

[0066] After obtaining the first program corresponding to the isolated environment, compiling the first program using a static compilation tool to obtain a compiled file corresponding to the second program, obtaining a dependent library corresponding to the second program, and obtaining a software development kit for a trusted execution environment;

[0067] The static library, the dependency library corresponding to the second program, and the software development kit are linked to obtain a runtime library corresponding to the isolation environment, wherein the runtime library is used to complete the calculation processing of the first objective function.

[0068] In a third aspect, an embodiment of the present application provides a data processing device, including:

[0069] Memory, used to store programs;

[0070] A processor is used to execute the program stored in the memory. When the program is executed, the processor is used to execute the method described in the first aspect and any one of the various possible designs of the first aspect.

[0071] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium comprising instructions, which, when executed on a computer, enables the computer to execute the method described in the first aspect and any one of the various possible designs of the first aspect.

[0072] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the method described in the first aspect and any of the various possible designs of the first aspect.

[0073] An embodiment of the present application provides a data processing method and apparatus, the method comprising: creating an isolated environment in a processing device. Creating a first instance object corresponding to a first program in the isolated environment, and creating a second instance object corresponding to a second program in the host environment of the processing device, the first program and the second program being written in a target language. Obtaining a compiled file of the first program in the isolated environment, the compiled file being obtained by compiling the first program using a static compilation tool. Determining the running result corresponding to the first target function in the first program in the host environment using the first instance object, the second instance object, and the compiled file. Writing the second program in the host environment using a high-level programming language, and writing the first program in the isolated environment using a high-level programming language, and using a static compilation tool to compile the first program in the isolated environment to obtain a compiled file, because the static compilation tool can effectively avoid directly compiling bytecode into assembly code, thereby effectively avoiding dependence on the language virtual machine and the underlying support platform, then determining the running result corresponding to the first target function in the first program in the host environment based on the first instance object, the second instance object, and the compiled file, thereby effectively realizing the development of confidential computing applications based on high-level programming languages, thereby improving the speed and efficiency of confidential computing application development. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0075] Figure 1 A schematic diagram of a scenario of a data processing method provided in an embodiment of the present application;

[0076] Figure 2 A flowchart of a data processing method provided in an embodiment of the present application;

[0077] Figure 3 The process of the data processing method provided in the embodiment of the present application Figure 2 ;

[0078] Figure 4 A schematic diagram of the processing structure of the data processing method provided in an embodiment of the present application;

[0079] Figure 5 Schematic diagram of the implementation of the first objective function and the second objective function provided in the embodiment of the present application;

[0080] Figure 6 A flowchart of a data processing method provided in an embodiment of the present application;

[0081] Figure 7 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0082] Figure 8 A schematic diagram of the hardware structure of the data processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0083] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0084] In order to better understand the technical solution of this application, the relevant technologies involved in this application are further introduced in detail below.

[0085] With the continuous improvement and development of the Internet, on the one hand, Internet technology has brought many conveniences, but on the other hand, the cyberspace composed of networks and information systems is also facing increasingly severe security issues.

[0086] Therefore, Intel launched SGX (Software Guard Extensions) technology. SGX isolates a trusted execution environment without relying on the security of the software and the entire firmware. It can protect the confidentiality and integrity of users' critical code and data from being damaged by malware in a completely secure manner.

[0087] In fact, SGX adds a new set of instruction sets and memory access mechanisms to the original architecture. It is a set of CPU instructions that can isolate code and data and form a specific trusted area to protect sensitive data and code from external interference and tampering.

[0088] SGX is also one of the solutions for the Trusted Execution Environment (TEE). Using SGX to build a TEE allows protected code to be signed and authenticated within the application. It creates a "container" that carves out a protected area within the application's address space, providing confidentiality and integrity protection for the code and data within the container, preventing them from being compromised by malicious software with special permissions.

[0089] The implementation of SGX requires the collaboration of hardware and software such as the processor, memory management components, Basic Input Output System (BIOS), drivers, and runtime environment. In addition to providing memory isolation and protection security properties.

[0090] Enclave is the most critical technology of SGX. It can be understood as a box that can only be read from the outside during operation. Once the permission holder writes from the outside, non-privileged owners cannot change it. Therefore, the code and data loaded into the enclave must be checked.

[0091] Once the protected portion of an application is loaded into the enclave, SGX protects this content from access by external software. The enclave can prove its identity to a remote authenticator and provide the necessary functional structures for securely providing keys. Users can also request a unique key, which is uniquely created by combining the enclave's identity with the platform's identity. This key can be used to protect keys or data stored outside the enclave.

[0092] Based on the above introduction, it can be determined that SGX implements a highly secure trusted execution environment. Based on this technology, highly secure confidential computing applications can be built. These applications are generally developed based on the SGX Software Development Kit (SDK), such as the Intel SGX SDK and the OpenEnclave SDK. The existing SGX solutions have the following characteristics:

[0093] 1. The application needs to be split into two parts: the Host module and the Enclave module. The Host module runs in a normal environment, while the Enclave module runs in a trusted environment.

[0094] 2. High security level: only modules that need to be protected are executed in the Enclave environment, effectively reducing the TCB attack surface.

[0095] 3. Only supports low-level programming languages ​​such as C / C++;

[0096] 4. Developers need to manually define the Enclave Definition Language (EDL) underlying interface description file. The EDL file is a file specification introduced in the Intel SGX SDK that describes the confidential computing service interface.

[0097] 5. You need to write Makefile and other compilation and construction files;

[0098] It is understandable that with regard to points 3 to 5 mentioned above, due to the limitations of the low-level programming language itself, users will need to perform a lot of tedious or additional development work, such as writing a large amount of code to implement the corresponding functions, and manually defining EDL files, writing compilation build files, etc., which will lead to low efficiency in application development.

[0099] To address the above issues, if SGX-based application development can be carried out through high-level programming languages ​​(such as Java / Go / Python), because high-level programming languages ​​have rich ecosystems, automatic memory recycling (Garbage Collections, GC) and high development efficiency, they can effectively improve application development efficiency.

[0100] However, these high-level programming languages ​​typically rely on complex language virtual machines and underlying runtime platforms. Due to the numerous limitations of the SGX execution environment, it is insufficient to support the normal operation of these high-level programming languages. This is why SGX-based application development is currently based on low-level programming languages.

[0101] In response to the problems in the existing technology, this application proposes the following technical concept: use high-level programming languages ​​to develop SGX-based applications, and use static compilation tools to compile the code of the application in the Enclave part. The static compilation technology can avoid dependence on complex language virtual machines and Runtime operating platforms, thereby effectively realizing the development of confidential computing applications using high-level programming languages.

[0102] Based on the above introduction, the data processing method provided by this application is introduced in detail below.

[0103] First combine Figure 1 The application scenarios of the data processing method in this application are introduced. Figure 1 A schematic diagram of a scenario of the data processing method provided in an embodiment of the present application.

[0104] The data processing method provided in this application can be applied to a processing device, where the processing device can be, for example, a server, processor, or other device with data processing capabilities. The processing device can include, for example, a host environment and an isolated environment. The host environment can be understood as a normal operating environment, while the isolated environment can be understood as the confidential environment corresponding to the enclave described above.

[0105] based on Figure 1 In the following, the data processing method provided by this application is introduced in combination with specific embodiments. Figure 2A flowchart of a data processing method provided in an embodiment of the present application.

[0106] like Figure 2 As shown, the method includes:

[0107] S201: Create an isolated environment in a processing device.

[0108] In this embodiment, the host environment in the processing device already exists, and the isolated environment needs to be created before it can be generated. Therefore, in this embodiment, the isolated environment can be created in the processing device, and the creation of the isolated environment can be understood as creating an enclave.

[0109] In one possible implementation, for example, the underlying interface provided by the TEE SDK can be called in the host environment to create an enclave execution environment in the processing device, which is the isolated environment mentioned in this embodiment. The underlying interface called is the interface used to create the isolated environment. Corresponding confidential computing can be performed in the isolated environment.

[0110] S202: Create a first instance object corresponding to a first program in an isolation environment, and create a second instance object corresponding to a second program in a host environment of a processing device, wherein the first program and the second program are written in a target language.

[0111] Based on the above introduction, it can be determined that the Host-Enclave programming model will divide confidential computing applications into two parts: Host and Enclave. The Host module runs in the host environment, and the Enclave module runs in the isolated environment.

[0112] Accordingly, during the development phase of the application, a first program is written for the isolated environment, and a second program is written for the host environment, wherein the first program and the second program are respectively used to implement operations in their respective corresponding environments. In this embodiment, the first program and the second program are both written in a target language. The target language can be the high-level programming language introduced above. A high-level programming language refers to a computer programming language with a higher level of abstraction, such as Java, Go, Python, etc. This embodiment does not limit the specific implementation of this target language.

[0113] Also, high-level programming languages ​​can use object-oriented programming. Therefore, when executing the corresponding code, it is necessary to first create an object and then perform corresponding data processing based on the object.

[0114] Therefore, in this embodiment, a first instance object corresponding to the first program can be created in the isolated environment. For example, if the first program is written in Java, the first instance object corresponding to the current first program can be a Java object. Furthermore, the first instance object in this embodiment is an instance object in the isolated environment, which can also be understood as a trusted service object used to perform actual data processing operations.

[0115] At the same time, in this embodiment, a second instance object corresponding to the second program can be created in the host environment. Similarly, if the second program is written in Java, then the second instance object corresponding to the current second program can be a Java object. Furthermore, the second instance object in this embodiment is an instance object in the host environment, which can also be understood as a trusted service proxy object, which is used to complete data management, transmission, etc.

[0116] The current processing goal is to process data in the isolation environment, obtain the execution result, and then obtain the execution result in the isolation environment in the host environment. Therefore, in one possible implementation, after creating a first instance object in the isolation environment and a second instance object in the host environment, a one-to-one mapping relationship can be established between the first instance object and the second instance object to ensure that the execution result determined by calling the function of the first instance object in the isolation environment can be obtained through the second instance object.

[0117] S203: Obtain a compiled file of the first program in the isolated environment, where the compiled file is obtained by compiling the first program using a static compilation tool.

[0118] It is also understandable that after completing the development of the first program corresponding to the isolation environment and the development of the second program corresponding to the host environment, it is still necessary to compile the first program and the second program to obtain corresponding compiled files, wherein the compilation is to translate the source program written in the programming language into a target program in an equivalent language format to ensure that the computer can perform corresponding data processing.

[0119] Therefore, in this embodiment, the compiled file of the first program can also be obtained in the isolated environment, wherein the compiled file of the first program can be obtained by compiling the first program using a static compilation tool.

[0120] For example, if the first program is written in Java, the static compilation tool may be a Java static compilation tool, wherein the Java static compilation tool is a method for directly compiling Java bytecodes into assembly codes before running.

[0121] S204: Determine, in the host environment, the running result corresponding to the first target function in the first program using the first instance object, the second instance object, and the compiled file.

[0122] It is understood that the first program is the program corresponding to the isolated environment. During the application development process, multiple functions need to be written in the first program to implement the corresponding functions of the application. Moreover, at different times and in different situations, the user may need to call different functions in the first program to implement the required functions in the current situation.

[0123] In a possible implementation, assuming that the embodiment needs to determine the operation result corresponding to the first target function in the first program, the embodiment does not limit which function the first operation function is, and the function can be selected and set accordingly according to the actual needs of the user.

[0124] It is also understandable that the first program is a program corresponding to the isolated environment, and the execution result corresponding to the first target function in the first program is also processed and obtained in the isolated environment, which can effectively ensure the security and confidentiality of data processing. Furthermore, in this embodiment, it is necessary to obtain the execution result corresponding to the first target function in the host environment.

[0125] Therefore, in one possible implementation, this embodiment can call the first instance object in the isolation environment based on the second instance object created in the host environment, complete the processing of the first target function therein based on the compiled file, thereby obtaining the execution result, and then obtain the execution result corresponding to the first target function in the host environment. This can effectively implement confidential computing for applications and effectively obtain the results of confidential computing.

[0126] The data processing method provided by the embodiment of the present application includes: creating an isolated environment in a processing device. A first instance object corresponding to a first program is created in the isolated environment, and a second instance object corresponding to a second program is created in the host environment of the processing device, wherein the first program and the second program are written in a target language. A compiled file of the first program is obtained in the isolated environment, and the compiled file is obtained by compiling the first program using a static compilation tool. The running result corresponding to the first target function in the first program is determined in the host environment through the first instance object, the second instance object and the compiled file. The second program in the host environment is written in a high-level programming language, and the first program in the isolated environment is written in a high-level programming language, and a static compilation tool is used to compile the first program in the isolated environment to obtain a compiled file, because the static compilation tool can effectively avoid directly compiling bytecode into assembly code, thereby effectively avoiding dependence on the language virtual machine and the underlying support platform. Then, based on the first instance object, the second instance object and the compiled file, the running result corresponding to the first target function in the first program is determined in the host environment, thereby effectively realizing application development based on high-level programming languages ​​for confidential computing, so as to improve the speed and efficiency of application development.

[0127] Based on the above introduction, Figure 3-Figure 5 The data processing method provided in this application is further introduced in detail. Figure 3 The process of the data processing method provided in the embodiment of the present application Figure 2 , Figure 4 A schematic diagram of the processing structure of the data processing method provided in the embodiment of the present application is shown. Figure 5 Schematic diagram of the implementation of the first objective function and the second objective function provided in the embodiment of the present application.

[0128] like Figure 3 As shown, the method includes:

[0129] S301: Create an isolated environment in a processing device.

[0130] The implementation of S301 is similar to the implementation of S201 described above, and the specific implementation will not be described in detail here.

[0131] It should be further explained that, although the first program and the second program in this embodiment are both written in a high-level program target language, the underlying processing of SGX is still completed in a low-level program language.

[0132] At the same time, there are conversion mechanisms between high-level and low-level programming languages. For example, the corresponding conversion mechanism for Java is the Java Native Interface (JNI) mechanism, and the corresponding conversion mechanism for Go is the CGO mechanism. Therefore, before creating an isolated environment in the processing device, for example, it is possible to switch from the high-level programming language context to the C language context in the host environment through NativeCall (the language conversion mechanism described above). Then, the low-level interface provided by the TEE SDK is used to create an isolated environment in the processing device.

[0133] S302: Create a first instance object corresponding to a first program in an isolation environment, and create a second instance object corresponding to a second program in a host environment of a processing device, wherein the first program and the second program are written in a target language.

[0134] The implementation of S302 is similar to the implementation of S202 described above, and will not be described in detail here.

[0135] For example, you can combine Figure 4 Further understanding of the first and second procedures, such as Figure 4 As shown, for example, during the development phase, a project file can be written in a high-level programming language. The written project file may include a first program corresponding to the isolation environment (which can be understood as an Enclave module) and a second program corresponding to the host environment (which can be understood as a Host module).

[0136] In addition, the project file can also include the interface program corresponding to the results, that is, Figure 4 The interface program adopts interface-oriented programming, adhering to the concept of trusted computing and services, and can include a series of defined interfaces in the interface program.

[0137] Furthermore, the first program corresponding to the isolation environment includes the services defined by a series of interfaces defined in the interface program, that is, the implementation of the specific functions corresponding to each interface. Furthermore, the second program corresponding to the host environment mainly includes the management (creation and deletion) of the Enclave, the loading and recycling of instance objects, and the calling and result collection of instance objects. In other words, the first program corresponding to the isolation environment is mainly used for the specific implementation of the service, while the second program corresponding to the host environment is only used for the related management of the service.

[0138] S303: Obtain a compiled file of the first program in the isolated environment, where the compiled file is obtained by compiling the first program using a static compilation tool.

[0139] The implementation of S303 is similar to the implementation of S203 described above, and will not be described in detail here.

[0140] For example, you can combine Figure 4 Further understanding of the compiled file of the first program, such as Figure 4 As shown, the first program can be compiled using a static compilation tool (Native Image Compiler) to obtain a compiled file of the first program, which can then be obtained in an isolated environment. The compiled file of the first program can also be understood as an Enclave Native Image.

[0141] and combined Figure 4 It is understandable that the compiled file of the first program runs on the basis of the runtime (Enclave Runtime) of the isolated environment and the TEE SDK.

[0142] S304: Obtain a compiled file of the second program in the host environment.

[0143] It is understood that after the development of the second program corresponding to the host environment is completed, the second program will also be compiled to obtain a compiled file of the second program. Therefore, in this embodiment, the compiled file of the second program can also be obtained in the host environment, wherein the compiled file of the second program can be obtained by compiling the second program using a native compilation tool of the target language.

[0144] Among them, because the second program is a code program corresponding to the host environment, the conditions of the host environment are actually the normal conditions of the processor, so it can support the compilation conditions of the high-level program language.

[0145] So you can refer to Figure 4 For example, if the target language is Java, the second program can be compiled using a native compiler tool (Original Compiler) of the target language to obtain a compiled file of the second program. For example, if the target language is Java, the second program can be compiled using a native compiler tool of Java to obtain a compiled file of the second program, where the compiled file of the second program can also be understood as the Host App.

[0146] The compiled file of the second program can also be understood as an executable file in the host environment, that is, the corresponding data processing corresponding to the second program can be implemented based on the compiled file of the second program.

[0147] and combined Figure 4It is understandable that the compiled file of the second program runs on the basis of a virtual machine (Virtual Manufacturing, VM) or a runtime (runtime), and the underlying basis is the operating system (Operating System, OS).

[0148] In addition, the above-mentioned isolation environment and host environment both run on the TEE infrastructure.

[0149] S305 : Call the second target function in the compiled file of the second program through the second instance object to obtain the function name and parameters of the second target function.

[0150] And, after obtaining the compiled file of the second program in the host environment, the second target function can be called in the compiled file of the second program through the second instance object, wherein the function name of the first target function is the same as the function name of the first target function.

[0151] In a possible implementation, the user may write the function name of the target function to be called in the running program, and then call the second target function in the compiled file of the second program according to the function name in the program.

[0152] It can be understood that in this embodiment, it is necessary to determine the running result of the first target function in the first program in the host environment, but the first target function is in the first program corresponding to the isolation environment, and the first target function cannot be directly accessed in the host environment.

[0153] Therefore, refer to Figure 5 During the development process, a second objective function can be written in the second program, where the function name of the second objective function is the same as the function name of the first objective function, but the specific function contents in the first objective function and the second objective function are different.

[0154] The first target function in the isolation environment is used to implement a specific function, while the second target function in the host environment is used to implement access to the isolation environment and information transmission with the isolation environment.

[0155] This can be understood with an example. For example, a first program includes a first target function, helloworld(), and a second program includes a second target function, helloworld(). The helloworld() function in the first program is used to output (printf) the content "hello, world". The helloworld() function in the second program is used to act as a proxy and exchange corresponding information with the host environment.

[0156] Therefore, it can be understood that the functions existing in the first program all have corresponding functions with the same function names in the second program, but the contents of the functions are different.

[0157] The second target function in the second program in the host environment can be understood as a proxy object method for implementing actual data processing. Furthermore, the first target function in the first program in the isolated environment can be understood as a true trusted service object method for indirectly calling the first target function in the first program.

[0158] Therefore, in this embodiment, after determining the compiled file of the second program, the second target function can be called in the compiled file of the second program through the second instance object created above, where the specific processing of the second target function can include obtaining the function name and parameters of the second target function, thereby obtaining the function name and parameters of the second target function.

[0159] S306: Serialize the function name and parameters of the second target function to obtain first serialization information corresponding to the function name and parameters.

[0160] Furthermore, the specific processing of the second target function may further include serializing the function name and parameters of the second target function to obtain first serialized information corresponding to the function name and parameters. It is understandable that when the host environment and the isolated environment exchange information, serialization processing is required to obtain serialized information and then perform corresponding data transmission.

[0161] S307. Write the first serialization information corresponding to the function name and parameters into the memory of the isolation environment.

[0162] After obtaining the first serialization information corresponding to the function name and parameters, the first serialization information corresponding to the function name and parameters can be written into the memory of the isolation environment, thereby transmitting the function name and parameters from the host environment to the isolation environment.

[0163] In a possible implementation, for example, an isolated environment (Enclave) may be entered through eacll (Enclave call), thereby writing the first serialization information into the memory of the isolated environment.

[0164] S308. In the isolated environment, deserialize the first serialized information to obtain a function name and parameters.

[0165] After the first serialization information is written into the memory of the isolation environment, for example, the first serialization information can be deserialized in the isolation environment, so that the function name and parameters introduced above can be obtained in the isolation environment.

[0166] S309: Calling a first target function corresponding to the function name in the compiled file of the first program through the first instance object, so as to process the parameters through the first target function and obtain an operation result corresponding to the first target function.

[0167] Among them, the function name of the first objective function and the second function name are the same. Therefore, after determining the function name, for example, the first objective function corresponding to the function name can be called in the compiled file of the first program through the first instance object according to the function name, so that the parameters are processed by the first objective function, and the running result corresponding to the first objective function is obtained.

[0168] In one possible implementation, the aforementioned implementation mechanism may be a reflection mechanism of a high-level programming language, which can also be understood as a reflective call, a technique for calling a method at runtime by its name. More specifically, for example, the reflection mechanism of the high-level programming language may be used to dynamically query the target address of a first target function based on the function name. Then, based on the target address of the first target function, the first target function may be called through a first instance object, so that the first target function processes the parameters and obtains the corresponding execution result of the first target function.

[0169] Among them, the reflective call feature of high-level programming languages ​​is applied to the Enclave service discovery mechanism, which can dynamically query and execute the target method through the function name at runtime, thereby avoiding users from manually defining underlying description files such as EDL, and thus effectively reducing the difficulty of development.

[0170] S310: In an isolated environment, serialize the running result to obtain second serialization information corresponding to the running result.

[0171] After determining the running result of the first target function in the isolation environment, the running result needs to be further returned to the host environment. Based on the above description, it can be determined that the information transmitted between the host environment and the isolation environment needs to be serialized.

[0172] Therefore, in this embodiment, the running result can be serialized in the isolation environment to obtain the second serialization information corresponding to the running result.

[0173] S311. Write the second serialization information corresponding to the running result into the memory of the host environment.

[0174] After obtaining the second serialization information corresponding to the execution result in the isolation environment, the second serialization information corresponding to the execution result may be written into the memory of the host environment.

[0175] S312: Deserialize the second serialized information in the host environment to obtain an operating result corresponding to the first target function in the host environment.

[0176] Furthermore, in the host environment, the second serialized information is deserialized, thereby obtaining the running result corresponding to the first objective function in the host environment. This effectively enables confidential computing in an isolated environment, while simultaneously obtaining the results of confidential computing in the isolated environment in the host environment.

[0177] For example, you can combine Figure 4 Further understanding of the implementation process introduced above, such as Figure 4 As shown, in the host environment, a service call can be made to the host environment through a native call, and the host environment will return the service result accordingly. Furthermore, the service call here can also be understood as the above-mentioned introduction, where the second instance object in the host environment writes the first serialization information to the memory of the isolated environment (through ecall). And the service result can also be understood as the above-mentioned introduction, where the first instance object in the isolated environment writes the second serialization information to the memory of the host environment (through ocall), thereby achieving the operation result of the first target program corresponding to the pre-specified function name in the isolated environment in the host environment.

[0178] And in a possible implementation, after the above-mentioned execution process is completed and the running result corresponding to the first target function is obtained in the host environment, the automatic memory recovery of the high-level programming language may reclaim the memory of the second instance object in the host environment.

[0179] Because there is a mapping relationship between the first instance object and the second instance object in this embodiment, the memory of the first instance object in the isolated environment can be recovered based on the mapping relationship between the first instance object and the second instance object, thereby effectively realizing automatic memory management and further improving memory security at runtime.

[0180] It should also be noted that the memory of the second instance object will not be reclaimed after the running result of the first target function is obtained in the host environment. The specific time of memory reclaiming for the second instance object depends on the specific implementation of the automatic memory recycling mechanism of the high-level programming language, and this embodiment does not impose any restrictions on this.

[0181] Furthermore, after obtaining the execution result corresponding to the first target function in the host environment, the enclave context can be destroyed in the host environment and the enclave resources can be reclaimed. Later, when the enclave is needed for confidential computing, the enclave can be recreated to avoid long-term invalid occupation and waste of resources.

[0182] The data processing method provided in the embodiment of the present application uses a high-level programming language to write a first program corresponding to an isolated environment, and also uses a high-level programming language to write a second program corresponding to a host environment. At the same time, through the static compilation technology of the high-level programming language, it can effectively avoid the dependence of the code written in the high-level programming language on the complex language virtual machine and runtime platform during compilation, thereby reducing the requirements for the SGX SDK support capabilities, thereby achieving SGX SDK support for high-level programming languages. In addition, the use of high-level programming languages ​​to write the first and second programs can further improve runtime memory security due to the automatic memory management capabilities of high-level programming languages. At the same time, due to the reflective calling mechanism of the high-level programming language, the second target function can be called through the second instance object in the host environment. The determined function name is used to call the first target function corresponding to the function name in the isolated environment. Therefore, the first target function can be dynamically queried by the function name at runtime, and the first target function is called to process the parameters to obtain the running result of the first target function, avoiding the need for users to manually define underlying description files such as EDL, thereby reducing development difficulty.

[0183] Based on the above introduction, it should be noted that before obtaining the compiled files corresponding to the first program and the compiled files corresponding to the second program, it is necessary to first obtain the first program and compile the first program, and it is necessary to first obtain the second program and compile the second program.

[0184] Therefore, in one possible implementation, before obtaining the compiled file of the first program in the isolated environment, the second program corresponding to the host environment can be obtained, and the second program can be compiled using the native compilation tool corresponding to the second program to obtain the compiled file corresponding to the second program.

[0185] Furthermore, a first program corresponding to the isolation environment may be obtained, and the first program may be compiled using a static compilation tool to obtain a compiled file corresponding to the first program.

[0186] In a possible implementation, after the first program is compiled using a static compilation tool, the compiled file corresponding to the first program may be a native static library.

[0187] And during the processing of the isolated environment, it also requires some dependent libraries and TEE SDK as a basis for corresponding confidential computing.

[0188] Therefore, after obtaining the compiled file corresponding to the second program, that is, the native static library. In this embodiment, the native static library, the dependent library corresponding to the second program, and the software tool development kit of the trusted execution environment can also be linked together through a linker to generate a self-contained trusted runtime library. Among them, the runtime library is used to support the calculation processing of the first objective function mentioned above. It can also be understood that the calculation processing of the first objective function is completed based on the runtime library.

[0189] Based on the above introduction, it can be determined that in the development process of confidential computing applications based on low-level programming languages, users are usually required to write Makefile files to implement the corresponding compilation process. However, in the embodiments of the present application, high-level programming languages ​​are used to develop confidential computing applications. Because high-level programming languages ​​usually have powerful compilation tool chain ecosystems (Java Maven / Go Mod, etc.), there is no need to write application-independent compilation and construction files such as Makefiles, which can help users focus on developing application-related code, thereby effectively improving the development efficiency of confidential computing applications.

[0190] The following can be combined Figure 6 The data processing method provided in the embodiments of the present application is further introduced in detail. Figure 6 A flowchart of a data processing method provided in an embodiment of the present application.

[0191] like Figure 6 As shown, the data processing method provided by the present application may include three stages, namely, a development stage, a compilation stage, and an operation stage.

[0192] During the development phase, you can write a second program corresponding to the host environment, an interface program, and a first program corresponding to the isolated environment. These programs are all written using a high-level programming language.

[0193] Also, during the compilation phase, the native compiler can be used to compile the second program corresponding to the host environment and the part of the interface program corresponding to the host environment to obtain an executable file of the host environment, wherein the executable file corresponding to the host environment can be understood as a compiled file of the second program.

[0194] Furthermore, a static compiler can be used to compile the first program corresponding to the isolated environment and the part corresponding to the isolated environment in the interface program, thereby obtaining a compiled file of the first program, which can also be understood as a native static library, that is, Figure 6The xx.o file shown in .

[0195] At the same time, you can also obtain the TEE SDK and other trusted dependent libraries, and link the static library, TEE SDK and other trusted dependent libraries through the linker to obtain the trusted runtime library of the isolated environment.

[0196] Based on the above introduction, it can be determined that the second program corresponding to the host environment and the first program corresponding to the isolation environment both depend on the interface program. Because the program in the host environment and the program in the isolation environment are not allowed to have a dependency relationship, this application uses the interface program to achieve dependency isolation between the second program in the host environment and the second program in the isolation environment.

[0197] Afterwards, during the running phase, the executable file of the host environment may be started first, thereby creating an isolated environment, and in the isolated environment, the trusted runtime library of the isolated environment may be loaded.

[0198] Then, a first instance object is created in the host environment, and a second instance object is created in the isolated environment. Then, the second target function is called in the host environment through the first instance object, and the second target function writes the first serialized information corresponding to the function name and parameters into the memory of the isolated environment.

[0199] In an isolated environment, a reflection call can be made according to the function name to call the first target function, and the processing of the first target function is performed based on the parameters to achieve Figure 6 The service calculation process shown is performed to obtain the running result of the first objective function.

[0200] Then, the isolation environment can return the running result, that is, write the second serialization information of the running result of the first target function into the memory of the host environment, and then deserialize the second serialization information in the host environment, so as to obtain the running result of the first target function in the host environment.

[0201] After executing the above process, the isolation environment can be destroyed to release the resources of the isolation environment.

[0202] In summary, the data processing method provided by the embodiment of the present application solves the problem of limited support capabilities of the trusted computing platform by applying static compilation technology to the trusted computing execution environment, and expands the programming language ecology of trusted applications. At the same time, the reflection characteristics of high-level programming languages ​​are utilized to avoid defining underlying interface description files, optimize programming models, and reduce development difficulty. At the same time, using different methods to compile the second program corresponding to the host environment and the first program corresponding to the isolated environment can better adapt to trusted and non-trusted execution environments.

[0203] It can be further understood that this application provides a programming model and construction method based on the Software Guard Extension (SGX) trusted platform that supports high-level programming languages ​​(Java / Go / Python) for trusted application development. This method greatly improves the development efficiency and engineering construction experience of trusted applications while maintaining the advantage of a small attack surface of the Trusted Computing Base (TCB), and expands the SGX trusted computing platform application development ecosystem from C / C++ to Java / Go / Python and other high-level programming language ecosystems. Among them, TCB is used to provide all hardware, firmware, and software components of a system with a secure environment.

[0204] Figure 7 This is a schematic diagram of the structure of the data processing device provided in the embodiment of the present application. Figure 7 As shown, the device 70 includes: a creation module 701, an acquisition module 702 and a processing module 703.

[0205] A creation module 701, configured to create an isolated environment in the processing device;

[0206] The creation module 701 is further configured to create a first instance object corresponding to a first program in the isolation environment, and a second instance object corresponding to a second program in the host environment of the processing device, wherein the first program and the second program are written in the target language;

[0207] An acquisition module 702 is configured to acquire a compiled file of the first program in the isolated environment, where the compiled file is obtained by compiling the first program using a static compilation tool;

[0208] The processing module 703 is configured to determine, in the host environment, an operating result corresponding to the first target function in the first program using the first instance object, the second instance object, and the compiled file.

[0209] In one possible design, the processing module 703 is specifically configured to:

[0210] Obtaining a compiled file of the second program in the host environment;

[0211] calling a second target function in the compiled file of the second program through the second instance object to write the function name and parameters of the second target function into the memory of the isolated environment, where the function name of the first target function is the same as the function name of the first target function;

[0212] In the isolated environment, processing the function name, the parameters, and the compiled file through the first instance object to obtain an execution result corresponding to the first target function;

[0213] The running result is written into the memory of the host environment to obtain the running result corresponding to the first objective function in the host environment.

[0214] In one possible design, the processing module 703 is specifically configured to:

[0215] Calling the second target function in the compiled file of the second program through the second instance object to obtain a function name and parameters of the second target function;

[0216] Serializing the function name and parameters of the second objective function to obtain first serialization information corresponding to the function name and parameters;

[0217] Write the first serialization information corresponding to the function name and parameters into the memory of the isolation environment.

[0218] In one possible design, the processing module 703 is specifically configured to:

[0219] In the isolated environment, deserialize the first serialized information to obtain the function name and the parameters;

[0220] The first target function corresponding to the function name is called in the compiled file of the first program through the first instance object, so as to process the parameters through the first target function and obtain the running result corresponding to the first target function.

[0221] In one possible design, the processing module 703 is specifically configured to:

[0222] In the isolated environment, serializing the operation result to obtain second serialization information corresponding to the operation result;

[0223] Writing the second serialization information corresponding to the running result into the memory of the host environment;

[0224] In the host environment, the second serialization information is deserialized to obtain an operating result corresponding to the first objective function in the host environment.

[0225] In one possible design, there is a mapping relationship between the first instance object and the second instance object;

[0226] The processing module 703 is further configured to:

[0227] After writing the running result into the memory of the host environment to obtain the running result corresponding to the first objective function in the host environment, if it is determined that the memory of the second instance object in the host environment is reclaimed, the memory of the first instance object in the isolated environment is reclaimed according to the mapping relationship between the first instance object and the second instance object.

[0228] In one possible design, the processing module 703 is further configured to:

[0229] Before obtaining the compiled file of the first program in the isolated environment, obtaining a second program corresponding to the host environment, and compiling the second program using a native compilation tool corresponding to the second program to obtain a compiled file corresponding to the second program;

[0230] Obtain a first program corresponding to the isolation environment, compile the first program using a static compilation tool, and obtain a compiled file corresponding to the first program.

[0231] In one possible design, the compiled file corresponding to the second program is a static library;

[0232] The processing module 703 is further configured to:

[0233] After obtaining the first program corresponding to the isolated environment, compiling the first program using a static compilation tool to obtain a compiled file corresponding to the second program, obtaining a dependent library corresponding to the second program, and obtaining a software development kit for a trusted execution environment;

[0234] The static library, the dependency library corresponding to the second program, and the software development kit are linked to obtain a runtime library corresponding to the isolation environment, wherein the runtime library is used to complete the calculation processing of the first objective function.

[0235] The device provided in this embodiment can be used to execute the technical solution of the above method embodiment. Its implementation principle and technical effects are similar and will not be described in detail in this embodiment.

[0236] Figure 8 A schematic diagram of the hardware structure of the data processing device provided in the embodiment of the present application is shown in FIG. Figure 8 As shown, the data processing device 80 of this embodiment includes: a processor 801 and a memory 802;

[0237] Memory 802, for storing computer-executable instructions;

[0238] The processor 801 is configured to execute computer-executable instructions stored in the memory to implement the various steps of the data processing method in the above embodiment. For details, please refer to the relevant description in the above method embodiment.

[0239] Optionally, the memory 802 may be independent or integrated with the processor 801 .

[0240] When the memory 802 is independently provided, the data processing device further includes a bus 803 for connecting the memory 802 and the processor 801 .

[0241] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the data processing method executed by the above data processing device is implemented.

[0242] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or module, which can be electrical, mechanical or other forms.

[0243] The above-mentioned integrated module implemented in the form of a software functional module can be stored in a computer-readable storage medium. The above-mentioned software functional module is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform some steps of the method described in various embodiments of the present application.

[0244] It should be understood that the processor described above may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), or application-specific integrated circuits (ASICs). A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly executed by a hardware processor or by a combination of hardware and software modules within the processor.

[0245] The memory may include a high-speed RAM memory, and may also include non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk.

[0246] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be classified into address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0247] The storage medium may be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0248] Those skilled in the art will appreciate that all or part of the steps in the above-described method embodiments can be implemented using hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0249] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data processing method, characterized in that: Applied to a processing device, the method comprises: creating an isolated environment in the processing device; Creating a first instance object corresponding to a first program in the isolation environment, and creating a second instance object corresponding to a second program in a host environment of the processing device, wherein the first program and the second program are written in a target language; Obtaining a compiled file of the first program in the isolated environment, where the compiled file is obtained by compiling the first program using a static compilation tool; wherein the compiled file of the first program is a static library; Determining, in the host environment, an execution result corresponding to a first target function in the first program using the first instance object, the second instance object, and the compiled file; After obtaining the compiled file of the first program in the isolated environment, the method further includes: Obtaining a dependency library corresponding to the second program and a software development kit for a trusted execution environment; Linking the static library, a dependency library corresponding to the second program, and the software development kit to obtain a runtime library corresponding to the isolation environment, wherein the runtime library is used to complete the calculation processing of the first objective function; Determining, in the host environment, an execution result corresponding to a first target function in the first program using the first instance object, the second instance object, and the compiled file includes: Obtaining a compiled file of the second program in the host environment; calling a second target function in the compiled file of the second program through the second instance object to write a function name and parameters of the second target function into the memory of the isolated environment, where the function name of the second target function is the same as the function name of the first target function; In the isolated environment, processing the function name, the parameters, and the compiled file through the first instance object to obtain an execution result corresponding to the first target function; In the isolated environment, the running result is serialized to obtain second serialization information corresponding to the running result; the second serialization information corresponding to the running result is written into the memory of the host environment; in the host environment, the second serialization information is deserialized to obtain the running result corresponding to the first objective function in the host environment.

2. The method according to claim 1, characterized in that Calling the second target function in the compiled file of the second program through the second instance object to write the function name and parameters of the second target function into the memory of the isolated environment includes: Calling the second target function in the compiled file of the second program through the second instance object to obtain a function name and parameters of the second target function; Serializing the function name and parameters of the second objective function to obtain first serialization information corresponding to the function name and parameters; Write the first serialization information corresponding to the function name and parameters into the memory of the isolation environment.

3. The method according to claim 2, characterized in that In the isolated environment, processing the function name, the parameters, and the compiled file through the first instance object to obtain an execution result corresponding to the first target function includes: In the isolated environment, deserialize the first serialized information to obtain the function name and the parameters; The first target function corresponding to the function name is called in the compiled file of the first program through the first instance object, so as to process the parameters through the first target function and obtain the running result corresponding to the first target function.

4. The method according to any one of claims 1 to 3, characterized in that There is a mapping relationship between the first instance object and the second instance object; After determining, in the host environment, the running result corresponding to the first target function in the first program using the first instance object, the second instance object, and the compiled file, the method further includes: If it is determined that the memory of the second instance object in the host environment is reclaimed, the memory of the first instance object in the isolation environment is reclaimed according to the mapping relationship between the first instance object and the second instance object.

5. The method according to any one of claims 1 to 3, characterized in that Before obtaining the compiled file of the first program in the isolated environment, the method further includes: Obtaining a second program corresponding to the host environment, and compiling the second program using a native compilation tool corresponding to the second program to obtain a compiled file corresponding to the second program; Obtain a first program corresponding to the isolation environment, compile the first program using a static compilation tool, and obtain a compiled file corresponding to the first program.

6. A data processing device, characterized in that: Applied to processing equipment, the device comprises: A creation module, configured to create an isolated environment in the processing device; The creation module is further configured to create a first instance object corresponding to a first program in the isolation environment, and to create a second instance object corresponding to a second program in the host environment of the processing device, wherein the first program and the second program are written in the target language; an acquisition module, configured to acquire a compiled file of the first program in the isolated environment, the compiled file being obtained by compiling the first program using a static compilation tool; wherein the compiled file of the first program is a static library; a processing module, configured to determine, in the host environment, an execution result corresponding to the first target function in the first program using the first instance object, the second instance object, and the compiled file; The processing module is further configured to: After obtaining the compiled file of the first program in the isolated environment, obtaining the dependent library corresponding to the second program and obtaining a software development kit of the trusted execution environment; Linking the static library, a dependency library corresponding to the second program, and the software development kit to obtain a runtime library corresponding to the isolation environment, wherein the runtime library is used to complete the calculation processing of the first objective function; The processing module is specifically used for: Obtaining a compiled file of the second program in the host environment; calling a second target function in the compiled file of the second program through the second instance object to write the function name and parameters of the second target function into the memory of the isolated environment, where the function name of the first target function is the same as the function name of the first target function; In the isolated environment, processing the function name, the parameters, and the compiled file through the first instance object to obtain an execution result corresponding to the first target function; In the isolated environment, the running result is serialized to obtain second serialization information corresponding to the running result; the second serialization information corresponding to the running result is written into the memory of the host environment; in the host environment, the second serialization information is deserialized to obtain the running result corresponding to the first objective function in the host environment.

7. A data processing device, characterized in that: include: Memory, used to store programs; A processor is configured to execute the program stored in the memory. When the program is executed, the processor is configured to execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The method comprises instructions which, when executed on a computer, cause the computer to perform the method according to any one of claims 1 to 5.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images