Methods for detecting privacy data leakage

Abstract

The present disclosure relates to a method for detecting privacy data leakage for an application that can run in a trusted execution environment, including: determining the source of privacy data input of the application; determining external events that the application interacts with outside the trusted execution environment; running test cases and recording information about the privacy data input of the application and information about external events in each test case; and calculating the degree of association between the privacy data input and the external event based on the recorded information about the privacy data input and the external event, and determining whether there is a possibility of leakage of the privacy data input through the external event based on the degree of association. The present disclosure also relates to a method for detecting application data leakage against side channel attacks, a method for deploying an application to a trusted execution environment, a non-transitory computer-readable storage medium, and a computing device.

Description

Technical Field

[0001] The embodiments of the present disclosure belong to the field of computer technology, and in particular, relate to a method for detecting privacy data leakage for an application that can run in a trusted execution environment, a method for detecting application data leakage against side-channel attacks, and a method for deploying an application to a trusted execution environment. Background Art

[0002] Trusted Execution Environment (TEE) is a solution to privacy computing. TEE is a secure extension based on CPU hardware and is completely isolated from the outside. TEE was first proposed by Global Platform to solve the problem of secure isolation of resources on mobile devices and provide a trusted and secure execution environment for applications in parallel with the operating system. With the development of technology, TEE has become a more generalized TEE than the original concept. For example, server chip manufacturers such as Intel and AMD have successively launched hardware-assisted TEEs and enriched the concept and features of TEE. TEE mentioned now usually refers to this type of hardware-assisted TEE technology. Unlike mobile terminals, cloud access requires remote access, and the hardware platform is invisible to end users. Therefore, the first step in using TEE is to confirm the authenticity of TEE. Therefore, the current TEE technology has introduced a remote proof mechanism, which is endorsed by hardware manufacturers (mainly CPU manufacturers) and uses digital signature technology to ensure that users can verify the TEE status. At the same time, security needs that cannot be met by secure resource isolation alone, and further data privacy protection has also been proposed. Commercial TEEs including Intel SGX and AMD SEV also provide memory encryption technology, which limits trusted hardware to the CPU. The data on the bus and memory are all encrypted to prevent malicious users from snooping. For example, TEE technologies such as Intel's Software Guard Extensions (SGX) isolate code execution, remote attestation, secure configuration, secure storage of data, and trusted paths for executing code. Applications running in TEE are securely protected and almost impossible to be accessed by third parties.

[0003] Taking Intel SGX technology as an example, SGX provides an enclave, which is an encrypted trusted execution area in memory, where the CPU protects data from being stolen. Taking a CPU that supports SGX as an example, using the newly added processor instructions, a part of the EPC (Enclave Page Cache) area can be allocated in the memory, and the data in it can be encrypted by the encryption engine MEE (Memory Encryption Engine) in the CPU. The encrypted content in the EPC will only be decrypted into plaintext after entering the CPU. In actual applications, private data can be encrypted and passed to the enclave in ciphertext form, and the corresponding secret key can also be passed to the enclave through remote attestation. Then, the data is used for calculation under the encryption protection of the CPU, and the result will be returned in ciphertext form. Summary of the invention

[0004] The purpose of the present disclosure is to provide a method for detecting privacy data leakage for an application that can run in a trusted execution environment, a method for detecting application data leakage against side-channel attacks, a method for deploying an application to a trusted execution environment, a non-temporary computer-readable storage medium, and a computing device.

[0005] According to a first aspect of the present disclosure, there is provided a method for detecting privacy data leakage for an application that can run in a trusted execution environment, comprising: determining a source of privacy data input of the application; determining an external event in which the application interacts with an external event outside the trusted execution environment; running test cases and recording information on the privacy data input of the application and information on external events in each test case; and calculating a degree of correlation between the privacy data input and the external event based on the recorded information on the privacy data input and the external event, and determining whether there is a possibility of leakage of the privacy data input through the external event based on the degree of correlation.

[0006] According to a second aspect of the present disclosure, a method for detecting application data leakage against side-channel attacks is provided, comprising: generating test cases for the application through fuzz testing technology; determining external events that the application can generate during operation; inserting stubs in the code of the application to record information about external events; running the test cases, and recording information about data input and external events of the application in each test case; and calculating the degree of correlation between the data input and the external event based on the recorded data input information and external event information, and determining whether there is a possibility of data input leakage through external events based on the degree of correlation.

[0007] According to a third aspect of the present disclosure, a method for deploying an application to a trusted execution environment is provided, comprising: before deploying the application, performing privacy data leakage detection on the application as follows: determining the source of privacy data input of the application; determining external events in which the application interacts with outside the trusted execution environment; running test cases and recording information on the privacy data input of the application and information on external events in each test case; and calculating the degree of correlation between the privacy data input and the external event based on the recorded information on the privacy data input and the external event, and determining whether there is a possibility of leakage of the privacy data input through the external event based on the degree of correlation.

[0008] According to a fourth aspect of the present disclosure, a non-temporary computer-readable storage medium is provided, on which a series of computer-executable instructions are stored. When the series of computer-executable instructions are executed by one or more computing devices, the one or more computing devices perform the method as described above.

[0009] According to a fifth aspect of the present disclosure, a computing device is provided, comprising one or more processors and one or more memories, wherein the one or more memories are configured to store a series of computer-executable instructions, wherein the series of computer-executable instructions, when executed by the one or more processors, causes the one or more processors to perform the method as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0011] Figure 1 is a schematic flow chart of a method for detecting privacy data leakage for an application program capable of running in a trusted execution environment according to an embodiment of the present disclosure;

[0012] Figure 2 is a schematic block diagram of a method for detecting privacy data leakage for an application program that can run in a trusted execution environment according to an embodiment of the present disclosure;

[0013] Figure 3 is a schematic diagram of an on-chain node in a blockchain network including a trusted execution environment;

[0014] Figure 4 is a schematic diagram of an off-chain node of a blockchain network including a trusted execution environment;

[0015] Figure 5 is a flowchart of a method for deploying an application to a trusted execution environment according to an embodiment of the present disclosure;

[0016] Figure 6 is a flow chart of a method for detecting application data leakage against a side channel attack according to an embodiment of the present disclosure;

[0017] Figure 7 is a schematic diagram of at least a portion of a node device according to an embodiment of the present disclosure;

[0018] Figure 8 is an exemplary block diagram of a general hardware system that can be applied according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the technical solutions in the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. However, it should be understood that one or more embodiments of the present disclosure can be presented in a variety of different ways and are not limited to the embodiments described below. It should also be understood that one or more embodiments of the present disclosure can be combined in various ways to provide more additional embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present disclosure.

[0020] It should be understood that the terms used herein are only used to describe specific embodiments and are not intended to be limiting. All terms (including technical terms and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. For the sake of simplicity and / or clarity, well-known functions or structures may not be described in detail.

[0021] In this document, the term "connection" is intended to include the physical, electrical, and / or communication connection between one feature and another feature, and there may or may not be intermediate features between this feature and another feature. When the connection is a communication connection, even if A and B are mentioned to be "directly connected", it is only intended to emphasize that there is no one or more features emphasized by one or more embodiments of the present disclosure between A and B, but it does not mean that A and B are limited to being connected without any elements. Those skilled in the art should understand that A and B can be connected through cables, routers, gateways, channels, links, networks, etc. It should be noted that in the drawings of one or more embodiments of the present disclosure, whether it is a direct connection or an indirect connection between A and B, it is represented by a straight line or other graphic elements connected between A and B.

[0022] Herein, the term "A or B" includes "A and B" and "A or B" rather than exclusively including only "A" or only "B", unless specifically stated otherwise.

[0023] In this document, the term "exemplary" means "used as an example, instance, or illustration" rather than as a "model" to be exactly copied. Any implementation described as an example herein is not necessarily to be interpreted as preferred or advantageous over other implementations. Moreover, one or more embodiments of the present disclosure are not limited by any stated or implied theory given in the above technical field, background technology, inventive content, or detailed description.

[0024] As used herein, the term "substantially" is intended to include any minor variations due to design or manufacturing imperfections, device or component tolerances, environmental influences, and / or other factors. The term "substantially" also allows for deviations from a perfect or ideal situation due to parasitic effects, noise, and other practical considerations that may exist in actual implementations.

[0025] In addition, the terms "first", "second" and the like may also be used herein for reference purposes only, and thus are not intended to be limiting. For example, the terms "first", "second" and other such numerical terms referring to structures or elements do not imply a sequence or order unless the context clearly indicates otherwise.

[0026] It should also be understood that when the term “include / comprises” is used in this document, it indicates the presence of the specified features, integers, steps, operations, units and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, units and / or components and / or their combinations.

[0027] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this disclosure. In some other embodiments, the steps included in the method may be more or less than those described in this disclosure. In addition, a single step described in this disclosure may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this disclosure may also be combined into a single step for description in other embodiments.

[0028] Computing devices that can create a trusted execution environment (TEE) can ensure that private data is only decrypted, read or executed in the TEE, and once it leaves the TEE, it is in an encrypted state, thereby ensuring privacy and security during the processing of private data. However, although the running state of the application can be guaranteed not to be obtained from outside the TEE when it runs in the TEE, the application running in the TEE (hereinafter referred to as the privacy application or TAPP) is also written by the developer, and there is no guarantee that the written application will not have privacy leakage. If the developer associates the private input data with external events in a certain way in the privacy application, or introduces improper time patterns due to the developer's negligence in event processing, it may lead to attacks such as side channel attacks, and there is a possibility of privacy leakage. Therefore, it is necessary to detect the leakage of private data of privacy applications.

[0029] The private data referred to in this article can be any type of data that the data owner or data provider does not want others to know, and may include, for example: user name, password, account name, checking account number, savings account number, credit card number, ID number, transaction content, execution results, device identifier, mobile phone number, geographic location, contact list, and message content.

[0030] According to the method for detecting privacy data leakage for an application that can run in a trusted execution environment according to an embodiment of the present disclosure, by calculating the degree of correlation between the privacy data input of the application and the external event with which the application interacts outside the trusted execution environment, it is determined whether there is a possibility of leakage of the privacy data input through an external event. If the correlation between the privacy data input and the external event is strong, for example, a change in the privacy data input of the application usually causes a change in one or more attributes of the external event, it can be determined that the external event may leak the privacy data input of the application. On the contrary, if the correlation between the privacy data input and the external event is weak, for example, a change in the privacy data input of the application has almost no effect on the attributes of the external event, it can be determined that the external event will not leak the privacy data input of the application.

[0031] Figure 1 and Figure 21 is a schematic diagram of a method 100 for detecting privacy data leakage for an application that can run in a trusted execution environment according to an embodiment of the present disclosure. The method 100 includes determining a privacy data input source of an application (operation 110); determining an external event in which the application interacts with the outside of the trusted execution environment (operation 120); running test cases and recording information about the privacy data input of the application and information about the external event in each test case (operation 130); and calculating the degree of association between the privacy data input and the external event based on the recorded information about the privacy data input and the external event, and determining whether there is a possibility of leakage of the privacy data input through the external event based on the degree of association (operation 140).

[0032] In operation 110, the privacy data input source is determined. The owner or provider of the privacy data can specify the privacy data input source so that privacy data leakage detection can be performed on the specified privacy data input source. For an application, the privacy data is input from outside the application, such as the content of a read file, data received from the network, parameters passed in by the command line, etc. Therefore, the privacy data input source can include at least one of the privacy data in the input parameters of the application, the privacy data in the file that the application will read during operation, or the privacy data that the application will obtain from the network during operation. The privacy data input source can be determined according to the specification of the user (for example, the owner or provider of the privacy data). Determining the privacy data input source according to the user's specification does not require detection of all input data from outside the application, which helps to reduce the amount of computation for privacy data leakage detection.

[0033] In operation 120, determine the external events that the application interacts with outside the trusted execution environment. The external events referred to herein include all events that the application interacts with the environment outside the trusted execution environment, which include both events with output attributes (such as writing to a file outside the trusted execution environment) and events with input attributes (such as reading a file outside the trusted execution environment). The external events that the application interacts with outside the trusted execution environment may include at least one of the following: a request and / or response to access outside the trusted execution environment, data transmission over a network, and reading and writing files. In some embodiments, the request and / or response outside the trusted execution environment includes a request and / or response based on HTTP. There may be one or more external events of the application, which can be determined by monitoring outside the trusted execution environment during the operation of the application.

[0034] Before performing operation 130, test cases can be generated by fuzz testing technology. Fuzz testing is a method for discovering software vulnerabilities by providing unexpected inputs to the target system and monitoring abnormal results. It is a type of security testing between complete manual penetration testing and complete automated testing. Fuzz testing attacks the program to be tested with random bad data (also known as fuzz) without logical analysis, that is, as much messy data as possible is thrown into the program. Therefore, using fuzz testing technology, a large number of test cases for the target application can be generated. As described above, in these use cases, the input of the application can include one or more of the input parameters of the application, the data in the file that the application will read during operation, or the data that the application will obtain from the network during operation. A large number of test cases generated using fuzz testing technology can cover various external events that the application interacts with outside the trusted execution environment.

[0035] In operation 130, the test cases are run, and the information of the private data input of the application and the information of the external events in each test case are recorded. The information of the private data input may include the content of the private data itself, which is usually determined and recorded when the test case is generated. The information of the external event may include information of one or more attributes of the external event, for example, the content information of the external event and the time information related to the external event. In a specific example, the external event is an HTTP request outside the trusted execution environment. The HTTP request usually includes a URL. Here, the URL is a concise representation of the location and access method of the resource that can be obtained from the Internet, and is the address of the standard resource on the Internet. Each file on the Internet has a unique URL, which contains information indicating the location of the file and how the browser should handle the URL. Generally, the URL consists of the following parts from left to right: Internet resource type (scheme), server address (host), port (port), path (path). Among them, the Internet resource type refers to the tool used by the World Wide Web WWW client program to operate, such as "http: / / " represents a WWW server, "ftp: / / " represents an FTP server, "gopher: / / " represents a Gopher server, and "new:" represents a Newgroup news group. In addition, the HTTP request may also include operation parameters. Operation parameters refer to specific operations in the resources corresponding to the URL, such as login, registration, logout, etc. The information of the external event may include the content information of the HTTP request, such as the URL and / or operation parameters included in the HTTP request. In addition, the information of the external event may also include time information related to the external event, such as the time when the application sends the HTTP request, the delay between the application sending the HTTP request and the execution of the previous program statement, the time it takes for the application to send the HTTP request, etc. Recording time information related to external events helps to identify side channel attacks that exploit time patterns. In one embodiment, the information of external events of the application in each test case can be recorded by inserting stubs in the code of the application.

[0036] In operation 140, the degree of association between the private data input and the external event is calculated based on the information of the recorded private data input and the information of the external event, and whether there is a possibility of leakage of the private data input through the external event is determined based on the degree of association. In one embodiment, the degree of association between the private data input and the external event can be calculated by calculating the mutual information between the private data input and the external event. In response to the mutual information between the private data input and the external event being greater than a threshold, it can be determined that there is a possibility of leakage of the private data input through the external event. For example, the mutual information between the private data input x and the external event y can be calculated according to the following formula :

[0037] ,in,

[0038] Vx is the value range of the private data input x, Vy is the value range of the external event y, is the information entropy of the private data input x, is the conditional entropy of the private data input x under the condition of a given external event y, and is calculated according to the following formulas:

[0039] ,

[0040] ,

[0041] Where P(•) represents the probability function.

[0042] For each external event determined in operation 120, the mutual information between each private data input of the application and the external event is calculated. The granularity of the private data input x can be formulated as needed, and the following is an example of an application having input parameters a and b. In one example, all input parameters of the application can be used as private data input x, and its value domain space Vx={x1, x2, …} is {(a1, b1), (a2, b2), …}, where ai, bi are the values ​​of the input parameters a and b of the application in the corresponding test case. For each external event of the application, the mutual information between the input parameters a and b together and the external event can be calculated. In another example, each input parameter of the application can be used as private data input x. That is, in the first calculation, the input parameter a is used as the private data input x, and its value domain space Vx={x1, x2, …} is {a1, a2, …}, where ai is the value of the input parameter a of the application in the corresponding test case. For each external event of the application, the mutual information between the input parameter a and the external event can be calculated. In the second calculation, the input parameter b is input as the privacy data x, and its value domain space Vx={x1, x2,…} is {b1, b2, …}, where bi is the value of the input parameter b of the application in the corresponding test case. For each external event of the application, the mutual information between the input parameter b and the external event can be calculated. In the first example above, the degree of association between the input parameter as the input source of the privacy data of the application and the external event can be determined, so as to determine whether the event has the possibility of leaking the input parameter; and in the second example, the degree of association between the input parameter a and the external event, as well as the degree of association between the input parameter b and the external event can be determined, so as to determine whether the event has the possibility of leaking the input parameter a or b.

[0043] The granularity of the external event y can also be formulated as needed. The following is an example of an application's external event including an HTTP request outside the trusted execution environment. In one example, the application's external HTTP request can be taken as an external event y, and its value domain space Vy={y1, y2, ...} can be, for example, the URL in the HTTP request issued by the application in the corresponding test case. The degree of association between the external event and the private data input x can be calculated for the external event, for example, when the private data input x changes, whether the URL in the HTTP request issued by the application will change accordingly, so as to determine whether the URL in the HTTP request has the possibility of leaking the private data input x. In another example, an HTTP request including the first address URL1 can be taken as an external event y, and its value domain space Vy={y1, y2, ...} can be, for example, the delay in issuing the HTTP request to the first address URL1 in the corresponding test case. The degree of association between the external event and the private data input x can be calculated. For example, when the private data input x changes, whether the delay of the HTTP request issued by the application to the first address URL1 will change accordingly, thereby determining whether the delay in issuing the HTTP request has the possibility of leaking the private data input x.

[0044] If it is determined that there is a possibility of leaking private data input through external events, it means that the external events may leak private data when the application is running. Therefore, an alarm message can be output to warn of this situation, or a private data leakage detection report can be output to present the possibility of each external event leaking each private data input.

[0045] In the embodiments of the present disclosure described above, in some cases, the trusted execution environment can be created in a chain node device in the blockchain network, for example, Figure 3 In the first blockchain node shown. In these cases, the application can be a smart contract to be deployed in the blockchain network. The first blockchain node can be divided into a regular execution environment and a trusted execution environment. The transaction submitted by the client (taking the transaction submitted by the client as an example) first enters the "transaction / query interface" in the regular execution environment for type identification, and the identified transactions that can be processed in plain text are left in the regular execution environment for processing, while the identified transactions that require privacy processing (referred to as "privacy transactions") are passed to the trusted execution environment for processing.

[0046] If the transaction type identified by the "transaction / query interface" in the conventional execution environment is a privacy transaction, the privacy transaction is passed to the trusted execution environment of the first blockchain node, and the first blockchain node decrypts the privacy transaction in the trusted execution environment. Assuming that the above-mentioned privacy transaction is generated by a user at a client, the client can first generate plaintext transaction content, and then encrypt the plaintext transaction content with a key. The encryption can be symmetric encryption or asymmetric encryption. Correspondingly, the first blockchain node can decrypt the privacy transaction with the corresponding key to obtain the plaintext transaction content. The transaction in the present disclosure can be used to implement relatively simple processing logic, such as transfer logic similar to the related art. In these cases, the plaintext transaction content can include fields such as to, value, and data in the Ethereum network. The transaction in the present disclosure can also be used to implement relatively complex processing logic, for example, it can be implemented with the help of smart contracts. In these cases, the plaintext transaction content can include the code of the smart contract for creating a smart contract in the blockchain; the plaintext transaction content can include the contract address of a smart contract that has been created in the blockchain for calling the smart contract.

[0047] After the privacy data leakage detection is performed using the method described above and the application that passes the detection, it can be deployed to the TEE of each node on the blockchain network, so that the smart contract can be deployed in the blockchain network for private transactions. After the smart contract is deployed, the smart contract can be called. In response to the smart contract being called, the first blockchain node can use the newly added processor instructions in the CPU to allocate a part of the area EPC in the memory, and encrypt the above plaintext code through the encryption engine MEE in the CPU and store it in the EPC. The encrypted content in the EPC is decrypted into plaintext after entering the CPU. In the CPU, the plaintext code is calculated to complete the execution process of the smart contract. Generally, after the CPU executes the plaintext code, the account status or contract status will change. From the perspective of the blockchain node, the account status or contract status is stored in the blockchain, which is to write the account status or contract status to a database, such as a local database. The database is generally stored in a storage medium, and more often a persistent storage medium. The persistent storage medium can be a disk, a floppy disk, or a memory that can recover data after power-on so that it can be stored persistently. The first blockchain node can ensure that the ciphertext execution result itself is sufficiently secure by encrypting the plaintext execution result into a ciphertext execution result using a key, and the ciphertext execution result can only be decrypted through the trusted execution environment. On this basis, the first blockchain node can execute the storage function code outside the trusted execution environment to store the ciphertext execution result in an external storage space outside the trusted execution environment. The first blockchain node can execute the write cache function code in the trusted execution environment to store the plaintext execution result in the write cache in the trusted execution environment. For example, the write cache can correspond to Figure 3 Further, the first blockchain node may encrypt the data in the write cache and output it from the trusted execution environment to store it in the external storage space.

[0048] In some cases, the trusted execution environment can be created in an off-chain node device outside the blockchain network, such as Figure 4 In these cases, the operation of the off-chain node device can be similar to the above combined Figure 3Description of the first blockchain node. For the sake of simplicity, operations similar to those in the above situation are omitted here. There can be one or more off-chain node devices. Each off-chain node device can be connected to an on-chain node in at least one blockchain network to receive computing requests from the on-chain node. When multiple off-chain node devices form a cluster, they can be connected to the on-chain node through a controller, and the controller can be responsible for message forwarding between the on-chain node and the off-chain node. It should be understood that the off-chain node devices do not need to perform a consensus process between devices. Therefore, each off-chain node device can perform its own computing tasks, and the controller can schedule computing resources among multiple off-chain node devices. The blockchain network can send transaction requests to off-chain node devices, such as Figure 4 The controller shown receives a transaction request from the on-chain node 4, which may be, for example, a computation request to call an application that has been deployed to the off-chain node device. In response to the request of the blockchain network, the off-chain node device performs privacy computation in the trusted execution environment and returns the computation result to the blockchain network, for example, to the on-chain node 4 via the controller. The returned computation result can be stored in the blockchain network.

[0049] In the case where the trusted execution environment is created in an off-chain node device outside the blockchain network, the application's request and / or response outside the trusted execution environment may be an interaction with one or more on-chain nodes in the blockchain network, such as an interaction via a controller. In these cases, external events in which the application interacts with outside the trusted execution environment can be determined by monitoring the interaction between the off-chain node device and the blockchain network.

[0050] Figure 52 is a flowchart of a method 200 for deploying an application to a trusted execution environment according to an embodiment of the present disclosure. The method 200 includes: before deploying the application, performing a privacy data leakage detection on the application (operation 210); in response to determining that there is no possibility of leaking the privacy data input through an external event, the node device where the trusted execution environment is located performs a remote certification process to prove to the client that the node device is a trusted node (operation 220); and the node device receives a transaction request for deploying the application from the client, stores and deploys the application, and returns a hash value of the application to the client (operation 230). Operation 210 can be completed by the method 100 described above. The node device where the trusted execution environment is located, as described above, can be an on-chain node in the blockchain network or an off-chain node outside the blockchain network. The hash value of the application returned to the client in operation 230 can be used for client verification. The client compares the hash value returned by the trusted execution environment with the hash value of the application stored locally. If they are exactly the same, it means that the application deployed by the trusted execution environment is the application requested to be deployed. In addition, the hash value of the application can also be used as the ID of the application so that the client can initiate a call to the application. After completing operation 230, the application that has passed the privacy data leakage detection is deployed to the node device, and the client can then initiate a call to the application, for example, through the ID of the application (for example, it can be the above hash value returned to the client by the power saving device).

[0051] Figure 6 The flowchart of the method 300 for detecting application data leakage against side channel attacks according to an embodiment of the present disclosure is as follows. The method 300 includes: generating test cases for an application by using fuzz testing technology (operation 310); determining external events that can be generated by the application during operation (operation 320), the external events including at least one of requests and / or responses to outside the application, data transmission through a network, and reading and writing files; inserting stubs in the code of the application to record information of external events (operation 330); running test cases, and recording information of data input of the application and information of external events in each test case (operation 340); and calculating the degree of association between data input and external events based on the recorded information of data input and external events, and determining whether there is a possibility of data input leakage through external events based on the degree of association (operation 350).

[0052] Figure 76 is a schematic diagram of at least part of a node device 600 (or computing device) according to an embodiment of the present disclosure. The node device 600 may be, for example, the above-mentioned on-chain node device or off-chain node device. The node device 600 includes one or more processors 610, one or more memories 620, and other components (not shown) that are typically present in a computer or other device. Each of the one or more memories 620 may store content accessible by the one or more processors 610, including instructions 621 that may be executed by the one or more processors 610, and data 622 that may be retrieved, manipulated, or stored by the one or more processors 610.

[0053] Instructions 621 may be any set of instructions, such as machine code, to be executed directly by one or more processors 610, or any set of instructions, such as scripts, to be executed indirectly. The terms "instructions," "applications," "processes," "steps," and "programs" in this disclosure may be used interchangeably in this disclosure. Instructions 621 may be stored in an object code format to be processed directly by one or more processors 610, or stored as a script or collection of independent source code modules in any other computer language, including those that are interpreted on demand or compiled in advance. Other portions of this disclosure explain the functions, methods, and routines of instructions 621 in more detail.

[0054] The one or more memories 620 may be any temporary or non-temporary computer-readable storage medium capable of storing content accessible by the one or more processors 610, such as a hard drive, a memory card, a ROM, a RAM, a DVD, a CD, a USB memory, a writable memory, and a read-only memory, etc. One or more of the one or more memories 620 may include a distributed storage system, in which instructions 621 and / or data 622 may be stored on a plurality of different storage devices that may be physically located at the same or different geographic locations. One or more of the one or more memories 620 may be connected to the one or more first devices 610 via a network, and / or may be directly connected to or incorporated into any one of the one or more processors 610.

[0055] One or more processors 610 may retrieve, store, or modify data 622 in accordance with instructions 621. Although the subject matter described in the present disclosure is not limited to any particular data structure, data 622 may also be stored in a computer register (not shown), as a table or XML document with many different fields and records, stored in a relational database. Data 622 may be formatted in any computing device readable format, such as, but not limited to, binary values, ASCII, or Unicode. In addition, data 622 may include any information sufficient to identify the relevant information, such as a number, descriptive text, proprietary code, pointer, reference to data stored in other storage such as other network locations, or information used by a function to calculate the relevant data.

[0056] The one or more processors 610 may be any conventional processor, such as a commercially available central processing unit (CPU), a graphics processing unit (GPU), etc. Alternatively, the one or more processors 610 may also be a dedicated component, such as an application specific integrated circuit (ASIC) or other hardware-based processor. Although not required, the one or more processors 610 may include specialized hardware components to perform specific computing processes faster or more efficiently.

[0057] Although Figure 7 Schematically, one or more processors 610 and one or more memories 620 are shown in the same frame, but the node device 600 may actually include multiple processors or memories that may exist in the same physical housing or in different physical housings. Therefore, references to processors, computers, computing devices, or memories should be understood to include references to a collection of processors, computers, computing devices, or memories that may or may not operate in parallel.

[0058] Figure 8 is an exemplary block diagram of a general hardware system 700 that may be applied according to one or more exemplary embodiments of the present disclosure. Figure 8 Describe system 700, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The node device 600 or computing device in the above embodiments may include all or part of the system 700. The system 700 can be any machine configured to perform processing and / or computing, and can be but is not limited to a workstation, a server, a desktop computer, a laptop computer, a tablet computer, a personal data assistant, a smart phone, a car computer, or any combination thereof.

[0059] The system 700 may include elements that may be connected to or communicate with the bus 702 via one or more interfaces. For example, the system 700 may include the bus 702, and one or more processors 704, one or more input devices 706, and one or more output devices 707. The one or more processors 704 may be any type of processor, and may include but is not limited to one or more general-purpose processors and / or one or more special-purpose processors (e.g., special processing chips). Each operation and / or step in the method described above may be implemented by executing instructions by one or more processors 704.

[0060] Input device 706 may be any type of device that can input information to a computing device, including but not limited to a mouse, keyboard, touch screen, microphone, and / or remote control. Output device 707 may be any type of device that can present information, including but not limited to a display, speaker, video / audio output terminal, vibrator, and / or printer.

[0061] The system 700 may also include or be connected to a non-transitory storage device 710. The non-transitory storage device 710 may be any storage device that is non-transitory and can implement data storage, and may include but is not limited to a disk drive, an optical storage device, a solid-state memory, a floppy disk, a hard disk, a tape or any other magnetic medium, an optical disk or any other optical medium, a ROM (read-only memory), a RAM (random access memory), a cache memory, and / or any other memory chip / chipset, and / or any other medium from which a computer can read data, instructions, and / or code. The non-transitory storage device 710 may be detachable from the interface. The non-transitory storage device 710 may have data / instructions / code for implementing the above methods, operations, steps, and processes.

[0062] The system 700 may also include a communication device 712. The communication device 712 may be any type of device or system capable of communicating with an external device and / or with a network, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication device, and / or a chipset, such as a Bluetooth device, a 702.11 device, a WiFi device, a WiMax device, a cellular communication device, a satellite communication device, and / or the like.

[0063] The bus 702 may include, but is not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus. In particular, for in-vehicle devices, the bus 702 may also include a Controller Area Network (CAN) bus or other architectures designed for use in a vehicle.

[0064] The system 700 may also include a working memory 714 , which may be any type of working memory that can store instructions and / or data useful for the operation of the processor 704 , and may include, but is not limited to, random access memory and / or read-only storage devices.

[0065] Software elements may be located in the working memory 714, including but not limited to an operating system 716, one or more application programs 717, drivers, and / or other data and code. Instructions for performing the above methods, operations, and steps may be included in one or more application programs 717. The executable code or source code of the instructions of the software elements may be stored in a non-transitory computer-readable storage medium, such as the storage device 710 described above, and may be read into the working memory 714 by compilation and / or installation. The executable code or source code of the instructions of the software elements may also be downloaded from a remote location.

[0066] It should also be understood that changes can be made according to specific requirements. For example, custom hardware can also be used, and / or specific elements can be implemented with hardware, software, firmware, middleware, microcode, hardware description language or any combination thereof. In addition, connections with other computing devices such as network input / output devices can be adopted. For example, some or all of the methods or devices according to the embodiments of the present disclosure can be implemented by programming hardware (e.g., including a field programmable gate array (FPGA) and / or a programmable logic array (PLA)) using logic and algorithms according to the present disclosure, in assembly language or hardware programming languages ​​(such as VERILOG, VHDL, C++).

[0067] It should also be understood that the components of system 700 can be distributed over a network. For example, some processing can be performed using one processor, while other processing can be performed by another processor remote from the one processor. Other components of system 700 can also be similarly distributed. In this way, system 700 can be interpreted as a distributed computing system that performs processing at multiple locations.

[0068] Although various aspects of the present disclosure have been described so far with reference to the accompanying drawings, the above-described methods, systems, and devices are merely illustrative examples, and the scope of the present disclosure is not limited by these aspects, but only by the following aspects: the attached claims and their equivalents. Various elements may be omitted or replaced with equivalent elements. In addition, the steps may be performed in an order different from the order described in the present disclosure. In addition, various elements may be combined in various ways. It is also important to note that as technology develops, many of the elements described may be replaced by equivalent elements that appear after the present disclosure.

[0069] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0070] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0071] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0072] Although one or more embodiments of the present disclosure provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, product or device including a series of elements includes not only those elements, but also other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or device. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or device including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0073] For the convenience of description, the above devices are described in terms of functions and are divided into various modules. Of course, when implementing one or more of the present disclosures, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0074] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0075] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0076] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0077] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0078] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0079] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0080] It should be understood by those skilled in the art that one or more embodiments of the present disclosure may be provided as a method, a system or a computer program product. Therefore, one or more embodiments of the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0081] One or more embodiments of the present disclosure may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present disclosure may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0082] Each embodiment in the present disclosure is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of the present disclosure, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In the present disclosure, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, in the absence of contradiction, a person skilled in the art can combine and combine the different embodiments or examples described in the present disclosure and the features of the different embodiments or examples.

[0083] The above description is only an example of one or more embodiments of the present disclosure, and is not intended to limit one or more embodiments of the present disclosure. For those skilled in the art, one or more embodiments of the present disclosure may have various changes and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the scope of the claims.

Claims

1. A method for detecting privacy data leakage for an application capable of running in a trusted execution environment, comprising: determining a source of private data input to the application; determining an external event in which the application interacts with outside of the trusted execution environment; Run the test cases and record the private data input information and external event information of the application described in each test case; as well as The degree of association between the privacy data input and the external event is calculated based on the recorded information of the privacy data input and the information of the external event, and whether there is a possibility of leakage of the privacy data input through the external event is determined based on the degree of association, wherein the strength of the degree of association indicates the possibility of the attribute of the external event changing accordingly when the privacy data input of the application changes, and the information of the external event includes information of one or more attributes of the external event, and the information of the one or more attributes includes content information of the external event and time information related to the external event.

2. The method according to claim 1, further comprising: The privacy data input source is determined according to a user's designation.

3. The method according to claim 1, wherein: The privacy data input source includes at least one of the following: Private data in the input parameters of the application; Private data in files that the application will read during operation; and The application will obtain private data from the network during operation.

4. The method according to claim 1, wherein: The external event includes at least one of the following: Requests and / or responses outside of the trusted execution environment; Transmit data over a network; and Read and write files.

5. The method according to claim 4, wherein: The request and / or response outside the trusted execution environment includes HTTP-based request and / or response.

6. The method according to claim 1, further comprising: Generate test cases through fuzz testing technology.

7. The method according to claim 1, further comprising: Information about external events of the application in each test case is recorded by inserting stubs in the code of the application.

8. The method according to claim 1, further comprising: The degree of association between private data input and external events is calculated by calculating the mutual information between the private data input and the external events.

9. The method according to claim 8, wherein: The mutual information between the private data input x and the external event y is calculated according to the following formula : ,in, Vx is the value range of the private data input x, Vy is the value range of the external event y, is the information entropy of the private data input x, is the conditional entropy of the private data input x under the condition of a given external event y, and is calculated according to the following formulas: ， ， Where P(•) represents the probability function.

10. The method according to claim 8, further comprising: In response to the mutual information between the private data input and the external event being greater than a threshold, it is determined that there is a possibility that the private data input is leaked through the external event.

11. The method according to claim 1, further comprising: In response to determining that there is a possibility that the private data input is leaked through an external event, a detection report of the private data leakage is output.

12. The method according to claim 1, wherein: The trusted execution environment is implemented in an on-chain node device in a blockchain network, and the application is a smart contract to be deployed in the blockchain network.

13. The method according to claim 1, wherein: The trusted execution environment is implemented in an off-chain node device outside the blockchain network. The off-chain node device is configured to respond to a request from the blockchain network, perform privacy computing in the trusted execution environment, and return the computing results to the blockchain network.

14. A method for detecting application data leakage against a side channel attack, comprising: generating test cases for the application by using fuzz testing technology; determining external events that the application can generate during execution; Instrumenting the application's code to record information about external events; Run test cases and record data input information and external event information of the application described in each test case; as well as The degree of association between the data input and the external event is calculated based on the recorded information of the data input and the information of the external event, and whether there is a possibility of leakage of the data input through the external event is determined based on the degree of association, wherein the strength of the degree of association indicates the possibility of the attribute of the external event changing accordingly when the privacy data input of the application changes, and the information of the external event includes information of one or more attributes of the external event, and the information of the one or more attributes includes content information of the external event and time information related to the external event.

15. The method according to claim 14, wherein: The external event includes at least one of the following: Requests and / or responses outside of said Application; Transmit data over a network; and Read and write files.

16. The method according to claim 15, wherein: Requests and / or responses outside of the application include HTTP-based requests and / or responses.

17. The method according to claim 14, further comprising: The degree of association between the data input and the external event is calculated by calculating the mutual information between the data input and the external event.

18. The method according to claim 17, wherein: The mutual information between the data input x and the external event y is calculated according to the following formula : ,in, Vx is the value range space of data input x, Vy is the value range space of external event y, is the information entropy of the data input x, It is the conditional entropy of data input x under the condition of given external event y, calculated according to the following formulas: ， ， Where P(•) represents the probability function.

19. The method according to claim 17, further comprising: In response to the mutual information between the data input and the external event being greater than a threshold, it is determined that there is a possibility that the data input is leaked through the external event.

20. A method for deploying an application to a trusted execution environment, comprising: Before deploying the application, perform privacy data leakage detection on the application as follows: determining a source of private data input to the application; determining an external event in which the application interacts with outside of the trusted execution environment; Run the test cases and record the private data input information and external event information of the application described in each test case; as well as The degree of association between the privacy data input and the external event is calculated based on the recorded information of the privacy data input and the information of the external event, and whether there is a possibility of leakage of the privacy data input through the external event is determined based on the degree of association, wherein the strength of the degree of association indicates the possibility of the attribute of the external event changing accordingly when the privacy data input of the application changes, and the information of the external event includes information of one or more attributes of the external event, and the information of the one or more attributes includes content information of the external event and time information related to the external event.

21. The method according to claim 20, further comprising: The privacy data input source is determined according to a user's designation.

22. The method according to claim 20, wherein: The privacy data input source includes at least one of the following: Private data in the input parameters of the application; Private data in files that the application will read during operation; and The application will obtain private data from the network during operation.

23. The method according to claim 20, wherein: The external event includes at least one of the following: Requests and / or responses to access outside of the trusted execution environment; Transmit data over a network; and Read and write files.

24. The method according to claim 23, wherein: The request and / or response outside the trusted execution environment includes HTTP-based request and / or response.

25. The method of claim 20, further comprising: Generate test cases through fuzz testing technology.

26. The method of claim 20, further comprising: Information about external events of the application in each test case is recorded by inserting stubs in the code of the application.

27. The method of claim 20, further comprising: The degree of association between private data input and external events is calculated by calculating the mutual information between the private data input and the external events.

28. The method according to claim 27, wherein: The mutual information between the private data input x and the external event y is calculated according to the following formula : ,in, Vx is the value range of the private data input x, Vy is the value range of the external event y, is the information entropy of the private data input x, is the conditional entropy of the private data input x under the condition of a given external event y, and is calculated according to the following formulas: ， ， Where P(•) represents the probability function.

29. The method of claim 27, further comprising: In response to the mutual information between the private data input and the external event being greater than a threshold, it is determined that there is a possibility that the private data input is leaked through the external event.

30. The method of claim 20, further comprising: In response to determining that there is a possibility that the private data input is leaked through an external event, a detection report of the private data leakage is output.

31. The method of claim 20, wherein: The trusted execution environment is implemented in an on-chain node device in a blockchain network, and the application is a smart contract to be deployed in the blockchain network.

32. The method of claim 20, wherein: The trusted execution environment is implemented in an off-chain node device outside the blockchain network. The off-chain node device is configured to respond to a request from the blockchain network, perform privacy computing in the trusted execution environment, and return the computing results to the blockchain network.

33. The method of claim 20, further comprising: In response to determining that there is no possibility of leakage of private data input through external events, the node device where the trusted execution environment is located performs a remote attestation process to prove to the client that the node device is a trusted node; The node device receives a transaction request for deploying the application from a client, stores and deploys the application, and returns a hash value of the application to the client.

34. A non-transitory computer-readable storage medium having a series of computer-executable instructions stored thereon, which, when executed by one or more computing devices, causes the one or more computing devices to perform the method as described in any one of claims 1 to 33.

35. A computing device comprising one or more processors and one or more memories, the one or more memories being configured to store a series of computer-executable instructions, wherein: The series of computer executable instructions, when executed by the one or more processors, causes the one or more processors to perform the method of any one of claims 1 to 33.

Images