Application execution method, apparatus, device, and storage medium

Abstract

This application relates to an application execution method, apparatus, device, and storage medium, and pertains to the field of information security. Specifically, it provides an application execution method in which a server and a client cooperate to execute the application, wherein the server is equipped with software protection extensions. This application execution method applied to a server includes: receiving an application to be executed sent by the client; relocating the entry address in the application to be executed to generate a target application, wherein the target application can run on the server; running the target application and generating a calculation result; and sending the calculation result to the client. This application aims to solve the problem that SGX applications cannot simultaneously guarantee high development efficiency and security.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to an application execution method, apparatus, device, and storage medium. Background Technology

[0002] SGX (Software Guard Extension) relies on hardware isolation technology, which places higher demands on application development and requires manually dividing the application into trust and untrust components. Therefore, developing a completely new SGX application is extremely costly.

[0003] Furthermore, for some library operating systems like Graphene (LibOS), applications can run unmodified within the enclave, which is a more developer- and user-friendly approach. Since SGX itself cannot perform tasks that an operating system (OS) can truly handle, such as file read / write, network input / output, and memory management requests, LibOS must forward these POSIX (Portable Operating System Interface) requests from applications to the underlying OS. Given the existence of Iago interface attacks, LibOS must implement a Shim layer. However, the POSIX interfaces are numerous and highly complex, making it difficult to guarantee the completeness of LibOS Shim verification. Summary of the Invention

[0004] This application provides an application execution method, apparatus, device, and storage medium to solve the problem that SGX applications cannot simultaneously guarantee high development efficiency and security.

[0005] In a first aspect, embodiments of this application provide an application execution method applied to a server, wherein the server is equipped with a software protection extension, and the application execution method includes:

[0006] Receive the application to be executed sent by the client;

[0007] Relocate the entry address in the application to be executed to generate the target application, wherein the target application is capable of running on the server;

[0008] Run the target application and generate the calculation results;

[0009] The calculation result is sent to the client.

[0010] Optionally, after receiving the application to be executed sent by the client and before relocating the entry address in the application to be executed, the method further includes:

[0011] The server generates a software protection extension report using its hardware. The software protection extension report includes at least one of the following: the server's developer information and summary information of the services called by the application to be executed.

[0012] The Software Protection Extension Report is sent to the client so that the client can verify that the Software Protection Extension Report is valid.

[0013] Optionally, before sending the software protection extension report to the client, the method further includes:

[0014] Shared information is generated by using a key negotiation algorithm on the negotiated public key;

[0015] Attach the shared information to the software protection extension report;

[0016] After attaching the shared information to the software protection extension report, the method further includes:

[0017] Receive the signer's private key sent by the client;

[0018] A digital signature is generated by using a signature algorithm on the signer's private key and the computation result, and then the digital signature is sent to the client.

[0019] Secondly, embodiments of this application provide an application execution method, applied to a client, comprising:

[0020] Get the application to be executed;

[0021] The application to be executed is sent to the server, wherein the server is equipped with a software protection extension;

[0022] Receive the calculation results for the application to be executed sent by the server.

[0023] Optionally, after sending the application to be executed to the server and before receiving the calculation result for the application to be executed sent by the server, the method further includes:

[0024] The system receives a software protection extension report sent by the server, the software protection extension report including at least one of the server's developer information and summary information of the services called by the application to be executed;

[0025] Verify that the software protection extension report is valid.

[0026] Optionally, after verifying that the software protection extension report is valid, the method further includes:

[0027] Obtain the shared information carried in the software protection extension report;

[0028] Based on the shared information, an encrypted connection is established between the signer and the server, and the signer's private key is sent to the server.

[0029] Receive the digital signature sent by the server;

[0030] The digital signature is verified based on the digital signature, the calculation result, and the public key corresponding to the signer's private key;

[0031] If the digital signature is successfully verified, the calculation result is stored.

[0032] Thirdly, embodiments of this application provide an application execution device configured on a server, wherein the server is provided with a software protection extension, and the application execution device includes:

[0033] The first receiving module is used to receive the application to be executed sent by the client;

[0034] A relocation module is used to relocate the entry address in the application to be executed and generate a target application, wherein the target application can run on the server;

[0035] The execution module is used to run the target application and generate the calculation results;

[0036] The first sending module is used to send the calculation result to the client.

[0037] Fourthly, embodiments of this application provide an application execution device configured on a client, including:

[0038] The acquisition module is used to acquire the application to be executed;

[0039] The second sending module is used to send the application to be executed to the server, wherein the server is equipped with a software protection extension;

[0040] The second receiving module is used to receive the calculation results for the application to be executed sent by the server.

[0041] Fifthly, embodiments of this application provide an electronic device, including: a processor, a memory, and a communication bus, wherein the processor and the memory communicate with each other via the communication bus;

[0042] The memory is used to store computer programs;

[0043] The processor is configured to execute the program stored in the memory to implement the application execution method described in the first aspect, or to implement the application execution method described in the second aspect.

[0044] Sixthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the application execution method described in the first aspect, or implements the application execution method described in the second aspect.

[0045] Compared with the prior art, the technical solution provided in this application has the following advantages: In this application embodiment, the client obtains the application to be executed and sends it to the server. The server is equipped with a software protection extension. After receiving the application to be executed from the client, the server relocates the entry address in the application to be executed and generates the target application. The target application can run on the server, generate calculation results, and send the calculation results to the client. Users do not need to manually divide the application into trusted and untrusted parts, nor do they need to implement a Shim layer to verify its completeness like LibOS. The client can directly send the application to be executed to the server, and the server will relocate the entry address in the application to be executed and generate the target application. Since the server is equipped with a software protection extension, the security of the target application can be ensured. The client only needs to send the application to be executed to the server and receive the calculation results sent by the server. The specific calculation process is implemented inside the server, which solves the problem that SGX applications cannot simultaneously guarantee high development efficiency and security. Attached Figure Description

[0046] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a schematic diagram of the method flow for executing an application on a server, as described in this application embodiment;

[0049] Figure 2 This is a schematic diagram of the method flow for executing an application applied to a client in an embodiment of this application;

[0050] Figure 3 This is a schematic diagram of the method flow for application execution in an embodiment of this application;

[0051] Figure 4 This is a schematic diagram of the method flow for application execution in a specific embodiment of this application;

[0052] Figure 5 This is a schematic diagram of the application execution system architecture in the embodiments of this application;

[0053] Figure 6 This is a schematic diagram of the architecture of an application execution system in a specific embodiment of this application;

[0054] Figure 7 This is a schematic diagram of the structure of the application execution device configured on the server in the embodiments of this application;

[0055] Figure 8 This is a schematic diagram of the structure of the application execution device configured on the client in the embodiments of this application;

[0056] Figure 9 This is a schematic diagram of the structure of the electronic device in the embodiments of this application. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0058] In this embodiment of the application, an application execution method is provided, in which the server and the client cooperate to execute the application. The server is equipped with a software protection extension. The process of application execution is explained from the perspectives of the server and the client respectively.

[0059] In the embodiments of this application, such as Figure 1 As shown, the execution method flow of an application applied to a server mainly includes:

[0060] Step 101: Receive the application to be executed sent by the client.

[0061] The application to be executed is trusted and can be relocated. Users only need to write the core trusted part of the application and send it to the server via the client. The untrusted parts of the application, such as helper modules and system call modules, do not need to be developed by the user; they are provided by the server. Users do not need to manually divide the application into trusted and untrusted parts, nor do they need to implement a Shim layer to verify its completeness like LibOS.

[0062] Step 102: Relocate the entry address in the application to be executed and generate the target application, which can run on the server.

[0063] The entry address in the application to be executed is relocated, and the target application is generated, enabling the target application to run in the trusted execution environment formed by the software protection extension on the server, thus ensuring the security of the target application.

[0064] Step 103: Run the target application and generate the calculation results.

[0065] Step 104: Send the calculation result to the client.

[0066] In one specific embodiment, after receiving the application to be executed sent by the client and before relocating the entry address in the application to be executed, the application execution method applied to the server further includes: generating a software protection extension report through the server's hardware, the software protection extension report including at least one of the server's developer information and summary information of the services called by the application to be executed; sending the software protection extension report to the client to verify that the software protection extension report is valid through the client.

[0067] By sending a Software Protection Extensions report to the client and having the client verify the report's validity, the server's trustworthiness can be ensured. This added verification further guarantees the security of the application to be executed while running on the server.

[0068] In one specific embodiment, before sending the Software Protection Extension Report to the client, the application execution method applied to the server further includes: generating shared information by using a key negotiation algorithm on the negotiated public key; and appending the shared information to the Software Protection Extension Report. After appending the shared information to the Software Protection Extension Report, the application execution method applied to the server further includes: receiving the signer's private key sent by the client; generating a digital signature by using a signature algorithm on the signer's private key and the calculation result; and sending the digital signature to the client.

[0069] In this algorithm, the key exchange algorithm can be ECDHE (Elliptic Curve Key Exchange) or other algorithms. Shared information can be represented by `share`. The signer's private key is represented by `d`. The result of the operation is represented by `M`, which is also the message to be signed. The signature algorithm can be ECDSA (Elliptic Curve Digital Signature Algorithm) or other algorithms. `H()` represents the cryptographic hash function of the message digest. Generating a digital signature by applying the signer's private key and the result of the operation using the signature algorithm is equivalent to signing `H(M)` using the ECDSA algorithm.

[0070] By attaching shared information to the software protection extended report, it is easy to establish an encrypted connection between the client and server to transmit the signer's private key, ensuring the security of the private key transmission process. By using a signature algorithm on the signer's private key and the computation result to generate a digital signature, and sending the digital signature to the client, it can be ensured that the computation result received by the client is the result of the computation of the application to be executed by the client, further ensuring the security of the computation result.

[0071] In the embodiments of this application, such as Figure 2 As shown, the method flow for application execution on the client side mainly includes:

[0072] Step 201: Obtain the application to be executed.

[0073] Step 202: Send the application to be executed to the server, where the server has a software protection extension configured.

[0074] Step 203: Receive the calculation results for the application to be executed sent by the server.

[0075] In one specific embodiment, after sending the application to be executed to the server and before receiving the calculation result for the application to be executed sent by the server, the application execution method applied to the client further includes: receiving a software protection extension report sent by the server, wherein the software protection extension report includes at least one of the server's developer information and summary information of the services called by the application to be executed; and verifying that the software protection extension report is valid.

[0076] The client verifies the validity of the extended software protection report. This can be achieved by verifying that the server's developer information is trustworthy and included in a pre-defined list of developer information, or by verifying that the summary information of the services called by the application to be executed matches the summary information of the services the user needs to call. Verifying the validity of the extended software protection report by the client ensures the server's trustworthiness, and this added verification further guarantees the security of the application running on the server.

[0077] In one specific embodiment, after verifying that the Software Protection Extension Report is valid, the application execution method applied to the client further includes: obtaining the shared information carried in the Software Protection Extension Report; establishing an encrypted connection with the server based on the shared information and sending the signer's private key to the server; receiving the digital signature sent by the server; verifying the digital signature based on the digital signature, the calculation result, and the public key corresponding to the signer's private key; and storing the calculation result if the digital signature verification is successful.

[0078] The public key corresponding to the signer's private key is represented by Pub. The client verifies the digital signature based on the digital signature, the computation result, and the public key corresponding to the signer's private key. If the digital signature is successfully verified, the computation result is stored. This ensures that the computation result received by the client is the result of the computation sent by the client for execution, further ensuring the security of the computation result.

[0079] In the embodiments of this application, such as Figure 3 As shown, the main steps in the application execution process include:

[0080] Step 301: The client obtains the application to be executed.

[0081] Step 302: The client sends the application to be executed to the server, where the server has a software protection extension configured.

[0082] Step 303: The server receives the application to be executed sent by the client.

[0083] Step 304: The server relocates the entry address in the application to be executed and generates the target application, which can run on the server.

[0084] Step 305: The server runs the target application and generates the calculation results.

[0085] Step 306: The server sends the calculation result to the client.

[0086] Step 307: The client receives the calculation result sent by the server.

[0087] In one specific embodiment, such as Figure 4 As shown, the main steps in the application execution process include:

[0088] Step 401: The client obtains the application to be executed and sends the application to be executed to the server.

[0089] The server is equipped with software protection extensions.

[0090] Step 402: After receiving the application to be executed sent by the client, the server generates a software protection extension report through the server's hardware, generates shared information by using a key negotiation algorithm on the negotiated public key, attaches the shared information to the software protection extension report, and sends the software protection extension report to the client.

[0091] Step 403: The client receives the Software Protection Extension Report sent by the server and verifies that the Software Protection Extension Report is valid.

[0092] Step 404: The client obtains the shared information carried in the software protection extension report, establishes an encrypted connection with the server based on the shared information, and sends the signer's private key to the server.

[0093] Step 405: After receiving the signer's private key sent by the client, the server relocates the entry address in the application to be executed, generates the target application, runs the target application, and generates the calculation result.

[0094] Step 406: The server uses the signature algorithm to generate a digital signature using the signer's private key and the calculation result, and sends the calculation result and digital signature to the client.

[0095] Step 407: The client verifies the digital signature based on the digital signature, the computation result, and the public key corresponding to the signer's private key. If the digital signature is successfully verified, the computation result is stored.

[0096] In summary, in this embodiment, the client obtains the application to be executed and sends it to the server. The server is equipped with a software protection extension. After receiving the application to be executed from the client, the server relocates the entry address of the application to be executed and generates the target application. The target application can run on the server, generate calculation results, and send the calculation results to the client. Users do not need to manually divide the application into trusted and untrusted parts, nor do they need to implement a Shim layer to verify its completeness as required by LibOS. The client can directly send the application to be executed to the server, and the server will relocate the entry address of the application to be executed and generate the target application. Because the server is equipped with a software protection extension, the security of the target application can be ensured. The client only needs to send the application to be executed to the server and receive the calculation results sent by the server. The specific calculation process is implemented internally by the server, which solves the problem that SGX applications cannot simultaneously guarantee high development efficiency and security.

[0097] Based on the same concept, this application provides an application execution system. The specific implementation of this application execution system can be found in the description of the method embodiments section; repeated details will not be repeated. The server is equipped with software protection extensions, such as... Figure 5 As shown, the application execution system mainly includes:

[0098] Server 501 is used to receive the application to be executed sent by the client, relocate the entry address in the application to be executed, generate the target application, wherein the target application can run on the server, run the target application, generate calculation results, and send the calculation results to the client.

[0099] Client 502 is used to obtain the application to be executed, send the application to be executed to the server, and receive the calculation results of the application to be executed sent by the server.

[0100] In one specific embodiment, such as Figure 6 As shown, the application execution system mainly includes server 501 and client 502, and server 501 is equipped with software protection extensions;

[0101] Server 501 includes a first key negotiation module 5011, a dynamic link module 5012, and a signature module 5013;

[0102] The first key negotiation module 5011 is used to generate shared information by using a key negotiation algorithm on the negotiated public key;

[0103] Dynamic link module 5012 is used to relocate the entry address in the application to be executed and generate the target application;

[0104] The signature module 5013 is used to generate a digital signature by using a signature algorithm on the signer's private key and the result of the operation;

[0105] Client 502 includes a second key negotiation module 5021, a remote authentication module 5022, and a signature verification module 5023;

[0106] The remote authentication module 5022 is used to verify that the Software Protection Extensions report sent by the server is valid;

[0107] The second key negotiation module 5021 is used to establish an encrypted connection with the first key negotiation module 5011 of the server based on the shared information, and to send the signer's private key to the server.

[0108] The signature verification module 5023 is used to verify the digital signature based on the digital signature, the calculation result, and the public key corresponding to the signer's private key;

[0109] Server 501 receives the application to be executed sent by the client, generates a software protection extension report through the server's hardware, calls the first key negotiation module 5011, generates shared information by using a key negotiation algorithm on the negotiated public key, appends the shared information to the software protection extension report, and sends the software protection extension report to the client; after receiving the signer's private key sent by the client, it calls the dynamic link module 5012, relocates the entry address in the application to be executed, generates the target application, runs the target application, and generates the calculation result; it calls the signature module 5013, generates a digital signature by using a signature algorithm on the signer's private key and the calculation result, and sends the calculation result and digital signature to the client;

[0110] Client 502 is used to obtain the application to be executed and send it to the server. It receives the Software Protection Extension Report sent by the server, calls the remote authentication module 5022 to verify that the Software Protection Extension Report is valid, obtains the shared information carried in the Software Protection Extension Report, calls the second key negotiation module 5021 to establish an encrypted connection with the server's first key negotiation module 5011 based on the shared information, and sends the signer's private key to the server. It calls the signature verification module 5023 to verify the digital signature based on the digital signature, the calculation result, and the public key corresponding to the signer's private key. If the digital signature verification is successful, the calculation result is stored.

[0111] The first key negotiation module 5011 takes the negotiated public key of the client and the server as input and outputs the shared information "share". Its function is to establish an encrypted connection through the first key negotiation module 5011 and the second key negotiation module 5021.

[0112] The dynamic link module 5012 takes the application to be executed as input, which can be relocated, and outputs the target application, which can run on the server. Its function is to relocate the entry address in the application to be executed, so that the target application can run correctly inside the server.

[0113] The signature module 5013 takes the signer's private key d and the calculation result M as input and outputs a digital signature. Its function is to sign H(M) using the ECDSA algorithm.

[0114] The second key negotiation module 5021 takes the negotiated public key of the client and server as input and outputs the shared information "share". Its function is to establish an encrypted connection between the second key negotiation module 5021 and the first key negotiation module 5011.

[0115] The remote authentication module 5022 takes as input the remote authentication attestation generated by the server hardware and outputs whether the authentication was successful or failed. Its function is to verify the software protection extended report generated by the server hardware through the IAS service (Internet Authentication Service).

[0116] The signature verification module 5023 takes the digital signature, the calculation result M, and the public key Pub corresponding to the signer's private key as input, and outputs whether the verification is successful or unsuccessful. Its function is to verify the digital signature using the ECDSA algorithm.

[0117] Based on the same concept, this application provides an application execution device configured on a server. The server has a software protection extension. Specific implementation details of this device can be found in the method embodiment section; repeated details will not be repeated here. Figure 7 As shown, the device mainly includes:

[0118] The first receiving module 701 is used to receive the application to be executed sent by the client;

[0119] The relocation module 702 is used to relocate the entry address in the application to be executed and generate the target application, wherein the target application can run on the server;

[0120] The execution module 703 is used to run the target application and generate the calculation results;

[0121] The first sending module 704 is used to send the calculation result to the client.

[0122] Based on the same concept, this application provides an application execution device configured on a client. Specific implementation of this device can be found in the description of the method embodiments; repeated details will not be repeated here. Figure 8 As shown, the device mainly includes:

[0123] Module 801 is used to obtain the application to be executed;

[0124] The second sending module 802 is used to send the application to be executed to the server, wherein the server is equipped with a software protection extension;

[0125] The second receiving module 803 is used to receive the calculation results for the application to be executed sent by the server.

[0126] Based on the same concept, this application also provides an electronic device, such as... Figure 9As shown, the electronic device mainly includes a processor 901, a memory 902, and a communication bus 903. The processor 901 and the memory 902 communicate with each other via the communication bus 903. The memory 902 stores programs that can be executed by the processor 901. The processor 901 executes the programs stored in the memory 902 to achieve the following steps:

[0127] Receive the application to be executed sent by the client; relocate the entry address in the application to be executed, generate the target application, wherein the target application can run on the server; run the target application and generate the calculation result; send the calculation result to the client;

[0128] or,

[0129] Obtain the application to be executed; send the application to be executed to the server, where the server has software protection extensions configured; receive the calculation results of the application to be executed sent by the server.

[0130] The communication bus 903 mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus 903 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0131] The memory 902 may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor 901.

[0132] The processor 901 mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc., or a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0133] In another embodiment of this application, a computer-readable storage medium is provided, which stores a computer program that, when run on a computer, causes the computer to execute the application execution method described in the above embodiments.

[0134] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. This computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another, for example, from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape, etc.), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0135] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0136] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. An application program execution method characterized by comprising: The application is applied to a server provided with a software guard extension, and the application execution method comprises the following steps: receiving an application to be executed sent by a client; generating a software guard extension report through hardware of the server, wherein the software guard extension report comprises at least one of developer information of the server and summary information of a service called by the application to be executed; sending the software guard extension report to the client to verify that the software guard extension report is valid; generating shared information by using a key agreement algorithm on a negotiated public key before sending the software guard extension report to the client; attaching the shared information to the software guard extension report; receiving a private key of a signer sent by the client; relocating an entry address in the application to be executed to generate a target application, wherein the target application can run in the server without dividing the application to be executed into a trusted part and an untrusted part during relocation; running the target application to generate a calculation result; generating a digital signature by using a signature algorithm on the private key of the signer and the calculation result; sending the calculation result and the digital signature to the client.

2. An application program execution method characterized by comprising: The application is applied to a client, and the client comprises the following steps: obtaining an application to be executed; sending the application to be executed to a server provided with a software guard extension; receiving a software guard extension report sent by the server, wherein the software guard extension report comprises at least one of developer information of the server and summary information of a service called by the application to be executed; verifying that the software guard extension report is valid; obtaining shared information carried in the software guard extension report; establishing an encrypted connection with the server according to the shared information and sending a private key of a signer to the server; receiving a digital signature sent by the server; receiving a calculation result of the application to be executed sent by the server; verifying the digital signature according to the digital signature, the calculation result and a public key corresponding to the private key of the signer; storing the calculation result when the verification of the digital signature is successful.

3. An application program execution device characterized by comprising: The application is configured in a server provided with a software guard extension, and the application execution device comprises the following steps: a first receiving module for receiving an application to be executed sent by a client; The first processing module is configured to generate a software guard extension report by using hardware of the server, the software guard extension report including at least one of developer information of the server and summary information of a service called by the application to be executed, send the software guard extension report to the client to verify that the software guard extension report is valid by the client, generate shared information by using a key agreement algorithm on a negotiated public key before sending the software guard extension report to the client, attach the shared information to the software guard extension report, and receive a private key of a signer sent by the client. The relocation module is configured to relocate an entry address in the application to be executed to generate a target application, wherein the target application can run in the server and the application to be executed does not need to be divided into a trusted part and an untrusted part during relocation. The running module is configured to run the target application and generate a calculation result. The second processing module is configured to generate a digital signature by using a signature algorithm on the private key of the signer and the calculation result. The first sending module is configured to send the calculation result and the digital signature to the client.

4. An application program execution device characterized by comprising: The client is configured to include: The obtaining module is configured to obtain an application to be executed. The second sending module is configured to send the application to be executed to a server, wherein the server is provided with a software guard extension. The third processing module is configured to receive a software guard extension report sent by the server, the software guard extension report including at least one of developer information of the server and summary information of a service called by the application to be executed, verify that the software guard extension report is valid, obtain shared information carried in the software guard extension report, establish an encrypted connection with the server according to the shared information, send a private key of a signer to the server, and receive a digital signature sent by the server. The second receiving module is configured to receive a calculation result of the application to be executed sent by the server. The fourth processing module is configured to verify the digital signature according to the digital signature, the calculation result, and a public key corresponding to the private key of the signer, and store the calculation result in a case where the verification of the digital signature is successful.

5. An electronic device, comprising: The client includes a processor, a memory, and a communication bus, wherein the processor and the memory complete mutual communication through the communication bus. The memory is configured to store a computer program. The processor is configured to execute the program stored in the memory to implement the application execution method in claim 1 or the application execution method in claim 2. The computer program is executed by the processor to implement the application execution method in claim 1 or the application execution method in claim 2.

6. A computer readable storage medium storing a computer program, characterized in that, ​

Images