A configuration method and apparatus

Abstract

The application provides a configuration method and device, the method comprises: a configuration method, comprising: obtaining description information of an application program, determining at least the type, dependent resource information, first configuration information and writable path information of the application program based on the description information; determining second configuration information based on the type, dependent resource information, first configuration information and writable path information of the application program; configuring the configuration item of the library file system associated with the privacy computing function based on the second configuration information, so that the configured library file system at least prepares the dependent resource, the configuration resource and the permission of the directory corresponding to the application writable path for the application program, and obtains a secure memory area, loads the application program into the secure memory area, so that the application program is configured based on the configuration resource and runs based on the dependent resource after the configuration.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a configuration method and apparatus. Background Technology

[0002] Currently, electronic devices can build a trusted and secure environment in specific hardware environments such as memory based on software protection extension technologies related to privacy computing (such as SGX (SoftwareGuard Extension)), enabling applications to run in a trusted and secure environment.

[0003] Applications can run directly in the built trusted and secure environment without modification, based on a library file system (such as Libos, a library operating system) associated with the privacy computing function. Currently, the library file system requires manual configuration by the user to support applications running directly in the trusted and secure environment without modification; however, the configuration process is cumbersome, time-consuming, and results in a poor user experience. Summary of the Invention

[0004] This application provides the following technical solution:

[0005] This application provides a configuration method, including:

[0006] Obtain the application's description information, and based on the description information, determine at least the application's type, dependent resource information, first configuration information, and writable path information;

[0007] The second configuration information is determined based on the application type, dependent resource information, first configuration information, and writable path information.

[0008] Based on the second configuration information, the configuration items of the library file system associated with the privacy computing function are configured so that the configured library file system at least prepares dependent resources, configuration resources and requests permissions for the directory corresponding to the writable path for the application, and obtains a secure memory area. The application is loaded into the secure memory area so that the application is configured based on the configuration resources and runs based on the dependent resources after configuration.

[0009] The method further includes:

[0010] The application's computing resource information and call entry information are determined based on the description information;

[0011] Based on the computing resource information and the call entry information, update the second configuration information;

[0012] Based on the second configuration information, configure the configuration items of the library file system associated with the privacy computing function, so that the configured library file system at least prepares dependent resources, configuration resources, and requests permissions for the directories corresponding to writable paths for the application, and obtains a secure memory area. Load the application into the secure memory area so that the application is configured based on the configuration resources and runs based on the dependent resources after configuration, including:

[0013] Based on the updated second configuration information, configure the configuration items of the library file system associated with the privacy computing function so that the configured library file system can obtain the application's dependent resources and configuration resources.

[0014] Generate an image file, the image file including the configured library file system, the application, the application's dependent resources, configuration resources, and call entry information;

[0015] Based on the configured library file system, a secure memory region corresponding to the computing resource information is obtained. A container is started in the secure memory region based on the image file, so that the container starts the application and the library file system, so that the library file system controls the application to be configured in the container based on the configured resources, and runs based on the dependent resources after configuration.

[0016] Generate an image file, which includes the configured library file system, the application, the application's dependent resources, configuration resources, and call entry information, including:

[0017] In the case of the first type, the configured library file system creates the root file system of the application and writes the dependent resources, the configuration resources and the call entry information into the root file system of the application.

[0018] Generate an image file, which includes the configured library file system, the application, and the directories of the root file system.

[0019] Generate an image file, which includes the configured library file system, the application, the application's dependent resources, configuration resources, and call entry information, including:

[0020] In the case of the second type, the configured library file system requests usage permissions for the dependent resources and the configuration resources, and obtains the access paths for the dependent resources and the configuration resources after obtaining the usage permissions;

[0021] Generate an image file, which includes the configured library file system, the application, the dependent resources, the access paths of the configuration resources, and the call entry information of the application.

[0022] Based on the description information, at least the application's dependent resource information is determined, including:

[0023] Based on the type of the application, determine the first type of dependent resource information;

[0024] Based on the personalized configuration parameters in the description information, the second type of dependent resource information is determined.

[0025] Loading the application into a secure memory region includes:

[0026] Once it is determined that the application type supports direct execution by the operating system, the application is loaded into the secure memory region.

[0027] Loading the application into a secure memory region includes:

[0028] If the application is determined to be of a type that does not support direct execution by the operating system, the interpreter corresponding to the application is obtained, and the application and the interpreter are loaded into the secure memory area so that the interpreter can interpret the application to obtain the interpreted application.

[0029] Determining the application's computing resource information based on the description information includes:

[0030] Based on the described information, multiple computing resource parameters are obtained;

[0031] A first combination of computing resource parameters is determined from the plurality of computing resource parameters to satisfy the performance threshold for running the application.

[0032] Determining the application's computing resource information based on the description information includes:

[0033] The historical computing resource parameter combination corresponding to the description information is obtained from multiple historical computing resource parameter combinations, which are determined in advance by testing the application.

[0034] This application also provides a configuration device, including:

[0035] The first determining module is used to obtain the application's description information and, based on the description information, at least determine the application's type, dependent resource information, first configuration information, and writable path information;

[0036] The second determining module is used to determine the second configuration information based on the type of the application, dependency resource information, first configuration information, and writable path information.

[0037] The configuration module is used to configure configuration items of the library file system associated with the privacy computing function based on the second configuration information, so that the configured library file system at least prepares dependent resources, configuration resources and requests permissions for the directory corresponding to the writable path for the application, and obtains a secure memory area, loads the application into the secure memory area, so that the application runs based on the dependent resources.

[0038] In this application, by obtaining the application's description information, at least the application type, dependent resource information, first configuration information, and writable path information are determined based on the description information. Second configuration information is then determined based on the application type, dependent resource information, first configuration information, and writable path information. Based on the second configuration information, configuration items of the library file system associated with the privacy computing function are configured, thereby realizing automatic configuration of the library file system based on the application's description information and improving the user experience. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart illustrating an embodiment 1 of an information processing method provided in this application;

[0041] Figure 2 This is a flowchart illustrating an embodiment 2 of the information processing method provided in this application;

[0042] Figure 3 This is a schematic diagram illustrating an implementation scenario of an information processing method provided in this application;

[0043] Figure 4 This is a schematic diagram of the structure of an electronic device provided in this application. Detailed Implementation

[0044] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0045] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0046] Reference Figure 1 This is a flowchart illustrating a configuration method provided in Embodiment 1 of this application. This method can be applied to electronic devices. This application does not limit the product type of the electronic device, such as... Figure 1 As shown, the method may include, but is not limited to, the following steps:

[0047] Step S101: Obtain the application's description information, and based on the description information, determine at least the application's type, dependent resource information, first configuration information, and writable path information.

[0048] In this embodiment, the application description information may be, but is not limited to, pre-stored in a designated storage area of ​​the electronic device. When the application description information is stored in the designated storage area of ​​the electronic device, the electronic device may, but is not limited to, retrieve the application description information from the designated storage area when the device is powered on.

[0049] Of course, if the user determines that the application needs to run in a secure environment, the user can input the basic description information of the application into the electronic device, and the electronic device can then obtain the input basic description information of the application.

[0050] The application's description information may include at least: a first description related to the application's type, a second description related to user-defined dependent resources, a third description related to the application's first configuration, and a fourth description related to the application's writable path. The second description information may include, but is not limited to, personalized configuration parameters. Accordingly, this step may include, but is not limited to:

[0051] S1011. Based on the first description information, determine the type of the application.

[0052] S1012. Based on the type of application, determine the first type of dependent resource information.

[0053] S1013. Based on the first type of dependency resource information, obtain the dependency resources set by the application.

[0054] The second descriptive information may include, but is not limited to, personalized configuration parameters. Based on these personalized configuration parameters, the second type of dependency resource information can be determined. Based on this second type of dependency resource information, user-defined dependency resources can be obtained.

[0055] S1014. Combine the first type of dependent resource information and the second type of dependent resource information into dependent resource information.

[0056] Dependency resource information may include, but is not limited to: dynamic library path information, related functional module directories, and runtime read-only file directories. Based on dynamic library path information, dynamic libraries can be obtained; based on related functional module directories, related functional modules (e.g., the formula function module usable by Word) can be obtained; based on runtime read-only file directories, other runtime read-only files can be obtained.

[0057] Dependency resource information may also include: resource information related to remote verification. Based on the resource information related to remote verification, the resources related to remote verification can be obtained.

[0058] S1015. Based on the third description information, determine the first configuration information of the application.

[0059] The first configuration information can be used to obtain the application's configuration resources. These resources may include, but are not limited to, configuration files, parameter files, and a list of input files. The configuration file is used to configure the application to use corresponding functions; the parameter file provides the parameters required for the application to run (e.g., command-line arguments and security-related parameters such as ASLR); the list of input files may include at least one input file, which can be understood as a file loaded only when the application needs it, such as an electronic certificate containing the application's key and identity information. Configuration resources may also include, but are not limited to, environment variables.

[0060] S1016. Based on the fourth description information, determine the writable path information of the application.

[0061] Based on the writable path information, the writable path can be obtained. The application can then write information to the corresponding directory based on the writable path.

[0062] In this embodiment, the application description information may further include: fifth description information related to whether the application supports software protection extension technology and sixth description information related to the library file system types supported by the application (e.g., Gramine, Mystikos, and Occlum). Accordingly, based on steps S1011-S1016, the following steps may also be included:

[0063] S1017. Based on the fifth description information, determine whether the application supports software protection extension technology.

[0064] If so, proceed to step S1018.

[0065] S1018. Based on the sixth description information, determine the library file system type supported by the application.

[0066] Step S102: Determine the second configuration information based on the application type, dependent resource information, first configuration information, and writable path information.

[0067] The second configuration information can be used to configure configuration items for the library file system associated with the privacy computing function.

[0068] In the implementation corresponding to steps S1011-1016, the second configuration information is determined based on the application type, dependency resource information, first configuration information, and writable path information, and may include, but is not limited to:

[0069] S1021. Based on the type of application, determine whether it is necessary to obtain the subroutines related to the application.

[0070] An application needs to rely on its associated subroutines to run; that is, the application starts running based on the subroutines.

[0071] If yes, proceed to step S1022; otherwise, proceed to step S1024.

[0072] S1022. Based on the type of application, obtain the directory of subroutines related to the application.

[0073] Subroutines associated with an application can be obtained from a directory of application-related subroutines.

[0074] S1023. The application type, dependent resource information, first configuration information, writable path information, and information of subroutines related to the application are combined to form second configuration information.

[0075] S1024. The application type, dependent resource information, first configuration information and writable path information are combined to form second configuration information.

[0076] In the implementation corresponding to steps S1011-S1018, the second configuration information is determined based on the application type, dependent resource information, first configuration information, and writable path information, and may include, but is not limited to:

[0077] S1025. Based on the type of application, determine whether it is necessary to obtain the application-related subroutines.

[0078] If yes, proceed to step S1026; otherwise, proceed to step S1028.

[0079] S1026. Based on the type of application, obtain the directory of subroutines related to the application.

[0080] For a detailed explanation of steps S1025-S1026, please refer to the relevant descriptions of steps S1021-S1022, which will not be repeated here.

[0081] S1027. The application type, dependent resource information, first configuration information, writable path information, and information of subroutines related to the application are combined to form second configuration information corresponding to the library file system type supported by the application.

[0082] S1028. The application type, dependency resource information, first configuration information, and writable path information are combined to form second configuration information corresponding to the library file system type supported by the application.

[0083] Step S103: Based on the second configuration information, configure the configuration items of the library file system associated with the privacy computing function so that the configured library file system at least prepares the dependent resources, configuration resources and requests the permissions of the directory corresponding to the writable path for the application, and obtains the secure memory area. Load the application into the secure memory area so that the application is configured based on the configuration resources and runs based on the dependent resources after configuration.

[0084] In this embodiment, the configuration items of the library file system associated with the privacy computing function may include, but are not limited to, a mount list, a read-only file list, and a writable file list. Correspondingly, based on the second configuration information, configuring the configuration items of the library file system associated with the privacy computing function may include, but are not limited to, the following:

[0085] The dependency resource information (e.g., dynamic library path information, related module directories, and runtime read-only file directories) in the second configuration information is configured into the mount list, the first configuration information is written to the read-only file list, and the writable path information is configured into the writable file list. If the second configuration information also includes directories of application-related subroutines, the directories of application-related subroutines can also be configured into the mount list.

[0086] The library file system can be configured based on the configured mount list, read-only file list, and writable file list. The configured library file system can at least prepare dependent resources and configuration resources for the application, request permissions for the directories corresponding to the writable paths, and obtain a safe memory area. The application is then loaded into the safe memory area so that it can be configured based on the configuration resources, run based on the dependent resources after configuration, and write information to the directories corresponding to the writable paths when writing information is required.

[0087] If the configured mount list also includes directories of application-related subroutines, the configured library file system can also prepare application-related subroutines for the application.

[0088] Preparing dependent resources for an application may include, but is not limited to, obtaining dynamic libraries, related modules, and runtime read-only files based on dynamic library path information, related module directories, and runtime read-only file directories, and storing the dynamic libraries, related modules, and runtime read-only files on an electronic device.

[0089] When dynamic libraries, related modules, and runtime read-only files are stored on an electronic device, the application can directly obtain the dynamic libraries, related modules, and runtime read-only files from the electronic device.

[0090] Of course, preparing dependent resources for an application can also include, but is not limited to: requesting access permissions for the dynamic library, related modules, and runtime read-only files based on the dynamic library path information, related module directories, and runtime read-only file directories.

[0091] Having applied for permissions to use dynamic libraries, related modules, and runtime read-only files, the application has the authority to access dynamic libraries, related modules, and runtime read-only files.

[0092] Preparing application-related subroutines for an application may include, but is not limited to: obtaining application-related subroutines based on a directory of application-related subroutines, storing the subroutines on an electronic device; or, requesting usage rights for the subroutines based on a directory of application-related subroutines.

[0093] When a subroutine is stored on an electronic device, the application can directly retrieve the subroutine from the electronic device; if permission to use the subroutine has been requested, the application has the authority to retrieve the subroutine, and the application retrieves the subroutine.

[0094] In this embodiment, loading the application into the secure memory region may include, but is not limited to:

[0095] Once the application type is determined to be one that supports direct execution by the operating system, the application is loaded into a safe memory region.

[0096] Once the application is loaded into a safe memory region, it can run in that region.

[0097] In this embodiment, loading the application into the safe memory region may include, but is not limited to:

[0098] Once it is determined that the application type does not support direct execution by the operating system, the corresponding interpreter for the application is obtained. The application and the interpreter are loaded into a safe memory area so that the interpreter can interpret the application, resulting in the interpreted application.

[0099] The interpreter interprets the application, and the interpreted application runs in a safe memory area.

[0100] It is understandable that a secure memory region is a memory region built in a specific hardware environment such as memory, based on software protection extension technologies related to privacy computing (such as SGX (Software Guard Extension)).

[0101] Based on the second configuration information, configure the configuration items of the library file system associated with the privacy computing function, so that the configured library file system at least prepares dependent resources, configuration resources, and requests permissions for the directories corresponding to writable paths for the application, and obtains a secure memory area. The application is then loaded into the secure memory area so that the application is configured based on the configuration resources and runs based on the dependent resources after configuration. This may include, but is not limited to:

[0102] The configured library file system prepares dependent resources and configuration resources for applications on electronic devices, requests permissions for directories corresponding to writable paths, and sends a request for a secure memory region to the operating system of the electronic device. The operating system responds to the request for a secure memory region, allocates a secure memory region based on actual needs, and loads the application into the secure memory region so that the application can be configured based on the configuration resources and run based on the dependent resources after configuration.

[0103] In this embodiment, by obtaining the application's description information, at least the application type, dependent resource information, first configuration information, and writable path information are determined based on the description information. Second configuration information is then determined based on the application type, dependent resource information, first configuration information, and writable path information. Based on the second configuration information, configuration items of the library file system associated with the privacy computing function are configured, thereby realizing automatic configuration of the library file system based on the application's description information and improving the user experience.

[0104] As another optional embodiment of this application, refer to Figure 2 This is a flowchart illustrating a configuration method embodiment 2 provided in this application. This embodiment is mainly an extension of the configuration method described in embodiment 1 above. The method may include, but is not limited to, the following steps:

[0105] Step S201: Obtain the application's description information, and based on the description information, determine at least the application's type, dependent resource information, first configuration information, and writable path information.

[0106] Step S202: Determine the second configuration information based on the application type, dependent resource information, first configuration information, and writable path information.

[0107] For a detailed description of steps S201-S202, please refer to the relevant description of steps S101-S102 in Example 1, which will not be repeated here.

[0108] Step S203: Determine the application's computing resource information and call entry information based on the description information.

[0109] In this embodiment, the description information may also include description information related to the application's computing resources and description information related to the application's entry point.

[0110] The computing resources of an application may include, but are not limited to: the memory required by the application, CPU cores, number of threads, stack size, and maximum brk call limit.

[0111] The application can be invoked based on the entry point, allowing the application to run.

[0112] The application's computing resource information can be determined based on the descriptive information related to the application's computing resources.

[0113] Based on the descriptive information related to the application's entry point, the application's entry point information can be determined.

[0114] Specifically, the application's computing resource information is determined based on the descriptive information, including but not limited to:

[0115] S2031. Based on the description information, obtain multiple computing resource parameters.

[0116] In this embodiment, multiple computing resource parameters can be obtained based on the description information related to the computing resources of the application in the description information.

[0117] S2032. Determine a first combination of computing resource parameters from multiple computing resource parameters that meets the performance threshold for running the application.

[0118] Specifically, multiple computing resource parameters can be arbitrarily combined to obtain multiple computing resource parameter combinations. The computing resource parameter combinations are tested based on the parameter tuning algorithm to determine the first computing resource parameter combination that meets the performance threshold for running the application.

[0119] In this embodiment, the determination of the application's computing resource information based on the description information also includes, but is not limited to:

[0120] S2033. Obtain the historical computing resource parameter combination corresponding to the description information from multiple historical computing resource parameter combinations. The historical computing resource parameter combination is determined in advance by testing the application.

[0121] Each historical computing resource parameter combination corresponds to an application. When there is a correspondence between historical computing resource parameter combinations and applications, the historical computing resource parameter combination corresponding to the description information can be obtained from multiple historical computing resource parameter combinations.

[0122] Step S204: Update the second configuration information based on computing resource information and call entry information.

[0123] In an implementation that combines the application type, dependent resource information, first configuration information, writable path information, and information about application-related subroutines into second configuration information, this step may include:

[0124] Based on the computing resource information and the call entry information, the second configuration information is updated so that the updated second configuration information includes: the application type, dependent resource information, first configuration information, writable path information, information of subroutines related to the application, computing resource information, and call entry information.

[0125] In an implementation that combines the application type, dependency resource information, first configuration information, and writable path information into second configuration information, this step may include:

[0126] Based on the computing resource information and the call entry information, the second configuration information is updated so that the updated second configuration information includes: the application type, dependency resource information, first configuration information, writable path information, computing resource information, and call entry information.

[0127] Step S205: Based on the updated second configuration information, configure the configuration items of the library file system associated with the privacy computing function so that the configured library file system can obtain the application's dependency resources and configuration resources.

[0128] For a detailed explanation of how the configured library file system obtains the application's dependency resources and configuration resources, please refer to the relevant introduction in Example 1 on how the configured library file system prepares dependency resources and configuration resources for the application, which will not be repeated here.

[0129] Step S206: Generate an image file. The image file includes the configured library file system, the application, the application's dependent resources, configuration resources, and call entry information.

[0130] This step may include, but is not limited to:

[0131] S2061. If the configured library file system is of type 1, create the root file system of the application and write the dependent resources, configuration resources and call entry information to the root file system of the application.

[0132] The configured library file system is of type 1, which can at least support the creation of a root file system.

[0133] Write dependent resources, configuration resources, and call entry information to the application's root file system, which may include, but is not limited to:

[0134] S20611. Write the call entry information to the first directory of the application's root file system.

[0135] The first directory may include, but is not limited to, the bin directory of the root file system.

[0136] S20612. Write the configuration resources to the second directory of the application's root file system.

[0137] S20613. Write the dependent resources to the third directory of the application's root file system.

[0138] S2062. Generate an image file, which includes the configured library file system, application, and root file system directories.

[0139] By creating a root file system, there is no need to worry about whether the application can write data to a specific directory.

[0140] Of course, this step may include, but is not limited to:

[0141] S2063. When the configured library file system is of type 2, it requests usage permissions for dependent resources and configuration resources, and obtains access paths for dependent resources and configuration resources after obtaining usage permissions.

[0142] The configured library file system is of type 2 and does not support the creation of a root file system.

[0143] S2064. Generate an image file. The image file includes the configured library file system, application, dependent resources, access paths of configuration resources, and application call entry information.

[0144] Step S207: Based on the configured library file system, obtain a safe memory area corresponding to the computing resource information. Start a container based on the image file in the safe memory area so that the container starts the application and the library file system. This allows the library file system to control the application to be configured in the container based on the configured resources and run based on the dependent resources after configuration.

[0145] This step may include, but is not limited to:

[0146] Based on a container cluster management system (such as Kubernetes), the system calls the functions of the configured library file system to obtain a safe memory region corresponding to the memory required by the application in the computing resource information. In the safe memory region, the container is started based on the image file, so that the container starts the library file system and starts the application based on the call entry information. This allows the started library file system to control the application to be configured in the container based on the configured resources, and then run based on the dependent resources after configuration.

[0147] In this embodiment, based on the container cluster management system, the functions of the configured library file system can also be called to obtain the corresponding number of CPU cores and threads, set the corresponding stack size and brk call maximum value, and provide computing support for the container.

[0148] Steps S205-S207 are a specific implementation of step S103 in Example 1.

[0149] In this embodiment, by obtaining the application's description information, at least the application type, dependent resource information, first configuration information, and writable path information are determined based on the description information. Second configuration information is determined based on the application type, dependent resource information, first configuration information, and writable path information. The application's computing resource information and call entry information are determined based on the description information. The second configuration information is updated based on the computing resource information and call entry information. Based on the updated second configuration information, configuration items of the library file system associated with the privacy computing function are configured. This enables automatic configuration of the library file system based on the application's description information, allowing the configured library file system to be applied in containers and improving the user experience.

[0150] Furthermore, the configuration of the library file system controls the application's configuration within the container, enabling automatic configuration and execution of the application within the container.

[0151] The following section describes a configuration device provided in this application. The configuration device described below can be referred to in correspondence with the configuration method described above.

[0152] Please see Figure 3The configuration device includes: a first determining module 100, a second determining module 200, and a configuration module 300.

[0153] The first determining module 100 is used to obtain the application's description information and, based on the description information, determine at least the application's type, dependent resource information, first configuration information, and writable path information;

[0154] The second determining module 200 is used to determine the second configuration information based on the application type, dependency resource information, first configuration information and writable path information.

[0155] The configuration module 300 is used to configure configuration items of the library file system associated with the privacy computing function based on the second configuration information, so that the configured library file system at least prepares dependent resources, configures resources and requests permissions for the directories corresponding to the writable paths for the application, and obtains a secure memory area, loads the application into the secure memory area, so that the application runs based on the dependent resources.

[0156] In this embodiment, the configuration device may further include:

[0157] The third determination module is used to determine the application's computing resource information and call entry information based on the description information;

[0158] The update module is used to update the second configuration information based on the computing resource information and the call entry information;

[0159] Accordingly, the configuration module 300 can be specifically used for:

[0160] Based on the updated second configuration information, configure the configuration items of the library file system associated with the privacy computing function so that the configured library file system can obtain the application's dependent resources and configuration resources.

[0161] Generate an image file, which includes the configured library file system, the application, the application's dependent resources, configuration resources, and call entry information;

[0162] Based on the configured library file system, a safe memory region corresponding to the computing resource information is obtained. A container is started in the safe memory region based on the image file, so that the container starts the application and the library file system, so that the library file system controls the application to be configured in the container based on the configured resources, and runs based on the dependent resources after configuration.

[0163] In this embodiment, the process by which the configuration module 300 generates an image file, which includes the configured library file system, application, application's dependent resources, configuration resources, and call entry information, may include:

[0164] In the case of the first type, the configured library file system creates the root file system of the application and writes the dependent resources, configuration resources and call entry information to the root file system of the application.

[0165] Generate an image file, which includes the configured library file system, application, and root file system directories.

[0166] In this embodiment, the process by which the configuration module 300 generates an image file, which includes the configured library file system, application, application's dependent resources, configuration resources, and call entry information, may include:

[0167] In the case of the second type, the configured library file system requests usage permissions for dependent resources and configuration resources, and obtains access paths for dependent resources and configuration resources after obtaining usage permissions;

[0168] Generate an image file, which includes the configured library file system, application, dependent resources, access paths to configuration resources, and application call entry information.

[0169] In this embodiment, the process by which the first determining module 100 determines at least the application's dependent resource information based on the description information may include:

[0170] Based on the type of application, determine the first type of dependent resource information;

[0171] Based on the personalized configuration parameters in the description information, the second type of dependent resource information is determined.

[0172] In this embodiment, loading the application into the secure memory region may include:

[0173] Once the application type is determined to be one that supports direct execution by the operating system, the application is loaded into a safe memory region.

[0174] In this embodiment, loading the application into the secure memory region may include:

[0175] Once it is determined that the application type does not support direct execution by the operating system, the corresponding interpreter for the application is obtained. The application and the interpreter are loaded into a safe memory area so that the interpreter can interpret the application, resulting in the interpreted application.

[0176] In this embodiment, the process by which the third determining module determines the application's computing resource information based on the description information may include:

[0177] Based on the described information, multiple computing resource parameters are obtained;

[0178] A first combination of computing resource parameters is determined from multiple computing resource parameters to meet the performance threshold for running the application.

[0179] In this embodiment, the process by which the third determining module determines the application's computing resource information based on the description information may include:

[0180] The historical computing resource parameter combination corresponding to the description information is obtained from multiple historical computing resource parameter combinations, which are determined in advance by testing the application.

[0181] Corresponding to the configuration method embodiment provided in this application above, this application also provides an electronic device embodiment in which the configuration method is applied.

[0182] like Figure 4 The diagram shown is a structural schematic of an electronic device according to embodiment 1 of this application. The electronic device may include the following structure:

[0183] Memory 10 and processor 20.

[0184] Memory 10 is used to store at least one set of instructions;

[0185] Processor 20 is configured to call and execute the instruction set in memory 100, and execute the configuration method as described in any one of the above method embodiments 1-2 by executing the instruction set.

[0186] Corresponding to the configuration method embodiment provided in this application above, this application also provides an embodiment of a storage medium.

[0187] In this embodiment, the storage medium stores a computer program that implements the configuration method as described in Method Embodiment 1 or 2. The computer program is executed by a processor to implement the configuration method as described in Embodiment 1 or 2.

[0188] It should be noted that each embodiment focuses on describing the differences from other embodiments, and the same or similar parts between the embodiments can be referred to accordingly. For the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments.

[0189] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0190] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.

[0191] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0192] The configuration method and apparatus provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A configuration method, comprising: Obtain the application's description information, and based on the description information, determine at least the application's type, dependent resource information, first configuration information, and writable path information; The second configuration information is determined based on the application type, dependent resource information, first configuration information, and writable path information. Based on the second configuration information, the configuration items of the library file system associated with the privacy computing function are configured so that the configured library file system at least prepares dependent resources, configuration resources and requests permissions for the directory corresponding to the writable path for the application, and obtains a secure memory area. The application is loaded into the secure memory area so that the application is configured based on the configuration resources and runs based on the dependent resources after configuration.

2. The method according to claim 1, further comprising: The application's computing resource information and call entry information are determined based on the description information; Based on the computing resource information and the call entry information, update the second configuration information; Based on the second configuration information, configure the configuration items of the library file system associated with the privacy computing function, so that the configured library file system at least prepares dependent resources, configuration resources, and requests permissions for the directories corresponding to writable paths for the application, and obtains a secure memory area. Load the application into the secure memory area so that the application is configured based on the configuration resources and runs based on the dependent resources after configuration, including: Based on the updated second configuration information, configure the configuration items of the library file system associated with the privacy computing function so that the configured library file system can obtain the application's dependent resources and configuration resources. Generate an image file, the image file including the configured library file system, the application, the application's dependent resources, configuration resources, and call entry information; Based on the configured library file system, a secure memory region corresponding to the computing resource information is obtained. A container is started in the secure memory region based on the image file, so that the container starts the application and the library file system, so that the library file system controls the application to be configured in the container based on the configured resources, and runs based on the dependent resources after configuration.

3. The method according to claim 2, generating an image file, the image file including the configured library file system, the application, the application's dependent resources, configuration resources, and call entry information, including: In the case of the first type, the configured library file system creates the root file system of the application and writes the dependent resources, the configuration resources and the call entry information into the root file system of the application. Generate an image file, which includes the configured library file system, the application, and the directories of the root file system.

4. The method according to claim 2, generating an image file, the image file including the configured library file system, the application, the application's dependent resources, configuration resources, and call entry information, including: In the case of the second type, the configured library file system requests usage permissions for the dependent resources and the configuration resources, and obtains the access paths for the dependent resources and the configuration resources after obtaining the usage permissions; Generate an image file, which includes the configured library file system, the application, the dependent resources, the access paths of the configuration resources, and the call entry information of the application.

5. The method according to claim 1, wherein at least the application's dependent resource information is determined based on the description information, comprising: Based on the type of the application, determine the first type of dependent resource information; Based on the personalized configuration parameters in the description information, the second type of dependent resource information is determined.

6. The method according to claim 1, wherein loading the application into a secure memory region comprises: Once it is determined that the application type supports direct execution by the operating system, the application is loaded into the secure memory region.

7. The method according to claim 1, wherein loading the application into a secure memory region comprises: If the application is determined to be of a type that does not support direct execution by the operating system, the interpreter corresponding to the application is obtained, and the application and the interpreter are loaded into the secure memory area so that the interpreter can interpret the application to obtain the interpreted application.

8. The method according to claim 2, wherein determining the computing resource information of the application based on the description information includes: Based on the described information, multiple computing resource parameters are obtained; A first combination of computing resource parameters is determined from the plurality of computing resource parameters to satisfy the performance threshold for running the application.

9. The method according to claim 2, wherein determining the computing resource information of the application based on the description information includes: The historical computing resource parameter combination corresponding to the description information is obtained from multiple historical computing resource parameter combinations, which are determined in advance by testing the application.

10. A configuration device, comprising: The first determining module is used to obtain the application's description information and, based on the description information, at least determine the application's type, dependent resource information, first configuration information, and writable path information; The second determining module is used to determine the second configuration information based on the type of the application, dependency resource information, first configuration information, and writable path information. The configuration module is used to configure configuration items of the library file system associated with the privacy computing function based on the second configuration information, so that the configured library file system at least prepares dependent resources, configuration resources and requests permissions for the directory corresponding to the writable path for the application, and obtains a secure memory area, loads the application into the secure memory area, so that the application runs based on the dependent resources.

Images