Data processing method, host and device

Abstract

This application discloses a method, host, and apparatus for processing data, belonging to the IT field. The host includes a program execution environment and a first isolation environment. The program execution environment is an environment where the host operates in a non-secure mode, and the first isolation environment is an environment where the host operates in a secure mode. The program execution environment includes at least one virtualization instance operating in the non-secure mode, and the first isolation environment corresponds to the virtualization instance in the program execution environment. The first isolation environment includes an operating system in secure mode and resources allocated to it. These resources include a first isolation space and processor resources. The first isolation space is used to run the operating system and a security processing program, and to store data to be processed. The security processing program corresponds to a program in the virtualization instance and is used to process the data to be processed. The first isolation space is isolated from the program execution environment. This application can improve the security of processed data.

Description

[0001] This application is a divisional application. The original application has the application number 202011051770.0 and the original application date is September 29, 2020. The entire contents of the original application are incorporated herein by reference. Technical Field

[0002] This application relates to the field of internet technology (IT), and in particular to a method, host, and apparatus for processing data. Background Technology

[0003] A virtual machine (VM) is a complete computer system simulated by software modules, possessing full hardware system functionality and running in an environment. In other words, a VM can be viewed as a complete computer system that can run programs to process data.

[0004] Currently, certain programs and data require a highly secure operating environment. However, virtual machines are currently used to run programs and process data, but virtual machines cannot provide a highly secure operating environment, which may reduce the security of data processing.

[0005] For example, suppose the program is a money transfer application, and the data to be processed includes the account numbers of the two parties involved in the transfer and the transfer amount. A virtual machine can run this money transfer application and complete the transfer based on the data. However, running this application in a virtual machine to process the data poses a high risk of information leakage and security breaches. Summary of the Invention

[0006] This application provides a method, host, and apparatus for processing data, thereby improving the security of processed data. The technical solution is as follows:

[0007] In a first aspect, this application provides a data processing host, including a program execution environment and a first isolation environment. The program execution environment is an environment in which the host operates in a non-secure mode, and the first isolation environment is an environment in which the host operates in a secure mode. The program execution environment includes at least one virtualization instance operating in a non-secure mode, wherein the first isolation environment corresponds to the virtualization instance in the program execution environment. The first isolation environment includes an operating system in a secure mode and resources allocated to the first isolation environment. These resources include a first isolation space and processor resources. The first isolation space is used to run the operating system and a security processing program, as well as to store data to be processed. The security processing program corresponds to a program in the virtualization instance and is used to process the data to be processed to implement the secure processing function of the program in the virtualization instance. The first isolation space is isolated from the program execution environment.

[0008] Since the host includes a program execution environment and a first isolation environment, the program execution environment includes virtualized instances. The first isolation environment corresponding to these virtualized instances includes an operating system and resources in secure mode. These resources include a first isolation space and processor resources. The first isolation space is used to run the operating system and security processing programs, as well as to process data to be processed. The security processing programs are programs called by the virtualized instances, and the data to be processed is the data required to run the security processing programs. The first isolation space is a space protected by the host in secure mode. Thus, the first isolation environment is a highly secure environment. Running security processing programs and using them to process data to be processed within this first isolation environment improves the security of the processed data.

[0009] In one possible implementation, the program runtime environment is used to provide the hardware and / or software resources required to run the virtualization instance, and the first isolation environment is used to provide the hardware and / or software resources required to run the security handler.

[0010] In another possible implementation, the host further includes a second isolation environment, which comprises a first management module and the first isolation environment itself. The first management module manages the first isolation environment. This divides the isolation environment into two layers: a first isolation environment and a second isolation environment. Different virtualization instances corresponding to the first isolation environment can be created within the second isolation environment. The first management module can manage the first isolation environments corresponding to different virtualization instances, achieving fine-grained management at the virtualization instance level.

[0011] In another possible implementation, the first isolation space is an isolated runtime environment that is only for communication with the virtualization instance corresponding to the first isolation space and cannot be accessed by other virtualization instances.

[0012] In another possible implementation, when the host switches to secure mode, the first management module receives task information, including the identifier of the virtualization instance. The first management module is also used to create or allocate a first isolation environment corresponding to the virtualization instance based on the task information. This allows the first management module to create or allocate a first isolation environment via the task information.

[0013] In another possible implementation, the first management module receives the task information sent by the security monitor, which is information acquired by the security monitor in non-secure mode. Here, the security monitor has a higher security level; by transmitting the task information from the program's runtime environment in non-secure mode to the first management module in secure mode via the security monitor, the security of task information transmission can be improved.

[0014] In another possible implementation, the task information is generated by the second management module in the program runtime environment when it receives the call request sent by the virtualization instance, and the task information obtained by the security monitor is input from the second management module. In this way, the task information can be securely transmitted to the first management module through the security monitor.

[0015] In another possible implementation, the task information also includes a shared memory address. The first management module is also used to obtain first data based on the shared memory address. The first data includes a secure running program and data to be processed. Since the shared memory is shared by the program running environment and the first isolation environment, the first data in the program running environment in the non-secure mode can be transferred to the first management module through the shared memory to ensure that the first management module can create the first isolation environment based on the first data.

[0016] In another possible implementation, the first management module is also used to adjust the amount of resources included in the first isolation environment corresponding to the virtualization instance running in the program runtime environment, so as to ensure that the amount of resources included in the first isolation environment meets the needs of the running program to process the data to be processed.

[0017] In another possible implementation, the first management module releases the first isolated environment corresponding to the virtualization instance running in the program runtime environment, thereby freeing up idle resources for use by other virtualization instances.

[0018] In another possible implementation, a first management module runs the operating system in the first isolation space under this security mode. The operating system then runs the security handler to process the data to be processed and obtain the processing result. This allows the security handler to be run and the data to be processed to be processed through the operating system in the first isolation environment, ensuring that the security handler can be run using the first isolation environment, thus achieving a one-to-one correspondence between the virtualization instance and the first isolation environment.

[0019] In another possible implementation, the first management module is also used to pass processing results to the program runtime environment and to trigger a switch of the host's operating mode to a non-secure mode. This ensures that the virtualization instance located in the program runtime environment can receive the processing results.

[0020] In another possible implementation, the first management module inputs task completion information to the security monitor, and the security monitor receives the task completion information and triggers the host to switch the working mode to non-security mode.

[0021] In another possible implementation, the first management module is further configured to acquire second data, which includes status information and data stored in the first isolation space. The status information describes the running state of the operating system and the security handler in the first isolation environment. The second data is used to restore the first isolation environment corresponding to the virtualization instance on other hosts. The first management module is also configured to send the second data to a second management module in the program execution environment. This allows the virtualization instance to be migrated to other hosts, enabling it to continue running on those hosts and allowing the security handler to process data in the first isolation environment, thus achieving hardware decoupling between the first isolation environment and the host.

[0022] In another possible implementation, a second management module is used to send second data to other hosts to restore the first isolation environment corresponding to the virtualization instance on those hosts. This allows the virtualization instance to be migrated to other hosts, enabling it to continue running on those hosts and allowing the security handler to process data within the first isolation environment, thus achieving hardware decoupling between the first isolation environment and the host.

[0023] In another possible implementation, the host includes multiple first isolation environments, each of which corresponds one-to-one with a virtualization instance in the program runtime environment. This allows different virtualization instances to correspond to different first isolation environments, enabling fine-grained management at the virtualization instance level.

[0024] In another possible implementation, the first management module is a virtualization management program called Hypervisor.

[0025] Secondly, this application provides a method for processing data, in which: when the host switches to secure mode, task information is received, the task information including an identifier of a virtualization instance, the virtualization instance being a virtualization instance operating in a non-secure mode within a program runtime environment, and the program runtime environment being the host's environment operating in non-secure mode. Based on the task information, a first isolation environment corresponding to the virtualization instance is created or allocated. The first isolation environment is the host's environment operating in secure mode, and includes an operating system in secure mode and resources allocated to the first isolation environment. These resources include a first isolation space and processor resources. The first isolation space is used to run the operating system and a security processing program, and to store data to be processed. The security processing program corresponds to a program in the virtualization instance and is used to process the data to be processed, thereby implementing the secure processing function of the program in the virtualization instance. The first isolation space is isolated from the program runtime environment.

[0026] In this process, when the host switches to secure mode, a first isolation environment corresponding to the virtualization instance is created or allocated based on the task information. Since the first isolation environment includes the operating system in secure mode and the resources allocated to it, including the first isolation space and processor resources, the first isolation space is used to run the operating system and security processing program and store data to be processed. The first isolation space is isolated from the program's runtime environment, making the first isolation environment a highly secure environment. Thus, running the security processing program in the first isolation environment corresponding to the virtualization instance and using it to process the data to be processed improves the security of the processed data.

[0027] In one possible implementation, a task information message is received from a security monitor. This task information is information acquired by the security monitor in non-secure mode. The security monitor has a higher security level; transmitting task information from the program's runtime environment in non-secure mode to secure mode via the security monitor improves the security of task information transmission.

[0028] In another possible implementation, the first isolation space is an isolated runtime environment that is only for communication with the virtualization instance corresponding to the first isolation space and cannot be accessed by other virtualization instances.

[0029] In another possible implementation, the task information also includes a shared memory address. First data, comprising a secure running program and data to be processed, is obtained based on this shared memory address. This shared memory is shared by the program's runtime environment and the first isolated environment. Because this shared memory is shared by both the program's runtime environment and the first isolated environment, the first data from the non-secure runtime environment can be transferred to the secure mode via the shared memory, ensuring that the first isolated environment can be created based on this first data.

[0030] In another possible implementation, the host also includes a second isolation environment, which includes the first isolation environment. This divides the isolation environment into two layers: a first isolation environment and a second isolation environment. Different virtualization instances corresponding to the first isolation environment can be created in the second isolation environment, and the first isolation environments corresponding to different virtualization instances can be managed, achieving fine-grained management at the virtualization instance level.

[0031] In another possible implementation, the amount of resources included in the first isolation environment corresponding to the virtualization instance running in the program runtime environment is adjusted. This ensures that the amount of resources included in the first isolation environment meets the needs of the running program to process the data to be processed.

[0032] In another possible implementation, the first isolated environment corresponding to the virtualization instance running in the program runtime environment is released, thus freeing up idle resources for use by other virtualization instances.

[0033] In another possible implementation, an operating system in this secure mode runs in the first isolated space. This operating system then runs the secure handler to process the data and obtain the result. This allows the secure handler to run and process the data using the operating system in the first isolated environment, ensuring that the secure handler can be run within that first isolated environment. This achieves a one-to-one correspondence between the virtualization instance and the first isolated environment.

[0034] In another possible implementation, the processing result is passed to the program runtime environment, and a switch to a non-secure mode is triggered. This ensures that the virtualization instance located in the program runtime environment receives the processing result.

[0035] In another possible implementation, second data is acquired. This second data includes status information and data stored in the first isolation space. The status information describes the running state of the operating system and the security handler in the first isolation environment. The second data is used to restore the first isolation environment corresponding to the virtualization instance on other hosts. This allows the virtualization instance to be migrated to other hosts, enabling it to continue running on those hosts and allowing the security handler to continue processing data in the first isolation environment, thus achieving hardware decoupling between the first isolation environment and the host.

[0036] In another possible implementation, second data is sent to other hosts to restore the first isolation environment corresponding to the virtualization instance on those hosts. This allows the virtualization instance to be migrated to other hosts, continue running on those hosts, and continue to allow the security handler to process data in the first isolation environment, thus achieving hardware decoupling between the first isolation environment and the host.

[0037] In another possible implementation, the host includes multiple first isolation environments, each of which corresponds one-to-one with a virtualization instance in the program runtime environment. This allows different virtualization instances to correspond to different first isolation environments, enabling fine-grained management at the virtualization instance level.

[0038] Thirdly, this application provides a data processing apparatus for performing the method in the second aspect or any possible implementation thereof. Specifically, the apparatus includes units for performing the method in the second aspect or any possible implementation thereof.

[0039] Fourthly, this application provides a data processing apparatus, comprising a transceiver, a processor, and a memory. The transceiver, the processor, and the memory are interconnected via internal connections. The memory stores programs, instructions, or code, and the processor executes the programs, instructions, or code stored in the memory, and, in conjunction with the transceiver, instructs the apparatus to perform the methods of the second aspect or any possible implementation thereof.

[0040] Fifthly, this application provides a computer program product comprising a computer program stored in a computer-readable storage medium, and the computer program being loaded by a processor to implement the method described in the second aspect or any possible implementation thereof.

[0041] In a sixth aspect, this application provides a computer-readable storage medium for storing a computer program, which is loaded by a processor to execute instructions of the method of the second aspect or any possible implementation thereof. Attached Figure Description

[0042] Figure 1 This is a schematic diagram of a system architecture provided in an embodiment of this application;

[0043] Figure 2 This is a schematic diagram of the structure of a host provided in an embodiment of this application;

[0044] Figure 3 This is a flowchart of a data processing method provided in an embodiment of this application;

[0045] Figure 4 This is a schematic diagram illustrating the transmission of information between various modules of a host according to an embodiment of this application;

[0046] Figure 5 This is a schematic diagram of a data processing device provided in an embodiment of this application;

[0047] Figure 6 This is a schematic diagram of another data processing device provided in an embodiment of this application. Detailed Implementation

[0048] The embodiments of this application will now be described in further detail with reference to the accompanying drawings.

[0049] See Figure 1 This application provides a system architecture that includes at least one host, and a network connection can be established between any two of the at least one host.

[0050] This system architecture can be applied to scenarios such as cloud environments or data centers. For example, the hosts in this system architecture can be servers included in cloud environments or servers included in data centers.

[0051] For each of the at least one host, the host may include at least one virtualization instance, and the host may provide a runtime environment for the at least one virtualization instance so that each virtualization instance can run in the environment.

[0052] The at least one virtualization instance includes virtual machines and / or containers, etc.

[0053] Each virtualization instance includes an operating system and programs that provide services. The operating system runs within the virtualization instance, and the programs are run through that operating system, enabling the virtualization instance to provide the service.

[0054] For each of the at least one virtualization instance, the virtualization instance may call certain security handlers at runtime to process data in order to implement the security processing function of the program.

[0055] This security processing program needs to run in a highly secure environment to ensure the security of data processing, thereby achieving the security processing function. The security processing function is a sub-function of the function that this program needs to implement. Alternatively, the operations performed by the security processing program are one or more steps included in the function that the program needs to implement.

[0056] For example, the program in this virtualization instance might be used for user login. During the login process, the virtualization instance might need to verify the user's entered password. In this case, the virtualization instance calls a security handler to verify the password. Alternatively, if the program in this virtualization instance is a financial application, it might need to perform fund transfers during its operation. In this case, the virtualization instance calls a security handler to perform the transfer, which processes data including the transfer amount, the entered account information, and the output account information.

[0057] In both examples above, to ensure the security of password verification or the security of fund transfers, it is necessary to run secure processing programs in a highly secure environment and to use secure processing programs to process data.

[0058] To meet this requirement, embodiments of this application provide, as follows: Figure 2 The host shown includes:

[0059] The program runs in environment 1 and the first isolation environment 2. Environment 1 is the environment in which the host operates in a non-secure mode, and the first isolation environment 2 is the environment in which the host operates in a secure mode.

[0060] The program runtime environment 1 includes at least one virtualized instance operating in an insecure mode, wherein the first isolation environment 2 corresponds to the virtualized instance 11 in the program runtime environment 1;

[0061] The first isolation environment 2 includes an operating system in a safe mode and resources allocated to the first isolation environment 2. The resources include a first isolation space and processor resources. The first isolation space is used to run the operating system and security processing program, as well as to store data to be processed. The security processing program corresponds to the program in the virtualization instance 11 and is used to process the data to be processed in order to realize the security processing function of the program in the virtualization instance 11. The first isolation space is isolated from the program running environment 1.

[0062] The program runtime environment 1 is used to provide the hardware and / or software resources required to run the virtualization instance, and the first isolation environment 1 is used to provide the hardware and / or software resources required to run the security process.

[0063] There is a relationship between the security handler and the program in the virtualization instance 11. For example, the security handler is a program called by a program in the virtualization instance 11. The function implemented by the security handler is a sub-function of the function implemented by the program in the virtualization instance 11, or the function implemented by the security handler is one or more steps of the function implemented by the program in the virtualization instance 11.

[0064] The first isolation environment 2 includes an operating system in safe mode that corresponds to the security handler. For example, this operating system is one that corresponds to the program category of the security handler. Specifically, this operating system can be used to process a class of programs, and the program category of the security handler corresponds to this operating system, enabling the operating system to run the security handler. For example, this operating system can be used to process programs of the Windows category; that is, the program category of the security handler is Windows.

[0065] The processor resources include the time slices occupied by the host's processor, and / or input / output (I / O) interfaces, etc. A time slice is a period of time during which the host's processor is used to run the operating system and security processes in the first isolation space, as well as to process the data to be processed.

[0066] The first isolation space is the space protected by the host in safe mode. The first isolation space is isolated from the program runtime environment 1, so that other virtualization instances in the program runtime environment 1, except for the virtualization instance 11, cannot communicate with the first isolation space.

[0067] The operating system included in the virtualization instance 11 is different from the operating system in safe mode. The operating system included in the virtualization instance 11 runs in the program execution environment 1, while the operating system in safe mode can only run in the first isolation environment 2 corresponding to the virtualization instance 11.

[0068] Optionally, the host may include multiple first isolation environments 2, each of which corresponds one-to-one with a virtualization instance in the program runtime environment 1.

[0069] In this context, non-secure mode and secure mode are two different modes in which the host operates; that is, the host can operate in non-secure mode or secure mode.

[0070] In secure mode, the first isolation environment 2 corresponding to the virtualization instance 11 is isolated from the program execution environment 1. Other virtualization instances running in the program execution environment 1 (excluding the virtualization instance 11) in non-secure mode cannot communicate with the first isolation environment 2 corresponding to the virtualization instance 11 in secure mode. Since the first isolation environment 2 corresponding to the virtualization instance 11 includes a security handler, the data to be processed required to run the security handler, and the operating system in secure mode, the security handler can be run within the first isolation environment 2 corresponding to the virtualization instance 11 through the operating system, and the data to be processed can be processed using the security handler. This achieves the running of the security handler and the processing of data in an isolated and protected environment, thereby improving the security of processing the data.

[0071] Optional, see Figure 2 The host also includes a second isolation environment 3, which is also an environment in which the host operates in a secure mode; the second isolation environment 3 includes a first management module 4 and one or more first isolation environments 2, the first management module 4 being used to manage each second isolation environment 2. For example, the first management module 4 can be used to create each first isolation environment 2.

[0072] Each first isolation environment 2 is a subset of the second isolation environment 3. The second isolation environment 3 also includes a second isolation space, which is also a space protected by the host in secure mode. The first isolation space included in each first isolation environment 2 is located in the second isolation space.

[0073] The host's storage space is divided into two parts: the user storage space and the second isolation space. The user storage space belongs to program runtime environment 1. Each virtualization instance in program runtime environment 1 can access the user storage space, but cannot access the second isolation space protected by the host.

[0074] Optional, see Figure 2 The program runtime environment 1 also includes a second management module 12, which is used to manage the program runtime environment 1. For example, the second management module 12 can be used to manage the various virtualization instances operating in the program runtime environment 1.

[0075] Since the first management module 4 and the second management module 12 are located in different environments and operate in different modes, namely, the first management module 4 is located in the second isolation environment 3 and operates in a secure mode, while the second management module 12 is located in the program running environment 1 and operates in a non-secure mode, the first management module 4 and the second management module 12 cannot communicate directly, that is, they cannot directly transmit information to each other.

[0076] To enable information exchange between the first management module 4 and the second management module 12, the host also includes a security monitor 5. The security monitor 5 has a higher security level than a specified level within the host. Information exchange between the first management module 4 and the second management module 12 is achieved through the security monitor 5.

[0077] The process of transmitting information using Security Monitor 5 can be as follows:

[0078] When the host is operating in secure mode, the first management module 4 inputs the information that needs to be passed to the second management module 12 into the security monitor 5. The security monitor 5 triggers the host to switch to non-secure mode and sends this information to the second management module 12. The second management module 12 receives this information when the host switches to non-secure mode. Alternatively,

[0079] When the host is operating in non-secure mode, the second management module 12 inputs the information that needs to be passed to the first management module 4 into the security monitor 5. The security monitor 5 triggers the host to switch to secure mode and sends the information to the first management module 4. The first management module 4 receives the information when the host switches to secure mode.

[0080] Because the security monitor 5 has a high security level, it is usually the highest security level in the host, thus ensuring that the security of information transmitted between the first management module 4 and the second management module 12 is also high.

[0081] For the first isolation environment 2 corresponding to the virtualization instance 11, in this embodiment, the first isolation environment 2 corresponding to the virtualization instance 11 can be created in the second isolation environment 3 in the following two ways. The two ways are:

[0082] In the first method, if the virtualization instance 11 calls the security handler, the first isolation environment 2 corresponding to the virtualization instance 11 is created in the second isolation environment 2.

[0083] In the first method, the host first operates in an insecure mode. When the virtualization instance 11 located in the program runtime environment 1 needs to call the security handler, it sends a call request to the second management module 12.

[0084] The second management module 12 is used to receive the call request, generate task information including the identifier of the virtualization instance 11, and input the task information to the security monitor 5 of the host.

[0085] Security monitor 5 is used to receive the task information, trigger the host to switch to safe mode, and send the task information to the first management module 4.

[0086] The first management module 4 is used to receive the task information when the host switches to safe mode, and create the first isolation environment 2 corresponding to the virtualization instance 11 based on the task information.

[0087] In the first approach, the call request may include the program identifier of the security handler and the data to be processed, which is the data required to run the security handler. For example, assuming the security handler is a program that implements a money transfer function, the data to be processed includes the transfer amount, the account information of the transferor and the account information of the transferee, etc.

[0088] The second management module 12 is also used to, after receiving the call request, obtain the security handler according to the program identifier of the security handler, and save the first data into the shared memory. The first data includes the security handler and the data to be processed.

[0089] The task information input by the second management module 12 to the security monitor 5 also includes the shared memory address and resource quantity.

[0090] Optionally, the resource amount is the capacity of the first isolation space. The task information may also include the data volume of the first data.

[0091] Optionally, the first data is a data packet, the header of which may include the amount of data in the first data.

[0092] The first management module 4 is also used to obtain first data from shared memory based on the task information, and create the first isolation environment 2 corresponding to the virtualization instance based on the first data.

[0093] The first management module 4 retrieves the first data from the shared memory based on the shared memory address included in the task information. Specifically, if the first data includes the data volume of the first data, the first management module 4 retrieves the data volume of the first data from the packet header of the first data in the shared memory based on the shared memory address, and then retrieves the first data from the shared memory based on that data volume. Alternatively, if the task information includes the data volume of the first data, the first management module 4 retrieves the first data from the shared memory based on both the shared memory address and the data volume.

[0094] For the first method, the complete process of creating the first isolation environment 2 is described in detail below. This complete process includes the following operations (1-1) to (1-5), which can be:

[0095] (1-1) The second management module 12 receives the call request, which includes the program identifier of the security handler and the data to be processed.

[0096] (1-2) The second management module 12 obtains the security processing program according to the program identifier of the security processing program, verifies the security processing program and the data to be processed to obtain verification information, and uses the first private key information corresponding to the virtualization instance 11 to encrypt the data to be encrypted to obtain the first data. The data to be encrypted includes the security processing program, the data to be processed and the verification information.

[0097] Optionally, the second management module 12 also obtains the operating system in secure mode based on the program category of the security handler called by the virtualization instance 11. The data to be encrypted also includes the operating system. Next, one implementation method for obtaining the operating system is listed as follows:

[0098] The program runtime environment 1 stores the mapping between program categories and operating systems. Each record in this mapping includes a program category and the operating system in safe mode. Therefore, the second management module 12 obtains the operating system in safe mode from the mapping between program categories and operating systems based on the program category of the security handler called by the virtualization instance 11.

[0099] Optionally, the verification information can be a hash value obtained by hashing the security handler and the data to be processed.

[0100] Optionally, the program runtime environment 1 can store the correspondence between the virtualization instance identifier and the first private key information. Each record in this correspondence includes the identifier of a virtualization instance and the first private key information corresponding to that virtualization instance. Therefore, the operation of the second management module 12 to obtain the first private key information corresponding to the virtualization instance 11 can be as follows:

[0101] The second management module 12 obtains the first private key information corresponding to the virtualization instance 11 from the correspondence between the identifier of the virtualization instance and the first private key information based on the identifier of the virtualization instance 11.

[0102] (1-3) The second management module 12 allocates shared memory in the user storage space included in the program running environment 1. The capacity of the shared memory is greater than the amount of data of the first data. The first data is saved in the shared memory, and task information is generated. The task information includes the identifier of the virtualization instance 11 and the shared memory address, etc. The task information is input to the security monitor 5 of the host.

[0103] (1-4) The security monitor 5 receives the task information, triggers the host to switch to security mode, and sends the task information to the first management module 4.

[0104] (1-5) When the host switches to safe mode, the first management module 4 receives the task information, obtains the operating system in safe mode, the security handler called by the virtualization instance 11 and the data to be processed according to the task information, allocates resources, including the first isolation space and processor resources, saves the operating system, security handler and data to be processed in the first isolation space, and obtains the first isolation environment 2 corresponding to the virtualization instance 11.

[0105] Regarding the security processing program and the data to be processed, the following is an implementation example of how the first management module 4 obtains the security processing program and the data to be processed. This implementation example can be:

[0106] The first management module 4 obtains the first public key information corresponding to the virtualization instance 11 based on the task information, including the identifier of the virtualization instance 11; it retrieves the first data from the shared memory based on the shared memory address included in the task information; using the first public key information corresponding to the virtualization instance 11, it decrypts the first data to obtain a secure processing program, data to be processed, and verification information; it uses the verification information to verify the secure processing program and data to be processed. If the verification passes, it obtains the secure processing program and data to be processed called by the virtualization instance 11. If the verification fails, it terminates the process, or notifies the second management module 12 through the security monitor 5, so that the second management module 12 re-saves the first data into the shared memory.

[0107] Regarding this verification information, if the verification information is a hash value, the verification process of the first management module 4 can be as follows:

[0108] The first management module 4 calculates a hash value based on the decrypted security processing program and the data to be processed. If the calculated hash value is the same as the verification information, the verification passes; if the calculated hash value is different from the verification information, the verification fails.

[0109] The first private key information and the first public key information corresponding to the virtualization instance 11 are a public-private key pair. The operation of the first management module 4 to obtain the first public key information can be as follows:

[0110] In the second isolation environment 3, the correspondence between the identifier of a virtualization instance and the first public key information can be stored. Each record in this correspondence includes the identifier of a virtualization instance and the first public key information corresponding to that virtualization instance. The first management module 4 obtains the first public key information corresponding to the virtualization instance 11 from the correspondence between the identifier of the virtualization instance 11 and the first public key information based on the identifier of the virtualization instance 11.

[0111] For an operating system in safe mode, the first management module 4 can obtain the operating system in the following two ways:

[0112] In Method 1, the first data includes the operating system, so the first management module 4 decrypts the first data to obtain the operating system.

[0113] Method 2: The second isolation environment 3 stores the mapping between program categories and operating systems. Each record in this mapping includes a program category and the operating system in safe mode. Therefore, the first management module 4 retrieves the corresponding operating system from the mapping between program type and operating system based on the program category of the security handler called by the virtualization instance.

[0114] The second approach involves creating at least one first isolation environment 2 in the second isolation environment 3 beforehand. This way, when the virtualization instance 11 in the program runtime environment 1 calls the security handler, the first isolation environment 2 can be allocated to the virtualization instance 11 in the second isolation environment 2.

[0115] In the second approach, for each of the at least one first isolation environment 2, the first isolation environment includes an operating system in a safe mode and resources allocated to the first isolation environment, the resources including a first isolation space for storing the operating system.

[0116] In this context, for an operating system in safe mode, the number of first isolation environments 2 including the operating system can be one or more. If there are multiple first isolation environments 2, the capacity of the first isolation space included in each of the multiple first isolation environments 2 is different. For example, for a certain operating system, three first isolation environments 2 including the operating system can be created in advance, and the capacities of the first isolation spaces included in the three first isolation environments 2 are 10G, 8G, and 6G, respectively.

[0117] The second isolation environment 3 includes operating systems corresponding to different program categories. For each operating system, one or more first isolation environments 2 can be established that include that operating system.

[0118] In the second approach, when the host is operating in a non-secure mode, for virtualization instance 11 in program runtime environment 1, when virtualization instance 11 calls a secure handler to process data, a first isolation environment 2 needs to be allocated for virtualization instance 11 in the second isolation environment 3. This allocation process includes operations (2-1) to (2-5), which can be:

[0119] (2-1) When the virtualization instance 11 needs to call the security handler, it sends a call request to the second management module 12. The call request includes the program identifier of the security handler and the data to be processed.

[0120] (2-2) The second management module 12 receives the call request, creates shared memory in the program execution space included in the program execution environment 1, saves the first data to the shared memory, the first data includes a security processing program and data to be processed, generates task information, the task information includes the identifier of the virtualization instance, the address of the shared memory and the capacity of the first isolation space, and inputs the task information to the security monitor 5 of the host.

[0121] Regarding the aforementioned first data, the operation by which the second management module 12 obtains the first data can be:

[0122] The second management module 12 can verify the security processing program and the data to be processed to obtain verification information, obtain the first private key information corresponding to the virtualization instance 11, and use the first private key information to encrypt the data to be encrypted to obtain the first data. The data to be encrypted includes the program identifier of the security processing program, the data to be processed, and the verification information.

[0123] (2-3) The security monitor 5 receives the task information, triggers the host to switch to security mode, and sends the task information to the first management module 4.

[0124] (2-4) When the host switches to safe mode, the first management module 4 reads the task information from the security monitor 5 and obtains the security handler and the data to be processed from the shared memory according to the shared memory address included in the task information.

[0125] Optionally, after the first management module 12 obtains the first data from the shared memory, it obtains the first public key information corresponding to the virtualization instance 11 based on the identifier of the virtualization instance 11, and uses the first public key information to decrypt the first data to obtain the security processing program, the data to be processed, and the verification information. It then verifies the data to be processed and the security processing program based on the verification information. If the verification passes, it performs the following operations (2-5).

[0126] (2-5) The first management module 4 allocates the pre-created first isolation environment 2 according to the capacity of the first isolation space included in the task information and the program category of the security process, saves the security process and the data to be processed into the first isolation space included in the first isolation environment 2, and allocates processor resources to the first isolation environment 2.

[0127] The capacity of the first isolation space included in the allocated first isolation environment 2 is greater than or equal to the capacity of the first isolation space included in the task information. After executing operation (2-5), the first isolation environment 2 includes the first isolation space and processor resources. The first isolation space stores the operating system in safe mode, the security handler, and the data to be processed.

[0128] In the first and second methods mentioned above, the first management module 4 can establish a first isolation environment 2 corresponding to different virtualization instances, thereby realizing the establishment of different first isolation environments for different virtualization instances and achieving updated and refined management.

[0129] The first management module 4 is also used to run the operating system in the first isolation environment 2 corresponding to the virtualization instance 11, and to run a security processing program through the operating system to process the data to be processed.

[0130] Optionally, the first management module 4 can process the data to be processed through the following operations (3-1) to (3-3). These operations (3-1) to (3-3) are as follows:

[0131] (3-1): The first management module 4 runs the operating system in the first isolation space 2 corresponding to the virtualization instance 11.

[0132] Optionally, the operating system is started in the first isolation space 2, and after the operating system starts, the host's processor can begin running the operating system.

[0133] (3-2): The first management module 4 starts a process in the operating system to run a security processing program.

[0134] Once the operating system is running, it can create processes for running security procedures.

[0135] (3-3): The process is used to process the data to be processed and obtain the processing result.

[0136] The host's processor can call and run the process, and while running the process, it processes the data to be processed and obtains the processing result.

[0137] Optionally, during the above-mentioned process of processing the data to be processed, the first management module 4 is also used to adjust the amount of resources included in the first isolation environment 2 corresponding to the virtualization instance 11.

[0138] This resource quantity may include the capacity of the first isolation space. That is, during the process of processing the data to be processed, the first management module 4 may increase or decrease the capacity of the first isolation space as needed.

[0139] Optionally, after processing the data to be processed, the first management module 4 is also used to release the first isolation environment 2 corresponding to the virtualization instance 11.

[0140] After processing the data to be processed and obtaining the processing result, the first management module 4 is also used to transmit the processing result to the program running environment 2, and to trigger the switching of the host's working mode to non-secure mode.

[0141] When the host switches to non-secure mode, the second management module 12 is also used to obtain the processing result and input the processing result into the virtualization instance 11.

[0142] Next, the complete process of inputting the processing result into the virtualization instance 11 is described in detail. This complete process includes the following operations (4-1)-(4-3), which can be:

[0143] (4-1) The first management module 4 obtains the second private key information corresponding to the virtualization instance 11, uses the second private key information to encrypt the processing result, saves the encrypted processing result to the shared memory, and inputs task completion information to the security monitor 5. The task completion information includes the identifier of the virtualization instance 11, the address of the shared memory, and the task completion indication.

[0144] The operation of the first management module 4 to obtain the second private key information can be as follows:

[0145] In the second isolation environment 3, the correspondence between the identifier of the virtualization instance and the second private key information can be stored. Each record in this correspondence includes the identifier of a virtualization instance and the second private key information corresponding to that virtualization instance. The first management module 4 obtains the second private key information corresponding to the virtualization instance 11 from the correspondence between the identifier of the virtualization instance 11 and the second private key information based on the identifier of the virtualization instance 11.

[0146] (4-2) The security monitor 5 receives the task completion information, triggers the host to switch the working mode to non-security mode, and sends the task completion information to the second management module 12.

[0147] (4-3) When the host switches to non-secure mode, the second management module 12 receives the task completion information, which includes the identifier of the virtualization instance 11, the shared memory address and the task completion indication. When the task completion indication is triggered, the second public key information corresponding to the virtualization instance 11 is obtained according to the identifier of the virtualization instance, the encrypted processing result is obtained according to the shared memory address, the encrypted processing result is decrypted using the second public key information, the processing result is obtained, and the processing result is input to the virtualization instance 11.

[0148] The second private key information corresponding to virtualization instance 11 and the second public key information corresponding to virtualization instance 11 are a public-private key pair. The operation for the second management module 12 to obtain the second public key information can be as follows:

[0149] In the program runtime environment 1, the correspondence between the identifier of a virtualization instance and the second public key information can be stored. Each record in this correspondence includes the identifier of a virtualization instance and the second public key information corresponding to that virtualization instance. The second management module 12 obtains the second public key information corresponding to the virtualization instance 11 from the correspondence between the identifier of the virtualization instance and the second public key information based on the identifier of the virtualization instance.

[0150] Optionally, within the first isolation environment 2 corresponding to the virtualization instance 11, during the process of processing data using a secure handler, the virtualization instance 11 can be migrated from this host to another host. When migrating the virtualization instance 11 to another host, the first isolation environment 2 corresponding to the virtualization instance 11 also needs to be migrated to that other host. In implementation:

[0151] The first management module 4 is also used to acquire second data and input the second data into the second management module 12. The second data includes status information and data stored in the first isolation space 2. The status information is used to describe the running status of the operating system and the running status of the security processing program.

[0152] The second management module 12 is also used to send second data to other hosts. Upon receiving the second data, the other hosts restore the first isolation environment 2 corresponding to the virtualization instance 11 based on the second data.

[0153] Optionally, the status information includes the current running status of the operating system and the current running status of the security handler. The data stored in the first isolated space includes the operating system, the security handler, and the intermediate results of the security handler processing the data to be processed.

[0154] Next, an implementation example of inputting the second data to the second management module 12 is given. This implementation example can be:

[0155] After obtaining the second data, the first management module 4 saves the second data to the shared memory and inputs migration information to the security monitor 5. The migration information includes the identifier of the virtualization instance 11, the shared memory address, and the migration instruction.

[0156] The security monitor 5 receives the migration information, triggers the host to switch its working mode to non-security mode, and sends the migration information to the second management module 12.

[0157] When the host switches to non-secure mode, the second management module 12 receives migration information and, triggered by the migration instruction, obtains the second data based on the shared memory address.

[0158] The other hosts, like those provided in this embodiment, also include a program execution environment and a second isolation environment. A second management module located in the program execution environment receives the second data, allocates shared memory in the user storage space of the program execution environment, saves the second data in the shared memory, and inputs recovery information to the security monitor of the other hosts. This recovery information includes the shared memory address and a recovery instruction.

[0159] Upon receiving the recovery information, the security monitor triggers the other host to switch its operating mode to secure mode and sends the recovery information to the first management module in the second isolated environment.

[0160] After the other host switches to safe mode, the first management module located in the second isolation environment receives the recovery information. Triggered by the recovery instruction, it reads the second data from the shared memory according to the shared memory address and restores the first isolation environment corresponding to the virtualization instance 11 according to the second data.

[0161] Optionally, the first management module 4 is a virtualization management program (Hypervisor), and the second management module 12 is also a Hypervisor.

[0162] In this embodiment, the host includes a program execution environment and a first isolation environment. For the program execution environment, which includes a virtualization instance operating in a non-secure mode, the first isolation environment corresponding to that virtualization instance includes an operating system and resources in a secure mode. These resources include a first isolation space and processor resources. The first isolation space is used to run the operating system and a security handler, as well as to process data to be processed. The security handler is a program called by the virtualization instance, and the data to be processed is the data required to run the security handler. The first isolation space is a space protected by the host in secure mode. Thus, in the first isolation environment corresponding to the virtualization instance 11, a security handler runs and processes the data to be processed, thereby improving the security of the processed data.

[0163] See Figure 3 This application provides a method for processing data, which can be applied to, for example... Figure 2 In the host shown, the method includes:

[0164] Step 301: When the host is operating in a non-secure mode, it receives a call request sent by the virtualization instance 11. The call request includes the program identifier of the security handler called by the virtualization instance 11 and the data to be processed.

[0165] The host includes a program execution environment and a second isolation environment. The program execution environment includes at least one virtualization instance, and the virtualization instance 11 is any one of the at least one virtualization instances.

[0166] See Figure 4 The second management module receives the call request sent by the virtualization instance 11.

[0167] Step 302: Save the first data to shared memory and input task information to the host's security monitor, including the identifier of the virtualization instance 11, to trigger the host's working mode to switch to safe mode.

[0168] See Figure 4 The second management module saves the first data to the shared memory and inputs task information to the host's security monitor.

[0169] In this step, a security processor is obtained based on its program identifier. The security processor and the data to be processed are verified to obtain verification information. The first private key information corresponding to the virtualization instance 11 is used to encrypt the data to be encrypted to obtain first data. The data to be encrypted includes the security processor, the data to be processed, and the verification information. Shared memory is allocated in the user storage space included in the program running environment according to the amount of the first data. The capacity of the shared memory is greater than the amount of the first data. The first data is saved in the shared memory, and task information is generated. The task information includes the identifier of the virtualization instance 11 and the shared memory address. The task information is input to the security monitor of the host.

[0170] Optionally, the mission information may also include information such as the capacity of the first isolation space.

[0171] Optionally, the data to be encrypted may also include the operating system in secure mode. That is, before encrypting the data, the operating system in secure mode is obtained based on the program category of the security processor.

[0172] The operations to obtain this operating system can be:

[0173] The host's program runtime environment maintains a mapping between program categories and operating systems. Each record in this mapping includes a program category and the operating system for that program category in safe mode. Therefore, based on the program category of the security handler, the operating system in safe mode is retrieved from the mapping between that program category and operating system.

[0174] Optionally, the verification information can be a hash value obtained by hashing the security handler and the data to be processed.

[0175] Optionally, the program runtime environment can store the correspondence between the identifier of virtualization instance 11 and the first private key information. Each record in this correspondence includes the identifier of a virtualization instance and the first private key information corresponding to that virtualization instance. Therefore, the operation of obtaining the first private key information corresponding to the virtualization instance 11 can be:

[0176] Based on the identifier of the virtualization instance 11, the first private key information corresponding to the virtualization instance 11 is obtained from the correspondence between the identifier of the virtualization instance and the first private key information.

[0177] The host's security monitor receives the task information, triggers the host to switch to safe mode, and then sends the task information.

[0178] Step 303: When the host switches to safe mode, receive the task information sent by the security monitor, and create or allocate the first isolation environment corresponding to the virtualization instance 11 according to the task information.

[0179] See Figure 4 The first management module receives the task information, retrieves the first data from the shared memory based on the task information, and creates or allocates the first isolation environment corresponding to the virtualization instance 11 based on the first data.

[0180] If the first isolation environment corresponding to the virtualization instance 11 in the program runtime environment has not been established in the second isolation environment beforehand, the operation of step 303 can be as follows:

[0181] When the host switches to secure mode, the task information is received. Based on the identifier of the virtualization instance 11 included in the task information, the first public key information corresponding to the virtualization instance 11 is obtained. Based on the shared memory address included in the task information, the first data is obtained from the shared memory. Using the first public key information corresponding to the virtualization instance 11, the first data is decrypted to obtain a secure handler, data to be processed, and verification information. The verification information is used to verify the secure handler and data to be processed. If the verification passes, the secure handler and data to be processed called by the virtualization instance 11 are obtained. The operating system corresponding to the program category of the secure handler in secure mode is obtained. A first isolation space and processor resources are allocated. The first isolation space includes the secure handler, data to be processed, and the operating system, thereby creating a first isolation environment corresponding to the virtualization instance 11.

[0182] For this verification information, if the verification information is a hash value, the verification process can be as follows:

[0183] The hash value is calculated based on the decrypted security processing program and the data to be processed. If the calculated hash value is the same as the verification information, the verification passes; if the calculated hash value is different from the verification information, the verification fails.

[0184] The first private key information and the first public key information corresponding to virtualization instance 11 are a public-private key pair. The operation to obtain the first public key information can be as follows:

[0185] In the second isolated environment, the correspondence between the identifier of a virtualization instance and the first public key information can be stored. Each record in this correspondence includes the identifier of a virtualization instance and the first public key information corresponding to that virtualization instance. Therefore, the first public key information corresponding to the virtualization instance 11 can be obtained from the correspondence between the identifier of the virtualization instance 11 and the first public key information.

[0186] This operating system can be obtained in the following two ways:

[0187] Method 1: The first data includes the operating system, so the operating system can be obtained by decrypting the first data.

[0188] Method two involves storing the mapping between program categories and operating systems in the second isolated environment. Each record in this mapping includes a program category and the operating system for that program category in safe mode. Therefore, based on the program category of the safe handler, the corresponding operating system is retrieved from the mapping between program categories and operating systems.

[0189] If the first isolation environment corresponding to the virtualization instance 11 is pre-established in the second isolation environment, the operation of step 303 can be as follows:

[0190] When the host switches to secure mode, the task information is received. Based on the shared memory address included in the task information, the first data is obtained from the shared memory. The first data includes the secure handler, the data to be processed, and the capacity of the first isolation space. Based on the capacity of the first isolation space included in the task information and the program type of the secure handler, a pre-created first isolation environment is allocated. The secure handler and the data to be processed are saved to the first isolation space included in the first isolation environment, and processor resources are allocated to the first isolation environment.

[0191] Optionally, after obtaining the first data from the shared memory, the first public key information corresponding to the virtualization instance 11 is obtained according to the identifier of the virtualization instance 11. The first public key information is used to decrypt the first data to obtain the security processing program, the data to be processed, and the verification information. The data to be processed and the security processing program are verified according to the verification information. If the verification is successful, the data to be processed and the security processing program are saved to the first isolation space included in the first isolation environment corresponding to the virtualization instance 11.

[0192] Step 304: Run the operating system in the first isolated environment corresponding to the virtualization instance 11, and run a security handler through the operating system to process the data to be processed.

[0193] Optionally, the data to be processed can be processed through the following operations 3041-3043. These operations 3041-3043 are as follows:

[0194] 3041: The operating system in this security mode runs in the first isolation space.

[0195] Optionally, the operating system is booted in the first isolation space, and after the operating system boots, the host's processor can begin running the operating system.

[0196] 3042: Start a process in the operating system to run security procedures.

[0197] Once the operating system is running, it creates processes for running security procedures.

[0198] 3043: This process processes the data to be processed and obtains the processing result.

[0199] The host's processor can call and run the process, and while the process is running, it processes the data to be processed and obtains the processing result.

[0200] Optionally, during the above process of processing the data to be processed, the amount of resources included in the first isolated environment corresponding to the virtualization instance 11 can be adjusted.

[0201] This resource quantity may include the capacity of the first isolation space. That is, during the process of processing the data to be processed, the capacity of the first isolation space can be increased or decreased as needed.

[0202] Optionally, after processing the data to be processed, the first isolation environment corresponding to the virtualization instance 11 can also be released.

[0203] Step 305: After processing the data to be processed and obtaining the processing result, pass the processing result to the program runtime environment and trigger the switch of the host's working mode to non-secure mode.

[0204] In step 305, the second private key information corresponding to the virtualization instance 11 is obtained, the processing result is encrypted using the second private key information, the encrypted processing result is saved to the shared memory, and task completion information is input to the security monitor. The task completion information includes the identifier of the virtualization instance 11, the address of the shared memory, and the task completion indication.

[0205] Optionally, the operation to obtain the second private key information can be:

[0206] In the second isolated environment, a mapping relationship between the identifier of a virtualization instance and the second private key information can be stored. Each record in this mapping relationship includes the identifier of a virtualization instance and the second private key information corresponding to that virtualization instance. Thus, based on the identifier of the virtualization instance 11, the second private key information corresponding to the virtualization instance 11 can be obtained from the mapping relationship between the identifier of the virtualization instance and the second private key information.

[0207] The security monitor receives the task completion information, triggers the host to switch its operating mode to non-security mode, and then sends the task completion information.

[0208] Step 306: When the host switches to non-secure mode, receive the task completion information, obtain the processing result based on the task completion information, and input the processing result into the virtualization instance 11.

[0209] See Figure 4 The second management module receives the task completion information, retrieves the processing result from the shared memory based on the task completion information, and inputs the processing result into the virtualization instance 11.

[0210] In step 306, when the host switches to non-secure mode, the task completion information is received. The task completion information includes the identifier of the virtualization instance 11, the shared memory address, and the task completion indication. When the task completion indication is triggered, the second public key information corresponding to the virtualization instance 11 is obtained according to the identifier of the virtualization instance 11, the encrypted processing result is obtained according to the shared memory address, the encrypted processing result is decrypted using the second public key information, and the processing result is input to the virtualization instance 11 according to the identifier of the virtualization instance 11.

[0211] The second private key information corresponding to the virtualization instance 11 and the second public key information corresponding to the virtualization instance are a public-private key pair.

[0212] In the program runtime environment 1, the correspondence between the identifier of a virtualization instance and the second public key information can be stored. Each record in this correspondence includes the identifier of a virtualization instance and the second public key information corresponding to that virtualization instance. Therefore, based on the identifier of the virtualization instance 11, the second public key information corresponding to the virtualization instance 11 can be obtained from the correspondence between the identifier of the virtualization instance and the second public key information.

[0213] Optionally, within the first isolated environment corresponding to the virtualization instance 11, during the process of processing data using a security handler, the virtualization instance 11 can be migrated from this host to another host. When migrating the virtualization instance 11 to another host, the first isolated environment corresponding to the virtualization instance 11 also needs to be migrated to the other host. This can be achieved through the following steps 307 to 308.

[0214] Step 307: Obtain second data, which includes status information and data stored in the first isolation space. The status information is used to describe the running status of the operating system and the running status of the security process.

[0215] See Figure 4 The first management module acquires the second data, saves the second data to the shared memory, and inputs migration information to the security monitor. This migration information includes the identifier of the virtualization instance 11, the shared memory address, and a migration instruction. Upon receiving the migration information, the security monitor triggers a switch to a non-secure mode for the host and sends the migration information to the second management module. Once the host is switched to non-secure mode, the second management module receives the migration information and, triggered by the migration instruction, acquires the second data based on the shared memory address.

[0216] Step 308: Send the second data to other hosts so that the other hosts can restore the first isolation environment corresponding to the virtualization instance 11 based on the second data.

[0217] See Figure 4 The second management module then sends second data to other hosts. These other hosts receive the second data and, based on it, restore the first isolation environment corresponding to the virtualization instance 11.

[0218] The steps for restoring other hosts to the first isolation environment can be as follows:

[0219] Other hosts include a program runtime environment and a second isolation environment. The second management module in the program runtime environment of the other host receives the second data, allocates shared memory in the user storage space of that program runtime environment, saves the second data to the shared memory, and inputs recovery information to the security monitor of the other host. This recovery information includes the shared memory address and a recovery instruction. The security monitor receives the recovery information, triggers the other host to switch its operating mode to secure mode, and sends the recovery information to the first management module in the second isolation environment. After the other host switches to secure mode, the first management module in the second isolation environment of the other host receives the recovery information. Triggered by the recovery instruction, it reads the second data from the shared memory according to the shared memory address and restores the first isolation environment corresponding to the virtualization instance 11 based on the second data.

[0220] In this embodiment, since the host switches to secure mode, it receives task information and creates a first isolation environment corresponding to virtualization instance 11. This makes the host include a program running environment and a first isolation environment. For the program running environment, which includes virtualization instance 11 operating in non-secure mode, the first isolation environment corresponding to virtualization instance 11 includes an operating system in secure mode and resources allocated to the first isolation environment. These resources include a first isolation space and processor resources. The first isolation space is used to run the operating system and security processing program, as well as to process data to be processed. In this way, data to be processed is processed in the first isolation environment, thereby improving the security of processing data to be processed.

[0221] See Figure 5 This application provides a data processing apparatus 500, which can be deployed in... Figure 1 , Figure 2 or Figure 3 The host provided in the illustrated embodiment includes:

[0222] The receiving unit 501 is used to receive task information when the host switches to secure mode. The task information includes the identifier of the virtualization instance, which is a virtualization instance in the program running environment, which is the environment in which the host is working in non-secure mode.

[0223] The processing unit 502 is configured to create or allocate a first isolation environment corresponding to the virtualization instance based on the task information. The first isolation environment is an environment in which the host operates in a secure mode. The first isolation environment includes an operating system in secure mode and resources allocated to the first isolation environment. The resources include a first isolation space and processor resources. The first isolation space is used to run the operating system and a security processing program, and to store data to be processed. The security processing program corresponds to the program in the virtualization instance and is used to process the data to be processed in order to realize the secure processing function of the program in the virtualization instance. The first isolation space is isolated from the program's running environment.

[0224] Optionally, for details of the process by which processing unit 502 creates or allocates the first isolation environment, see [link to documentation]. Figure 3 The details of step 303 in the illustrated embodiment will not be described in detail here.

[0225] Optionally, the receiving unit 501 is used to receive the task information sent by the security monitor, which is information obtained by the security monitor in non-security mode.

[0226] Optionally, for details of the receiving unit 501 receiving task information, please refer to [link / reference]. Figure 3 The details of step 301 in the illustrated embodiment will not be described in detail here.

[0227] Optionally, the task information also includes a shared memory address, and the processing unit 502 is further used for:

[0228] The first data is obtained based on the shared memory address. The first data includes the secure running program and the data to be processed. The shared memory is the memory shared by the program's running environment and the first isolation environment.

[0229] Optionally, for details of the process by which processing unit 502 acquires the first data, please refer to [link / reference]. Figure 3 The details of step 303 in the illustrated embodiment will not be described in detail here.

[0230] Optionally, the host may also include a second isolation environment, which includes the first isolation environment.

[0231] Optionally, the processing unit 502 is also used for:

[0232] Adjust the amount of resources included in the first isolated environment corresponding to the virtualization instance running in the program runtime environment, or release the first isolated environment corresponding to the virtualization instance running in the program runtime environment.

[0233] Optionally, the processing unit 502 is also used for:

[0234] The operating system in this security mode runs in the first isolation space. The operating system runs a security handler to process the data to be processed and obtain the processing result.

[0235] Optionally, for detailed information on the process obtained by processing unit 502, please refer to [link / reference]. Figure 3 The details of step 304 in the illustrated embodiment will not be described in detail here.

[0236] Optionally, the processing unit 502 is also used to transmit the processing result to the program runtime environment and to trigger the host's working mode to switch to a non-secure mode.

[0237] Optionally, for details of how processing unit 502 transmits the processing results, please refer to [link / reference]. Figure 3 The details of step 305 in the illustrated embodiment will not be described in detail here.

[0238] Optionally, the processing unit 502 is further configured to acquire second data, which includes status information and data stored in the first isolation space. The status information is used to describe the running status of the operating system and the running status of the security process in the first isolation environment. The second data is used to restore the first isolation environment corresponding to the virtualization instance on other hosts.

[0239] Optionally, for details of the process by which processing unit 502 acquires the second data, see [link to documentation]. Figure 3 The details of step 307 in the illustrated embodiment will not be described in detail here.

[0240] Optionally, the device 500 further includes:

[0241] The sending unit 503 is used to send the second data to other hosts in order to restore the first isolation environment corresponding to the virtualization instance on other hosts.

[0242] Optionally, the host may include multiple first isolation environments, each of which corresponds one-to-one with a virtualization instance in the program runtime environment.

[0243] In this embodiment, since the receiving unit receives task information when the host switches to secure mode, the processing unit creates a first isolation environment corresponding to the virtualization instance. This makes the host include a program running environment and a first isolation environment. For the program running environment, which includes a virtualization instance working in non-secure mode, the first isolation environment corresponding to the virtualization instance includes an operating system in secure mode and resources allocated to the first isolation environment. These resources include a first isolation space and processor resources. The first isolation space is used to run the operating system and security processing program, as well as to process the data to be processed. In this way, the processing unit processes the data to be processed in the first isolation environment, thereby improving the security of processing the data to be processed.

[0244] See Figure 6 This application provides a schematic diagram of a data processing apparatus 600. The apparatus 600 can be a host in any of the above embodiments. The apparatus 600 includes at least one processor 601, internal connections 602, a memory 603, and at least one transceiver 604.

[0245] The device 600 is a hardware-structured device that can be used to implement... Figure 5 The functional modules in the device 500. For example, those skilled in the art will conceive of them. Figure 5 The processing unit 502 in the illustrated device 500 can be implemented by the at least one processor 601 calling code in the memory 603. Figure 5 The receiving unit 501 and the transmitting unit 502 in the device 500 shown can be implemented by the transceiver 604.

[0246] Optionally, the device 600 can also be used to implement the functions of the host, the first management module and / or the second management module in the host in any of the above embodiments.

[0247] Optionally, the processor 601 described above may be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the present application.

[0248] The aforementioned internal connection 602 may include a pathway for transmitting information between the aforementioned components. Optionally, the internal connection 602 may be a single board or a bus, etc.

[0249] The transceiver 604 described above is used for communicating with other devices or communication networks.

[0250] The aforementioned memory 603 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory may exist independently and be connected to the processor via a bus. The memory may also be integrated with the processor.

[0251] The memory 603 stores the application code that executes the solution of this application, and its execution is controlled by the processor 601. The processor 601 executes the application code stored in the memory 603, and works in conjunction with at least one transceiver 604, thereby enabling the device 600 to perform the functions of the method of this patent.

[0252] In a specific implementation, as one embodiment, the processor 601 may include one or more CPUs, for example... Figure 6 CPU0 and CPU1 in the CPU.

[0253] In a specific implementation, as one example, the device 600 may include multiple processors, for example... Figure 6 Processors 601 and 607 are described herein. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. A processor here may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0254] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0255] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A host computer, characterized in that, It includes a program running environment, a second isolation environment, and a security monitor. The second isolation environment includes a first management module and a first isolation environment. The program running environment is the environment in which the host works in a non-secure mode. The first isolation environment is the environment in which the host works in a secure mode. The security monitor has a security level higher than a specified level. The program runtime environment contains a virtualized instance that operates in the non-secure mode, wherein the first isolation environment corresponds to the virtualized instance; The first management module is used to receive task information sent by the security monitor, and create or allocate a first isolation environment corresponding to the virtualization instance according to the task information. The task information is information obtained by the security monitor in the non-secure mode. The first isolation environment includes an operating system in the security mode and resources allocated to the first isolation environment. The resources include a first isolation space and processor resources. The first isolation space is isolated from the program execution environment. The first isolation space is used to run the operating system and a security processing program. The security processing program corresponds to the program in the virtualization instance to implement the security processing function of the program in the virtualization instance.

2. The host computer as described in claim 1, characterized in that, The task information also includes shared memory addresses. The first management module is further configured to obtain first data based on the shared memory address, the first data including a secure running program and data to be processed, and the shared memory being the memory shared by the program running environment and the first isolation environment.

3. The host computer as described in claim 1 or 2, characterized in that, The first management module is further configured to adjust the amount of resources included in the first isolation environment corresponding to the virtualization instance running in the program runtime environment, or to release the first isolation environment corresponding to the virtualization instance running in the program runtime environment.

4. The host computer as described in claim 1 or 2, characterized in that, The first management module is used to run the operating system in the security mode in the first isolation space, and run the security processing program through the operating system to process the data to be processed and obtain the processing result.

5. The host computer as described in claim 4, characterized in that, The first management module is also used to transmit the processing result to the program runtime environment and to trigger the switching of the host's working mode to the non-secure mode.

6. The host computer as described in any one of claims 1, 2, or 5, characterized in that, The first management module is further configured to acquire second data, which includes status information and data stored in the first isolation space. The status information is used to describe the running status of the operating system and the running status of the security processing program in the first isolation environment. The second data is used to restore the first isolation environment corresponding to the virtualization instance on other hosts. The first management module is also used to send the second data to the second management module in the program runtime environment.

7. The host computer as described in claim 6, characterized in that, The second management module is used to send the second data to the other hosts in order to restore the first isolation environment corresponding to the virtualization instance on the other hosts.

8. The host computer as described in any one of claims 1, 2, 5 or 7, characterized in that, The host includes multiple first isolation environments, and each of the multiple first isolation environments corresponds one-to-one with a virtualization instance in the program running environment.

9. A method for processing data, characterized in that, The method includes: When the host switches to secure mode, it receives task information sent by a security monitor. The security monitor has a security level higher than a specified level. The task information is information obtained by the security monitor in non-secure mode. The task information includes the identifier of the virtualization instance. The virtualization instance is a virtualization instance in the program runtime environment. The program runtime environment is the environment in which the host is working in non-secure mode. Based on the task information, a first isolation environment corresponding to the virtualization instance is created or allocated. The first isolation environment is the environment in which the host operates in the security mode. The first isolation environment includes an operating system in the security mode and resources allocated to the first isolation environment. The resources include a first isolation space and processor resources. The first isolation space is used to run the operating system and security processing programs. The security processing programs correspond to programs in the virtualization instance to implement the security processing functions of the programs in the virtualization instance. The first isolation space is isolated from the program running environment. The host also includes a second isolation environment, which includes the first isolation environment.

10. The method as described in claim 9, characterized in that, The task information also includes a shared memory address, and the method further includes: First data is obtained based on the shared memory address. The first data includes a secure running program and data to be processed. The shared memory is the memory shared by the program's running environment and the first isolated environment.

11. The method as described in claim 9 or 10, characterized in that, The method further includes: Adjust the amount of resources included in the first isolated environment corresponding to the virtualization instance running in the program runtime environment, or release the first isolated environment corresponding to the virtualization instance running in the program runtime environment.

12. The method as described in claim 9 or 10, characterized in that, The method further includes: The operating system in the security mode is run in the first isolated space, and the security processing program is run through the operating system to process the data to be processed and obtain the processing result.

13. The method as described in claim 12, characterized in that, The method further includes: The processing result is transmitted to the program runtime environment, and the host's operating mode is switched to the non-secure mode.

14. The method as described in any one of claims 9, 10, or 13, characterized in that, The method further includes: Obtain second data, which includes status information and data stored in the first isolation space. The status information is used to describe the running status of the operating system and the running status of the security processing program in the first isolation environment. The second data is used to restore the first isolation environment corresponding to the virtualization instance on other hosts.

15. The method as described in claim 14, characterized in that, The method further includes: The second data is sent to the other hosts to restore the first isolation environment corresponding to the virtualization instance on the other hosts.

16. The method as described in any one of claims 9, 10, 13, or 15, characterized in that, The host includes multiple first isolation environments, and each of the multiple first isolation environments corresponds one-to-one with a virtualization instance in the program running environment.

17. A data processing apparatus, characterized in that, The device includes: The receiving unit is used to receive task information sent by a security monitor when the host switches to a secure mode. The security level of the security monitor is higher than a specified level. The task information is information obtained by the security monitor in a non-secure mode. The task information includes the identifier of the virtualization instance. The virtualization instance is a virtualization instance in the program running environment. The program running environment is the environment in which the host is working in a non-secure mode. The processing unit is configured to create or allocate a first isolation environment corresponding to the virtualization instance based on the task information. The first isolation environment is the environment in which the host operates in the security mode. The first isolation environment includes an operating system in the security mode and resources allocated to the first isolation environment. The resources include a first isolation space and processor resources. The first isolation space is used to run the operating system and a security processing program. The security processing program corresponds to a program in the virtualization instance to implement the security processing function of the program in the virtualization instance. The first isolation space is isolated from the program running environment. The host also includes a second isolation environment, which includes the first isolation environment.

18. The apparatus as claimed in claim 17, characterized in that, The processing unit is further configured to: The operating system in the security mode is run in the first isolated space, and the security processing program is run through the operating system to process the data to be processed and obtain the processing result.

19. The apparatus as claimed in claim 18, characterized in that, The processing unit is also used to transmit the processing result to the program runtime environment and to trigger the switching of the host's working mode to the non-secure mode.

20. The apparatus according to any one of claims 17 to 19, characterized in that, The processing unit is further configured to acquire second data, which includes status information and data stored in the first isolation space. The status information is used to describe the running status of the operating system and the running status of the security processing program in the first isolation environment. The second data is used to restore the first isolation environment corresponding to the virtualization instance on other hosts.

Images