Data processing method, host machine and virtual machine

Abstract

The embodiment of the invention provides a data processing method, a host machine and a virtual machine. The method is based on computer equipment, the computer equipment comprises a host machine and a virtual machine, the virtual machine runs on the host machine, and the computer equipment comprises a private memory and a shared memory; the method comprises the following steps that: a virtual machine generates ciphertext data and a verification label according to an effective load of a source application, and stores the ciphertext data and the verification label into a shared memory; the virtual machine encapsulates the ciphertext data and the verification label to generate a data packet, the data packet comprises a data head, the ciphertext data and the verification label, and the data head is stored in a private memory; and the host machine copies the ciphertext data and the verification label from the shared memory, and copies the data head from the private memory through the rebound buffer area. According to the technical scheme provided by the embodiment of the invention, the extra I / O data processing overhead is eliminated, so that the I / O performance of the virtual machine is improved.

Description

[Technical field]

[0001] The embodiments of the present invention relate to the technical field of virtual machines, and in particular to a data processing method, a host machine and a virtual machine. [Background technology]

[0002] With the popularity of cloud computing technology, more and more developers and enterprises choose to host their applications in the data centers of cloud computing platforms. Enterprise users can avoid the cost of purchasing hardware and software by renting cloud services provided by cloud computing platforms, and can easily deploy their own applications with the help of the infrastructure already built by cloud service providers. However, in the cloud computing environment, data security has always been a major problem. In recent years, data security issues in cloud computing scenarios have received widespread attention. How to ensure the confidentiality of cloud tenants' data will become an important issue for the future development of the cloud computing industry.

[0003] At present, cloud service providers mainly use system virtualization technology to provide services to the outside world. Therefore, confidential virtual machines have become the core means and key technology to ensure cloud computing data privacy and protect data security.

[0004] Confidential virtual machines have data security functions, but since the private memory of the confidential virtual machine is hardware-isolated from the virtual machine monitor of the host machine, the host machine cannot access the private memory. Therefore, data copying between the host machine and the confidential virtual machine needs to be achieved through a bounce buffer. Using a bounce buffer for data copying will increase the overhead of additional I / O data processing, thereby reducing the input / output (I / O) performance of the confidential virtual machine. [Summary of the invention]

[0005] In view of this, an embodiment of the present invention provides a data processing method, a host machine and a virtual machine, so as to eliminate the overhead of additional I / O data processing, thereby improving the I / O performance of the virtual machine.

[0006] A first aspect provides a data processing method, the data processing method is based on a computer device, the computer device comprises: a host machine and a virtual machine, the virtual machine runs on the host machine, the computer device comprises a private memory and a shared memory;

[0007] The method comprises:

[0008] The virtual machine generates ciphertext data and a verification tag according to the payload of the source application, and stores the ciphertext data and the verification tag in the shared memory;

[0009] The virtual machine encapsulates the ciphertext data and the verification tag to generate a data packet, the data packet includes a data header, the ciphertext data and the verification tag, and the data header is stored in the private memory;

[0010] The host machine copies the ciphertext data and the verification tag from the shared memory, and copies the data header from the private memory through a bounce buffer.

[0011] A second aspect provides a data processing method, the data processing method is based on a computer device, the computer device includes: a host machine and a virtual machine, the virtual machine runs on the host machine, and the computer device includes a private memory and a shared memory;

[0012] The method comprises:

[0013] The host machine refreshes the acquired data packet to the shared memory, wherein the data packet includes a data header, ciphertext data and a verification tag;

[0014] The virtual machine parses the data header stored from the shared memory to the private memory to determine the target application;

[0015] If the virtual machine successfully verifies the verification tag, it decrypts the ciphertext data to obtain a payload, and stores the payload in the private memory, so as to send the payload to the target application through the private memory.

[0016] A third aspect provides a data processing method, the data processing method is based on a virtual machine of a computer device, the computer device includes a private memory and a shared memory;

[0017] The method comprises:

[0018] Generate ciphertext data and a verification tag according to the payload of the source application, and store the ciphertext data and the verification tag in the shared memory;

[0019] The ciphertext data and the verification tag are encapsulated to generate a data packet, the data packet includes a data header, the ciphertext data and the verification tag, and the data header is stored in the private memory.

[0020] In a possible implementation, before generating the ciphertext data and the verification tag according to the payload of the source application, the method further includes:

[0021] storing the payload into a register;

[0022] The generating of ciphertext data and verification tags according to the payload of the source application includes:

[0023] Perform encryption calculation on the effective load read from the register to generate the ciphertext data, and store the ciphertext data in the register;

[0024] The verification tag is generated according to the ciphertext data read from the register.

[0025] A fourth aspect provides a data processing method, the data processing method is based on a host machine of a computer device, the computer device includes a private memory and a shared memory;

[0026] The method comprises:

[0027] The ciphertext data and the verification tag are copied from the shared memory, and the data header is copied from the private memory through a bounce buffer.

[0028] A fifth aspect provides a data processing method, the data processing method is based on a host machine of a computer device, the computer device includes a shared memory;

[0029] The method comprises:

[0030] The acquired data packet is refreshed to the shared memory, the data packet including a data header, ciphertext data and a verification tag.

[0031] In a possible implementation, before refreshing the acquired data packet to the shared memory, the step further includes:

[0032] Receiving an initial data packet through the input and output device;

[0033] The initial data packet is preprocessed according to the set refresh rule.

[0034] In a possible implementation, preprocessing the data packet according to the set refresh rule includes:

[0035] Detecting whether there is a cached data packet of the same flow as the initial data packet;

[0036] If it is detected that the initial data packet has a same-flow data packet, determining whether the state information of the initial data packet is consistent with the state information of the same-flow data packet;

[0037] If it is determined that the status information of the initial data packet is consistent with the status information of the data packet of the same flow, the initial data packet is merged with the data packet of the same flow to generate the data packet.

[0038] In a possible implementation, the method further includes:

[0039] If it is determined that the state information of the initial data packet is inconsistent with the state information of the data packet of the same flow, the cached data packet of the same flow is used as the data packet.

[0040] In a possible implementation, the data header of the initial data packet includes a push flag; the method further includes: if it is detected that the initial data packet does not have a same-flow data packet, determining whether the push PSH flag is set;

[0041] If it is determined that the PSH flag is set, the initial data packet is used as the data packet.

[0042] A sixth aspect provides a data processing method, the data processing method is based on a virtual machine of a computer device, the computer device includes a private memory and a shared memory;

[0043] The method comprises:

[0044] Parsing a data header stored from the shared memory to the private memory to determine a target application;

[0045] If the verification tag is successfully verified, the ciphertext data is decrypted to obtain a payload, and the payload is stored in the private memory, so as to send the payload to the target application through the private memory.

[0046] In a possible implementation, if the verification tag is successfully verified, before decrypting the ciphertext data to obtain the payload, the method further includes:

[0047] Reading the ciphertext data and the verification tag from the shared memory, and storing the ciphertext data and the verification tag in a register;

[0048] If the verification tag is successfully verified, the ciphertext data is decrypted to obtain the payload, including:

[0049] said verifying the verification tag read from said register;

[0050] If the verification tag is successfully verified, the ciphertext data read from the register is decrypted to obtain the effective load.

[0051] A seventh aspect provides a virtual machine, comprising: a front-end driver module, a network protocol stack module, and an end-to-end encryption and decryption module;

[0052] The end-to-end encryption and decryption module is used to generate ciphertext data and a verification tag according to the payload of the source application, and store the ciphertext data and the verification tag in a shared memory;

[0053] The network protocol stack module is used to encapsulate the ciphertext data and the verification tag to generate a data packet, the data packet includes a data header, the ciphertext data and the verification tag, and the data header is stored in a private memory;

[0054] The front-end driver module is used to send first notification information to the back-end driver module of the host machine.

[0055] In a possible implementation, the virtual machine further includes an I / O data security protection module;

[0056] The I / O data security protection module is used to store the effective load into a register;

[0057] The end-to-end encryption and decryption module is specifically used to perform encryption calculation on the effective load read from the register to generate the ciphertext data;

[0058] The I / O data security protection module is further used to store the ciphertext data into the register;

[0059] The end-to-end encryption and decryption module is specifically used to generate the verification tag according to the ciphertext data read from the register.

[0060] An eighth aspect provides a host machine, including: a backend driver module;

[0061] The backend driver module is used to copy the ciphertext data and the verification tag from the shared memory according to the first notification information sent by the frontend driver module of the virtual machine, and copy the data header from the private memory through the rebound buffer.

[0062] A ninth aspect provides a virtual machine, comprising: a front-end driver module, a network protocol stack module, and an end-to-end encryption and decryption module;

[0063] The front-end driver module is used to send a second notification message to the back-end driver module of the host machine, so that the back-end driver module refreshes the acquired data packet to the shared memory according to the second notification message, wherein the data packet includes a data header, ciphertext data and a verification tag;

[0064] The network protocol stack module is used to parse the data header stored from the shared memory to the private memory to determine the target application;

[0065] The end-to-end encryption and decryption module is used to decrypt the ciphertext data to obtain a payload if the verification tag is successfully verified, and store the payload in the private memory, so as to send the payload to the target application through the private memory.

[0066] In a possible implementation, the virtual machine further includes an I / O data security protection module;

[0067] The I / O data security protection module is used to read the ciphertext data and the verification tag from the shared memory, and store the ciphertext data and the verification tag in a register;

[0068] The end-to-end encryption and decryption module is specifically used to verify the verification tag read from the register. If the verification of the verification tag is successful, the ciphertext data read from the register is decrypted to obtain the effective load.

[0069] A tenth aspect provides a host machine, comprising: a backend driver module;

[0070] The back-end driver module is used to refresh the acquired data packet to the shared memory according to the second notification information sent by the front-end driver module of the virtual machine, and the data packet includes a data header, ciphertext data and a verification tag.

[0071] In a possible implementation, the backend driver module is used to receive an initial data packet through the input / output device; and pre-process the initial data packet according to a set refresh rule.

[0072] In a possible implementation, the backend driver module includes an I / O data preprocessing module;

[0073] The I / O data preprocessing module is used to detect whether there is a cached same-stream data packet for the initial data packet; if it is detected that there is a same-stream data packet for the initial data packet, determine whether the status information of the initial data packet is consistent with the status information of the same-stream data packet; if it is determined that the status information of the initial data packet is consistent with the status information of the same-stream data packet, merge the initial data packet with the same-stream data packet to generate the data packet.

[0074] The eleventh aspect provides a host machine, comprising: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions, which, when executed by the host machine, enable the host machine to execute the data processing method in the implementation of the fourth aspect or the data processing method in the fifth aspect or any possible implementation of the fifth aspect.

[0075] In the technical solution provided by the embodiment of the present invention, the virtual machine stores the generated ciphertext data and verification tag in the shared memory, the host machine can copy the ciphertext data and verification tag from the shared memory, and the data header is stored in the private memory. The host machine can copy the data header from the private memory through the bounce buffer, and there is no need to use the bounce buffer to copy the ciphertext data and verification tag, thereby eliminating the additional I / O data processing overhead generated by using the bounce buffer to copy the ciphertext data and verification tag, thereby improving the I / O performance of the virtual machine.

[0076] In the technical solution provided by the embodiment of the present invention, the host machine can refresh the acquired data packets to the shared memory, eliminating the additional I / O data processing overhead generated by using the bounce buffer for data copying, thereby improving the I / O performance of the virtual machine.

Brief Description of the Drawings

[0077] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0078] Figure 1 is a schematic diagram of the structure of a computer device in some embodiments;

[0079] Figure 2 is a flow chart of a data processing method in some embodiments;

[0080] Figure 3 is a flow chart of a data processing method in some other embodiments;

[0081] Figure 4 is a flow chart of a method for preprocessing a data packet in some embodiments;

[0082] Figure 5 is a schematic diagram comparing the merging of data packets in the related technology in some embodiments and in the embodiments of the present invention;

[0083] Figure 6 is a schematic diagram of a host machine provided by some embodiments;

[0084] Figure 7 Schematic diagram of normalized throughput in the Rx direction and the Tx direction in Example 1

[0085] Figure 8a This is a schematic diagram of the test results of implementing a Memcached server;

[0086] Figure 8b It is a schematic diagram of the Nginx server in the first embodiment;

[0087] Figure 8c is a schematic diagram of the test results of the Redis server in Example 1;

[0088] Fig. 9 is a schematic diagram of normalized throughput in the Rx direction and the Tx direction in the second embodiment;

[0089] Fig.10a This is a schematic diagram of the test results of the Memcached server in Implementation 2;

[0090] Fig.10b It is a schematic diagram of the Nginx server in the second embodiment;

[0091] Fig.10c It is a schematic diagram of the test results of the Redis server in Example 2. [Specific implementation method]

[0092] In order to better understand the technical solution of the present invention, the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0093] It should be clear that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0094] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0095] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0096] Confidential virtual machine technology protects and isolates sensitive data in virtual machines in a trusted computing execution environment, preventing anyone other than specially authorized data processing code (for example, cloud service providers) from accessing the data. Currently, different hardware vendors have provided corresponding support for confidential virtual machine technology. For example, confidential virtual machine systems may include Intel TDX, ARM CCA, and AMD SEV.

[0097] Confidential virtual machines have security protection mechanisms. Generally speaking, the data security protection mechanisms of confidential virtual machine systems may include central processing unit (CPU) state protection, memory data protection, and I / O data protection. CPU state protection is specifically: when a virtual machine is down, the trusted computing base (TCB) hides the register state of the virtual machine to prevent the private data in the register from being stolen by the virtual machine monitor (hypervisor), where TCB is a trusted software / hardware module in the system. Memory data protection is specifically: the virtual machine memory is divided into private memory and shared memory, and private memory cannot be accessed by untrusted code (for example). I / O data protection is specifically: the I / O virtualization solutions for mainstream applications in cloud vendors still require the participation of virtual machine monitors, where the I / O virtualization solutions for mainstream applications may include paravirtualization input and output (PV I / O).

[0098] The mainstream I / O virtualization solutions for virtual machines may include device passthrough and PV I / O. Among them, PV I / O is to run the front-end driver of the device inside the virtual machine and the back-end driver of the device in the virtual machine monitor, and the two parties cooperate to complete I / O data transmission. However, in the confidential virtualization scenario, there is hardware isolation between the confidential virtual machine memory and the virtual machine monitor, and the virtual machine monitor cannot access the private memory of the confidential virtual machine. In response to the above problems, the current solution is to reuse the existing bounce buffer in Linux to copy data between the private memory of the confidential virtual machine and the shared memory of the host-guest virtual machine. However, using the bounce buffer for data copying will increase the overhead of additional I / O data processing, thereby reducing the I / O performance of the confidential virtual machine.

[0099] To solve the above technical problems, the embodiments of the present invention provide a data processing method, a host machine and a virtual machine. The embodiments of the present invention adopt Bifrost design, and the I / O data zero-copy technology based on redundant encryption deduplication eliminates the extra overhead caused by the rebound buffer of I / O data. The driver layer load optimization technology based on I / O backend preprocessing reduces the workload of the confidential virtual machine vCPU as a bottleneck. The above two technologies greatly improve the IO data processing performance of the confidential virtual machine; the time-of-check-to-time-of-use (TOCTTOU) defense technology based on one-time trusted read prevents data security issues caused by TOCTTOU.

[0100] Before describing in detail the solution provided by the embodiments of the present invention, the I / O data zero copy technology based on redundant encryption deduplication, the TOCTTOU defense technology based on one-time trusted reading, and the driver layer load optimization technology based on I / O backend preprocessing adopted by the embodiments of the present invention are first introduced.

[0101] I / O data zero-copy technology based on redundant encryption and deduplication:

[0102] In the traditional virtual machine scenario, in the sending (Tx) direction, the guest kernel obtains the payload by copying data from the application (APP), and the network protocol stack module encapsulates the payload into a data packet. Then, the front-end driver module in the virtual machine kernel notifies the back-end driver module in the user state of the host machine of the memory address and data length of the data packet. Since the host kernel (Host Kernel) can access the memory space of the entire virtual machine, the back-end driver module can copy the data packet to the user space hypervisor module, and then the user space hypervisor copies the data packet to the network card driver module. Finally, the physical network card device sends the data packet out through DMA. Similarly, the data processing process in the receiving (Rx) direction is the reverse process of the data processing process in the Tx direction.

[0103] However, in the confidential virtual machine scenario, the host kernel is not trusted and cannot access the private memory of the confidential virtual machine. The confidential virtual machine solution in the related art uses a bounce buffer to copy data so that the host kernel can access the data packet. Since the use of a bounce buffer for data copying introduces an additional memory copy, this brings significant performance overhead on the IO path of the confidential virtual machine.

[0104] Network communication protocols usually include end-to-end encryption and decryption protocols, and there is a memory encryption mechanism inside the confidential virtual machine, so additional redundant encryption is unnecessary. At the same time, end-to-end encryption and decryption technology can change the memory location of data at the same time, which is functionally equivalent to copying data between two memory areas. Therefore, the rebound buffer can be bypassed by directly encrypting or decrypting data into the shared memory of the host and virtual machine.

[0105] When the virtual machine is initialized, the virtual machine will reserve a special memory area, which is shared by the virtual machine and the host machine. The special memory area can be called shared memory. Subsequent I / O data needs to be directly allocated in this shared memory and the integrity and privacy of the data are guaranteed by reusing the end-to-end encryption and decryption protocol. In order to ensure that the data packets of the virtual machine can be allocated from this special memory area, the embodiment of the present invention reuses the non-uniform memory access (NUMA) node design in Linux, by adding a special NUMA node to the virtual machine, where the NUMA node can be called the zero copy I / O data (Zero Copy I / O, ZCIO) NUMA node, to ensure that it can be allocated from the ZCIO NUMA node if and only if the allocated memory buffer is used to store the payload of the data packet.

[0106] TOCTTOU defense technology based on one-time trusted reading:

[0107] TOCTTOU refers to a security issue that occurs in the time interval between a program's data integrity check and the actual use of a resource. During this time interval, an attacker can modify or replace the relevant resources, thereby bypassing the data integrity check and achieving the attack purpose.

[0108] In the related art, there is an integrity check on the header of the data packet in the Linux driver. However, if a malicious virtual machine monitor modifies the header after the check is passed, for example, by modifying the length, it may cause the network protocol stack module of the subsequent virtual machine kernel to be attacked when processing data, for example, a stack overflow may occur. In the related art, the Bifrost technology is used to reuse the rebound buffer to resist the TOCTTOU attack.

[0109] In the embodiment of the present invention, in the Rx direction, the front-end driver module of the virtual machine verifies the data header of the data packet, and then copies the read data header to the private memory. After that, all accesses to the data header will point to the data header copied in the private memory. Since the process of copying the read data header to the private memory only occurs once, and the size of the data header is very small, it will not cause a significant increase in performance overhead, and resists the TOCTTOU attack, thereby realizing the protection of the data header. In the embodiment of the present invention, in the Tx direction, the virtual machine encrypts the payload to generate ciphertext data, and can perform once to store the ciphertext data in the register, so that when the authentication tag is generated according to the ciphertext data, the ciphertext data is read from the register, thereby preventing the ciphertext data from being tampered with by the host machine, resisting the TOCTTOU attack, thereby realizing the protection of the payload. In the embodiment of the present invention, in the Rx direction, during the process of decrypting the ciphertext data, the virtual machine can perform once to store the ciphertext data read from the shared memory to the register, so that during the decryption process, the ciphertext data is read from the register, thereby preventing the ciphertext data from being tampered with by the host machine, resisting the TOCTTOU attack, thereby realizing the protection of the payload.

[0110] Driver layer load optimization technology based on I / O backend preprocessing:

[0111] Due to the limitation of the physical layer, large data packets must be divided into smaller data packets to accommodate the transmission of data packets. The above process of dividing data packets is called fragmentation or segmentation. Since additional operations are required to divide and reassemble data packets, the fragmentation or segmentation process will affect the performance of data packet processing. In the Tx direction, the sender usually uses a technology called Transmission Control Protocol (TCP) Segment Offload (TSO) to offload the segments of TCP data packets to the network card to save CPU resources. Correspondingly, the receiver also hopes to offload the reassembled data packets to the hardware to reduce the number of data packets passing through the network stack. However, different computer devices may require different reassembly strategies, and modifiable strategies are difficult to deploy on non-programmable hardware. Therefore, the GRO technology is proposed in the related art. The GRO technology can place the reassembled data packets at the device driver layer, thereby reducing the number of data packets entering the network stack, and the GRO technology is more flexible than the Generic Receive Offloading (LRO) technology.

[0112] In the related art, the vCPU of the network-intensive confidential virtual machine has been saturated and has become a bottleneck. Using the vCPU that has become a bottleneck to merge packets will directly affect network performance. Since the backend driver (i.e., the I / O backend) of the host machine usually has a large amount of surplus CPU resources, the embodiment of the present invention relieves the computing burden of the vCPU to improve performance by offloading the packet pre-merging operation in the backend driver, thereby realizing load optimization through the backend driver.

[0113] An embodiment of the present invention provides a data processing method and a computer device through an I / O data zero-copy technology based on redundant encryption deduplication, a driver layer load optimization technology based on I / O backend preprocessing, and a driver layer load optimization technology based on I / O backend preprocessing.

[0114] Figure 1 is a schematic diagram of the structure of computer equipment in some embodiments, such as Figure 1 As shown, the computer device includes a host machine, a virtual machine and an I / O device, and the virtual machine runs on the host machine.

[0115] In the embodiment of the present invention, the virtual machine may be a confidential virtual machine, and the solution provided by the embodiment of the present invention may be a PV I / O performance optimization technology for confidential virtual machine scenarios. The embodiment of the present invention adopts Bifrost design, and the computer device may adopt a Bifrost system structure.

[0116] In some embodiments, the computer device may be a platform that supports a confidential virtual machine solution. For example, the computer device includes but is not limited to: AMD SEV / ES / SNP, Intel TDX, ARM CCA, etc.

[0117] In some embodiments, the virtual machine may install a guest operation system, which may be an operating system with a kernel I / O stack. For example, the guest operation system includes but is not limited to Linux, FreeBSD, Windows, etc.

[0118] like Figure 1 As shown, the host machine includes a back-end driver module, and the virtual machine includes a front-end driver module, a network stack module, and an end-to-end encryption module. Among them, the front-end driver module and the network stack module correspond to the virtual machine kernel state, and the end-to-end encryption module corresponds to the virtual machine kernel state and the virtual machine user state.

[0119] like Figure 1 As shown, the back-end driver module includes an I / O data preprocessing module, and the I / O data preprocessing module may include a pre-receiver packet reassembling (PRPR) module.

[0120] like Figure 1 As shown, the end-to-end encryption and decryption module includes a first I / O data zero copy module, and the front-end driver module includes a second I / O data zero copy module. The first I / O data zero copy module and the second I / O data zero copy module correspond to the virtual machine kernel state. The first I / O data zero copy module may include a ZCIO NUMA module, and the second I / O data zero copy module may include a ZCIO NUMA module.

[0121] like Figure 1 As shown, the virtual machine includes an I / O data security protection module. The I / O data security protection module corresponds to the virtual machine kernel state. The I / O data security protection module may include a one-time trusted read (OTTR) module.

[0122] like Figure 1 As shown, a virtual machine can install multiple APPs, and the multiple APPs correspond to the user state of the virtual machine.

[0123] In an embodiment of the present invention, a computer device includes a private memory and a shared memory, wherein the shared memory is a memory shared by a host machine and a virtual machine. When the virtual machine is initialized, the virtual machine reserves a special memory area, which can be shared by the virtual machine and the host machine, and the virtual machine can use the special memory area as a shared memory, and the host machine can access the shared memory. To ensure that data packets can be allocated in the shared memory, an embodiment of the present invention adds a ZCIO NUMA node to the virtual machine, and the memory range of the ZCIO NUMA node can be configured by setting the guest physical address (GPA) and the total length through the kernel command line. The virtual machine parses the number of ZCIO NUMA nodes and adds the specified virtual machine memory range to each ZCIO NUMA node. All ZCIO NUMA nodes have no associated vCPU when they are created. Before a ZCIO NUMA node can be used for memory allocation, the virtual machine sets the security type of its memory to shared. The distance between ZCIO NUMA nodes is the same as the distance between the original NUMA nodes to which the memory range of the ZCIO NUMA nodes belongs, and the distance between each ZCIO NUMA node and the original NUMA node to which the ZCIO NUMA node belongs is zero. Prioritizing memory allocation from ZCIO NUMA nodes with a small distance will result in better access performance. Figure 1 The first I / O data zero copy module in corresponds to a ZCIO NUMA node, Figure 1 The second I / O data zero copy module in corresponds to another ZCIO NUMA node.

[0124] based on Figure 1 The computer device shown in the figure, an embodiment of the present invention provides a data processing method. Figure 2 is a flow chart of a data processing method in some embodiments, such as Figure 2 As shown, the method includes:

[0125] Step 102: The virtual machine generates ciphertext data and a verification tag according to the payload of the source application, and stores the ciphertext data and the verification tag in a shared memory.

[0126] In an embodiment of the present invention, the source application can be any application. When the source application starts to send a payload through the virtual machine operating system, the virtual machine can copy data from the source application through the private memory to obtain the payload, which is plaintext data. The payload refers to the valid data part carried in the transmission protocol. In a possible implementation, the virtual machine can generate ciphertext data and an authentication tag according to the payload through end-to-end encryption and decryption technology, and store the generated ciphertext data and authentication tag directly in the shared memory.

[0127] In order to achieve data security protection, the correct ciphertext data and verification tag must be generated during the data encryption process, and the correctness of the data decryption result depends on the integrity of the verification tag. The generation and integrity verification of the verification tag both use the ciphertext data as input data. If the ciphertext data is stored in the shared memory, the ciphertext data may be tampered with by the host machine. Since the ciphertext data will be read from the shared memory multiple times during the generation of the verification tag, the ciphertext data may be vulnerable to TOCTTOU attacks.

[0128] In order to prevent the ciphertext data from being tampered with and thus being subjected to a TOCTTOU attack, in an embodiment of the present invention, in a possible implementation, after obtaining the payload, the virtual machine may store the payload in a register, and then execute step 102. Step 102 may specifically include:

[0129] Step 1022: The virtual machine performs encryption calculation on the effective load read from the register to generate ciphertext data, and stores the ciphertext data in the register.

[0130] For example, the virtual machine may encrypt the payload using an asymmetric encryption algorithm or a symmetric encryption algorithm to generate ciphertext data. For example, the asymmetric encryption algorithm may include an RSA encryption algorithm or an elliptic curve encryption algorithm, etc.; the symmetric encryption algorithm may include an Advanced Encryption Standard (AES) encryption algorithm, etc.

[0131] Step 1024: The virtual machine generates a verification tag according to the ciphertext data read from the register.

[0132] For example, the virtual machine may perform encryption calculation on the ciphertext data through an encryption algorithm to generate a verification tag. For example, the encryption algorithm may include a Galois Counter Mode (GCM) encryption algorithm, an Electronic Code Book Mode (ECB) algorithm, a Cipher Block Chaining Mode (CBC) algorithm, a Cipher Feedback Mode (CFB) algorithm, or an Output Feedback Mode (OFB) algorithm, etc.

[0133] In the embodiment of the present invention, the encryption part code of the encryption algorithm can be modified to ensure that data is read only from the register. For example, in step 1024, the encryption part code of the Linux AES-GCM encryption algorithm can be modified to ensure that ciphertext data is read only from the register.

[0134] In an embodiment of the present invention, in a possible implementation, the virtual machine stores the payload as plaintext data in a register, and also stores the generated ciphertext data in the register. In the subsequent process of generating a verification tag based on the ciphertext data, the ciphertext data can be read from the register multiple times, thereby avoiding the problem of generating an erroneous verification tag due to the host machine tampering with the ciphertext data in the shared memory after the ciphertext data is stored in the shared memory, and avoiding the ciphertext data being tampered with by the host machine, thereby ensuring the correctness of the generated verification tag.

[0135] In an embodiment of the present invention, the virtual machine performs encryption calculation on the payload to generate ciphertext data, and can execute the step of storing the ciphertext data in the register once, so that the ciphertext data can be read from the register multiple times when generating the verification tag, thereby avoiding the ciphertext data from being tampered with by the host machine, resisting TOCTTOU attacks, and thus realizing the protection of the payload.

[0136] Step 104: The virtual machine encapsulates the ciphertext data and the verification tag to generate a data packet, the data packet includes a data header, ciphertext data and the verification tag, and the data header is stored in a private memory.

[0137] In the embodiment of the present invention, the data header is data that is not encrypted by the end-to-end encryption and decryption technology. Therefore, in order to protect the data header, the virtual machine stores the unencrypted data header in the private memory.

[0138] In a possible implementation, the data header may include a MAC address, an IP address, a TCP port, a data length, etc. The data header may also include other fields, which are not listed here one by one.

[0139] Step 106: The host copies the ciphertext data and the verification tag from the shared memory, and copies the data header from the private memory through the bounce buffer.

[0140] In the embodiment of the present invention, since the ciphertext data is encrypted data, and the verification tag is data generated based on the ciphertext data and used for verification, the security of the data is guaranteed. Therefore, the encrypted ciphertext data and the verification tag can be stored in the shared memory, and the host machine can directly copy the ciphertext data and the verification tag from the shared memory by accessing the shared memory. On the basis of ensuring the security of the data, the host machine can directly copy the ciphertext data and the verification tag from the shared memory, avoiding the additional overhead generated by copying data using a rebound buffer. In the embodiment of the present invention, since the data header is unencrypted data, the data header is stored in the private memory, and since the host machine cannot access the private memory, it still needs to copy the data header from the private memory through the rebound buffer, thereby ensuring the security of the data.

[0141] Step 108: The host sends the data packet through the I / O device.

[0142] In an embodiment of the present invention, the virtual machine stores the generated ciphertext data and verification tags in a shared memory, and the host machine can copy the ciphertext data and verification tags from the shared memory without using a bounce buffer to copy the ciphertext data and verification tags, thereby eliminating the additional I / O data processing overhead generated by using a bounce buffer to copy the ciphertext data and verification tags, thereby improving the I / O performance of the virtual machine.

[0143] Figure 2 The data processing method shown is the data transmission process in the Tx direction. Figure 1 ,right Figure 2 The data sending process in the Tx direction shown is described in detail.

[0144] like Figure 1 As shown, the end-to-end encryption and decryption module is used to generate ciphertext data and verification tags according to the payload of the source application, and store the ciphertext data and verification tags in the shared memory.

[0145] The source application can be any application. When the source application starts to send a payload from the virtual machine operating system, the end-to-end encryption and decryption module can copy data from the source application through the private memory to obtain the payload, which is plaintext data. In a possible implementation, the end-to-end encryption and decryption module can generate ciphertext data and a verification tag according to the payload through the end-to-end encryption and decryption technology, and directly store the generated ciphertext data and verification tag in the shared memory. Specifically, after the ciphertext data and the verification tag are generated, the first I / O data zero copy module in the end-to-end encryption and decryption module can be used to store the ciphertext data and the verification tag in the shared memory.

[0146] In order to prevent the ciphertext data from being tampered with and suffering from TOCTTOU attacks, in an embodiment of the present invention, the virtual machine may further include an I / O data security protection module. In a possible implementation, after the end-to-end encryption and decryption module obtains the payload, the I / O data security protection module may be used to store the payload in a register. The end-to-end encryption and decryption module is specifically used to perform encryption calculations on the payload read from the register to generate ciphertext data. The I / O data security protection module is also used to store the ciphertext data in the register. The end-to-end encryption and decryption module is specifically used to generate a verification tag based on the ciphertext data read from the register.

[0147] In an embodiment of the present invention, in a possible implementation, the I / O data security protection module stores the payload as plaintext data in a register, and also stores the generated ciphertext data in the register. The subsequent end-to-end encryption and decryption module can read the ciphertext data from the register multiple times in the process of generating a verification tag based on the ciphertext data, thereby avoiding the problem of generating an erroneous verification tag due to the host machine tampering with the ciphertext data in the shared memory after the ciphertext data is stored in the shared memory, and avoiding the ciphertext data being tampered with by the host machine, thereby ensuring the correctness of the generated verification tag.

[0148] In an embodiment of the present invention, the end-to-end encryption and decryption module performs encryption calculations on the payload to generate ciphertext data, which can be executed once by the I / O data security protection module to store the ciphertext data in the register, so that when generating the verification tag, the end-to-end encryption and decryption module can read the ciphertext data from the register multiple times, thereby preventing the ciphertext data from being tampered with by the host machine and resisting TOCTTOU attacks, thereby achieving protection of the payload.

[0149] like Figure 1 As shown, the network protocol stack module is used to encapsulate the ciphertext data to generate a data packet, the data packet includes a data header, ciphertext data and a verification tag, and the data header is stored in a private memory. In an embodiment of the present invention, the data header is not encrypted by the end-to-end encryption and decryption technology. Therefore, in order to protect the data header, the unencrypted data header can be stored in the private memory.

[0150] like Figure 1 As shown, the front-end driver module is used to send the first notification information to the back-end driver module.

[0151] In order to avoid data leakage caused by accidentally storing data in shared memory, the computer device adjusts the memory allocation strategy of the virtual machine operating system, which only allows shared memory to be obtained through explicit allocation. In other words, if and only if shared memory can be obtained from the ZCIO NUMA node through a dedicated memory allocation interface, the dedicated allocator will first try to obtain shared memory from the nearest ZCIO NUMA node. The front-end driver module checks the memory address where the data in the data packet is located. If the memory address of the data belongs to the ZCIO NUMA node, it indicates that the data includes ciphertext data and a verification tag, and the rebound buffer can be skipped; if the memory address of the data does not belong to the ZCIO NUMA node, it indicates that the data includes a data header, and the rebound buffer is not skipped. After checking the memory address where the data in the data packet is located, the front-end driver module can send a first notification message to the back-end driver module to notify the back-end driver module of relevant information that can be used to copy the data packet. For example, the first notification information includes a data memory address and a data length, wherein the data memory address may include the memory address of the ciphertext data and the verification tag and the memory address of the data header, and the data length may include the data length of the ciphertext data and the verification tag and the data length of the data header.

[0152] like Figure 1 As shown, the backend driver module is used to copy the ciphertext data and the verification tag from the shared memory according to the first notification information, and copy the data header from the private memory through the rebound buffer.

[0153] Specifically, the back-end driver can copy the ciphertext data and verification tag from the shared memory according to the memory address of the ciphertext data and verification tag and the data length of the ciphertext data and verification tag; and the back-end driver can copy the data header from the private memory through the bounce buffer according to the memory address of the data header and the data length of the data header.

[0154] In the embodiment of the present invention, since the ciphertext data is encrypted data, and the verification tag is data generated based on the ciphertext data and used for verification, the security of the data is guaranteed. Therefore, the encrypted ciphertext data and the verification tag can be stored in the shared memory, and the back-end driver module of the host machine can directly copy the ciphertext data and the verification tag from the shared memory by accessing the shared memory. On the basis of ensuring the security of the data, the back-end driver module can directly copy the ciphertext data and the verification tag from the shared memory, avoiding the additional overhead generated by copying data using a rebound buffer. In the embodiment of the present invention, since the data header is unencrypted data, the data header is stored in the private memory, and since the host machine cannot access the private memory, it is still necessary to copy the data header from the private memory through the rebound buffer, thereby ensuring the security of the data.

[0155] like Figure 1 As shown, the back-end driver module is also used to send data packets through input and output devices.

[0156] In an embodiment of the present invention, the end-to-end encryption and decryption module stores the generated ciphertext data and verification tags in a shared memory, and the back-end driver module can copy the ciphertext data and verification tags from the shared memory without using a bounce buffer to copy the ciphertext data and verification tags, thereby eliminating the additional I / O data processing overhead generated by using a bounce buffer to copy the ciphertext data and verification tags, thereby improving the I / O performance of the virtual machine.

[0157] based on Figure 1 The computer device shown in the figure, the embodiment of the present invention provides another data processing method. Figure 3 is a flow chart of a data processing method in some other embodiments, such as Figure 3 As shown, the method includes:

[0158] Step 202: The host receives an initial data packet through an input / output device.

[0159] The initial data packet includes an initial data header, initial ciphertext data, and an initial verification tag.

[0160] Step 204: The host machine pre-processes the initial data packet according to the set refresh rule.

[0161] It is very important for the host to flush data packets to the operating system of the virtual machine at the appropriate time, because network performance is very sensitive to the delay of data packets. If a data packet is cached in the backend driver of the host for too long, the receiving virtual machine may mistakenly believe that the network is blocked, thereby reducing the throughput of its congestion control. In a possible implementation, in order to flush data packets to the network protocol stack of the virtual machine in time, the computer device sets a set of basic flushing rules based on the information of the data packet to pre-process the initial data packet.

[0162] Figure 4 is a flowchart of a method for preprocessing a data packet in some embodiments, such as Figure 4 As shown, step 204 may specifically include:

[0163] Step 2042 , the host machine detects whether there is a cached data packet of the same flow as the initial data packet. If so, execute step 2044 ; if not, execute step 2050 .

[0164] In a possible implementation, a same-flow data packet refers to a data packet with the same source, destination and sequence number. Then step 2042 may specifically include: the host determines whether the received initial data packet and the cached data packet have the same header information, for example, the header may include the MAC address of the link layer (L2), the IP address of the network layer (L3) and the TCP port of the transport layer (L4), so the host can determine whether the received initial data packet and the cached data packet have the same MAC address, IP address and TCP port. If the host determines that the received initial data packet and the cached data packet have the same MAC address, IP address and TCP port, it indicates that the cached data packet is a same-flow data packet of the initial data packet, and the host detects that the initial data packet has the cached same-flow data packet, and continues to execute step 2044; if the host determines that the received initial data packet and the cached data packet do not have the same MAC address, IP address and TCP port, it indicates that the cached data packet is not a same-flow data packet of the received initial data packet, and the host detects that the initial data packet does not have the cached same-flow data packet, and continues to execute step 2050. In the embodiment of the present invention, the number of cached data packets of the same flow may be one or more.

[0165] Step 2044, the host determines whether the status information of the initial data packet is consistent with the status information of the data packet of the same flow. If so, execute step 2046; if not, execute step 2048.

[0166] For example, the data header may include a time to live (TTL) field, and the status information may include TTL. In one possible implementation, if the host machine determines that the TTL of the received initial data packet is consistent with the TTL of the same-stream data packet, indicating that the received initial data packet and the same-stream data packet can be recombined into a new data packet, then step 2046 may be continued; if the host machine determines that the TTL of the received initial data packet is inconsistent with the TTL of the same-stream data packet, indicating that the received initial data packet and the same-stream data packet cannot be recombined into a new data packet, then step 2048 may be continued.

[0167] Step 2046: The host machine merges the initial data packet with the same-flow data packet to generate a data packet.

[0168] Step 2048: The host machine uses the cached data packet of the same flow as the data packet.

[0169] After the host machine uses the cached same-flow data packet as the acquired data packet, the host machine can refresh the cached same-flow data packet to the shared memory.

[0170] Step 2050 , the host determines whether the PSH flag of the initial data packet is set, if so, execute step 2052 ; if not, execute step 2042 .

[0171] In a possible implementation, the data header of the initial data packet may include a push (PUSH, PSH) flag in TCP. If the host determines that the PSH flag is set, it indicates that the initial data packet can be immediately refreshed to the shared memory; if the host determines that the PSH flag is not set, it indicates that the initial data packet cannot be immediately refreshed to the shared memory, and the initial data packet can continue to be cached in the host, and step 2042 is continued to be executed to wait whether to merge with other data packets.

[0172] Step 2052: The host machine uses the initial data packet as a data packet.

[0173] The host uses the initial data packet as the acquired data packet so that the acquired data packet can be refreshed to the shared memory.

[0174] In the embodiment of the present invention, steps 2042 to 2052 describe a refresh rule. In practical applications, the computer device also allows each virtual machine user to customize his own refresh rule. The computer device provides a PV interface for the CVM to install the CVM's own refresh rule. For example, a virtual machine that is sensitive to delay only forwards data packets after simple processing. The virtual machine may hope that there is no delay when receiving data packets. Then the refresh rule can be set to: determine whether to refresh the initial data packet to the shared memory by judging whether the TTL of the initial data packet is consistent with the TTL of the same flow data packet. For another example, the refresh rule can be set to: prohibit the initial data packet from being merged, and the initial data packet can be directly refreshed to the shared memory. For another example, the refresh rule can be set to: set the maximum number of data packets cached by the host machine. If the number of data packets cached by the host machine reaches the maximum number, the cached data packets can be refreshed to the shared memory. For another example, the refresh rule can be set to: set the cache time threshold of the cached data packet. If the cache time of the data packet reaches the cache time threshold, the cached data packet can be refreshed to the shared memory.

[0175] Due to the limitation of the transmission size of the physical layer, a large data packet is divided into small data packets before being sent, and then the receiver re-merges the small data packets at the device driver layer to generate new data packets to reduce the number of data packets processed by the network protocol stack. However, when the number of data packets is large, if the data packets are re-merged through the front-end driver of the virtual machine, a large amount of vCPU resources will still be occupied, seriously affecting the application performance. In the embodiment of the present invention, the computer device releases valuable vCPU resources for the virtual machine. Since the back-end driver of the host machine usually has a large amount of remaining CPU resources, the pre-processing process of the initial data packet can be transferred to the back-end driver of the host machine with sufficient CPU resources, and the initial data packet is pre-processed by the back-end driver of the host machine, especially the re-merging process of the initial data packet is transferred to the back-end driver of the host machine with sufficient CPU resources, and the initial data packet is re-combined by the back-end driver of the host machine. In this way, the number of data packets processed by the virtual machine will be greatly reduced, thereby reducing the workload of the vCPU of the virtual machine.

[0176] Step 206: The host machine refreshes the acquired data packet to the shared memory, where the acquired data packet includes a data header, ciphertext data, and a verification tag.

[0177] The virtual machine can use the content of the data packet to process the data packet only after verifying the data integrity of the data header in the data packet. However, if a malicious host tampers with the data header after the virtual machine successfully verifies the data header, the virtual machine may encounter problems when processing the data packet due to the invalid data header. For example, if the virtual machine extracts data from the data packet using the modified length, a buffer overflow problem will occur. To solve the above problem, in an embodiment of the present invention, after step 206, the method further includes:

[0178] Step 2072: The virtual machine verifies the data header.

[0179] Specifically, the virtual machine may perform data integrity verification on the data header.

[0180] Step 2074: If the virtual machine successfully verifies the data header, it reads the data header from the shared memory and stores the data header in the private memory.

[0181] The virtual machine may execute the step of reading the data header from the shared memory only once. Since the amount of data in the data header is very small, the process of executing step 2074 will not cause significant performance overhead.

[0182] In one possible implementation, the virtual machine stores the data header in private memory, and all subsequent accesses to the data header will point to the private memory. Storing the data header in private memory can effectively prevent the data header from being tampered with by the host machine. The main purpose of this operation is to improve data security and reliability, and ensure the integrity and correctness of data transmission.

[0183] Step 208: The virtual machine parses the data header stored from the shared memory to the private memory to determine the target application.

[0184] The virtual machine parses the data header through private memory to determine the target application to which the data packet needs to be sent.

[0185] Step 210: If the virtual machine successfully verifies the verification tag, it decrypts the ciphertext data to obtain a payload, and stores the payload in a private memory, so as to send the payload to the target application through the private memory.

[0186] The virtual machine verifies the verification tag. Specifically, the virtual machine can generate a verification tag based on the ciphertext data, and compare the verification tag in the received data packet with the generated verification tag. If the verification tag in the received data packet is the same as the generated verification tag, the integrity verification of the verification tag is successful, indicating that the verification of the verification tag is successful, and the decryption process in step 210 is continued.

[0187] In step 210, the virtual machine implements decrypting the ciphertext data directly into the private memory, so as to send the decrypted payload to the target application through the private memory.

[0188] In order to achieve data security protection, correct ciphertext data and verification tags must be generated during the data encryption process, and the correctness of the data decryption result depends on the integrity of the verification tag. The generation and integrity verification of the verification tag both use ciphertext data as input data. If the ciphertext data is stored in shared memory, the ciphertext data may be tampered with by the host machine. For example, currently, when decrypting through the Linux AES-GCM algorithm on the x86-64 platform, the ciphertext data will be repeatedly read from the shared memory in the final stage of parallel decryption, making the ciphertext data vulnerable to TOCTTOU attacks.

[0189] To prevent the ciphertext data from being tampered with and thus being subjected to a TOCTTOU attack, in an embodiment of the present invention, before decrypting the ciphertext data to obtain the payload, the virtual machine may read the ciphertext data and the verification tag from the shared memory, store the ciphertext data and the verification tag in the register, and then execute step 210. Step 210 may specifically include:

[0190] Step 2102: The virtual machine verifies the verification tag read from the register.

[0191] Specifically, the virtual machine may generate a verification tag according to the ciphertext data read from the register, and compare the verification tag read from the register with the generated verification tag. If they are the same, it indicates that the verification of the verification tag is successful.

[0192] Step 2104: If the virtual machine successfully verifies the verification tag, it decrypts the ciphertext data read from the register to obtain the effective payload.

[0193] In an embodiment of the present invention, the virtual machine can execute reading of ciphertext data from the shared memory once and store the ciphertext data in the register, so that the ciphertext data can be read from the register multiple times during the decryption process of the ciphertext data, thereby avoiding the ciphertext data from being tampered with by the host machine, and further avoiding the reading of the tampered ciphertext data, resisting the TOCTTOU attack, and thus realizing the protection of the payload.

[0194] In the embodiment of the present invention, the host machine can refresh the acquired data packets to the shared memory, eliminating the extra I / O data processing overhead generated by using the bounce buffer to copy data, thereby improving the I / O performance of the virtual machine.

[0195] In the embodiment of the present invention, the host machine pre-processes the initial data packet according to the set refresh rules, reducing the number of data packets processed by the virtual machine, thereby reducing the workload of the vCPU of the virtual machine and further improving the I / O performance of the virtual machine.

[0196] Figure 3 and Figure 4 The data processing method shown is the data transmission process in the Rx direction. Figure 1 ,right Figure 3 and Figure 4 The data receiving process in the Rx direction shown is described in detail.

[0197] like Figure 1 As shown, the back-end driver module is used to receive the initial data packet through the input and output devices; and pre-process the initial data packet according to the set refresh rules.

[0198] Specifically, the back-end driver module includes an I / O data preprocessing module. The I / O data preprocessing module is used to detect whether there is a cached same-stream data packet in the initial data packet; if it is detected that there is a same-stream data packet in the initial data packet, determine whether the status information of the initial data packet is consistent with the status information of the same-stream data packet; if it is determined that the status information of the initial data packet is consistent with the status information of the same-stream data packet, merge the initial data packet with the same-stream data packet to generate the data packet. The I / O data preprocessing module is also used to use the cached same-stream data packet as the data packet if it is determined that the status information of the initial data packet is consistent with the status information of the same-stream data packet. In a possible implementation, the data header of the initial data packet includes a push flag, and the I / O data preprocessing module is also used to determine whether the push flag is set if it is detected that there is no same-stream data packet in the initial data packet; if it is determined that the push flag is set, use the initial data packet as the data packet.

[0199] The specific process of the back-end driver module pre-processing the initial data packet according to the set refresh rule can be found in the description of step 204, which will not be repeated here.

[0200] Figure 5 is a schematic diagram comparing the merging of data packets in the related technology in some embodiments and in the embodiments of the present invention, such as Figure 5As shown, in the related art, the initial data packet and the same-flow data packet are merged by the front-end driver module; while in the embodiment of the present invention, the initial data packet and the same-flow data packet are merged by the back-end driver module. In the embodiment of the present invention, the computer device releases valuable vCPU resources for the virtual machine. Since the back-end driver of the host machine usually has a large amount of remaining CPU resources, the preprocessing process of the initial data packet can be transferred to the back-end driver module of the host machine, and the initial data packet is preprocessed by the back-end driver module, especially the re-merging process of the initial data packet is transferred to the back-end driver module of the host machine, and the initial data packet is recombined by the back-end driver module of the host machine. In this way, the number of data packets processed by the virtual machine will be greatly reduced, thereby reducing the workload of the vCPU of the virtual machine.

[0201] like Figure 1 As shown, the back-end driver module is used to refresh the acquired data packet to the shared memory according to the second notification information sent by the front-end driver module, and the data packet includes a data header, ciphertext data and a verification tag. The back-end driver module can refresh the data packet to the shared memory through the virtual network queue of the virtual machine. Specifically, the front-end driver module is used to send the second notification information to the back-end driver module, and the second notification information includes the memory address of the shared memory to notify the back-end driver module of the memory address of the shared memory where the data packet can be placed; the back-end driver module is used to refresh the data packet to the shared memory according to the memory address of the shared memory.

[0202] like Figure 1 As shown, the front-end driver module includes a second I / O data zero copy module. The second I / O data zero copy module is used to send a second notification message to the back-end driver module; the back-end driver module refreshes the data packet to the shared memory according to the memory address of the shared memory.

[0203] The virtual machine can use the content of a data packet to process the data packet only after verifying the data integrity of the data header in the data packet. However, if a malicious host tampers with the data header after the virtual machine successfully verifies the data header, the virtual machine may encounter problems when processing the data packet due to the invalid data header. For example, if the virtual machine uses a modified length to extract data from a data packet, a buffer overflow problem will occur. To solve the above problems, in an embodiment of the present invention, the virtual machine includes an I / O data security protection module. The front-end driver module is also used to verify the data header, specifically, the front-end driver module can perform data integrity verification on the data header. The I / O data security protection module is used to read the data header from the shared memory and store the data header in the private memory if the front-end driver module successfully verifies the data header.

[0204] The I / O data security protection module can only execute the step of reading the data header from the shared memory once. Since the amount of data in the data header is very small, executing the above process will not cause significant performance overhead. The I / O data security protection module stores the data header in the private memory. After that, all access to the data header will point to the private memory. Storing the data header in the private memory can effectively prevent the data header from being tampered with by the host machine, thus realizing the protection of the data header. The main purpose of this operation is to improve data security and reliability, and ensure the integrity and correctness of data transmission.

[0205] like Figure 1 As shown, the network protocol stack module is used to parse the data header stored from the shared memory to the private memory to determine the target application. The network protocol stack module parses the data header through the private memory to determine the target application to which the data packet needs to be sent.

[0206] like Figure 1 As shown, the end-to-end encryption and decryption module is used to decrypt the ciphertext data to obtain a payload if the verification tag is successfully verified, and store the payload in the private memory, so as to send the payload to the target application through the private memory.

[0207] The end-to-end encryption and decryption module verifies the verification tag. Specifically, the end-to-end encryption and decryption module can generate a verification tag based on the ciphertext data, and compare the verification tag in the received data packet with the generated verification tag. If the verification tag in the received data packet is the same as the generated verification tag, the integrity verification of the verification tag is successful, indicating that the verification of the verification tag is successful, and the subsequent decryption process continues. The end-to-end encryption and decryption module implements the direct decryption of ciphertext data to private memory, so that the decrypted payload can be sent to the target application through the private memory.

[0208] In order to prevent the ciphertext data from being tampered with and thus suffering from a TOCTTOU attack, in an embodiment of the present invention, the virtual machine includes an I / O data security protection module. The I / O data security protection module is used to read the ciphertext data and the verification tag from the shared memory, and store the ciphertext data and the verification tag in a register.

[0209] The end-to-end encryption and decryption module is specifically used to verify the verification tag read from the register, and if the verification of the verification tag is successful, the ciphertext data read from the register is decrypted to obtain the payload. Specifically, the end-to-end encryption and decryption module can generate a verification tag according to the ciphertext data read from the register, and compare the verification tag read from the register with the generated verification tag. If they are the same, it indicates that the verification of the verification tag is successful.

[0210] In an embodiment of the present invention, the I / O data security protection module can execute once to read the ciphertext data from the shared memory and store the ciphertext data in the register, so that during the decryption process of the ciphertext data, the end-to-end encryption and decryption module can read the ciphertext data from the register multiple times, thereby avoiding the ciphertext data from being tampered with by the host machine, and further avoiding the reading of the tampered ciphertext data, resisting the TOCTTOU attack, and thus realizing the protection of the payload.

[0211] In the embodiment of the present invention, the backend driver module can copy the acquired data packets to the shared memory, eliminating the additional I / O data processing overhead generated by using the bounce buffer for data copying, thereby improving the I / O performance of the virtual machine.

[0212] In an embodiment of the present invention, the I / O data preprocessing module in the back-end driver module preprocesses the initial data packet according to the set refresh rules, reducing the number of data packets processed by the virtual machine, thereby reducing the workload of the vCPU of the virtual machine and further improving the I / O performance of the virtual machine.

[0213] To summarize, in the technical solution provided by the embodiment of the present invention, I / O data processing for confidential virtual machines is realized through I / O data zero-copy technology based on redundant encryption deduplication, TOCTTOU defense technology based on one-time trusted reading, and driver layer load optimization technology based on I / O backend preprocessing. This eliminates the overhead of additional I / O data processing while ensuring data security, reduces the workload of the vCPU of the confidential virtual machine, and thereby improves the I / O performance of the virtual machine.

[0214] An embodiment of the present invention provides a virtual machine, which includes: a front-end driver module, a network protocol stack module and an end-to-end encryption and decryption module. The end-to-end encryption and decryption module is used to generate ciphertext data and a verification tag according to the payload of the source application, and store the ciphertext data and the verification tag in the shared memory; the network protocol stack module is used to encapsulate the ciphertext data and the verification tag to generate a data packet, the data packet includes a data header, the ciphertext data and the verification tag, and the data header is stored in the private memory; the front-end driver module is used to send a first notification message to the back-end driver module of the host machine. In this embodiment, the description of each module in the virtual machine can be found in Figure 1 The description in the illustrated embodiment will not be repeated here.

[0215] An embodiment of the present invention provides a host machine, which includes: a back-end driver module. The back-end driver module is used to copy the ciphertext data and the verification tag from the shared memory according to the first notification information sent by the front-end driver module of the virtual machine, and copy the data header from the private memory through the rebound buffer. In this embodiment, the description of each module in the host machine can be found in Figure 1 The description in the illustrated embodiment will not be repeated here.

[0216] An embodiment of the present invention provides a virtual machine, which includes: a front-end driver module, a network protocol stack module and an end-to-end encryption and decryption module. The front-end driver module is used to send a second notification message to the back-end driver module of the host machine, so that the back-end driver module can refresh the acquired data packet to the shared memory according to the second notification message, and the data packet includes a data header, ciphertext data and a verification tag; the network protocol stack module is used to parse the data header stored from the shared memory to the private memory to determine the target application; the end-to-end encryption and decryption module is used to decrypt the ciphertext data to obtain a payload if the verification tag is successfully verified, and store the payload in the private memory, so as to send the payload to the target application through the private memory. In this embodiment, the description of each module in the virtual machine can be found in Figure 1 The description in the illustrated embodiment will not be repeated here.

[0217] The embodiment of the present invention provides a host machine, which includes: a back-end driver module. The back-end driver module is used to refresh the acquired data packet to the shared memory according to the second notification information sent by the front-end driver module of the virtual machine, and the data packet includes a data header, ciphertext data and a verification tag. In this embodiment, the description of each module in the host machine can be found in Figure 1 The description in the illustrated embodiment will not be repeated here.

[0218] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored program, wherein when the program is executed, a host machine where the computer-readable storage medium is located is controlled to execute various steps of a data processing method.

[0219] An embodiment of the present invention provides a computer program product including instructions. When the computer program product is run on a computer or any at least one processor, the computer is enabled to execute each step in the above data processing method embodiment.

[0220] An embodiment of the present invention provides a host machine. The host machine includes: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions, and when the instructions are executed by the host machine, the host machine can be used to perform each step in the above data processing method embodiment.

[0221] Figure 6 is a schematic diagram of a host machine provided by some embodiments, such as Figure 6 As shown, the host machine 100 includes: a processor 11, a memory 12, and a computer program 13 stored in the memory 12 and executable on the processor 11. When the computer program 13 is executed by the processor 11, the data processing method in the above-mentioned embodiment is implemented. To avoid repetition, they are not described one by one here.

[0222] The host machine 100 includes, but is not limited to, a processor 11 and a memory 12. Those skilled in the art will appreciate that Figure 6 It is only an example of the host machine 100 and does not constitute a limitation of the host machine 100. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the host machine 100 may also include input and output devices, network access devices, buses, etc.

[0223] The processor 11 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0224] The memory 12 may be an internal storage unit of the host machine 100, such as a hard disk or memory of the host machine 100. The memory 12 may also be an external storage device of the host machine 100, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the host machine 100. Furthermore, the memory 12 may also include both an internal storage unit of the host machine 100 and an external storage device. The memory 12 is used to store computer programs and other programs and data required by the host machine 100. The memory 12 may also be used to temporarily store data that has been output or is to be output.

[0225] The technical solutions and technical effects provided by the embodiments of the present invention are described in detail below through three specific embodiments.

[0226] For Example 1: Example 1 of the present invention is implemented on the AMD-Secure Encrypted Virtualization (SEV) system. Example 1 uses Linux as the virtual machine kernel and the Open vSwitch-Data Plane Development Kit (DPDK) as the back-end driver (network I / O back-end) of the host machine. In the Linux kernel, 815 lines of code are added to support ZCIO NUMA. The 851 lines of code mainly include the creation of ZCIO NUMA nodes during the initialization of the memory subsystem and the replacement of memory allocation calls. In OpenvSwitch-DPDK, 541 lines of code are added, and the 541 lines of code are composed of two parts: 1) Reorganization of network packets, which includes data header reorganization, flag reset, etc. during the data packet merging process. 2) The aforementioned refresh rules. Example 1 also adds about 175 lines of code to OpenvSwitch, which calls the interface provided by DPDK and pre-processes the network data packet (for example, parses the header in advance).

[0227] In order to demonstrate the technical effect of the first embodiment, micro-benchmark tests and real application benchmark tests were conducted.

[0228] For micro-benchmarks: First, a micro-benchmark is established to study the upper limit of the performance improvement that Bifrost can bring. Since the existing posted interrupt mechanism can already minimize the performance impact of VM sinking, the effect of Bifrost on such hardware should be focused on. In order to make the performance of confidential VMs on AMD-SEV machines close to that of hardware that supports posted interrupt mechanisms, the AMD confidential VMs can be optimized by modifying the network backend driver to reduce the frequency of VM exits. The optimized AMD confidential VM can be called CVM+RIF, and the Intel VM with posted interrupt support can be called CVM+PI. +ZC means that the VM only applies ZCIO NUMA technology (i.e., I / O data zero copy technology based on redundant encryption deduplication) and OTTR technology (i.e., TOCTTOU defense technology based on one-time trusted read), while +PRPR means that the VM only applies PRPR technology (driver layer load optimization technology based on I / O backend preprocessing). Bifrost means that the VM applies three technologies at the same time: ZCIO NUMA technology, OTTR technology, and PRPR technology. The base technology is a native technology that does not use virtualization technology.

[0229] Example 1 provides a TCP-based Transport Layer Security (TLS) client / server pair to evaluate network throughput. The client / server only contains simple single-threaded I / O data transmission and reception code. In order to fully utilize the vCPU like an I / O intensive application, four TLS server instances can be run in a virtual machine with one vCPU.

[0230] Figure 7 It is a schematic diagram of the network throughput in the Rx direction and the Tx direction in the first embodiment. Figure 7 A comparison diagram of normalized throughput in four cases in the Rx direction is shown. Figure 7 The network throughput shown in is the normalized throughput, where the baseline is the network throughput of the traditional virtual machine, that is, the network throughput of the non-CVM, and the normalized throughput of the baseline is "1" on the vertical axis. Figure 7 As shown in the figure, the normalized throughput of CVM+RIF is reduced by 24.10% compared with the normalized throughput of the baseline; through the ZCIO NUMA technology, +ZC can reduce the overhead to 7.81%; through the PRPR technology, the normalized throughput of +PRPR is increased by 21.10% compared with the normalized throughput of the benchmark 1; by combining the +ZC and +PRPR technologies, the normalized throughput of Bifrost is increased by 53.55% compared with the normalized throughput of the benchmark.

[0231] Figure 7 A comparative diagram of network throughput in the Tx direction is also shown. Figure 7 As shown in the figure, the normalized throughput of CVM+RIF is 23.03% lower than that of the baseline; +ZC can reduce the overhead to 11.37%; while the normalized throughput of +PRPR has no significant improvement in the Tx direction. The overhead of Bifrost relative to the baseline is 10.79%, which is slightly smaller than the overhead of +ZC.

[0232] like Figure 7 As shown above, in summary, Bifrost can achieve 12.24% performance improvement in the Tx direction compared to CVM+RIF. The reason why the performance improvement in the Tx direction is much smaller than that in the Rx direction is that the PRPR technology only optimizes the network throughput in the Rx direction.

[0233] For real application benchmark testing: Example 1 provides the test results of real application benchmark testing on Memcached server, Nginx server and Redis server. Figures 8a to 8c As shown, Figure 8a This is a schematic diagram of the test results of implementing a Memcached server. Figure 8b is a schematic diagram of the Nginx server in Example 1, Figure 8c It is a schematic diagram of the test results of the Redis server in Example 1.

[0234] The network throughput of the Memcached server can be measured using the "memtier_benchmark" tool. The Memcached server is configured with 1 or 4 threads in a 1vCPU or 4vCPU virtual machine and 4096MB of memory. The "memtier_benchmark" tool uses 4 clients and 16 concurrency for the 1-thread server and 8 clients and 32 concurrency for the 4-thread server. Figure 8aThe benchmark results of the Memcached server of CVM+RIF are shown. In the case of 1vCPU, 32KB and 4vCPU, 32KB, Bifrost reduces the overhead by more than half compared to CVM+RIF. In the case of 1vCPU, 32KB and 4vCPU, 32KB, both +ZC and +PRPR can slightly reduce the overhead compared to the overhead of CVM+RIF. In the case of 1vCPU, 256KB and 4vCPU, 256KB, the overhead of Bifrost is reduced by about 10% compared to the overhead of the baseline. In the case of 1vCPU, 256KB and 4vCPU, 256KB, both +ZC and +PRPR alone reduce the overhead by more than half compared to the overhead of CVM+RIF.

[0235] With the same number of vCPUs, Bifrost's performance optimization degree increases with the increase of data size. This is because the I / O overhead of CVM increases with the growth of data size, resulting in more room for performance improvement. First, the increase in data volume leads to more data copies, which increases the copy overhead of SWIOTLB. In addition, since the increase in data volume increases the amount of data transmitted and the number of packets that need to be processed, the packet processing overhead also increases. The performance optimization degree is the difference between the overhead before optimization and the overhead after optimization (ie: overhead before optimization - overhead after optimization). The overhead before optimization increases, while the overhead after optimization is always close to 0, which makes the difference larger, resulting in a higher degree of performance optimization. Figure 8a As shown, taking 1vCPU as an example, when the data size changes from 32KB to 256KB, the data size increases, and the overhead before optimization increases with the increase of data size. After optimization with Bifrost technology, the overhead after optimization is always close to 0, which makes the difference larger. Therefore, using Bifrost technology, the performance optimization degree when the data size is 256KB is improved compared with the performance optimization degree when the data size is 32KB.

[0236] The network throughput of the Nginx server in terms of requests per second (RPS) was measured by running the "wrk" benchmark tool. The Nginx server was configured with 1 or 4 threads in a 1vCPU or 4vCPU virtual machine and 4096MB of memory. The "wrk" benchmark tool used 4 clients and 16 concurrency for the 1-thread server and 8 clients and 32 concurrency for the 4-thread server. Figure 8b The following table shows the benchmark results of the CVM+RIF Nginx server. Figure 8bAs shown in the figure, for the cases of 1vCPU, 32KB, 1vCPU, 256KB, 4vCPU, 32KB, and 4vCPU, 256KB, the overhead of +ZC is significantly reduced compared to the overhead of CVM+RIF; the overhead of Bifrost is also significantly reduced compared to the overhead of CVM+RIF. Since the traffic type of the Nginx server benchmark is mainly traffic in the Tx direction, most of the performance improvement of Bifrost comes from the ZCIO NUMA technology. Compared with CVM+RIF, +ZC reduces the overhead by less than half. The overhead of Bifrost is slightly reduced compared to the overhead of +ZC because the additional VM sinking still has a great impact on the performance of these benchmarks. Compared with CVM+RIF, the PRPR technology even adds additional overhead. Because in the benchmark test after the PRPR technology is applied, there are more VM sinks, which leads to more overhead brought by the PRPR technology.

[0237] The “memtier_benchmark” tool can be used to measure the network throughput of the Redis server. The Redis server is configured with 4096MB of memory. The “memtier_benchmark” tool uses the same configuration as the Memcached server. In order to fully utilize the vCPU resources in the 4vCPU case, we used redis-cli to establish a Redis cluster with 4 instances. Figure 8c The benchmark results for Redis are shown, and the results are similar to those for the Memcached server.

[0238] In summary, according to the test results in Example 1 of the present invention, it can be seen that the solution of Example 1 of the present invention can safely transmit I / O data without using a bounce buffer, eliminates the extra overhead generated by the bounce buffer, and offloads the data packet merging operation to the CPU of the I / O backend to release a large amount of vCPU resources, thereby greatly improving the I / O performance of the confidential virtual machine.

[0239] For Example 2: Example 2 of the present invention is implemented on the Intel Trusted Domain Extensions (TDX) system. Intel TDX is a hardware extension based on the Virtual Machine Extension (VMX). TDX focuses on providing support for confidential virtual machines and achieves strong confidentiality through hardware encryption and integrity protection. To ensure confidentiality, TDX assigns a unique private key ID to each confidential virtual machine, monitors the interaction between the virtual machine and the untrusted virtual machine monitor through the TDX module, and enforces security policies. TDX protects confidential information by providing hardware-level memory encryption, thereby enhancing confidentiality and data integrity. Each confidential virtual machine has a unique private key ID, which reduces the risks of key conflicts and key security, thereby improving confidentiality.

[0240] In the implementation of Bifrost, the front-end driver module of the virtual machine in the Tx direction sinks into the TDX module by triggering the Extended Page Table (EPT) system configuration utility (Microsoft System Configuration, Misconfig), and then the TDX module injects virtual exceptions into the virtual machine to notify the virtual machine to sink. The exception handler module in the virtual machine fills the relevant parameters that need to be notified to the back-end driver module into the register and sinks to the TDX module again through TDCall. The TDX module hides the virtual machine context and forwards the request to the kernel-based virtual machine (KVM) while retaining the necessary parameter registers. KVM notifies the user-mode DPDK driver module (i.e., the back-end driver module of the host machine) to process the packet sending request based on the corresponding sinking reason and parameter register. In the Rx direction, the DPDK driver module notifies the front-end driver module of the virtual machine to receive the packet by notifying the interrupt after applying the PRPR module to pre-process the packet in advance.

[0241] In order to demonstrate the technical effect of the second embodiment, micro-benchmark tests and real application benchmark tests were conducted.

[0242] Fig. 9 Schematic diagram of normalized throughput in the Rx direction and the Tx direction in Example 2. Fig. 9As shown, in the Rx direction, CVM+PI produces a 27.03% performance overhead compared to the baseline. +ZC produces a 2.59% performance overhead relative to the baseline. The normalized throughput of +PRPR is improved by 4.95% compared to the normalized throughput of the baseline. Integrating the two technologies of +ZC and +PRPR improves the normalized throughput of Bifrost by 62.20% compared to the normalized throughput of the baseline. Therefore, Bifrost can improve the performance of confidential virtual machines in the Rx direction by 89.23% (from ordinary confidential virtual machines with a performance of -27.03% relative to the baseline to Bifrost with a performance exceeding the baseline by 62.20%, Bifrost's performance is 89.23% higher than that of ordinary confidential virtual machines). The experimental results also show that the performance improvement of combining the two technologies of +ZC and +PRPR is greater than the sum of the improvements of each technology alone. Similarly, the network throughput in the Tx direction shows similar results to the network throughput in the Rx direction.

[0243] For real application benchmark testing: Example 2 provides the test results of real application benchmark testing on Memcached server, Nginx server and Redis server. Figures 10a to 10c As shown, Fig.10a This is a diagram showing the test results of the Memcached server in Implementation 2. Fig.10b is a schematic diagram of the Nginx server in the second embodiment, Fig.10c Schematic diagram of the test results of the Redis server in Example 2. Example 2 can use the same test configuration as AMD-SEV in Example 1 to test three real applications.

[0244] like Fig.10aAs shown in Figure 1, the Memcached benchmark results for CVM+PI show that Bifrost reduces the overhead by more than half compared to CVM+PI in the case of 1vCPU, 32KB and 4vCPU, 32KB. In the case of 1vCPU, 32KB and 4vCPU, 32KB, both +ZC and +PRPR can slightly reduce the overhead compared to the overhead of CVM+RIF. In the case of 1vCPU, 256KB and 4vCPU, 256KB, Bifrost's overhead is reduced by 10% compared to the overhead of the baseline. In the case of 1vCPU, 256KB and 4vCPU, 256KB, both +ZC and +PRPR alone reduce the overhead by more than half compared to the overhead of CVM+RIF. At the same time, with the same number of vCPUs, the performance optimization of Bifrost increases with the increase of data size. This is a major reason for the performance improvement. The increase in data size leads to more data copies, which expands the copy overhead of SWIOTLB. In addition, the growth in data volume also increases the amount of data transmitted and the number of packets that need to be processed, and the processing overhead of the packets will also increase. Therefore, Bifrost's performance will be further improved in the case of big data.

[0245] By comparing different optimization modes, we can see that Bifrost has lower overhead and higher performance. By using technologies such as ZCIO NUMA and PRPR, Bifrost can further reduce overhead. In summary, Bifrost's optimization technology can significantly improve the performance and efficiency of the system. Especially when processing large amounts of data, Bifrost's performance advantage is more obvious.

[0246] Fig.10b The figure shows the test results of the Nginx server on CVM+PI. Due to the presence of ZCIO NUMA, Bifrost can reduce the overhead to less than 2.8% in all cases, and PRPR no longer has a negative impact on performance, because the performance overhead of virtual machine sinking is negligible on computer devices with notification interrupt support.

[0247] Fig.10c The benchmark results of the Redis server are shown. Fig.10a The test results of the Memcached service in are similar.

[0248] In summary, according to the test results in Example 2 of the present invention, it can be seen that the solution of Example 2 of the present invention can safely transmit I / O data without using a bounce buffer, eliminates the extra overhead generated by the bounce buffer, and offloads the data packet merging operation to the CPU of the I / O backend to release a large amount of vCPU resources, thereby greatly improving the I / O performance of the confidential virtual machine.

[0249] For Example 3: Example 3 of the present invention is implemented on the ARM Confidential Computing Architecture (CCA) system. ARM CCA introduces Realm to provide page-granular memory encryption. Realm runs in a confidential state, but can still be managed by the virtual machine monitor of the normal world (NormalWorld). For memory access, the confidential virtual machine can access its own private address space in the confidential realm, and can also realize shared memory through the address space of the normal world.

[0250] In TrustZone, secure world memory is usually statically allocated and cannot be moved dynamically. In comparison, ARM CCA is more flexible and implements page-granular memory access management by confirming access permissions for each page of physical memory through the Granule Protection Table (GPT). Because ARM CCA has finer granularity for memory access control, it can move memory between different worlds. Since the confidential domain and the secure world do not trust each other, the codes of the two cannot access each other. To ensure the security of memory, ARM CCA provides two different keys for the confidential domain and the secure world, and enforces memory integrity through hardware. This prevents unauthorized memory access between the confidential domain and the secure world, ensuring the overall security of the system.

[0251] In the implementation of Bifrost, the virtual machine in the Realm world in the Tx direction sinks to the dedicated Realm virtual machine monitor (Hypervisor) through memory-mapped I / O (MMIO). After the Realm virtual machine monitor performs a security check, it forwards the MMIO request to the virtual machine monitor in the ordinary world for specific processing by the virtual machine monitor in the ordinary world. The virtual machine monitor in the ordinary world (i.e., the virtual machine monitor of the host machine) notifies the DPDK in EL-0 (i.e., the backend driver module of the host machine) to read the data packet from the shared memory and send the data packet. Similarly, the data processing in the RX direction is similar to the data processing process in the Tx direction.

[0252] In summary, the solution of embodiment 3 of the present invention can safely transmit I / O data without using a bounce buffer, eliminates the extra overhead generated by the bounce buffer, and offloads the data packet merging operation to the CPU of the I / O backend to release a large amount of vCPU resources, thereby greatly improving the I / O performance of the confidential virtual machine.

[0253] In the embodiments of the present invention, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. A and B may be singular or plural. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c may be single or multiple.

[0254] Those skilled in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented in a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0255] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0256] In several embodiments provided by the present invention, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0257] The above is only a specific embodiment of the present invention. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A data processing method, characterized in that: The data processing method is based on a computer device, the computer device includes: a host machine and a virtual machine, the virtual machine runs on the host machine, and the computer device includes a private memory and a shared memory; The method comprises: The virtual machine generates ciphertext data and a verification tag according to the payload of the source application, and stores the ciphertext data and the verification tag in the shared memory; The virtual machine encapsulates the ciphertext data and the verification tag to generate a data packet, the data packet includes a data header, the ciphertext data and the verification tag, and the data header is stored in the private memory; The host machine copies the ciphertext data and the verification tag from the shared memory, and copies the data header from the private memory through a bounce buffer.

2. A data processing method, characterized in that: The data processing method is based on a computer device, the computer device includes: a host machine and a virtual machine, the virtual machine runs on the host machine, and the computer device includes a private memory and a shared memory; The method comprises: The host machine refreshes the acquired data packet to the shared memory, wherein the data packet includes a data header, ciphertext data and a verification tag; The virtual machine parses the data header stored from the shared memory to the private memory to determine the target application; If the virtual machine successfully verifies the verification tag, it decrypts the ciphertext data to obtain a payload, and stores the payload in the private memory, so as to send the payload to the target application through the private memory.

3. A data processing method, characterized in that: The data processing method is based on a virtual machine of a computer device, wherein the computer device includes a private memory and a shared memory; The method comprises: Generate ciphertext data and a verification tag according to the payload of the source application, and store the ciphertext data and the verification tag in the shared memory; The ciphertext data and the verification tag are encapsulated to generate a data packet, the data packet includes a data header, the ciphertext data and the verification tag, and the data header is stored in the private memory.

4. The method according to claim 1 or 3, characterized in that: Before generating the ciphertext data and the verification tag according to the payload of the source application, the method further includes: storing the payload into a register; The generating of ciphertext data and verification tags according to the payload of the source application includes: Perform encryption calculation on the effective load read from the register to generate the ciphertext data, and store the ciphertext data in the register; The verification tag is generated according to the ciphertext data read from the register.

5. A data processing method, characterized in that: The data processing method is based on a host machine of a computer device, wherein the computer device includes a private memory and a shared memory; The method comprises: The ciphertext data and the verification tag are copied from the shared memory, and the data header is copied from the private memory through a bounce buffer.

6. A data processing method, characterized in that: The data processing method is based on a host machine of a computer device, wherein the computer device includes a shared memory; The method comprises: The acquired data packet is refreshed to the shared memory, the data packet including a data header, ciphertext data and a verification tag.

7. The method according to claim 2 or 6, characterized in that: Before refreshing the acquired data packet to the shared memory, the method further includes: Receiving an initial data packet through the input and output device; The initial data packet is preprocessed according to the set refresh rule.

8. The method according to claim 7, characterized in that The preprocessing of the data packet according to the set refresh rule includes: Detecting whether there is a cached data packet of the same flow as the initial data packet; If it is detected that the initial data packet has a same-flow data packet, determining whether the state information of the initial data packet is consistent with the state information of the same-flow data packet; If it is determined that the status information of the initial data packet is consistent with the status information of the data packet of the same flow, the initial data packet is merged with the data packet of the same flow to generate the data packet.

9. The method according to claim 8, characterized in that The method further comprises: If it is determined that the state information of the initial data packet is inconsistent with the state information of the data packet of the same flow, the cached data packet of the same flow is used as the data packet.

10. The method according to claim 8 or 9, characterized in that: The data header of the initial data packet includes a push flag; the method further includes: if it is detected that the initial data packet does not have a same-flow data packet, determining whether the push PSH flag is set; If it is determined that the PSH flag is set, the initial data packet is used as the data packet.

11. A data processing method, characterized in that: The data processing method is based on a virtual machine of a computer device, wherein the computer device includes a private memory and a shared memory; The method comprises: Parsing a data header stored from the shared memory to the private memory to determine a target application; If the verification tag is successfully verified, the ciphertext data is decrypted to obtain a payload, and the payload is stored in the private memory, so as to send the payload to the target application through the private memory.

12. The method according to claim 2 or 11, characterized in that: If the verification tag is successfully verified, before decrypting the ciphertext data to obtain the effective load, the method further includes: Reading the ciphertext data and the verification tag from the shared memory, and storing the ciphertext data and the verification tag in a register; If the verification tag is successfully verified, the ciphertext data is decrypted to obtain the payload, including: said verifying the verification tag read from said register; If the verification tag is successfully verified, the ciphertext data read from the register is decrypted to obtain the effective load.

13. A virtual machine, characterized in that: include: Front-end driver module, network protocol stack module and end-to-end encryption and decryption module; The end-to-end encryption and decryption module is used to generate ciphertext data and a verification tag according to the payload of the source application, and store the ciphertext data and the verification tag in a shared memory; The network protocol stack module is used to encapsulate the ciphertext data and the verification tag to generate a data packet, the data packet includes a data header, the ciphertext data and the verification tag, and the data header is stored in a private memory; The front-end driver module is used to send first notification information to the back-end driver module of the host machine.

14. The virtual machine according to claim 13, characterized in that: The virtual machine also includes an I / O data security protection module; The I / O data security protection module is used to store the payload into a register; The end-to-end encryption and decryption module is specifically used to perform encryption calculation on the effective load read from the register to generate the ciphertext data; The I / O data security protection module is further used to store the ciphertext data into the register; The end-to-end encryption and decryption module is specifically used to generate the verification tag according to the ciphertext data read from the register.

15. A host machine, characterized in that: include: Backend driver module; The backend driver module is used to copy the ciphertext data and the verification tag from the shared memory according to the first notification information sent by the frontend driver module of the virtual machine, and copy the data header from the private memory through the rebound buffer.

16. A virtual machine, characterized in that: include: Front-end driver module, network protocol stack module and end-to-end encryption and decryption module; The front-end driver module is used to send a second notification message to the back-end driver module of the host machine, so that the back-end driver module refreshes the acquired data packet to the shared memory according to the second notification message, wherein the data packet includes a data header, ciphertext data and a verification tag; The network protocol stack module is used to parse the data header stored from the shared memory to the private memory to determine the target application; The end-to-end encryption and decryption module is used to decrypt the ciphertext data to obtain a payload if the verification tag is successfully verified, and store the payload in the private memory, so as to send the payload to the target application through the private memory.

17. The virtual machine according to claim 16, characterized in that: The virtual machine also includes an I / O data security protection module; The I / O data security protection module is used to read the ciphertext data and the verification tag from the shared memory, and store the ciphertext data and the verification tag in a register; The end-to-end encryption and decryption module is specifically used to verify the verification tag read from the register. If the verification of the verification tag is successful, the ciphertext data read from the register is decrypted to obtain the effective load.

18. A host machine, characterized in that: include: Backend driver module; The back-end driver module is used to refresh the acquired data packet to the shared memory according to the second notification information sent by the front-end driver module of the virtual machine, and the data packet includes a data header, ciphertext data and a verification tag.

19. The host machine according to claim 18, characterized in that: The back-end driver module is used to receive an initial data packet through the input and output device; and pre-process the initial data packet according to a set refresh rule.

20. The host machine according to claim 19, characterized in that: The back-end driver module includes an I / O data preprocessing module; The I / O data preprocessing module is used to detect whether there is a cached same-flow data packet in the initial data packet; If it is detected that the initial data packet has a same-flow data packet, determining whether the state information of the initial data packet is consistent with the state information of the same-flow data packet; If it is determined that the status information of the initial data packet is consistent with the status information of the data packet of the same flow, the initial data packet is merged with the data packet of the same flow to generate the data packet.

21. A host machine, characterized in that: include: one or more processors; Memory; And one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions, which, when executed by the host machine, enable the host machine to execute the data processing method according to claim 5 or the data processing method according to any one of claims 6 to 10.

Images