Request processing method and device and related equipment

Abstract

The invention provides a request processing method and device and related equipment, and relates to the technical field of security and confidential calculation. The method comprises the steps that under the condition that an application program request in a data flow is received, an available thread corresponding to the application program request is determined in a thread pool, and the thread pool and the enclave pool are the thread pool and the enclave pool which are created when the first application program request in the data flow is received; determining an available enclave corresponding to the available thread in an enclave pool; processing the application program request based on the available enclave; and after all application program requests in the data stream are processed, releasing the thread pool and the enclave pool. By maintaining a batch of available threads and available enclaves for reuse of application requests in a data stream, resource overhead caused by repeated creation and destruction of the threads and enclaves can be saved, so that the load of a CPU is reduced when the CPU responds to a large number of requests.

Description

Technical Field

[0001] The present application relates to the technical field of security and confidential computing, and in particular to a request processing method, apparatus and related equipment. Background Art

[0002] In order to support and build a confidential environment for operating systems, software libraries, and applications to ensure the trusted execution and processing of sensitive user data (such as personal photos, passwords, calendars, medical and banking data to work-related information), many server manufacturers have released confidential computing technologies with their own characteristics and application scenarios, such as Intel Software Guard Extensions (SGX) technology, which uses a secure isolation area called an enclave to implement encryption protection for the code and data content running in the area.

[0003] It is found in the application that the standard enclave management strategy will create a new enclave for each application request, and after the application request is processed, the created enclave will be destroyed. Since the creation and destruction of enclaves will generate additional performance overhead and central processing unit (CPU) load, therefore, in a high-concurrency scenario, when facing a large number of application requests, the enclave creation and destruction operations based on the aforementioned enclave management strategy will cause a serious degradation of application performance.

[0004] In other words, the enclave management strategy provided by the related art places a high load on the CPU. Summary of the invention

[0005] The purpose of the present application is to provide a request processing method, apparatus and related equipment to solve the technical problem that the enclave management strategy provided by the related technology has a high CPU load.

[0006] In a first aspect, an embodiment of the present application provides a request processing method, the method comprising:

[0007] In the case of receiving an application request in a data stream, determining an available thread corresponding to the application request in a thread pool, wherein the data stream includes at least two different application requests and the thread pool is a thread pool created when the first application request in the data stream is received;

[0008] determining an available enclave corresponding to the available thread in an enclave pool, wherein the enclave pool is an enclave pool created when a first application request in the data stream is received;

[0009] processing the application request based on the available enclaves;

[0010] After completing the processing of all application requests in the data stream, the resources occupied by the thread pool and the resources occupied by the enclave pool are released.

[0011] In a second aspect, an embodiment of the present application provides a request processing device, the device comprising:

[0012] a thread determination module, configured to determine, in a thread pool, an available thread corresponding to an application request in a case where the application request in the data stream is received, wherein the data stream includes at least two different application requests, and the thread pool is a thread pool created when the first application request in the data stream is received;

[0013] an enclave determination module, configured to determine an available enclave corresponding to the available thread in an enclave pool, wherein the enclave pool is an enclave pool created when a first application request in the data stream is received;

[0014] a request processing module, configured to process the application request based on the available enclaves;

[0015] A resource recovery module is used to release the resources occupied by the thread pool and the resources occupied by the enclave pool after completing the processing of all application requests in the data stream.

[0016] In a third aspect, the present application provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the method described in the first aspect when executed by the processor.

[0017] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0018] In a fifth aspect, the present application provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the method described in the first aspect.

[0019] In the present application, based on the setting of the thread pool and the enclave pool, a batch of available threads and available enclaves are maintained for repeated use by application requests in the data stream, thereby eliminating the resource overhead caused by repeated creation and destruction of threads and enclaves, so as to reduce the load of the CPU when responding to a large number of requests, and for each application request, there are generally multiple available threads and available enclaves that can be selected, so that the time overhead of waiting for threads and / or enclaves can be saved, which can further reduce the load of the CPU. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flowchart of a request processing method provided in an embodiment of the present application;

[0021] Figure 2 is an architecture diagram corresponding to an enclave management method provided in an embodiment of the present application;

[0022] Figure 3 is a structural diagram of a request processing device provided in an embodiment of the present application;

[0023] Figure 4 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] The present application embodiment provides a request processing method, such as Figure 1 As shown, the method includes:

[0026] Step 101: When an application request is received in a data stream, an available thread corresponding to the application request is determined in a thread pool.

[0027] The data stream includes at least two different application requests, and the thread pool is a thread pool created when the first application request in the data stream is received.

[0028] The above data stream can be understood as a set of at least two application requests initiated by one or more applications in a continuous period of time. It should be understood that different application requests in the above data stream can come from the same application (Application, APP) or from different applications.

[0029] In the present application, the application request can be understood as a request to read and write private data and / or use private data. For example, the private data includes but is not limited to personal photos, passwords, calendars, medical and banking data, work-related data, etc.

[0030] Step 102: Determine an available enclave corresponding to the available thread in the enclave pool.

[0031] The enclave pool is an enclave pool created when the first application request in the data stream is received.

[0032] The enclave pool includes multiple enclaves, which are generated based on Intel Software Guard Extensions (SGX) technology, allowing user mode and kernel mode codes to be defined in a specific security isolation area to achieve encryption protection of the code and data content running in the area. The enclave cannot be accessed by any process other than itself (including processes running at a higher privilege level).

[0033] The available threads referred to in step 102 are specifically the available threads that are determined to have a corresponding relationship with the application request in step 101 .

[0034] It should be understood that the correspondence between the available enclaves in the enclave pool and the available threads in the thread pool is not pre-set, but is dynamically determined based on the available threads corresponding to the actual application request after determining the corresponding available threads. That is to say, during the existence of the enclave pool, the available enclaves in the enclave pool can establish a correspondence with multiple available threads in the thread pool one after another, which can avoid direct connection between threads and enclaves, so as to flexibly schedule multiple available threads and multiple available enclaves, and further reduce the response time of application requests.

[0035] In some embodiments, the interaction between the thread pool and the enclave pool can be proxied to uniformly manage all threads corresponding to application requests in the thread pool, and the mapping between available enclaves and application requests can be efficiently completed in a distributed collaborative manner based on the parameters contained in each thread corresponding to the application request by verifying the parameters contained in the thread corresponding to the application request.

[0036] In the application, each application request in the data stream can be set to correspond to an available thread in the thread pool, and different application requests at the same time correspond to different available threads, and each application request in the data stream can be set to correspond to an available enclave in the enclave pool, and different application requests at the same time correspond to different available enclaves, so as to map and bind each application request to be processed to an available thread in the thread pool one by one, thereby avoiding information leakage between threads in a multi-threaded scenario and ensuring data security within the enclave.

[0037] The different available threads corresponding to different application requests at the same time should be understood as: when the number of available threads is greater than or equal to the number of pending application requests, each of the multiple application requests can directly determine the corresponding available thread;

[0038] When the number of available threads is less than the number of pending application requests, some of the multiple application requests can directly determine the corresponding available threads, while the other application requests need to wait for a period of time until the occupied threads become available threads again before determining the corresponding available threads.

[0039] Similarly, different available enclaves corresponding to different application requests at the same time should be understood as: when the number of available enclaves is greater than or equal to the number of pending application requests, each of the multiple application requests can directly determine the corresponding available enclave;

[0040] When the number of available enclaves is less than the number of pending application requests, some of the multiple application requests can directly determine the corresponding available enclaves, while the other application requests need to wait for a period of time until the occupied enclave becomes an available enclave again before determining the corresponding available enclave.

[0041] In this implementation, by setting a one-to-one mapping between application requests and available threads, and a one-to-one mapping between available threads mapped with application requests and available enclaves, security vulnerabilities between threads can be effectively avoided, and data security within the enclave can be guaranteed.

[0042] Step 103: Process the application request based on the available enclaves.

[0043] Step 104: After completing the processing of all application requests in the data stream, release the resources occupied by the thread pool and the resources occupied by the enclave pool.

[0044] In the present application, based on the setting of the thread pool and the enclave pool, a batch of available threads and available enclaves are maintained for repeated use by application requests in the data stream, thereby eliminating the resource overhead caused by repeated creation and destruction of threads and enclaves, so as to reduce the load of the CPU when responding to a large number of requests, and for each application request, there are generally multiple available threads and available enclaves that can be selected, so that the time overhead of waiting for threads and / or enclaves can be saved, which can further reduce the load of the CPU.

[0045] In particular, in a multi-threaded high-concurrency request interaction scenario, based on the above settings, multiple available threads and multiple available enclaves are provided for each pending application request to be processed, which can reduce the resource overhead caused by frequent creation and destruction of enclaves while responding to a larger number of application requests, thereby improving the CPU concurrency speed.

[0046] After completing the processing of all application requests in the data stream, by timely releasing the resources occupied by the thread pool and the resources occupied by the enclave pool, the resource overhead and energy consumption of the CPU during the sleep period when no application request is received and / or the non-private data processing period are reduced.

[0047] In the application, a waiting time can be set. When all application requests in the data stream are processed and no new application request is received within the waiting interval indicated by the waiting time, the resources occupied by the thread pool and the resources occupied by the enclave pool are released;

[0048] If a new application request is received within the waiting interval indicated by the waiting time length, the newly received application request continues to be processed based on the thread pool and the enclave pool until the last application request is processed, and then the process again waits for receiving a new application request within the waiting interval indicated by the waiting time length.

[0049] In one embodiment, when receiving an application request in a data stream, before determining an available thread corresponding to the application request in a thread pool, the method further includes:

[0050] When receiving the first application request in the data stream, create the thread pool and the enclave pool according to preset initialization information, wherein the initialization information is used to indicate the number of threads included in the thread pool and the number of enclaves included in the enclave pool;

[0051] According to the preset suspension information, resources are suspended for the threads in the thread pool and the enclaves in the enclave pool, respectively, wherein the available threads include threads that are not suspended in the thread pool, and the available enclaves include enclaves that are not suspended in the enclave pool, and the suspension information is used to indicate: the number of suspended threads in the thread pool, and the number of suspended enclaves in the enclave pool.

[0052] Compared with unsuspended threads and enclaves, the resource overhead of suspended threads and enclaves is smaller. In this embodiment, after creating the thread pool and enclave pool, more enclave page cache (EPC) resources are reserved by suspending some threads in the thread pool and some enclaves in the enclave pool. In the non-peak phase of application requests, the normal resource overhead of maintaining the thread pool and the enclave pool is reduced. In the peak phase of application requests, the suspended threads and enclaves are adaptively awakened and buffered in time to dynamically match the surge in application requests. In the process of maintaining the thread pool and the enclave pool for a long time, the overall resource overhead is reduced, and flexible adaptation to the number of application requests is achieved.

[0053] In the application, the initialization information and suspension information may be manually set by the user based on experience, or may be determined by setting a program or model to collect changes in the number of past application program requests and analyzing the changes accordingly.

[0054] For example, the number of threads in the thread pool and the number of enclaves in the enclave pool indicated by the initialization information may both be the number of CPU cores + 1, and the number of suspended threads in the thread pool and the number of suspended enclaves in the enclave pool indicated by the suspension information may both be half of the number of CPU cores.

[0055] In one embodiment, after suspending resources of threads in the thread pool and enclaves in the enclave pool according to preset suspension information, the method further includes:

[0056] In a case where the first number is greater than the second number, and the number of suspended threads that can be awakened in the thread pool is greater than or equal to the difference between the first number and the second number, awakening a third number of suspended threads in the thread pool, the sum of the third number and the second number being greater than or equal to the first number, the available threads including the awakened suspended threads, wherein the first number is used to indicate the number of application requests to be processed in the data stream, and the second number is used to indicate the number of available threads in the thread pool;

[0057] In the case where the first number is greater than the fourth number, and the number of suspended takeoffs that can be awakened in the enclave pool is greater than or equal to the difference between the first number and the fourth number, a fifth number of suspended takeoffs are awakened in the enclave pool, the sum of the fourth number and the fifth number is greater than or equal to the first number, and the available enclaves include the awakened suspended takeoffs, wherein the third number is used to indicate the number of available enclaves in the enclave pool.

[0058] It should be understood that, in this embodiment, after the awakened suspended thread completes processing the corresponding application request, if the first number at the current moment is less than or equal to the second number, the awakened suspended thread can be suspended again to save resource overhead for keeping the thread active; if the first number at the current moment is still greater than the second number, the awakened suspended thread is not processed so that the awakened suspended thread can be used by other pending application requests until the first number at a certain moment in the future is less than or equal to the second number, then the awakened suspended thread can be suspended again;

[0059] Similarly, after the awakened suspended takeoff completes processing the corresponding application request, if the first number at the current moment is less than or equal to the second number, the awakened suspended takeoff can be suspended again to save resource overhead for keeping the enclave active; if the first number at the current moment is still greater than the second number, the awakened suspended takeoff is not processed so that the awakened suspended takeoff can be used by other pending application requests until the first number is less than or equal to the second number at a certain moment in the future, and then the awakened suspended takeoff can be suspended again.

[0060] In this embodiment, the above configuration is used to fully utilize EPC resources, and while flexibly and quickly responding to application requests, the overall resource overhead of maintaining the thread pool and enclave pool for a long time is reduced.

[0061] In one embodiment, when the first number is greater than the second number, and the number of suspended threads that can be awakened in the thread pool is less than the difference between the first number and the second number, all suspended threads in the thread pool are awakened, and new threads are created, wherein the sum of the second number, the number of suspended threads in the thread pool, and the number of newly created threads is equal to the first number;

[0062] When the first number is greater than the fourth number and the number of suspended takeoffs that can be awakened in the enclave pool is less than the difference between the first number and the fourth number, all suspended takeoffs in the enclave pool are awakened, and a new enclave is created, wherein the sum of the fourth number, the number of suspended takeoffs in the enclave pool, and the number of created new enclaves is equal to the first number.

[0063] In this embodiment, when the resources in the thread pool and / or enclave pool cannot quickly respond to a large number of application requests at the current moment, new enclaves and / or threads are created to ensure rapid response to a large number of application requests, so as to adapt to high-concurrency multi-threading situations in extreme scenarios and enhance the applicability of the method described in this application.

[0064] It should be understood that, after processing the corresponding application request, the newly created thread will be incorporated into the thread pool and suspended to achieve flexible expansion of the thread pool. Among them, the newly created thread will be incorporated into the thread pool and start timing after being suspended. If the timing time exceeds the set time threshold (such as 5 seconds, 30 seconds, etc.) and has not been awakened, the newly created thread can be destroyed to save the resource overhead of maintaining the newly created thread; if it is awakened within the set time (such as 5 seconds, 30 seconds, etc.), the timing will be restarted after the newly created thread is suspended again, and the above process will be repeated until the newly created thread is destroyed.

[0065] Similarly, after the newly created enclave has processed the corresponding application request, it will be incorporated into the enclave pool and suspended to achieve flexible expansion of the enclave pool. In this case, the newly created enclave will be incorporated into the enclave pool and suspended and then start timing. If the timing time exceeds the set time threshold (such as 5 seconds, 30 seconds, etc.) and has not been awakened, the newly created enclave can be destroyed to save the resource overhead of maintaining the newly created enclave; if it is awakened within the set time (such as 5 seconds, 30 seconds, etc.), the newly created enclave will be suspended again and the timing will be restarted, and the above process will be repeated until the newly created enclave is destroyed.

[0066] In one embodiment, the enclave pool includes occupied enclaves; and the method further comprises:

[0067] collecting the usage status of the occupied enclave in real time;

[0068] When the usage status indicates that the application request corresponding to the occupied enclave has been completed, the stack content of the occupied enclave is cleared to convert the occupied enclave into the available enclave.

[0069] The occupied enclave may be understood as an enclave that is determined to have a corresponding application request.

[0070] In this embodiment, the occupied enclave is converted into an available enclave only when the corresponding application request has been processed and the stack content of the occupied enclave has been cleared, so as to ensure that the same enclave will not leak information when it is allocated to process different application requests at different times, which effectively ensures the security of the data processed in the enclave.

[0071] In the application, the stack contents of the occupied enclave can be cleared through the SGX driver.

[0072] For ease of understanding, the following examples are provided:

[0073] like Figure 2 As shown, the resource management module, thread pool, enclave service management module, enclave pool, and enclave memory recovery module can be set to cooperate with each other to significantly reduce the creation and destruction time of a large number of enclaves, reduce CPU load, and save system overhead costs when the application is in a high-concurrency, multi-threaded environment; and support the safe operation of a large number of identical and different application instances on multiple enclaves.

[0074] Specifically:

[0075] The resource management module is used to record or store all metadata of the thread pool and resource pool, monitor the running status of the thread pool and enclave pool, receive CPU information to send instructions to control the creation and destruction of the thread pool and enclave pool, and notify the memory management module in time to clear the stack content of the enclave after a certain enclave is used up.

[0076] The thread pool includes a series of pre-allocated suspended thread structures, which are used to manage the allocation of existing thread resources and support the creation and destruction of new threads. For example, when all currently suspended threads are in use, the thread pool can control the creation and destruction of new threads. A thread is associated / corresponds / mapped to an APP request. After the APP request currently associated with a thread is processed, the thread pool can allocate another APP request to the thread.

[0077] The enclave pool includes a series of pre-allocated hanging enclave structures, which are used to manage the allocation of existing enclave resources and support the creation and destruction of new enclaves. The pre-allocated enclaves are concentrated to construct the fixed address area of ​​the enclave pool. All ECALLs in the fixed area are predefined.

[0078] The enclave service management module is used to provide a means for threads associated with application requests to communicate securely with the enclave and manage the life cycle of the enclave. This module centralizes all requests from the thread pool in a proxy, is responsible for verifying the request parameters, then forwarding it to the corresponding enclave, and returning the corresponding response to the requesting application.

[0079] The enclave memory management module is used to call the SGX underlying driver to clear the stack content of a specific enclave in the enclave pool after use, so that the information of the previous application will not be leaked when the specific enclave is subsequently used by other applications.

[0080] based on Figure 2 The process of enclave resource management in the shown architecture can be:

[0081] In the initialization phase, that is, when the first application request in the data stream is received, the operating system calls the resource manager to create the aforementioned thread pool and enclave pool. For CPU-intensive tasks, the sizes of the thread pool and enclave pool can be set to the number of CPU cores plus 1, that is, N core +1, where N core That is the number of CPU cores;

[0082] Suspend half of the resources in the enclave pool and thread pool, that is, the number of suspended threads and suspended enclaves is N core / 2, which can reserve more EPC resources for the unfixed area, so that when a sudden increase in requests occurs in the future, the remaining resources can be awakened for timely buffering.

[0083] After the operations in the aforementioned initialization phase are completed, the program running phase is performed, in which the data flow is mapped and bound one by one to the multiple pending application requests at the current moment and the available threads in the thread pool: App[i]→Thread(i), APP[i] indicates the i-th application request among the multiple pending application requests at the current moment, and Thread(i) indicates an available thread in the thread pool at the current moment that is mapped and bound to the i-th application request. Based on the above mapping and binding processing, a thread lock can be set during multi-threaded operations to prevent information leakage between threads.

[0084] After that, when the number of threads (ie, application requests) of the requesting program is monitored, T < N core / 2, there is no need to wake up the suspended threads and enclaves; and when the number of threads of the requesting program T>N core / 2, it is necessary to revive the suspended threads and enclaves as a supplement so that the number of threads and enclaves M that can respond to program requests exceeds the number T requested by the application.

[0085] The Enclave service management module manages T applications to M (M<N) in a distributed collaborative manner according to the parameters contained in the thread (i.e., application request). core ) enclaves, and the Enclave service management module will quickly assign these requests to the corresponding enclaves.

[0086] In the above process, the usage status of the enclave is fed back to the resource management module in real time. The resource management module identifies the identification code of the specific enclave that has processed the application after analysis, and informs the memory recycling module of the identification code, so that the recycling module clears the stack content of the aforementioned specific enclave by calling the SGX driver to prevent the encrypted information in the previous thread from being obtained by the subsequent thread.

[0087] When all requests are completed, the resource management module can be called to release the resources occupied by the thread pool and enclave pool.

[0088] The pseudo code corresponding to the above process can be:

[0089]

[0090]

[0091] The first line of pseudocode is used to initialize the enclave pool, and the initialization size is N. core +1, the second line of pseudo code is used to initialize the thread pool, the initialization size is N core+1, the third line of pseudo code is used to suspend half of the enclaves in the enclave pool and half of the threads in the thread pool, the fourth line of pseudo code is used to calculate the number of waiting threads, and the fifth to tenth lines of pseudo code are used for the function body of the service management module function, which is specifically used to wake up the suspended threads as a buffer when the number of waiting threads exceeds the current number of threads, otherwise it will not wake up.

[0092] Based on the above settings, the resource overhead and time consumption caused by the creation and destruction of enclaves can be effectively reduced when responding to user requests to process private data, especially in a high-concurrency, multi-threaded environment, reducing the CPU load and ensuring that a large number of identical and different application instances can run safely on multiple enclaves.

[0093] In applications, the method described in this application can be applied to the relevant products of cloud vendors to build a secure operating system, perform security enhancements at all levels of the operating system and application programs, and gradually build and improve mobile cloud confidential computing capabilities based on a variety of confidential computing technologies for users' high-security business scenarios, providing a solid foundation for users' data security. For example, it can be applied to computing scenarios with high security requirements such as party and government, and finance.

[0094] See also Figure 3 , Figure 3 is a request processing device provided in an embodiment of the present application, such as Figure 3 As shown, the request processing device 300 includes:

[0095] A thread determination module 301 is used to determine, in a thread pool, an available thread corresponding to an application request in a case where the application request in the data stream is received, wherein the data stream includes at least two different application requests, and the thread pool is a thread pool created when the first application request in the data stream is received;

[0096] an enclave determination module 302, configured to determine an available enclave corresponding to the available thread in an enclave pool, wherein the enclave pool is an enclave pool created when a first application request in the data stream is received;

[0097] A request processing module 303, configured to process the application request based on the available enclaves;

[0098] The resource recovery module 304 is used to release the resources occupied by the thread pool and the resources occupied by the enclave pool after completing the processing of all application requests in the data stream.

[0099] In one embodiment, the request processing device 300 further includes an initialization module, and the initialization module is used to:

[0100] When receiving the first application request in the data stream, create the thread pool and the enclave pool according to preset initialization information, wherein the initialization information is used to indicate the number of threads included in the thread pool and the number of enclaves included in the enclave pool;

[0101] According to the preset suspension information, resources are suspended for the threads in the thread pool and the enclaves in the enclave pool, respectively, wherein the available threads include threads that are not suspended in the thread pool, and the available enclaves include enclaves that are not suspended in the enclave pool, and the suspension information is used to indicate: the number of suspended threads in the thread pool, and the number of suspended enclaves in the enclave pool.

[0102] In one embodiment, the request processing device 300 further includes a first buffer module, and the first buffer module is used to:

[0103] In a case where the first number is greater than the second number, and the number of suspended threads that can be awakened in the thread pool is greater than or equal to the difference between the first number and the second number, awakening a third number of suspended threads in the thread pool, the sum of the third number and the second number being greater than or equal to the first number, the available threads including the awakened suspended threads, wherein the first number is used to indicate the number of application requests to be processed in the data stream, and the second number is used to indicate the number of available threads in the thread pool;

[0104] In the case where the first number is greater than the fourth number, and the number of suspended takeoffs that can be awakened in the enclave pool is greater than or equal to the difference between the first number and the fourth number, a fifth number of suspended takeoffs are awakened in the enclave pool, the sum of the fourth number and the fifth number is greater than or equal to the first number, and the available enclaves include the awakened suspended takeoffs, wherein the third number is used to indicate the number of available enclaves in the enclave pool.

[0105] In one embodiment, the request processing device 300 further includes a second buffer module, and the second buffer is used to:

[0106] In a case where the first number is greater than a second number, and the number of suspended threads that can be awakened in the thread pool is less than a difference between the first number and the second number, awakening all suspended threads in the thread pool and creating new threads, wherein the sum of the second number, the number of suspended threads in the thread pool, and the number of created new threads is equal to the first number;

[0107] When the first number is greater than the fourth number and the number of suspended takeoffs that can be awakened in the enclave pool is less than the difference between the first number and the fourth number, all suspended takeoffs in the enclave pool are awakened, and a new enclave is created, wherein the sum of the fourth number, the number of suspended takeoffs in the enclave pool, and the number of created new enclaves is equal to the first number.

[0108] In one embodiment, the enclave pool includes occupied enclaves; the request processing device 300 further includes a clearing module, the clearing module being used to:

[0109] collecting the usage status of the occupied enclave in real time;

[0110] When the usage status indicates that the application request corresponding to the occupied enclave has been completed, the stack content of the occupied enclave is cleared to convert the occupied enclave into the available enclave.

[0111] In one embodiment, each application request in the data stream corresponds to an available thread in the thread pool, and different application requests correspond to different available threads at the same time.

[0112] The request processing device 300 provided in the embodiment of the present application can implement each process in the above-mentioned request processing method embodiment. To avoid repetition, it will not be described here.

[0113] According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0114] Figure 4 A schematic block diagram of an example electronic device 400 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0115] like Figure 4As shown, the device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 to a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0116] A number of components in the device 400 are connected to the I / O interface 405, including: an input unit 406, such as a keyboard, a mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a disk, an optical disk, etc.; and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 409 allows the device 400 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0117] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSP), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above, such as the request processing method. For example, in some embodiments, the request processing method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 400 via the ROM 402 and / or the communication unit 409. When the computer program is loaded into the RAM 403 and executed by the computing unit 401, one or more steps of the request processing method described above may be executed. Alternatively, in other embodiments, the computing unit 401 may be configured to execute the request processing method in any other appropriate manner (eg, by means of firmware).

[0118] Various embodiments of the systems and techniques described above herein may be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0119] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0120] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0121] As used herein, the term "machine-readable medium" refers to any computer program product, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0122] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0123] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0124] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0125] The present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above Figure 1 or Figure 2The various processes of the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0126] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0127] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A request processing method, characterized in that: The method comprises: In the case of receiving an application request in a data stream, determining an available thread corresponding to the application request in a thread pool, wherein the data stream includes at least two different application requests and the thread pool is a thread pool created when the first application request in the data stream is received; determining an available enclave corresponding to the available thread in an enclave pool, wherein the enclave pool is an enclave pool created when a first application request in the data stream is received; processing the application request based on the available enclaves; After completing the processing of all application requests in the data stream, the resources occupied by the thread pool and the resources occupied by the enclave pool are released.

2. The method according to claim 1, characterized in that In the case of receiving an application request in the data stream, before determining an available thread corresponding to the application request in the thread pool, the method further includes: When receiving the first application request in the data stream, create the thread pool and the enclave pool according to preset initialization information, wherein the initialization information is used to indicate the number of threads included in the thread pool and the number of enclaves included in the enclave pool; According to the preset suspension information, resources are suspended for the threads in the thread pool and the enclaves in the enclave pool, respectively, wherein the available threads include threads that are not suspended in the thread pool, and the available enclaves include enclaves that are not suspended in the enclave pool, and the suspension information is used to indicate: the number of suspended threads in the thread pool, and the number of suspended enclaves in the enclave pool.

3. The method according to claim 2, characterized in that After suspending resources of threads in the thread pool and enclaves in the enclave pool respectively according to preset suspension information, the method further includes: In a case where the first number is greater than the second number, and the number of suspended threads that can be awakened in the thread pool is greater than or equal to the difference between the first number and the second number, awakening a third number of suspended threads in the thread pool, the sum of the third number and the second number being greater than or equal to the first number, the available threads including the awakened suspended threads, wherein the first number is used to indicate the number of application requests to be processed in the data stream, and the second number is used to indicate the number of available threads in the thread pool; In the case where the first number is greater than the fourth number, and the number of suspended takeoffs that can be awakened in the enclave pool is greater than or equal to the difference between the first number and the fourth number, a fifth number of suspended takeoffs are awakened in the enclave pool, the sum of the fourth number and the fifth number is greater than or equal to the first number, and the available enclaves include the awakened suspended takeoffs, wherein the third number is used to indicate the number of available enclaves in the enclave pool.

4. The method according to claim 3, characterized in that In a case where the first number is greater than a second number, and the number of suspended threads that can be awakened in the thread pool is less than a difference between the first number and the second number, awakening all suspended threads in the thread pool and creating new threads, wherein the sum of the second number, the number of suspended threads in the thread pool, and the number of created new threads is equal to the first number; When the first number is greater than the fourth number and the number of suspended takeoffs that can be awakened in the enclave pool is less than the difference between the first number and the fourth number, all suspended takeoffs in the enclave pool are awakened, and a new enclave is created, wherein the sum of the fourth number, the number of suspended takeoffs in the enclave pool, and the number of created new enclaves is equal to the first number.

5. The method according to any one of claims 1 to 4, characterized in that The enclave pool includes occupied enclaves; and the method further includes: collecting the usage status of the occupied enclave in real time; When the usage status indicates that the application request corresponding to the occupied enclave has been completed, the stack content of the occupied enclave is cleared to convert the occupied enclave into the available enclave.

6. The method according to claim 1, characterized in that Each application request in the data stream corresponds to an available thread in the thread pool, and different application requests correspond to different available threads at the same time.

7. A request processing device, characterized in that: The device comprises: a thread determination module, configured to determine, in a thread pool, an available thread corresponding to an application request in a case where the application request in the data stream is received, wherein the data stream includes at least two different application requests, and the thread pool is a thread pool created when the first application request in the data stream is received; an enclave determination module, configured to determine an available enclave corresponding to the available thread in an enclave pool, wherein the enclave pool is an enclave pool created when a first application request in the data stream is received; a request processing module, configured to process the application request based on the available enclaves; A resource recovery module is used to release the resources occupied by the thread pool and the resources occupied by the enclave pool after completing the processing of all application requests in the data stream.

8. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the method according to any one of claims 1 to 6 when executed by the processor.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The method comprises computer instructions, which implement the method according to any one of claims 1 to 6 when executed by a processor.

Images