Data secrecy method, related device and system

Abstract

The invention provides a data secrecy method, a related device and a system, the method relates to the field of virtualization, the method is applied to heterogeneous equipment, part of hardware resources or all hardware resources in the heterogeneous equipment are divided into a trusted execution environment (TEE) side, confidential data are preset on the TEE side of the heterogeneous equipment, and the confidential data are stored in the TEE side of the heterogeneous equipment. The method comprises the steps that a processor of heterogeneous equipment verifies whether a virtual machine running on a TEE side of a host can acquire confidential data in the heterogeneous equipment or not on the TEE side; and when it is verified that the virtual machine running on the TEE side of the host cannot obtain the confidential data, the TEE side of the heterogeneous device receives an access request of the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device. By implementing the embodiment of the invention, the confidential data can be protected from being leaked and stolen.

Description

Technical Field

[0001] The present application relates to the field of virtualization, and in particular to a data confidentiality method, related devices and systems. Background Art

[0002] Confidential computing is a computing model that builds an encrypted, isolated, and provable computing environment based on trusted hardware, combined with firmware and software to ensure the confidentiality and integrity of data in the environment, as well as the confidentiality of the computing process. Through the isolation mechanism, the general computing environment is separated from the confidential computing environment, and unauthorized applications cannot access the confidential computing environment; by verifying the applications running in the confidential computing environment, the integrity and legitimacy of the program are guaranteed; through the encryption mechanism, it is ensured that the calculation in the memory is in an encrypted form to prevent privileged software or even hardware from snooping.

[0003] The foundation of confidential computing technology lies in the trusted execution environment (TEE) of the hardware architecture. Through the hardware-based isolation mechanism, it is ensured that the code and data running in the TEE cannot be accessed or tampered with by untrusted code.

[0004] For large-scale computing scenarios such as machine learning and neural networks, confidential computing can be applied to heterogeneous systems. However, the current trusted execution environment technology cannot meet the needs of confidential data owners to protect confidential data from being stolen. Summary of the invention

[0005] The present application provides a data confidentiality method, related devices and systems, and proposes a new application scenario. The data confidentiality method meets the needs of the new application scenario and achieves the purpose of preventing confidential data from being leaked and stolen.

[0006] In a first aspect, the present application provides a data confidentiality method, which is applied to a heterogeneous device, where some or all hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, and the TEE side of the heterogeneous device is pre-set with confidential data, and the method includes:

[0007] The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, wherein the integrity of the TEE side of the host includes: the virtual machine running on the TEE side of the host does not have the ability to read and write the confidential data in the heterogeneous device, and the heterogeneous device and the host constitute a heterogeneous system;

[0008] When the integrity of the TEE side of the host is verified, the TEE side of the heterogeneous device receives an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

[0009] This application proposes a new application scenario and demand, namely: the owner of confidential data does not belong to the cloud service platform, nor to the host and virtual machine tenants. The owner of confidential data does not want the cloud service platform, the host and the virtual machine tenant to obtain the confidential data, but allows the cloud service platform or the host or the virtual machine tenant to use the confidential data through heterogeneous devices. In response to the new application scenario and demand, this application proposes a data confidentiality method, which places the confidential data to be protected on the TEE side of the heterogeneous device, divides the hardware resources on the host into the TEE side and the REE side, and the processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, wherein the integrity of the TEE side of the host includes: the virtual machine running on the TEE side of the host does not have the ability to read and write confidential data in the heterogeneous device, and only when the integrity verification of the TEE side of the host passes, the TEE side of the heterogeneous device receives the access request of the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device, and allows the virtual machine running on the TEE side of the host to use the confidential data through the heterogeneous device. The data confidentiality method solves the needs of the newly proposed application scenario and prevents the leakage or theft of confidential data.

[0010] Based on the first aspect, in a possible implementation, the processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, including: the processor of the heterogeneous device verifies the integrity of the virtual machine manager hypervisor on the TEE side of the host on the TEE side, and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host, wherein the integrity of the virtual machine manager hypervisor includes not mapping the target address on the virtual machine manager hypervisor, the target address includes the mapping address of the confidential data in the heterogeneous device on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read operations and write operations on the target address.

[0011] It can be understood that in order to prevent the virtual machine running on the TEE side of the host from having the ability to read and write confidential data in heterogeneous devices, one implementation method may be that the virtual machine manager on the TEE side of the host does not map the target address on the virtual machine manager, so that the virtual machine cannot access the target address, that is, it cannot access the confidential data. Another implementation method may be that the virtual function driver module of the virtual machine running on the TEE side of the host includes a logical code that prohibits the virtual machine from reading and writing the target address, so that the virtual machine cannot access the destination address, that is, it cannot access the confidential data.

[0012] Based on the first aspect, in a possible implementation method, the processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, including: the processor of the heterogeneous device generates a random number on the TEE side and sends the random number to the TEE side of the host; the processor of the heterogeneous device receives the measurement value sent by the TEE side of the host on the TEE side, and verifies the integrity of the TEE side of the host based on the measurement value.

[0013] Based on the first aspect, in a possible implementation, the access request carries input data, and the method further includes: the processor of the heterogeneous device uses the confidential data to process according to the input data to obtain a processing result; the processor of the heterogeneous device sends the processing result to the virtual machine running on the TEE side of the host.

[0014] It is understandable that the virtual machine running on the TEE side of the host cannot directly read confidential data, but can use confidential data for data processing operations through heterogeneous devices. Relative to the virtual machine, confidential data is like a "black box". The virtual machine is given input data, and the heterogeneous device uses this "black box" to process the input data, and then returns the processing results to the virtual machine, thereby achieving the purpose of using confidential data for calculations, while meeting the needs of the application scenario of this application.

[0015] Based on the first aspect, in a possible implementation, the method further includes: when the integrity verification of the TEE side of the host fails, the TEE side of the heterogeneous device refuses to receive an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

[0016] In a second aspect, the present application provides a heterogeneous device, in which some or all hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, and the TEE side of the heterogeneous device is pre-set with confidential data, including:

[0017] A security management module, used for verifying the integrity of the TEE side of the host on the TEE side of the heterogeneous device, wherein the integrity of the TEE side of the host includes: a virtual machine running on the TEE side of the host does not have the ability to read and write the confidential data in the heterogeneous device, the heterogeneous device and the host constitute a heterogeneous system, and the security management module is located on the TEE side of the heterogeneous device;

[0018] The communication module is used to receive, on the TEE side of the heterogeneous device, an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device when the integrity of the TEE side of the host is verified.

[0019] Based on the second aspect, in a possible implementation, the security management module is used to: verify the integrity of the virtual machine manager hypervisor on the TEE side of the host, and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host on the TEE side of the heterogeneous device, wherein the integrity of the virtual machine manager hypervisor includes not mapping the target address on the virtual machine manager hypervisor, the target address includes the mapping address of the confidential data in the heterogeneous device on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read operations and write operations on the target address.

[0020] Based on the second aspect, in a possible implementation,

[0021] The security management module is used to generate a random number on the TEE side of the heterogeneous device;

[0022] The communication module is used to send the random number to the TEE side of the host;

[0023] The communication module is used to receive, at the TEE side of the heterogeneous device, the metric value sent by the TEE side of the host;

[0024] The security management module is used to verify the integrity of the TEE side of the host according to the measurement value.

[0025] Based on the second aspect, in a possible implementation manner, the access request carries input data, and the heterogeneous device further includes:

[0026] A processing module, used to process the confidential data according to the input data to obtain a processing result;

[0027] The communication module is used to send the processing result to the virtual machine running on the TEE side of the host.

[0028] Based on the second aspect, in a possible implementation method, the communication module is also used to refuse to receive access requests from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device on the TEE side of the heterogeneous device when the integrity of the TEE side of the host fails to be verified.

[0029] The functional modules of the second aspect are used to implement the method described in the first aspect and the possible implementation methods of the first aspect.

[0030] In a third aspect, the present application provides a heterogeneous device, including a memory and a processor, wherein the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the method described in the first aspect and various possible implementation methods of the first aspect.

[0031] In a fourth aspect, the present application provides a computer storage medium, comprising program instructions, which, when executed by a processor, causes the processor to execute the method described in the first aspect and various possible implementation methods of the first aspect.

[0032] In a fifth aspect, the present application provides a data confidentiality system, including a host and a heterogeneous device, wherein some or all of the hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, and some of the hardware resources in the host are divided into a trusted execution environment TEE side. The TEE side of the heterogeneous device is pre-installed with confidential data, and the heterogeneous device is used to execute the method described in the first aspect and each possible implementation method of the first aspect.

[0033] In a sixth aspect, the present application provides a computer program product, including program instructions, which, when executed on a heterogeneous device, enables the heterogeneous device to execute the method described in the first aspect and various possible implementations of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of a scenario provided for this application;

[0035] Figure 2 A schematic diagram of a system structure provided for this application;

[0036] Figure 3 A schematic diagram of a system structure for a confidential computing scenario provided by this application;

[0037] Figure 4 A schematic diagram of a scenario provided for this application;

[0038] Figure 5 A schematic diagram of a data security system architecture provided for this application;

[0039] Figure 6 A flowchart of a data confidentiality method provided for this application;

[0040] Figure 7 A schematic diagram of a system structure provided for this application;

[0041] Figure 8 A flowchart of a method for verifying the integrity of the TEE side of a host provided in this application;

[0042] Fig. 9 A state machine schematic diagram provided for this application;

[0043] Fig.10 A schematic diagram of the structure of a heterogeneous device provided in this application;

[0044] Fig.11 A schematic diagram of the physical structure of a heterogeneous device provided in this application. DETAILED DESCRIPTION

[0045] Before introducing the embodiments of the present application, the technical terms involved in the embodiments of the present application are first described.

[0046] Trustzone technology was first introduced as a security extension in the ARMv6 version. It divides the hardware resources of computing devices into two worlds: trusted execution environment (TEE) and rich execution environment (REE). TEE can also be called a secure execution environment or a secure world, and REE can also be called a normal execution environment or a non-secure execution environment or a non-secure world.

[0047] The security of the REE environment is lower than that of the TEE environment. When the processor works on the REE side, the resources on the REE side can be accessed, but the resources on the TEE side (such as registers, memory, cache, peripherals, etc.) are prohibited from access. When the processor works on the TEE side, it can access both the resources on the TEE side and the resources on the REE side. The essential difference between TEE and REE is the issue of permissions. The TEE side has higher operating permissions than the REE side.

[0048] In actual applications, many different types of processors are involved, such as central processing unit (CPU), graphic processing unit (GPU) and neural network processing unit (NPU). Different types of processors have different performances. For example, CPU has strong logic control ability but weak computing ability, especially when facing large-scale computing; while GPU or NPU has weak logic control ability but strong computing ability, especially good at large-scale computing.

[0049] Among them, the CPU is a processor located on the host, and the host processes instructions or data through the CPU. The host can be, for example, a desktop computer, a personal notebook, a physical server, etc. In this application, other processors are running on heterogeneous devices, and other processors refer to non-CPUs. For example, a GPU is running on a heterogeneous device, and the heterogeneous device processes data through the GPU. For another example, an NPU is running on a heterogeneous device, and the heterogeneous device processes data through the NPU. That is, the heterogeneous device is relative to the host, and the processor of the heterogeneous device is heterogeneous relative to the processor of the host.

[0050] Heterogeneous devices can exist in the form of smart network cards. Optionally, heterogeneous devices can be plugged into a host, or establish a connection with the host through other means. The processor on the host and the processor on the heterogeneous device work together to achieve efficient computing. The system composed of heterogeneous devices and hosts can be called a heterogeneous system.

[0051] This application proposes a new application requirement, which is introduced as follows.

[0052] Confidential data is pre-installed in a heterogeneous device, or is deployed on a heterogeneous device. The owner of the confidential data does not want the confidential data to be obtained by other devices, including not wanting other devices to read the confidential data or modify the parameters in the confidential data, but allows other devices to use the confidential data for calculations through the heterogeneous device. For example, see Figure 1 In the schematic diagram shown, the manufacturer produces heterogeneous devices, and a big data computing company pre-sets confidential data in the heterogeneous devices. The confidential data can be, for example, a neural network model. When the heterogeneous device with pre-set confidential data is applied on the host, the owner of the confidential data hopes that the host or the virtual machine deployed on the host cannot obtain the confidential data on the heterogeneous device and modify the confidential data on the heterogeneous device, but allows the host or the virtual machine on the host to use the confidential data through other instructions. For example, the host or the virtual machine on the host sends an instruction to the heterogeneous device, and the instruction carries input data. The heterogeneous device uses the input data and the pre-set confidential data (for example, AI model) for processing to obtain the processing result, and the heterogeneous device reports the processing result to the host or the virtual machine on the host.

[0053] That is, in this application requirement, confidential data is not open to other devices and other users. Other devices refer to any device other than heterogeneous devices, including hosts and virtual machines. Other users include virtual machine tenants and cloud service platforms. For other devices, confidential data is like a "black box", and other devices cannot obtain the data in the "black box". However, other devices can use the data in the "black box" for calculations through heterogeneous devices. When other devices need to use confidential data for calculations, other devices can send instructions to heterogeneous devices, and heterogeneous devices use confidential data for calculations according to the instructions. Then, the heterogeneous devices send the processing results to other devices.

[0054] It should be noted that confidential data can be a trained neural network model or other data that needs to be protected. This application does not limit confidential data.

[0055] For the application requirements proposed by this application, traditional data confidentiality methods can no longer meet the requirements of this application scenario. This application embodiment provides a data confidentiality method and system. Before introducing the data confidentiality method and system provided by the embodiment of this application, the technology involved in the method of the embodiment of this application is first introduced.

[0056] See also Figure 2 , Figure 2 A schematic diagram of a system structure provided in the present application, wherein the system includes a host and heterogeneous devices, and the host and heterogeneous devices constitute a heterogeneous system. A processor on the host establishes a virtual machine on the host operating system through a virtual machine manager.

[0057] In a heterogeneous system, heterogeneous devices provide data space and configuration space, where the data space is used to store data, such as data transmitted between the host and the heterogeneous device, and the configuration space is used to store configuration instructions and control instructions, such as the host's configuration instructions and control instructions for the heterogeneous device. The data space and configuration space on the heterogeneous device cannot be directly accessed by the host. In order to enable the software on the host to access the heterogeneous device, the bus controller on the host (such as the peripheral component interconnect express (PCIe) controller) divides an address space on the host's memory. This address space can be called memory mapped I / O (MMIO) space. This address space is used to map the data space and configuration space of the heterogeneous device, such as Figure 2 The mapping relationship shown.

[0058] In the device pass-through scenario, the virtual machine running on the host accesses the data space and configuration space of the heterogeneous device through the virtual address (VA), which requires two stages of mapping: virtual address->intermediate physical address (IPA)->MMIO address. The mapping of virtual address->intermediate physical address is completed by the virtual machine configuration, and the mapping of intermediate physical address->MMIO is completed by the virtual machine manager configuration.

[0059] See also Figure 3 , Figure 3 A schematic diagram of a system structure applied to a confidential computing scenario provided for an embodiment of the present application. In this scenario, the hardware resources on the host are divided into a trusted execution environment TEE side and a rich execution environment REE side. The hardware resources include computing resources and memory. A first virtual machine manager (hypervisor) is deployed on the REE side of the host, and virtual machine 1 is run on the first virtual machine manager. A second virtual machine manager is deployed on the TEE side of the host, and virtual machine 2 is run on the second virtual machine manager. It can be understood that the MMIO address space is also divided into the TEE side and the REE side. Virtual machine 1 can only access the MMIO address space on the REE side, and virtual machine 2 can access the MMIO address space on the TEE side. Optionally, virtual machine 2 can also access the MMIO address space on the REE side.

[0060] The hardware resources on heterogeneous devices are divided into the TEE side and the REE side, such as Figure 3 As shown in the figure, the TEE side includes data space 2 and configuration space, and the REE side includes data space 1 and configuration space (not shown in the figure). For the convenience of description, a number is marked on a certain data space. The address space of the TEE side of the heterogeneous device is mapped to the MMIO space of the TEE side on the host, and the address space of the REE side of the heterogeneous device is mapped to the MMIO space of the REE side on the host, as shown in the figure. Figure 3 As shown, therefore, virtual machine 2 can access the address space of the TEE side on the heterogeneous device, and virtual machine 1 can access the address space of the REE side on the heterogeneous device.

[0061] The application scenario requirements proposed by this application are as follows: confidential data in heterogeneous devices cannot be obtained by virtual machines running on the host, and the virtual machines cannot access the target address, which includes the mapping address of the confidential data on the heterogeneous device on the host memory. In order to meet the scenario requirements of the embodiments of this application and protect confidential data from being stolen or leaked, confidential data is usually pre-placed in the storage space on the TEE side of the heterogeneous device, for example, pre-place confidential data in Figure 3In the data space on the TEE side of the heterogeneous device. If you want to achieve the purpose of prohibiting confidential data from being obtained by the virtual machine running on the host, it is necessary that virtual machine 2 cannot access the target address, that is, Figure 4 As shown, the mapping relationship between virtual machine 2 and the target address cannot be satisfied, that is, Figure 4 As shown in “”.

[0062] Based on the above Figure 4 The system architecture shown in the figure, this application provides a data security method and a data security system. Figure 5 As shown, Figure 5 A schematic diagram of a data confidentiality system architecture provided for this application. The data confidentiality system includes a host and a heterogeneous device, the hardware resources of the host are divided into a TEE side and a REE side, the TEE side of the host includes a security management module, the security management module is used to manage the hardware resources of the TEE side of the host, the hardware resources on the heterogeneous device are divided into a TEE side and a REE side, confidential data is preset on the TEE side of the heterogeneous device, and the TEE side of the heterogeneous device includes a security management module, the security management module is used to manage the hardware resources of the TEE side of the heterogeneous device.

[0063] Optionally, when the hardware capabilities of heterogeneous devices do not support the division of hardware resources into the TEE side and the REE side, that is, the hardware capabilities do not support the division of access rights to hardware resources, because the software installed on the heterogeneous devices is simpler and the control logic is weaker, the probability of security vulnerabilities is smaller. Therefore, the environment on the heterogeneous devices is considered to be trusted, that is, TEE.

[0064] The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, specifically including: the security management module of the TEE side of the heterogeneous device sends a request to the TEE side of the host, the request is used to verify the integrity of the TEE side of the host, and the request carries a random number; after receiving the request, the security management module of the TEE side of the host calculates the measurement value of the TEE side of the host according to the random number, and returns the measurement value to the security management module of the TEE side of the heterogeneous device; the security management module of the TEE side of the heterogeneous device determines the integrity of the TEE side of the host according to the measurement value. When it is determined that the integrity of the TEE side of the host is passed, the TEE side of the heterogeneous device establishes an encrypted channel with the TEE side of the host, and the TEE side of the heterogeneous device receives the access request sent by the TEE side of the host; when it is determined that the integrity of the TEE side of the host is not passed, the TEE side of the heterogeneous device refuses to receive the access request sent by the TEE side of the host.

[0065] based on Figure 4 and Figure 5 The system shown in the present application embodiment provides a data confidentiality method, see Figure 6 , Figure 6A flowchart of a data confidentiality method provided in this application, the method includes but is not limited to the description of the following content.

[0066] S101. The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side of the heterogeneous device.

[0067] The integrity of the host's TEE side includes: the virtual machine running on the host's TEE side does not have the ability to read and write confidential data in heterogeneous devices, for example, Figure 4 In the diagram, virtual machine 2 does not have the ability to read and write confidential data in the heterogeneous device. That is, the processor of the heterogeneous device verifies on the TEE side whether the virtual machine on the host has the ability to read and write confidential data on the heterogeneous device.

[0068] In one implementation, the virtual machine manager on the TEE side of the host does not map the intermediate physical address IPA to the target address, or in other words, does not map the target address on the virtual machine manager, wherein the target address includes the MMIO address of the confidential data in the heterogeneous device on the host memory. In this implementation, the processor of the heterogeneous device only needs to verify the integrity of the virtual machine manager on the TEE side of the host on the TEE side. If the integrity verification of the virtual machine manager on the TEE side of the host passes, the virtual machine running on the TEE side of the host cannot read the confidential data, wherein the integrity of the virtual machine manager includes not mapping the target address on the virtual machine manager.

[0069] In one implementation, the virtual machine running on the TEE side of the host is set with a function of prohibiting read and write operations on the target address. In this implementation, the processor of the heterogeneous device only needs to verify the integrity of the virtual function driver (VF driver) module of the virtual machine running on the TEE side of the host. If the integrity verification of the virtual function driver module of the virtual machine passes, the virtual machine running on the TEE side of the host cannot read confidential data, wherein the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read and write operations on the target address. Alternatively, the processor of the heterogeneous device verifies the integrity of the kernel code logic of the virtual machine running on the TEE side of the host. If the integrity verification of the kernel code logic of the virtual machine passes, the virtual machine running on the TEE side of the host cannot read confidential data, wherein the integrity of the kernel code logic includes prohibiting the virtual machine from performing read and write operations on the target address.

[0070] In one implementation, the processor of the heterogeneous device verifies the integrity of the virtual machine manager on the TEE side of the host and the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host on the TEE side. If the integrity verification of any one of them passes, the integrity verification of the TEE side of the host passes; if the integrity of both passes, the integrity verification of the host passes; if the integrity of both fails to pass, the integrity verification of the host fails.

[0071] Combine the following Figure 7 This section describes how to verify the integrity of the TEE side of the host. Figure 7 A schematic diagram of a system structure provided for this application. Figure 7 In the system, the system includes a host and heterogeneous devices.

[0072] The hardware resources on the heterogeneous device are divided into the TEE side and the REE side. The REE side includes hardware device cluster 1, hardware device cluster 2 and a hardware device management module. The hardware device management module is used to manage the hardware devices on the REE side. The REE side also includes a physical function configuration module. The physical function configuration module is used to communicate with the first virtual machine manager on the host. The TEE side includes hardware device cluster 3 and a security management module. The security management module is used to manage the hardware devices on the TEE side. Confidential data is preset in the hardware device cluster 3 on the TEE side of the heterogeneous device.

[0073] The hardware resources on the host are divided into the TEE side and the REE side. The first virtual machine manager is deployed on the REE side, and virtual machines 1 and 2 are run on the first virtual machine manager. The second virtual machine manager is deployed on the TEE side, and virtual machine 3 is run on the second virtual machine manager. The TEE side also includes a security management module, which is used to manage the memory on the TEE side of the host. Optionally, the second virtual machine manager and the security management module can be integrated into one module, and the integrated module has the functions of the second virtual machine manager and the security management module.

[0074] See also Figure 8 , Figure 8 A flowchart of a method for verifying the integrity of the TEE side of a host provided in the present application, the method includes but is not limited to the description of the following content.

[0075] S1011. The processor of the heterogeneous device generates a random number on the TEE side.

[0076] The processor of the heterogeneous device generates a random number nonce on the TEE side, where nonce is the abbreviation of number once. In cryptography, nonce is an arbitrary or non-repeating random value that is used only once. Figure 7In the schematic diagram, this step can be performed by the security management module on the TEE side of the heterogeneous device, and the security management module generates a nonce.

[0077] S1012. The processor of the heterogeneous device sends the random number to the TEE side of the host on the TEE side.

[0078] The processor of the heterogeneous device sends the random number on the TEE side to the TEE side of the host. Figure 7 In the schematic diagram, the security management module writes the generated random number into the register R1 of the heterogeneous device and generates an interrupt. After receiving the interrupt signal, the interrupt processing function in the first virtual machine manager on the host processes the interrupt and obtains the random number from the register R1 of the heterogeneous device. The first virtual machine manager calls the interface of the security management module on the TEE side and sends the random number to the security management module on the TEE side of the host. Among them, register R1 can be located in the configuration space on the REE side of the heterogeneous device.

[0079] S1013. The processor of the host performs integrity measurement on the TEE side according to the random number to obtain a measurement value.

[0080] The processor of the host performs integrity measurement on the TEE side, and this step can be performed by the security management module on the TEE side of the host.

[0081] In one example, Figure 7 In the schematic diagram shown, the target address is not mapped to the intermediate physical address in the code logic of the second virtual machine manager, wherein the target address includes the MMIO address of the confidential data in the heterogeneous device on the host memory. The security management module measures the integrity of the second virtual machine manager according to the random number to obtain a measurement value. The security management module is provided with an algorithm for measuring the integrity of the second virtual machine manager, and the security management module calculates the integrity of the second virtual machine manager according to the algorithm.

[0082] In one example, Figure 7 In the schematic diagram shown, the code logic of the virtual function driver module of the virtual machine 3 includes prohibiting the virtual machine 3 from performing read operations and write operations on the target address, or the kernel module of the virtual machine 3 includes code logic prohibiting the virtual machine 3 from performing read operations and write operations on the target address. The security management module measures the integrity of the virtual function driver module of the virtual machine 3 or the integrity of the kernel module according to the random number to obtain a measurement value. Among them, the security management module is provided with an algorithm for measuring the integrity of the virtual function driver module of the virtual machine 3 or the integrity of the kernel module, and the security management module calculates the integrity of the virtual function driver module of the virtual machine 3 or the integrity of the kernel module according to the algorithm.

[0083] In one example, Figure 7 In the schematic diagram shown, the security management module can measure the integrity of the second virtual machine manager and the integrity of the virtual function driver module (or kernel module) of the virtual machine 3 to obtain a measurement value. The security management module is provided with an algorithm for measuring the integrity of the second virtual machine manager and the integrity of the virtual function driver module (or kernel module) of the virtual machine 3, and the security management module calculates the integrity of the two according to the algorithm.

[0084] S1014. The processor of the host returns the measurement value to the TEE side of the heterogeneous device on the TEE side.

[0085] The host processor returns the measurement value on the TEE side to the TEE side of the heterogeneous device. Figure 7 In the schematic diagram, the security management module on the TEE side of the host returns the measurement value to the first virtual machine manager, the first virtual machine manager writes the measurement value into the register R2 of the heterogeneous device, and the security management module on the TEE side of the heterogeneous device reads the measurement value from the register R2. The register R2 may be located in the configuration space of the heterogeneous device.

[0086] S1015. The processor of the heterogeneous device verifies the integrity of the TEE side of the host based on the measurement value on the TEE side.

[0087] After receiving the measurement value on the TEE side, the processor of the heterogeneous device verifies the integrity of the TEE side of the host based on the measurement value. Figure 7 In the schematic diagram, this step can be performed by the security management module on the TEE side of the heterogeneous device.

[0088] In one implementation, an algorithm for calculating the integrity of the TEE side of the host is set in the security management module on the TEE side of the heterogeneous device. The security management module compares the received measurement value with the measurement value calculated by itself according to the algorithm. If they are consistent, the integrity verification of the TEE side of the host passes; if they are inconsistent, the integrity verification of the TEE side of the host fails.

[0089] In one implementation, the security management module on the TEE side of the heterogeneous device may not be provided with an algorithm for calculating the integrity of the TEE side of the host. After the security management module on the TEE side of the host calculates the measurement value, the measurement value is sent to a third-party server, wherein the third-party server stores the algorithm for calculating integrity. The third-party server compares the received measurement value with the measurement value calculated by itself according to the algorithm. If they are consistent, the integrity verification of the TEE side of the host passes. If they are inconsistent, the integrity verification of the TEE side of the host fails. The third-party server sends the result of verification passing or verification failing to the security management module on the TEE side of the heterogeneous device, and the security management module on the TEE side of the heterogeneous device obtains the verification result.

[0090] S102: When the integrity of the TEE side of the host is verified, the TEE side of the heterogeneous device receives an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

[0091] When the integrity of the TEE side of the host is verified, the TEE side of the heterogeneous device and the TEE side of the host generate a session key through a key exchange protocol and establish an encrypted channel. After that, the TEE side of the heterogeneous device and the TEE side of the host communicate through the encrypted channel. For example, the TEE side of the heterogeneous device receives an access request sent by the virtual machine running on the TEE side of the host through an encrypted channel. The TEE side of the heterogeneous device processes the confidential data according to the access request, obtains the processing result, and returns the processing result to the virtual machine on the TEE side of the host through the encrypted channel.

[0092] For example, in Figure 7 In the schematic diagram, when the integrity of the TEE side of the host is verified, the security management module on the TEE side of the heterogeneous device and the security management module on the TEE side of the host generate a session key through a key exchange protocol and establish an encrypted channel. The security management module on the TEE side of the heterogeneous device receives the access request sent by the virtual machine 3 running on the TEE side of the host through the encrypted channel. The security management module on the TEE side of the heterogeneous device processes the confidential data according to the access request, obtains the processing result, and returns the processing result to the virtual machine 3 on the TEE side of the host through the encrypted channel.

[0093] S103: When the integrity of the TEE side of the host fails to be verified, the TEE side of the heterogeneous device refuses to receive an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

[0094] If the integrity of the host's TEE side fails to be verified, the TEE side of the heterogeneous device cannot establish an encrypted channel with the TEE side of the host, and the TEE side of the heterogeneous device refuses to receive access requests from the virtual machine running on the host's TEE side to the TEE side of the heterogeneous device.

[0095] Optionally, the method further includes: the TEE side of the host verifies the integrity of the TEE side of the heterogeneous device. Specifically, the TEE side of the host sends a request to the TEE side of the heterogeneous device, the request is used to verify the integrity of the TEE side of the heterogeneous device, and the request carries a random number nonce. The TEE side of the heterogeneous device calculates a measurement value based on the random number and sends the measurement value to the TEE side of the host. The TEE side of the host determines the integrity of the TEE side of the heterogeneous device based on the measurement value. The operation of the TEE side of the host verifying the integrity of the TEE side of the heterogeneous device can occur before step S101 or after step S101, and this application does not limit it.

[0096] Optionally, in one implementation, when the integrity verification of the TEE side of the heterogeneous device passes and the integrity verification of the TEE side of the host passes, the TEE side of the heterogeneous device and the TEE side of the host generate a session key through a key exchange protocol and establish an encrypted channel, and the TEE side of the heterogeneous device and the TEE side of the host communicate through the encrypted channel. In the embodiment of the present application, the state machine that needs to be maintained by the heterogeneous device is as follows: Fig. 9 As shown, Fig. 9 middle,

[0097] Status 1 indicates that the integrity verification of the TEE side of the heterogeneous device by the host TEE side is not completed, including the unverified state or the verifying state.

[0098] State 2 indicates that the integrity verification of the TEE side of the host on the TEE side of the heterogeneous device is completed. State 2 indicates that the integrity verification of the TEE side of the heterogeneous device is completed. If the verification result is not passed, it will enter state 5; if the verification result is passed, it will be determined whether there is confidential data on the TEE side of the heterogeneous device. If so, the heterogeneous device needs to verify the integrity of the TEE side of the host; if there is no confidential data on the TEE side of the heterogeneous device, the TEE side of the host and the TEE side of the heterogeneous device communicate directly and are in a running state.

[0099] State 3 indicates that when there is confidential data on the TEE side of the heterogeneous device, the integrity verification of the TEE side of the host by the TEE side of the heterogeneous device is completed.

[0100] State 4 indicates that the integrity verification of the host's TEE side is completed, and if the verification result is passed, the host's TEE side and the heterogeneous device's TEE side are in a communication operation state.

[0101] State 5 indicates an error state, including various error situations, such as an error occurring in the process of verifying the integrity of the TEE side of the heterogeneous device (from state 1 to state 5), a situation where the integrity verification of the TEE side of the heterogeneous device fails (from state 2 to state 5), a situation where the integrity verification of the TEE side of the host fails (from state 3 to state 5), and an error occurring in the process of verifying the integrity of the TEE side of the host (from state 3 to state 5), etc.

[0102] In heterogeneous devices, a status bit of "whether there is confidential data" is added. In specific implementation, this status bit can be implemented by an electronic fuse (e-fuse for short). When confidential data is loaded, the electronic fuse is blown to ensure that the heterogeneous device runs in a protected state.

[0103] It can be seen that the present application proposes a new application scenario: confidential data is pre-set in a heterogeneous device, and the host and the virtual machine running on the host are required not to obtain the confidential data in the heterogeneous device. The host and the virtual machine running on the host can only send access requests to the heterogeneous device so that the heterogeneous device processes the confidential data according to the access request, and the heterogeneous device returns the processing result to the host or virtual machine, thereby achieving the purpose of the host or virtual machine using the confidential data for calculation. For the new application scenario proposed in the present application, in order to protect the confidential data from being obtained by other devices, in the present application scheme, the resources in the heterogeneous device are divided into the TEE side and the REE side, and the confidential data is pre-set on the TEE side of the heterogeneous device. When the virtual machine running on the TEE side of the host needs to access the confidential data, the TEE side of the heterogeneous device initiates a challenge to verify the integrity of the TEE side of the host. If the integrity verification of the TEE side of the host passes, the TEE side of the heterogeneous device receives the access request sent by the virtual machine on the TEE side of the host. If the integrity verification of the TEE side of the host fails, the TEE side of the heterogeneous device refuses to receive the access request sent by the virtual machine on the TEE side of the host. The method embodiment of the present application solves the needs of new application scenarios and achieves the purpose of protecting confidential data from being obtained by virtual machines and cloud service platforms.

[0104] The above text has elaborated in detail the data confidentiality method provided by the present application. Based on the same inventive concept, the following text will continue to introduce the heterogeneous device provided by the present application.

[0105] See also Fig.10 , Fig.10 A schematic diagram of the structure of a heterogeneous device 800 provided in the present application, in which some or all hardware resources in the heterogeneous device 800 are divided into a trusted execution environment TEE side, and the TEE side of the heterogeneous device 800 is pre-set with confidential data. The heterogeneous device 800 includes:

[0106] The security management module 810 is used to verify the integrity of the TEE side of the host on the TEE side of the heterogeneous device 800, wherein the integrity of the TEE side of the host includes: the virtual machine running on the TEE side of the host does not have the ability to read and write confidential data in the heterogeneous device 800, the heterogeneous device 800 and the host constitute a heterogeneous system, and the security management module 810 is located on the TEE side of the heterogeneous device 800;

[0107] The communication module 820 is used to receive, on the TEE side of the heterogeneous device 800 , an access request from a virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device 800 , when the integrity of the TEE side of the host is verified.

[0108] In a possible implementation, the security management module 810 is used to: verify the integrity of the virtual machine manager hypervisor on the TEE side of the host, and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host on the TEE side of the heterogeneous device 800, wherein the integrity of the virtual machine manager hypervisor includes not mapping the target address on the virtual machine manager hypervisor, the target address includes the mapping address of confidential data in the heterogeneous device 800 on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read operations and write operations on the target address.

[0109] In a possible implementation, the security management module 810 is used to generate a random number on the TEE side of the heterogeneous device 800; the communication module 820 is used to send the random number to the TEE side of the host; the communication module 820 is also used to receive the measurement value sent by the TEE side of the host on the TEE side of the heterogeneous device 800; the security management module 810 is used to verify the integrity of the TEE side of the host based on the measurement value.

[0110] In a possible implementation, the access request carries input data, and the heterogeneous device 800 further includes: a processing module 830 for processing the input data using confidential data to obtain a processing result; and a communication module 820 for sending the processing result to a virtual machine running on the TEE side of the host.

[0111] In a possible implementation, the communication module 820 is also used to refuse, on the TEE side of the heterogeneous device 800 , to receive access requests from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device 800 when the integrity of the TEE side of the host fails to be verified.

[0112] It can be understood that the unit modules inside the heterogeneous device 800 can also be divided into multiple types. Each module can be a software module or a hardware module, or can be partly a software module and partly a hardware module. This application does not limit this. Fig.10 This is an exemplary introduction to the functions of each module of the heterogeneous device 800. The functions of each module described by way of example are only functions that the heterogeneous device 800 may have in some embodiments of the present application, and the present application does not limit the functions of each module. Specifically, the specific implementation of various operations performed by the above heterogeneous device 800 can refer to the description of the relevant content in the above data confidentiality method embodiment, and for the sake of brevity of the specification, it will not be repeated here.

[0113] This application provides a heterogeneous device 900, see Fig.11 , Fig.11 A schematic diagram of the physical structure of a heterogeneous device 900 provided in the present application, wherein the heterogeneous device 900 includes:

[0114] Bus 902, processor 904, memory 906 and communication interface 908. Processor 904, memory 906 and communication interface 908 communicate with each other via bus 902. It should be understood that the present application does not limit the number of processors and memories in heterogeneous device 900.

[0115] The bus 902 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.11 The bus 902 may include a path for transmitting information between various components of the heterogeneous device 900 (eg, the memory 906, the processor 904, and the communication interface 908).

[0116] The processor 904 may include any one or more of a graphics processing unit (GPU), a neural network processing unit (NPU), a microprocessor (MP), or a digital signal processor (DSP).

[0117] The memory 906 may include a volatile memory, such as a random access memory (RAM). The memory 906 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0118] The memory 906 stores executable codes, and the processor 904 executes the executable codes to implement the functions of the heterogeneous device 800, thereby implementing a data security method. That is, the memory 906 stores instructions for executing a data security method.

[0119] The communication interface 908 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the heterogeneous device 900 and other devices or communication networks.

[0120] An embodiment of the present application also provides a data confidentiality system, including a host and a heterogeneous device, wherein some or all hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, and some hardware resources in the host are divided into a trusted execution environment TEE side. The TEE side of the heterogeneous device is pre-installed with confidential data, and the heterogeneous device may be the above-mentioned heterogeneous device 800 or heterogeneous device 900.

[0121] An embodiment of the present application further provides a computer program product comprising instructions, and when the computer program product is run on at least one heterogeneous device, the at least one heterogeneous device executes a data confidentiality method.

[0122] The embodiment of the present application also provides a readable storage medium. The readable storage medium can be any available medium that can be stored by a heterogeneous device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The readable storage medium includes instructions that instruct the heterogeneous device to execute a data confidentiality method.

[0123] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0124] In the above embodiments, it can be implemented in whole or in part by software, hardware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a heterogeneous device, the process or function described in the embodiment of the present application is generated in whole or in part. The heterogeneous device may be a GPU, an NPU or the like. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium, or a semiconductor medium.

[0125] The above is only a specific implementation of the present application. Those skilled in the art may conceive of changes or substitutions based on the specific implementation provided by the present application, which should all be included in the protection scope of the present application.

Claims

1. A data confidentiality method, characterized in that: The method is applied to a heterogeneous device, where some or all hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, and the TEE side of the heterogeneous device is pre-set with confidential data. The method includes: The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, wherein the integrity of the TEE side of the host includes: the virtual machine running on the TEE side of the host does not have the ability to read and write the confidential data in the heterogeneous device, and the heterogeneous device and the host constitute a heterogeneous system; When the integrity of the TEE side of the host is verified, the TEE side of the heterogeneous device receives an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

2. The method according to claim 1, characterized in that The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, including: The processor of the heterogeneous device verifies the integrity of the virtual machine manager hypervisor on the TEE side of the host, and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host, wherein the integrity of the virtual machine manager hypervisor includes not mapping the target address on the virtual machine manager hypervisor, the target address includes the mapping address of the confidential data in the heterogeneous device on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read operations and write operations on the target address.

3. The method according to claim 1 or 2, characterized in that: The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, including: The processor of the heterogeneous device generates a random number on the TEE side and sends the random number to the TEE side of the host; The processor of the heterogeneous device receives the measurement value sent by the TEE side of the host on the TEE side, and verifies the integrity of the TEE side of the host according to the measurement value.

4. The method according to any one of claims 1 to 3, characterized in that: The access request carries input data, and the method further includes: The processor of the heterogeneous device performs processing using the confidential data according to the input data to obtain a processing result; The processor of the heterogeneous device sends the processing result to the virtual machine running on the TEE side of the host.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: When the integrity verification of the TEE side of the host fails, the TEE side of the heterogeneous device refuses to receive an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

6. A heterogeneous device, characterized in that: Part or all of the hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, and the TEE side of the heterogeneous device is pre-set with confidential data, including: A security management module, used for verifying the integrity of the TEE side of the host on the TEE side of the heterogeneous device, wherein the integrity of the TEE side of the host includes: a virtual machine running on the TEE side of the host does not have the ability to read and write the confidential data in the heterogeneous device, the heterogeneous device and the host constitute a heterogeneous system, and the security management module is located on the TEE side of the heterogeneous device; The communication module is used to receive, on the TEE side of the heterogeneous device, an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device when the integrity of the TEE side of the host is verified.

7. The heterogeneous device according to claim 6, characterized in that: The security management module is used for: Verify the integrity of the virtual machine manager hypervisor on the TEE side of the host and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host on the TEE side of the heterogeneous device, wherein the integrity of the virtual machine manager hypervisor includes not mapping the target address on the virtual machine manager hypervisor, the target address includes the mapping address of the confidential data in the heterogeneous device on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read operations and write operations on the target address.

8. The heterogeneous device according to claim 6 or 7, characterized in that: The security management module is used to generate a random number on the TEE side of the heterogeneous device; The communication module is used to send the random number to the TEE side of the host; The communication module is used to receive, at the TEE side of the heterogeneous device, the metric value sent by the TEE side of the host; The security management module is used to verify the integrity of the TEE side of the host according to the measurement value.

9. The heterogeneous device according to any one of claims 6 to 8, characterized in that: The access request carries input data, and the heterogeneous device further includes: A processing module, used to process the confidential data according to the input data to obtain a processing result; The communication module is used to send the processing result to the virtual machine running on the TEE side of the host.

10. The heterogeneous device according to any one of claims 6 to 9, characterized in that: The communication module is also used to, when the integrity verification of the TEE side of the host fails, refuse to receive an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device on the TEE side of the heterogeneous device.

11. A data security system, characterized in that: It includes a host and a heterogeneous device, part of the hardware resources or all of the hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, part of the hardware resources in the host are divided into a trusted execution environment TEE side, the TEE side of the heterogeneous device is pre-installed with confidential data, and the heterogeneous device is used to execute the method as described in any one of claims 1 to 5.

12. A heterogeneous device, characterized in that: The method comprises a memory and a processor, wherein the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the method according to any one of claims 1 to 5.

13. A computer storage medium, characterized in that: The method comprises program instructions, and when the program instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 5.

14. A computer program product, characterized in that The method comprises program instructions, and when the program instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 5.

Images