A data security method, related device and system

Abstract

The application provides a data security method, related device and system, the method relates to the field of virtualization, the method is applied to a heterogeneous device, part or all of hardware resources in the heterogeneous device are divided into a trusted execution environment (TEE) side, the TEE side of the heterogeneous device is preset with confidential data, and the method comprises the following steps: a processor of the heterogeneous device verifies whether a virtual machine running on the TEE side of a host can obtain the confidential data in the heterogeneous device on the TEE side; in the case that the virtual machine running on the TEE side of the host cannot obtain the confidential data, the TEE side of the heterogeneous device receives an access request of the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device. By implementing the embodiment of the application, the confidential data can be protected from being leaked and stolen.

Description

Technical Field

[0001] This application relates to the field of virtualization, and more particularly to a data confidentiality method, related apparatus and system. Background Technology

[0002] Confidential computing is a computing model based on trusted hardware, combined with firmware and software to construct an encrypted, isolated, and provable computing environment that ensures the confidentiality and integrity of data within the environment, as well as the confidentiality of the computation process. Through isolation mechanisms, the general computing environment is separated from the confidential computing environment, preventing unauthorized applications from accessing it. Verification of applications running within the confidential computing environment ensures the integrity and legitimacy of the programs. Encryption mechanisms ensure that computations in memory are performed in an encrypted state, preventing eavesdropping by privileged software or even hardware.

[0003] The foundation of confidential computing technology lies in the trusted execution environment (TEE) of the hardware architecture. Through hardware isolation mechanisms, it is ensured that the code and data running in the TEE cannot be accessed or tampered with by untrusted code.

[0004] In applications involving large-scale computing such as machine learning and neural networks, confidential computing can be applied to heterogeneous systems. However, current trusted execution environment technologies cannot meet the needs of owners of confidential data to protect their confidential data from theft. Summary of the Invention

[0005] This application provides a data confidentiality method, related apparatus and system, and proposes a new application scenario. The data confidentiality method meets the needs of the new application scenario and achieves the purpose of preventing confidential data from being leaked or stolen.

[0006] In a first aspect, this application provides a data confidentiality method applied to heterogeneous devices, wherein some or all of the hardware resources in the heterogeneous devices are divided into a Trusted Execution Environment (TEE) side, and the TEE side of the heterogeneous devices is pre-configured with confidential data. The method includes:

[0007] The processor of the heterogeneous device verifies the integrity of the host's TEE side on the TEE side. The integrity of the host's TEE side includes: the virtual machine running on the host's TEE side does not have the ability to read or write the confidential data in the heterogeneous device. The heterogeneous device and the host constitute a heterogeneous system.

[0008] If the integrity of the host's TEE side is verified, the heterogeneous device's TEE side receives access requests from virtual machines running on the host's TEE side to the heterogeneous device's TEE side.

[0009] This application proposes a novel application scenario and requirement: the owner of confidential data is neither a cloud service platform nor a host or virtual machine tenant, and the owner does not wish the cloud service platform, host, or virtual machine tenant to access the confidential data, but allows the cloud service platform, host, or virtual machine tenant to use the confidential data through heterogeneous devices. To address this new application scenario and requirement, this application proposes a data confidentiality method. This method places the confidential data to be protected on the TEE side of the heterogeneous device, and divides the hardware resources on the host into the TEE side and the REE side. The processor of the heterogeneous device verifies the integrity of the host's TEE side on the TEE side. The integrity of the host's TEE side includes: virtual machines running on the host's TEE side do not have the ability to read or write to the confidential data on the heterogeneous device. Only after the integrity verification of the host's TEE side is passed will the heterogeneous device's TEE side accept access requests from virtual machines running on the host's TEE side, and only then will virtual machines running on the host's TEE side be allowed to use the confidential data through the heterogeneous device. This data confidentiality method solves the requirements of the newly proposed application scenario and prevents confidential data from being leaked or stolen.

[0010] Based on the first aspect, in a possible implementation, the processor of the heterogeneous device verifies the integrity of the host's TEE side on the TEE side, including: the processor of the heterogeneous device verifies the integrity of the virtual machine manager (hypervisor) on the host's TEE side, and / or the integrity of the virtual function driver module of the virtual machine running on the host's TEE side, wherein the integrity of the virtual machine manager (hypervisor) includes not mapping the target address on the virtual machine manager (hypervisor), the target address including the mapping address of the confidential data in the heterogeneous device on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read and write operations on the target address.

[0011] It is understandable that to prevent virtual machines running on the host's TEE side from having the ability to read and write confidential data in heterogeneous devices, one implementation method could be that the virtual machine manager on the host's TEE side does not map the target address on the virtual machine manager, so the virtual machine cannot access the target address, i.e., cannot access the confidential data. Another implementation method could be that the virtual function driver module of the virtual machine running on the host's TEE side includes logic code that prohibits the virtual machine from performing read and write operations on the target address, so the virtual machine also cannot access the destination address, i.e., cannot access the confidential data.

[0012] Based on the first aspect, in a possible implementation, the processor of the heterogeneous device verifies the integrity of the host's TEE side on the TEE side, including: the processor of the heterogeneous device generating a random number on the TEE side and sending the random number to the host's TEE side; the processor of the heterogeneous device receiving a metric value sent by the host's TEE side on the TEE side and verifying the integrity of the host's TEE side based on the metric value.

[0013] Based on the first aspect, in a possible implementation, the access request carries input data, and the method further includes: the processor of the heterogeneous device processes the confidential data according to the input data to obtain a processing result; the processor of the heterogeneous device sends the processing result to a virtual machine running on the TEE side of the host.

[0014] It is understandable that virtual machines running on the host's TEE side cannot directly read confidential data, but they can use heterogeneous devices to perform data processing operations on the confidential data. Compared to the virtual machine, the confidential data is like a "black box". The virtual machine provides input data, the heterogeneous device uses this "black box" to process the input data, and then returns the processing result to the virtual machine, thereby achieving the purpose of using confidential data for computation, while also meeting the requirements of the application scenario of this application.

[0015] Based on the first aspect, in a possible implementation, the method further includes: if the integrity verification of the host's TEE side fails, the heterogeneous device's TEE side refuses to accept access requests from virtual machines running on the host's TEE side to the heterogeneous device's TEE side.

[0016] Secondly, this application provides a heterogeneous device, in which some or all of the hardware resources of the heterogeneous device are divided into a Trusted Execution Environment (TEE) side, and the TEE side of the heterogeneous device is pre-configured with confidential data, including:

[0017] A security management module is used to verify the integrity of the host's TEE side on the TEE side of the heterogeneous device. The integrity of the host's TEE side includes: virtual machines running on the host's TEE side do not have the ability to read or write the confidential data in the heterogeneous device. The heterogeneous device and the host constitute a heterogeneous system. The security management module is located on the TEE side of the heterogeneous device.

[0018] A communication module is used to receive access requests from virtual machines running on the TEE side of the host to the TEE side of the heterogeneous device, provided that the integrity of the TEE side of the host has been verified.

[0019] Based on the second aspect, in a possible implementation, the security management module is used to: verify the integrity of the hypervisor on the TEE side of the host on the TEE side of the heterogeneous device, and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host, wherein the integrity of the hypervisor includes not mapping the target address on the hypervisor, the target address including the mapping address of the confidential data in the heterogeneous device on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read and write operations on the target address.

[0020] Based on the second aspect, among the possible implementation methods,

[0021] The security management module is used to generate random numbers on the TEE side of the heterogeneous device.

[0022] The communication module is used to send the random number to the TEE side of the host;

[0023] The communication module is used to receive measurement values ​​sent by the host's TEE side on the TEE side of the heterogeneous device;

[0024] The security management module is used to verify the integrity of the host's TEE side based on the metric value.

[0025] Based on the second aspect, in a possible implementation, the access request carries input data, and the heterogeneous device further includes:

[0026] The processing module is used to process the confidential data according to the input data to obtain the processing result;

[0027] The communication module is used to send the processing result to the virtual machine running on the TEE side of the host.

[0028] Based on the second aspect, in a possible implementation, the communication module is further configured to, if the integrity verification of the host's TEE side fails, refuse to receive access requests from virtual machines running on the host's TEE side to the heterogeneous device's TEE side.

[0029] The functional modules of the second aspect are used to implement the methods described in the first aspect and the various possible implementations of the first aspect.

[0030] Thirdly, this application provides a heterogeneous device, including a memory and a processor, wherein the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the methods described in the first aspect and various possible implementations of the first aspect.

[0031] Fourthly, this application provides a computer storage medium including program instructions that, when executed by a processor, cause the processor to perform the methods described in the first aspect and various possible implementations thereof.

[0032] Fifthly, this application provides a data confidentiality system, including a host and a heterogeneous device. Some or all of the hardware resources in the heterogeneous device are divided into a Trusted Execution Environment (TEE) side, and some of the hardware resources in the host are divided into a TEE side. Confidential data is pre-configured on the TEE side of the heterogeneous device. The heterogeneous device is used to execute the methods described in the first aspect and various possible implementations of the first aspect.

[0033] In a sixth aspect, this application provides a computer program product, including program instructions that, when executed on a heterogeneous device, cause the heterogeneous device to perform the methods described in the first aspect and various possible implementations thereof. Attached Figure Description

[0034] Figure 1 A scenario illustration provided for this application;

[0035] Figure 2 A schematic diagram of a system structure is provided for this application;

[0036] Figure 3 This application provides a schematic diagram of a system architecture applied in a confidential computing scenario;

[0037] Figure 4 A scenario illustration provided for this application;

[0038] Figure 5 A schematic diagram of a data confidentiality system architecture provided for this application;

[0039] Figure 6 A flowchart illustrating a data confidentiality method provided in this application;

[0040] Figure 7 A schematic diagram of a system structure is provided for this application;

[0041] Figure 8 A flowchart illustrating a method for verifying the integrity of the TEE side of a host, as provided in this application;

[0042] Figure 9 A schematic diagram of a state machine provided in this application;

[0043] Figure 10 This application provides a structural schematic diagram of a heterogeneous device;

[0044] Figure 11 This is a schematic diagram of the physical structure of a heterogeneous device provided in this application. Detailed Implementation

[0045] Before introducing the embodiments of this application, let's first describe the technical terms involved in the embodiments of this application.

[0046] Trustzone technology, as a security extension, was first introduced in the ARMv6 version. It divides the hardware resources of computing devices into two worlds: Trusted Execution Environment (TEE) and Rich Execution Environment (REE). TEE can also be called a secure execution environment or secure world, while REE can also be called a normal execution environment or insecure execution environment or insecure world.

[0047] The security of an REE environment is lower than that of a TEE environment. When the processor is operating on the REE side, its resources are accessible, but access to TEE resources (such as registers, memory, cache, and peripherals) is prohibited. When the processor is operating on the TEE side, it can access resources on both the TEE and REE sides. The fundamental difference between TEE and REE is the issue of permissions; the TEE side has higher operational privileges than the REE side.

[0048] In practical applications, various types of processors are involved, such as central processing units (CPUs), graphics processing units (GPUs), and neural network processing units (NPUs). Different types of processors have different performance characteristics. For example, CPUs have strong logical control capabilities but weaker computational power, especially when faced with large-scale computations; while GPUs or NPUs have weaker logical control capabilities but stronger computational power, making them particularly adept at large-scale computations.

[0049] In this context, the CPU is the processor located on the host computer, which processes instructions and data. The host computer can be, for example, a desktop computer, a personal laptop, or a physical server. In this application, the heterogeneous device runs other processors, which refer to non-CPU devices. For example, the heterogeneous device might run a GPU, which processes data; or it might run an NPU, which processes data. In other words, the heterogeneous device is defined relative to the host computer; the processors in the heterogeneous device are heterogeneous compared to the host computer's processor.

[0050] Heterogeneous devices can exist in the form of smart network interface cards (NICs). Optionally, heterogeneous devices can be plugged into a host, or establish communication with the host through other means. The processors on the host and the processors on the heterogeneous devices work together to achieve efficient computing. A system composed of heterogeneous devices and a host can be called a heterogeneous system.

[0051] This application proposes a new application requirement, which is described below.

[0052] The heterogeneous device contains pre-installed confidential data, or the confidential data is deployed on the heterogeneous device. The owner of the confidential data does not want other devices to access it, including not allowing other devices to read the confidential data or modify the parameters within it, but allows other devices to use the confidential data for computation through the heterogeneous device. For example, see... Figure 1 The diagram illustrates a scenario where a manufacturer produces heterogeneous devices. A big data computing company pre-installs confidential data within these devices, such as a neural network model. When these heterogeneous devices with pre-installed confidential data are used on a host machine, the owner of the confidential data desires that the host machine or its virtual machines cannot access or modify the confidential data on the heterogeneous devices. However, the host machine or its virtual machines are permitted to use the confidential data through other instructions. For example, the host machine or its virtual machines could issue instructions to the heterogeneous devices, carrying input data. The heterogeneous devices would then process the input data and the pre-installed confidential data (e.g., the AI ​​model) to obtain the processing result, which would then be reported back to the host machine or its virtual machines.

[0053] In other words, in this application requirement, confidential data is not disclosed to other devices or users. "Other devices" refers to any device other than heterogeneous devices, including hosts and virtual machines. "Other users" includes virtual machine tenants and cloud service platform providers. For other devices, the confidential data is like a "black box," and they cannot access the data within it. However, they can use the data from the "black box" for computation through heterogeneous devices. When other devices need to use the confidential data for computation, they can send instructions to the heterogeneous device. The heterogeneous device then performs the computation based on the instructions and sends the result back to the other devices.

[0054] It should be noted that confidential data can be a trained neural network model or other data that needs to be protected. This application does not limit the scope of confidential data.

[0055] Traditional data security methods are no longer sufficient to meet the application requirements outlined in this application. This application provides a data security method and system. Before introducing the data security method and system provided in this application, the technologies involved in the method of this application embodiment will be described first.

[0056] See Figure 2 , Figure 2 This application provides a schematic diagram of a system architecture, wherein the system includes a host and heterogeneous devices, which constitute a heterogeneous system. The processor on the host creates virtual machines on top of the host operating system through a virtual machine manager.

[0057] In heterogeneous systems, heterogeneous devices provide data space and configuration space. The data space stores data, such as data transferred between the host and the heterogeneous device. The configuration space stores configuration and control commands, such as configuration and control commands from the host to the heterogeneous device. The data space and configuration space on the heterogeneous device cannot be directly accessed by the host. To enable host software to access the heterogeneous device, the host's bus controller (such as a peripheral component interconnect express (PCIe) controller) allocates a segment of address space in the host's memory. This address space is called the memory-mapped I / O (MMIO) space, and it is used to map the data space and configuration space of the heterogeneous device. Figure 2 The mapping relationship is shown.

[0058] In device passthrough scenarios, virtual machines running on the host access the data and configuration spaces of heterogeneous devices through virtual addresses (VA). This requires a two-stage mapping process: virtual address -> intermediate physical address (IPA) -> MMIO address. The mapping from virtual address to intermediate physical address is configured by the virtual machine, while the mapping from intermediate physical address to MMIO is configured by the virtual machine manager.

[0059] See Figure 3 , Figure 3 This is a schematic diagram of a system architecture applied in a confidential computing scenario, provided as an embodiment of this application. In this scenario, the hardware resources on the host are divided into a Trusted Execution Environment (TEE) side and a Rich Execution Environment (REE) side. The hardware resources include computing power and memory. A first hypervisor is deployed on the REE side of the host, running virtual machine 1. A second hypervisor is deployed on the TEE side of the host, running virtual machine 2. It can be understood that the MMIO address space is also divided into the TEE side and the REE side. Virtual machine 1 can only access the MMIO address space on the REE side, while virtual machine 2 can access the MMIO address space on the TEE side. Optionally, virtual machine 2 can also access the MMIO address space on the REE side.

[0060] Hardware resources on heterogeneous devices are divided into TEE side and REE side, such as Figure 3 As shown, the TEE side includes data space 2 and configuration space, and the REE side includes data space 1 and configuration space (not shown in the figure). For ease of description, labels are used to indicate certain data spaces. The address space of the heterogeneous device's TEE side is mapped to the MMIO space of the TEE side on the host, and the address space of the heterogeneous device's REE side is mapped to the MMIO space of the REE side on the host, as follows: Figure 3 As shown, therefore, virtual machine 2 can access the address space on the TEE side of the heterogeneous device, and virtual machine 1 can access the address space on the REE side of the heterogeneous device.

[0061] The application scenario proposed in this application requires that confidential data in heterogeneous devices be prevented from being accessed by virtual machines running on the host. This necessitates that the virtual machine cannot access the target address, which includes the mapping address of the confidential data on the heterogeneous device in the host memory. To meet the scenario requirements of this application embodiment and protect confidential data from theft or leakage, the confidential data is typically pre-stored in the storage space on the TEE side of the heterogeneous device. For example, the confidential data is pre-stored in… Figure 3In the data space of the TEE side of heterogeneous devices. To prevent confidential data from being accessed by virtual machines running on the host, virtual machine 2 must be unable to access the target address, i.e., ... Figure 4 As shown, this makes it impossible to satisfy the mapping relationship between virtual machine 2 and the target address, i.e. Figure 4 As shown in the middle.

[0062] Based on the above Figure 4 As shown in the system architecture, this application provides a data confidentiality method and a data confidentiality system. Figure 5 As shown, Figure 5 This application provides a schematic diagram of a data confidentiality system architecture. The data confidentiality system includes a host and heterogeneous devices. The host's hardware resources are divided into a TEE side and an REE side. The TEE side of the host includes a security management module, which manages the hardware resources of the host's TEE side. The hardware resources of the heterogeneous devices are also divided into a TEE side and an REE side. Confidential data is pre-installed on the TEE side of the heterogeneous devices. The TEE side of the heterogeneous devices also includes a security management module, which manages the hardware resources of the TEE side of the heterogeneous devices.

[0063] Optionally, if the hardware capabilities of a heterogeneous device do not support dividing hardware resources into TEE and REE sides, that is, if the hardware capabilities do not support the division of access permissions for hardware resources, then because the software installed on the heterogeneous device is simpler and the control logic is weaker, the probability of security vulnerabilities is smaller. Therefore, the environment on the heterogeneous device is considered trustworthy, i.e., TEE.

[0064] The processor on the heterogeneous device verifies the integrity of the host's TEE on the TEE side. Specifically, this involves: the security management module on the heterogeneous device's TEE side sending a request to the host's TEE side, which includes a random number, to verify the integrity of the host's TEE side; upon receiving the request, the host's TEE side's security management module calculates a metric based on the random number and returns the metric to the heterogeneous device's TEE side's security management module; the heterogeneous device's TEE side's security management module then determines the integrity of the host's TEE side based on the metric. If the integrity of the host's TEE side is verified, an encrypted channel is established between the heterogeneous device's TEE side and the host's TEE side, and the heterogeneous device's TEE side receives access requests from the host's TEE side; if the integrity of the host's TEE side is verified, the heterogeneous device's TEE side rejects the access requests from the host's TEE side.

[0065] based on Figure 4 and Figure 5 The system shown in this application provides a data confidentiality method, see [link to relevant documentation]. Figure 6 , Figure 6This is a flowchart illustrating a data confidentiality method provided in this application, the method including but not limited to the following description.

[0066] S101. The processor of the heterogeneous device verifies the integrity of the host's TEE side on the TEE side of the heterogeneous device.

[0067] The integrity of the host's TEE side includes: virtual machines running on the host's TEE side do not have the ability to read or write confidential data on heterogeneous devices. For example, in Figure 4 In the diagram, virtual machine 2 does not have the ability to read or write confidential data on the heterogeneous device. That is, the processor of the heterogeneous device verifies on the TEE side whether the virtual machine on the host has the ability to read and write confidential data on the heterogeneous device.

[0068] In one implementation, the virtual machine manager on the host's TEE side does not map the intermediate physical address (IPA) to the target address; in other words, it does not map the target address on the virtual machine manager. The target address includes the MMIO address of confidential data from the heterogeneous device in the host's memory. In this implementation, the processor of the heterogeneous device only needs to verify the integrity of the virtual machine manager on the host's TEE side. If the integrity verification of the virtual machine manager on the host's TEE side passes, the virtual machine running on the host's TEE side cannot read the confidential data. The integrity of the virtual machine manager includes the fact that the target address is not mapped on the virtual machine manager.

[0069] In one implementation, the virtual machine running on the host's TEE side is configured to disable read and write operations on the target address. In this implementation, the processor of the heterogeneous device only needs to verify the integrity of the virtual function driver (VF driver) module of the virtual machine running on the host's TEE side. If the integrity verification of the virtual function driver module passes, the virtual machine running on the host's TEE side cannot read confidential data. The integrity of the virtual function driver module includes disabling read and write operations on the target address. Alternatively, the processor of the heterogeneous device verifies the integrity of the kernel code logic of the virtual machine running on the host's TEE side. If the integrity verification of the virtual machine's kernel code logic passes, the virtual machine running on the host's TEE side cannot read confidential data. The integrity of the kernel code logic includes disabling read and write operations on the target address.

[0070] In one implementation, the processor of the heterogeneous device verifies the integrity of the virtual machine manager on the host's TEE side and the integrity of the virtual function driver module of the virtual machine running on the host's TEE side on the TEE side. If the integrity verification of either one passes, the integrity verification of the host's TEE side passes; if the integrity verification of both passes, the integrity verification of the host passes; if the integrity verification of both fails, the integrity verification of the host fails.

[0071] The following is combined Figure 7 This section explains how to verify the integrity of the host's TEE side. Figure 7 A schematic diagram of a system structure provided for this application. Figure 7 In this system, the host computer and heterogeneous devices are included.

[0072] The hardware resources on the heterogeneous device are divided into the TEE side and the REE side. The REE side includes hardware device cluster 1, hardware device cluster 2, and a hardware device management module. The hardware device management module manages the hardware devices on the REE side. The REE side also includes a physical function configuration module, which communicates with the first virtual machine manager on the host. The TEE side includes hardware device cluster 3 and a security management module. The security management module manages the hardware devices on the TEE side. Confidential data is pre-loaded in hardware device cluster 3 on the TEE side of the heterogeneous device.

[0073] The host's hardware resources are divided into a TEE side and an REE side. A first virtual machine manager is deployed on the REE side, running virtual machines 1 and 2. A second virtual machine manager is deployed on the TEE side, running virtual machine 3. The TEE side also includes a security management module, which manages the host's TEE side memory. Optionally, the second virtual machine manager and the security management module can be integrated into a single module, which combines the functions of both the second virtual machine manager and the security management module.

[0074] See Figure 8 , Figure 8 This application provides a flowchart illustrating a method for verifying the integrity of the TEE side of a host, the method including, but not limited to, the following description.

[0075] S1011, The processor of the heterogeneous device generates random numbers on the TEE side.

[0076] The processor of the heterogeneous device generates a random number, nonce, on the TEE side. Nonce is an abbreviation for number once; in cryptography, nonce is an arbitrary or non-repeating random value that is used only once. Figure 7In the diagram, this step can be performed by the security management module on the TEE side of the heterogeneous device, and the security management module generates a nonce.

[0077] S1012, The processor of the heterogeneous device sends a random number to the TEE side of the host on the TEE side.

[0078] The processors of heterogeneous devices send random numbers from the TEE side to the TEE side of the host. Figure 7 In the diagram, the security management module writes the generated random number into register R1 of the heterogeneous device and generates an interrupt. Upon receiving the interrupt signal, the interrupt handler in the first virtual machine manager on the host processes the interrupt, retrieves the random number from register R1 of the heterogeneous device, and calls the interface of the security management module on the TEE side to send the random number to the security management module on the host's TEE side. Register R1 can be located in the configuration space on the REE side of the heterogeneous device.

[0079] S1013. The host's processor performs an integrity measurement on the TEE side based on a random number and obtains the measurement value.

[0080] The host's processor performs integrity measurements on the TEE side, a step that can be performed by the host's security management module on the TEE side.

[0081] In one example, in Figure 7 In the diagram shown, the code logic of the second virtual machine manager does not map the target address to the intermediate physical address. The target address includes the MMIO address of confidential data in the heterogeneous device on the host memory. The security management module measures the integrity of the second virtual machine manager based on a random number and obtains a measurement value. Specifically, the security management module includes an algorithm for measuring the integrity of the second virtual machine manager, and calculates the integrity of the second virtual machine manager according to this algorithm.

[0082] In one example, in Figure 7 In the diagram shown, the code logic of the virtual function driver module of virtual machine 3 includes provisions to prohibit virtual machine 3 from performing read and write operations on the target address, or the kernel module of virtual machine 3 includes code logic to prohibit virtual machine 3 from performing read and write operations on the target address. The security management module measures the integrity of the virtual function driver module or the kernel module of virtual machine 3 based on a random number and obtains a measurement value. Specifically, the security management module includes an algorithm for measuring the integrity of the virtual function driver module or the kernel module of virtual machine 3, and calculates the integrity of the virtual function driver module or the kernel module of virtual machine 3 according to the algorithm.

[0083] In one example, in Figure 7 In the diagram shown, the security management module can measure the integrity of both the second virtual machine manager and the virtual function driver module (or kernel module) of virtual machine 3, obtaining measurement values. Specifically, the security management module includes an algorithm for measuring the integrity of both the second virtual machine manager and the virtual function driver module (or kernel module) of virtual machine 3, and the security management module calculates the integrity of both based on this algorithm.

[0084] S1014. The host's processor returns the measurement value to the TEE side of the heterogeneous device on the TEE side.

[0085] The host processor returns the measurement values ​​from the TEE side to the TEE side of the heterogeneous device. Figure 7 In the diagram, the security management module on the host's TEE side returns the metric value to the first virtual machine manager. The first virtual machine manager writes the metric value into register R2 of the heterogeneous device, and the security management module on the heterogeneous device's TEE side reads the metric value from register R2. Register R2 can be located in the configuration space of the heterogeneous device.

[0086] S1015. The processor of the heterogeneous device verifies the integrity of the host's TEE side based on the metric value.

[0087] After receiving the metric value on the TEE side, the processor of the heterogeneous device verifies the integrity of the host's TEE side based on the metric value. Figure 7 In the diagram, this step can be performed by the security management module on the TEE side of the heterogeneous device.

[0088] In one implementation, the security management module on the TEE side of the heterogeneous device is equipped with an algorithm for verifying the integrity of the host's TEE side. The security management module compares the received measurement value with the measurement value it calculates based on the algorithm. If they match, the integrity verification of the host's TEE side passes; otherwise, the integrity verification of the host's TEE side fails.

[0089] In one implementation, the security management module on the TEE side of the heterogeneous device may not have an algorithm configured to compute the integrity of the host's TEE side. After calculating the metric, the host's TEE-side security management module sends the metric to a third-party server. This third-party server stores the integrity computation algorithm. The third-party server compares the received metric with its own calculated metric. If they match, the integrity verification on the host's TEE side passes; otherwise, it fails. The third-party server then sends the pass / fail result to the security management module on the heterogeneous device's TEE side, which then receives the verification result.

[0090] S102. If the integrity of the host's TEE side is verified, the heterogeneous device's TEE side receives access requests from virtual machines running on the host's TEE side to the heterogeneous device's TEE side.

[0091] Once the integrity of the host's TEE side is verified, the heterogeneous device's TEE side and the host's TEE side generate a session key through a key exchange protocol, establishing an encrypted channel. Thereafter, the heterogeneous device's TEE side and the host's TEE side communicate through this encrypted channel. For example, the heterogeneous device's TEE side receives access requests from virtual machines running on the host's TEE side via the encrypted channel. The heterogeneous device's TEE side processes the confidential data according to the access requests, obtains the processing results, and returns the results to the virtual machines on the host's TEE side via the encrypted channel.

[0092] For example, in Figure 7 In the diagram, after verifying the integrity of the host's TEE side, the security management modules of the heterogeneous device's TEE side and the host's TEE side generate a session key through a key exchange protocol, establishing an encrypted channel. The security management module of the heterogeneous device's TEE side receives access requests from virtual machine 3 running on the host's TEE side through the encrypted channel. Based on the access requests, the security management module processes the confidential data, obtains the processing results, and returns the results to virtual machine 3 on the host's TEE side through the encrypted channel.

[0093] S103. If the integrity verification of the host's TEE side fails, the heterogeneous device's TEE side will refuse to accept access requests from virtual machines running on the host's TEE side to the heterogeneous device's TEE side.

[0094] If the integrity of the host's TEE side fails to be verified, the TEE side of the heterogeneous device cannot establish an encrypted channel with the host's TEE side, and the TEE side of the heterogeneous device will refuse to accept access requests from virtual machines running on the host's TEE side to the TEE side of the heterogeneous device.

[0095] Optionally, the method further includes: the host's TEE side verifying the integrity of the heterogeneous device's TEE side. Specifically, the host's TEE side sends a request to the heterogeneous device's TEE side to verify the integrity of the heterogeneous device's TEE side. The request carries a random number (nonce). The heterogeneous device's TEE side calculates a metric based on the random number and sends the metric to the host's TEE side. The host's TEE side determines the integrity of the heterogeneous device's TEE side based on the metric. This operation of the host's TEE side verifying the integrity of the heterogeneous device's TEE side can occur before or after step S101, and this application does not limit it.

[0096] Optionally, in one implementation, if the integrity verification on both the heterogeneous device's TEE side and the host's TEE side passes, the heterogeneous device's TEE side and the host's TEE side generate a session key through a key exchange protocol and establish an encrypted channel. The heterogeneous device's TEE side and the host's TEE side then communicate through this encrypted channel. In this embodiment, the state machine that the heterogeneous device needs to maintain is as follows: Figure 9 As shown, Figure 9 middle,

[0097] Status 1 indicates that the integrity verification of the host's TEE side to the TEE side of the heterogeneous device has not been completed, including unverified status or verification in progress status.

[0098] State 2 indicates that the integrity verification of the heterogeneous device's TEE side by the host is complete. If the verification result is unsuccessful, the process proceeds to State 5; if the verification result is successful, it is determined whether there is confidential data on the heterogeneous device's TEE side. If so, the heterogeneous device needs to verify the integrity of the host's TEE side; if there is no confidential data on the heterogeneous device's TEE side, the host's TEE side and the heterogeneous device's TEE side communicate directly, and the system is in operation.

[0099] Status 3 indicates that the integrity verification of the host's TEE side by the heterogeneous device is completed when confidential data exists on the TEE side of the heterogeneous device.

[0100] Status 4 indicates that the integrity verification of the host's TEE side is complete and the verification result is passed. In this case, the host's TEE side and the heterogeneous device's TEE side are in communication operation.

[0101] State 5 indicates an error state, which includes various error situations, such as errors occurring during the verification of the integrity of the TEE side of heterogeneous devices (from state 1 to state 5), failure of integrity verification of the TEE side of heterogeneous devices (from state 2 to state 5), failure of integrity verification of the TEE side of the host (from state 3 to state 5), and errors occurring during the verification of the integrity of the TEE side of the host (from state 3 to state 5), etc.

[0102] In heterogeneous devices, a status bit indicating whether confidential data exists has been added. In practice, this status bit can be implemented using an electronic fuse (e-fuse). When confidential data is loaded, the electronic fuse is blown to ensure that the heterogeneous device operates in a protected state.

[0103] As can be seen, this application proposes a new application scenario: confidential data is pre-positioned in heterogeneous devices, and the host and virtual machines running on the host are required to be unable to access the confidential data in the heterogeneous devices. The host and virtual machines running on the host can only access the confidential data by sending access requests to the heterogeneous devices, so that the heterogeneous devices can process the confidential data according to the access requests. The heterogeneous devices return the processing results to the host or virtual machine, thereby achieving the purpose of the host or virtual machine using the confidential data for computation. To protect the confidential data from being accessed by other devices in this new application scenario, the resources in the heterogeneous devices are divided into TEE side and REE side. The confidential data is pre-positioned on the TEE side of the heterogeneous devices. When a virtual machine running on the host's TEE side needs to access the confidential data, the TEE side of the heterogeneous devices initiates an integrity verification challenge to the host's TEE side. If the integrity verification on the host's TEE side passes, the TEE side of the heterogeneous devices accepts the access request sent by the virtual machine on the host's TEE side. If the integrity verification on the host's TEE side fails, the TEE side of the heterogeneous devices refuses to accept the access request sent by the virtual machine on the host's TEE side. The method embodiments of this application address the needs of new application scenarios and achieve the goal of protecting confidential data from being obtained by virtual machines and cloud service platforms.

[0104] The data confidentiality method provided in this application has been described in detail above. Based on the same inventive concept, the heterogeneous device provided in this application will be introduced below.

[0105] See Figure 10 , Figure 10 This application provides a schematic diagram of the structure of a heterogeneous device 800. Some or all of the hardware resources in the heterogeneous device 800 are allocated to a Trusted Execution Environment (TEE) side. Confidential data is pre-configured on the TEE side of the heterogeneous device 800. The heterogeneous device 800 includes:

[0106] The security management module 810 is used to verify the integrity of the host's TEE side on the TEE side of the heterogeneous device 800. The integrity of the host's TEE side includes: virtual machines running on the host's TEE side do not have the ability to read or write confidential data in the heterogeneous device 800. The heterogeneous device 800 and the host constitute a heterogeneous system. The security management module 810 is located on the TEE side of the heterogeneous device 800.

[0107] The communication module 820 is used to receive access requests from virtual machines running on the TEE side of the host to the TEE side of the heterogeneous device 800, provided that the integrity of the TEE side of the host is verified.

[0108] In a possible implementation, the security management module 810 is used to: verify the integrity of the virtual machine manager hypervisor on the TEE side of the host on the TEE side of the heterogeneous device 800, and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host, wherein the integrity of the virtual machine manager hypervisor includes ensuring that the target address is not mapped on the virtual machine manager hypervisor, the target address including the mapping address of confidential data in the heterogeneous device 800 on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read and write operations on the target address.

[0109] In a possible implementation, the security management module 810 is used to generate a random number on the TEE side of the heterogeneous device 800; the communication module 820 is used to send the random number to the TEE side of the host; the communication module 820 is also used to receive a measurement value sent by the TEE side of the host on the TEE side of the heterogeneous device 800; and the security management module 810 is used to verify the integrity of the TEE side of the host based on the measurement value.

[0110] In a possible implementation, the access request carries input data, and the heterogeneous device 800 also includes: a processing module 830, which processes the input data using confidential data to obtain a processing result; and a communication module 820, which sends the processing result to a virtual machine running on the TEE side of the host.

[0111] In a possible implementation, the communication module 820 is also configured to, if the integrity verification of the host's TEE side fails, refuse to accept access requests from virtual machines running on the host's TEE side to the heterogeneous device 800's TEE side.

[0112] It is understood that the internal unit modules of the heterogeneous device 800 can be divided in various ways. Each module can be a software module, a hardware module, or a combination of both. This application does not impose any restrictions on this. Figure 10 This is an exemplary description of the functions of each module of the heterogeneous device 800. The functions of each module described are only some of the functions that the heterogeneous device 800 may have in some embodiments of this application, and this application does not limit the functions of each module. Specifically, the specific implementation of the various operations performed by the heterogeneous device 800 can be referred to the description in the relevant content of the above-described data confidentiality method embodiments, and will not be repeated here for the sake of brevity.

[0113] This application provides a heterogeneous device 900, see [link]. Figure 11 , Figure 11 This is a schematic diagram of the physical structure of a heterogeneous device 900 provided in this application. The heterogeneous device 900 includes:

[0114] The device 900 includes a bus 902, a processor 904, a memory 906, and a communication interface 908. The processor 904, memory 906, and communication interface 908 communicate via the bus 902. It should be understood that this application does not limit the number of processors and memories in the heterogeneous device 900.

[0115] The 902 bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 11 The bus 902 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 902 may include a path for transmitting information between various components of the heterogeneous device 900 (e.g., memory 906, processor 904, communication interface 908).

[0116] The processor 904 may include any one or more processors such as a graphics processing unit (GPU), a neural network processing unit (NPU), a microprocessor (MP), or a digital signal processor (DSP).

[0117] Memory 906 may include volatile memory, such as random access memory (RAM). Memory 906 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0118] The memory 906 stores executable code, which the processor 904 executes to implement the functionality of the heterogeneous device 800, thereby implementing a data security method. In other words, the memory 906 stores instructions for executing a data security method.

[0119] The communication interface 908 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the heterogeneous device 900 and other devices or communication networks.

[0120] This application also provides a data security system, including a host and heterogeneous devices. Some or all of the hardware resources in the heterogeneous devices are divided into a Trusted Execution Environment (TEE) side, and some of the hardware resources in the host are also divided into a Trusted Execution Environment (TEE) side. The TEE side of the heterogeneous devices is pre-loaded with confidential data. The heterogeneous devices can be the aforementioned heterogeneous device 800 or heterogeneous device 900.

[0121] This application also provides a computer program product containing instructions that, when run on at least one heterogeneous device, cause the at least one heterogeneous device to perform a data confidentiality method.

[0122] This application also provides a readable storage medium. The readable storage medium can be any available medium capable of being stored on a heterogeneous device, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The readable storage medium includes instructions that instruct the heterogeneous device to perform a data confidentiality method.

[0123] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0124] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a heterogeneous device, all or part of the processes or functions described in the embodiments of this application are generated. The heterogeneous device may be a GPU, NPU, or others. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium, or a semiconductor medium, etc.

[0125] The above description is merely a specific embodiment of this application. Any variations or substitutions conceived by those skilled in the art based on the specific embodiments provided in this application should be covered within the protection scope of this application.

Claims

1. A data confidentiality method, characterized in that, The method is applied to heterogeneous devices, where some or all of the hardware resources of the heterogeneous devices are divided into a Trusted Execution Environment (TEE) side, and the TEE side of the heterogeneous devices has confidential data pre-configured. The method includes: The processor of the heterogeneous device verifies the integrity of the host's TEE side on the TEE side. The integrity of the host's TEE side includes: the virtual machine running on the host's TEE side does not have the ability to read or write the confidential data in the heterogeneous device. The heterogeneous device and the host constitute a heterogeneous system. If the integrity of the host's TEE side is verified, the heterogeneous device's TEE side receives access requests from virtual machines running on the host's TEE side to the heterogeneous device's TEE side.

2. The method according to claim 1, characterized in that, The processor of the heterogeneous device verifies the integrity of the host's TEE side on the TEE side, including: The processor of the heterogeneous device verifies the integrity of the hypervisor on the TEE side of the host, and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host. The integrity of the hypervisor includes ensuring that the target address is not mapped on the hypervisor, and the target address includes the mapping address of the confidential data in the heterogeneous device on the host memory. The integrity of the virtual function driver module includes prohibiting the virtual machine from performing read and write operations on the target address.

3. The method according to claim 1 or 2, characterized in that, The processor of the heterogeneous device verifies the integrity of the host's TEE side on the TEE side, including: The processor of the heterogeneous device generates a random number on the TEE side and sends the random number to the TEE side of the host. The processor of the heterogeneous device receives the measurement value sent by the host's TEE side on the TEE side, and verifies the integrity of the host's TEE side based on the measurement value.

4. The method according to any one of claims 1 to 3, characterized in that, The access request carries input data, and the method further includes: The processor of the heterogeneous device processes the confidential data based on the input data to obtain the processing result; The processor of the heterogeneous device sends the processing result to the virtual machine running on the TEE side of the host.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: If the integrity verification of the host's TEE side fails, the heterogeneous device's TEE side will refuse to accept access requests from virtual machines running on the host's TEE side to the heterogeneous device's TEE side.

6. A heterogeneous device, characterized in that, Some or all of the hardware resources in the heterogeneous device are allocated to the Trusted Execution Environment (TEE) side. The TEE side of the heterogeneous device is pre-configured with confidential data, including: A security management module is used to verify the integrity of the host's TEE side on the TEE side of the heterogeneous device. The integrity of the host's TEE side includes: virtual machines running on the host's TEE side do not have the ability to read or write the confidential data in the heterogeneous device. The heterogeneous device and the host constitute a heterogeneous system. The security management module is located on the TEE side of the heterogeneous device. A communication module is used to receive access requests from virtual machines running on the TEE side of the host to the TEE side of the heterogeneous device, provided that the integrity of the TEE side of the host has been verified.

7. The heterogeneous device according to claim 6, characterized in that, The security management module is used for: Verify the integrity of the hypervisor on the host's TEE side at the TEE side of the heterogeneous device, and / or the integrity of the virtual function driver module of the virtual machine running on the host's TEE side, wherein the integrity of the hypervisor includes not mapping the target address on the hypervisor, the target address including the mapping address of the confidential data in the heterogeneous device on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read and write operations on the target address.

8. The heterogeneous device according to claim 6 or 7, characterized in that, The security management module is used to generate random numbers on the TEE side of the heterogeneous device. The communication module is used to send the random number to the TEE side of the host; The communication module is used to receive measurement values ​​sent by the host's TEE side on the TEE side of the heterogeneous device; The security management module is used to verify the integrity of the host's TEE side based on the metric value.

9. The heterogeneous device according to any one of claims 6 to 8, characterized in that, The access request carries input data, and the heterogeneous device further includes: The processing module is used to process the confidential data according to the input data to obtain the processing result; The communication module is used to send the processing result to the virtual machine running on the TEE side of the host.

10. The heterogeneous device according to any one of claims 6 to 9, characterized in that, The communication module is further configured to, if the integrity verification of the host's TEE side fails, refuse to receive access requests from virtual machines running on the host's TEE side to the heterogeneous device's TEE side.

11. A data security system, characterized in that, The system includes a host and heterogeneous devices. Some or all of the hardware resources in the heterogeneous devices are allocated to the Trusted Execution Environment (TEE) side. Some of the hardware resources in the host are allocated to the TEE side. The TEE side of the heterogeneous devices is pre-configured with confidential data. The heterogeneous devices are used to execute the method described in any one of claims 1-5.

12. A heterogeneous device, characterized in that, The method includes a memory and a processor, the memory being used to store instructions, and the processor being used to execute the instructions stored in the memory to implement the method as claimed in any one of claims 1 to 5.

13. A computer storage medium, characterized in that, Includes program instructions that, when executed by a processor, cause the processor to perform the method as described in any one of claims 1 to 5.

14. A computer program product, characterized in that, Includes program instructions that, when executed by a processor, cause the processor to perform the method as described in any one of claims 1 to 5.

Images