Data processing method and related equipment

Abstract

The invention discloses a data processing method and related equipment so as to improve the starting speed of a confidential virtual machine. The method comprises the following steps: receiving a secret virtual machine mirror image from client equipment and a hash tree corresponding to the secret virtual machine mirror image, and measuring a value of a root node of the hash tree to obtain a first measurement value; and running the confidential virtual machine according to the confidential virtual machine mirror image, wherein the first metric value is used for proving the integrity of the confidential virtual machine.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a data processing method and related equipment. Background Art

[0002] Confidential computing is a technology that protects the confidentiality of data while performing computations. Confidential computing uses a combination of security technologies to ensure the confidentiality of data and applications. Confidential computing typically uses encryption algorithms to protect the confidentiality of data. Unlike traditional encryption technologies, confidential computing encrypts not only during data transmission, but also during computation and processing. This means that data can remain encrypted during the computation process, preventing unauthorized access and snooping.

[0003] One of the implementation methods of confidential computing is confidential virtual machines. Confidential virtual machines generally run on cloud service providers. In order to prevent the confidential virtual machine program from being tampered with by the cloud service provider's hypervisor or staff, two technologies, trusted boot and remote attestation, are required. Trusted boot ensures that the confidential virtual machine startup process is secure and reliable. It uses hash and digital signature technology to measure the integrity of each component and driver in the confidential virtual machine startup process and saves the measurement results in trusted hardware. Remote verification uses hash and digital certificate technology to prove to another computing unit (usually a confidential computing user) that the hardware and program of the confidential virtual machine have not been tampered with.

[0004] Compared with ordinary boot, trusted boot adds the step of measurement. In confidential computing scenarios, the entire confidential virtual machine needs to be measured. The size of the virtual machine is in the order of 1GB to 100GB. If you want to load 10GB into the memory at one time during boot, it takes 5 to 10 seconds, and trusted boot is slow. Summary of the invention

[0005] The present application provides a data processing method and related devices to solve the problem of slow startup speed of confidential virtual machines.

[0006] The first aspect provides a data processing method. The method is applied to a confidential computing server device. The confidential computing server device can be a server or a server cluster, and the confidential computing server device can also be a terminal device. The method includes: receiving a confidential virtual machine image from a client device and a hash tree corresponding to the confidential virtual machine image. Measuring the value of the root node of the hash tree to obtain a first measurement value. The first measurement value can be stored in a trusted module of the confidential computing server device to ensure that the first measurement value will not be changed. The confidential virtual machine is run using the confidential virtual machine image, and the first measurement value is used to prove the integrity of the confidential virtual machine. When starting the confidential virtual machine image, only the root node of the hash tree of the confidential virtual machine image is measured, without measuring the entire confidential virtual machine. The root node of the hash tree has a small amount of data and a short measurement time, which can increase the startup speed of the confidential virtual machine.

[0007] In a possible implementation, using a confidential virtual machine image to run a confidential virtual machine includes: obtaining a target data block from the confidential virtual machine image according to the operation requirements of the confidential virtual machine; verifying the integrity of the target data block according to the target data block, the hash tree, and the first metric; if the target data block is complete, running the target data block; if the target data block is incomplete, stopping the operation of the confidential virtual machine. When the confidential virtual machine is running, the integrity of the data blocks required for operation is verified. In actual operation, the confidential virtual machine often does not need to run all the data in the confidential virtual machine image, but only runs a part of it. Therefore, verifying the integrity of the data block on demand during operation can significantly reduce the time required to start the confidential virtual machine as a whole.

[0008] In a possible implementation, the hash tree includes a target path corresponding to the target data block, the target path includes a leaf node storing a first hash value of the target data block, and an ancestor node of the leaf node, the ancestor node includes a root node, and the integrity of the target data block is verified according to the target data block, the hash tree and the first metric value, including: calculating the second hash value of the target data block; judging whether the target path is credible according to the first metric value; if the first hash value is the same as the second hash value and the target path is credible, then the target data block is determined to be complete; if the first hash value is different from the second hash value, or the target path is not credible, then the target data block is determined to be incomplete. The first metric value in the trusted module is the trust root of the trust chain, and the trust chain is the first metric value in the trusted module → target path → target data block. Under the premise that the first metric value is credible, the trusted authentication of the target path is performed based on the first metric value, and the integrity authentication of the target data block is performed based on the target path, which can ensure that the target data block is complete, thereby ensuring that the confidential computing environment is credible.

[0009] In a possible implementation, judging whether a target path is credible based on a first metric value includes: measuring a root node to obtain a second metric value; calculating hash values ​​of all child nodes in the target path, where a child node is a node other than the root node in the target path; comparing whether the first metric value is the same as the second metric value, and comparing whether the hash value of each child node is the same as the hash value of the child node stored in the parent node of the child node in the hash tree; if the first metric value is the same as the second metric value, and the hash value of each child node is the same as the hash value of the child node stored in the parent node of the child node in the target path, determining that the target path is credible.

[0010] In a possible implementation, the method also includes: obtaining attributes of multiple memory pages, the multiple memory pages include data loaded into the memory after at least two virtual machines are started, the at least two virtual machines include a confidential virtual machine, the attributes include a confidentiality attribute, an integrity attribute and a mergeability attribute, the value of the confidentiality attribute indicates confidentiality or non-confidentiality, the value of the integrity attribute indicates integrity or non-integrity, and the value of the mergeability attribute indicates whether it can be merged or not; based on the attributes of the multiple memory pages, while ensuring the integrity and confidentiality of the confidential virtual machine, memory deduplication of the confidential virtual machine can be achieved to improve memory utilization.

[0011] In a possible implementation, based on the attributes of multiple memory pages, the memory pages with the same data, the confidentiality attribute value indicating no confidentiality, and the mergeability attribute value indicating mergeable memory pages are merged, including: based on the attributes of the multiple memory pages, obtaining the target memory pages with the confidentiality attribute value indicating no confidentiality and the mergeability attribute value indicating mergeable memory pages; merging the memory pages with the same data in the target memory pages. Thus, the memory deduplication of the confidential virtual machine can be achieved and the memory utilization rate can be improved under the premise of ensuring the integrity and confidentiality of the virtual machine.

[0012] The second aspect provides a data processing method. This aspect is applied to a client device. The method includes: calculating a confidential virtual machine image to obtain a corresponding hash tree; sending the confidential virtual machine image and the hash tree to a confidential computing server device, the hash tree being used to prove the integrity of the confidential virtual machine image, so that the confidential computing server device obtains the first metric value corresponding to the root node of the hash tree and then uses the confidential virtual machine image to run the confidential virtual machine. Since the hash tree is obtained by the client device calculating the confidential virtual machine image, it can be used to prove the integrity of the confidential virtual machine image, so that the confidential computing server device can subsequently verify the integrity of the confidential virtual machine based on the hash tree.

[0013] In a possible implementation, the method further includes: receiving verification information sent by a confidential computing server device, the verification information including a first metric value, the first metric value being used to prove the integrity of the confidential virtual machine; determining that the confidential virtual machine is complete according to the verification information; and sending the data to be analyzed to the confidential computing server device, so that the confidential virtual machine running on the confidential computing server device analyzes the data to be analyzed. After proving that the confidential computing environment on the confidential computing server device is complete and credible based on the first metric value, the data to be analyzed is uploaded, thereby ensuring that the data to be analyzed will not be leaked or stolen, and ensuring the security of the data to be analyzed during the calculation process.

[0014] In a possible implementation, determining that the confidential virtual machine is complete according to the verification information includes: determining whether the first metric value meets expectations; and determining that the confidential virtual machine is complete if the first metric value meets expectations.

[0015] The third aspect provides a data processing device. The device includes a transceiver module and a processing module. The transceiver module is used to receive a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image from a client device. The processing module is used to measure the value of the root node of the hash tree to obtain a first measurement value. The processing module is used to run a confidential virtual machine using the confidential virtual machine image, and the first measurement value is used to prove the integrity of the confidential virtual machine.

[0016] In a possible implementation, the processing module is used to obtain a target data block from a confidential virtual machine image according to the operation requirements of the confidential virtual machine. The processing module is used to verify the integrity of the target data block according to the target data block, the hash tree and the first metric value. The processing module is used to run the target data block when the target data block is complete. The processing module is used to stop running the confidential virtual machine when the target data block is incomplete.

[0017] In a possible implementation, a hash tree includes a target path corresponding to a target data block, the target path includes a leaf node storing a first hash value of the target data block, and an ancestor node of the leaf node, the ancestor node including a root node; a processing module, configured to calculate a second hash value of the target data block. The processing module, configured to determine whether the target path is credible according to a first metric value. The processing module, configured to determine that the target data block is complete when the first hash value is the same as the second hash value and the target path is credible. The processing module, configured to determine that the target data block is incomplete when the first hash value is different from the second hash value or the target path is not credible.

[0018] In a possible implementation, a processing module is used to measure a root node to obtain a second measurement value; a processing module is used to calculate hash values ​​of all child nodes in a target path, where a child node is a node other than a root node in the target path; a processing module is used to compare whether a first measurement value is the same as a second measurement value, and to compare whether a hash value of each child node is the same as a hash value of a child node stored in a parent node of the child node in a hash tree; and a processing module is used to determine that a target path is credible when the first measurement value is the same as the second measurement value and the hash value of each child node is the same as a hash value of a child node stored in a parent node of the child node in the target path.

[0019] In a possible implementation, a processing module is used to obtain attributes of multiple memory pages, the multiple memory pages include data loaded into memory after at least two virtual machines are started, the at least two virtual machines include a confidential virtual machine, the attributes include a confidentiality attribute, an integrity attribute, and a mergeability attribute, the value of the confidentiality attribute indicates confidentiality or non-confidentiality, the value of the integrity attribute indicates integrity or non-integrity, and the value of the mergeability attribute indicates mergeability or non-mergibility. The processing module is used to merge, according to the attributes of the multiple memory pages, memory pages with the same data, the value of the confidentiality attribute indicating non-confidentiality, and the value of the mergeability attribute indicating mergeability.

[0020] In one possible implementation, a processing module is used to obtain, based on the attributes of multiple memory pages, a target memory page in which the value of a confidentiality attribute indicates no confidentiality and the value of a mergeability attribute indicates mergeable; and a processing module is used to merge memory pages with the same data in the target memory page.

[0021] A fourth aspect provides a data processing device. The device includes a transceiver module. The transceiver module is used to send a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image to a confidential computing server device, and the hash tree is used to prove the integrity of the confidential virtual machine image, so that the confidential computing server device obtains a first metric value corresponding to the root node of the hash tree and then uses the confidential virtual machine image to run the confidential virtual machine.

[0022] In a possible implementation, the device further includes a processing module. A transceiver module is used to receive verification information sent by a confidential computing server device, the verification information includes a first measurement value, and the first measurement value is used to prove the integrity of the confidential virtual machine; the processing module is used to determine that the confidential virtual machine is complete according to the verification information; and the transceiver module is used to send data to be analyzed to the confidential computing server device, so that the confidential virtual machine running on the confidential computing server device analyzes the data to be analyzed.

[0023] In a possible implementation, the processing module is used to determine whether the first metric value meets expectations; the processing module is used to determine that the confidential virtual machine is complete when the first metric value meets expectations.

[0024] A fifth aspect provides a data processing method, which includes: obtaining attributes of multiple memory pages, the multiple memory pages include data loaded into the memory after at least two virtual machines are started, the at least two virtual machines include a confidential virtual machine, the attributes include a confidentiality attribute, an integrity attribute and a mergeability attribute, the value of the confidentiality attribute indicates confidentiality or non-confidentiality, the value of the integrity attribute indicates integrity or non-integrity, and the value of the mergeability attribute indicates whether it can be merged or not; according to the attributes of the multiple memory pages, merging the memory pages in which the data is the same, the value of the confidentiality attribute indicates non-confidentiality, and the value of the mergeability attribute indicates that it can be merged.

[0025] In one possible implementation, based on the attributes of multiple memory pages, memory pages having the same data, whose confidentiality attribute values ​​indicate no confidentiality, and whose mergeability attribute values ​​indicate mergeable memory pages are merged, include: based on the attributes of the multiple memory pages, obtaining target memory pages whose confidentiality attribute values ​​indicate no confidentiality, and whose mergeability attribute values ​​indicate mergeable memory pages; and merging memory pages having the same data in the target memory pages.

[0026] A sixth aspect provides a data processing device, which includes a processing module. The processing module is used to obtain the attributes of multiple memory pages, the multiple memory pages include data loaded into the memory after at least two virtual machines are started, the at least two virtual machines include a confidential virtual machine, the attributes include a confidentiality attribute, an integrity attribute, and a merge attribute, the value of the confidentiality attribute indicates confidentiality or non-confidentiality, the value of the integrity attribute indicates integrity or non-integrity, and the value of the merge attribute indicates whether it can be merged or not. The processing module is also used to merge the memory pages with the same data in the multiple memory pages, the value of the confidentiality attribute indicates non-confidentiality, and the value of the merge attribute indicates that it can be merged.

[0027] In one possible implementation, a processing module is used to obtain, based on the attributes of multiple memory pages, a target memory page in which the value of a confidentiality attribute indicates no confidentiality and the value of a mergeability attribute indicates mergeable; and a processing module is used to merge memory pages with the same data in the target memory page.

[0028] A fifth aspect provides a computing device. The computing device includes a processor and a memory, the processor is coupled to the memory, and the processor is configured to execute the data processing method in the first aspect or any possible implementation of the first aspect, or the data processing method in the second aspect or any possible implementation of the second aspect, or the data processing method in the fifth aspect or any possible implementation of the second aspect based on instructions stored in the memory.

[0029] A sixth aspect provides a computer-readable storage medium. The computer-readable storage medium includes instructions, and when the computer-readable storage medium is run on a computer, the computer executes the data processing method in the first aspect or any possible implementation of the first aspect, or the data processing method in the second aspect or any possible implementation of the second aspect, or the data processing method in the fifth aspect or any possible implementation of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of the architecture of a server running a virtual machine;

[0031] Figure 2 A schematic diagram of starting the operating system kernel in a trusted boot;

[0032] Figure 3 A schematic diagram of the architecture of a confidential computing system provided for this application;

[0033] Figure 4 A schematic diagram comparing the traditional trusted boot and the trusted boot provided by this application;

[0034] Figure 5 A flowchart of a data processing method provided in this application;

[0035] Figure 6 A schematic diagram of the structure of a hash tree provided for this application;

[0036] Figure 7 A flowchart of a confidential virtual machine operation method provided in this application;

[0037] Figure 8 Schematic diagram of memory deduplication of confidential virtual machines provided for this application;

[0038] Fig. 9 A schematic diagram of the structure of a data processing device provided in this application;

[0039] Fig.10 A schematic diagram of the structure of a computing device provided in this application. DETAILED DESCRIPTION

[0040] The present application provides a data processing method and related equipment to improve the startup speed of a confidential virtual machine.

[0041] The following describes the embodiments of the present application in conjunction with the accompanying drawings. Obviously, the described embodiments are only embodiments of a part of the present application, rather than all embodiments. It is known to those skilled in the art that with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0042] The terms "first", "second", etc. in the specification and claims of this application and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. In the description of this application, unless otherwise specified, the meaning of "plurality" refers to two or more.

[0043] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0044] In order to better explain the technical solution of the present application, the relevant terms involved in the present application are explained below.

[0045] A virtual machine (VM) is a complete computer system that is simulated by software and has complete hardware system functions and runs in a completely isolated environment. Any work that can be done in a server can also be done in a virtual machine. When creating a virtual machine in a server, part of the hard disk and memory capacity of the physical machine is used as the hard disk and memory capacity of the virtual machine. Each virtual machine has an independent hard disk and operating system, and the user of the virtual machine can operate the virtual machine just like using a server. Figure 1 As shown, the server includes a hardware layer and a software layer. The hardware layer is the conventional configuration of the server, for example, including memory, processor, disk and peripheral component interconnect (PCI) devices. Among them, PCI devices can be devices such as network cards, graphics processing units (GPUs), and offload cards that can be inserted into the PCI / PCIe slots of the server. The software layer includes an operating system installed and running on the server (relative to the operating system of the virtual machine, it can be called the host operating system), and a virtual machine manager (virtual machine monitor, VMM) (also known as Hypervisor) is provided in the host operating system. The role of the virtual machine manager is to realize the computing virtualization, network virtualization and storage virtualization of the virtual machine, and is responsible for managing the virtual machine. Computing virtualization refers to providing part of the server's processor and memory to the virtual machine, network virtualization refers to providing part of the functions of the network card (such as bandwidth) to the virtual machine, and storage virtualization refers to providing part of the disk to the virtual machine.

[0046] Confidential computing is a computing model that protects the confidentiality and integrity of data and code, as well as the confidentiality of the computing process, by building a secret, isolated, and provable computing environment based on trusted hardware. The computing process refers to the program running process, during which the process program segment, data segment, process control block, and all data involved in the process communication are generated.

[0047] A confidential computing VM is an operating environment that includes a complete confidential computing operating system and confidential computing applications. The confidential computing operating system can support a complete application or the sensitive part of an application after it is split. In the following, the confidential computing VM is referred to as a confidential VM.

[0048] A secure channel is a communication channel that provides confidentiality and authenticity for the messages exchanged. It ensures that local data is securely transmitted to the confidential computing environment.

[0049] Confidentiality is the property of using cryptographic technology to ensure that information is not leaked.

[0050] Integrity: the quality of being accurate and complete.

[0051] A confidential computing environment is a collection of software and related components deployed on a confidential computing platform.

[0052] A general computing environment is a collection of software and related components that do not have confidential computing capabilities and only provide basic functions and computing resources. A general computing environment is an independent operating environment relative to a confidential computing environment.

[0053] Confidential computing application program: An application that is deployed and runs in a confidential computing environment. Application layer components in a confidential computing environment and processing logic involving sensitive data should all be completed in the confidential computing application program.

[0054] A confidential computing operating system is a system software layer component in a confidential computing environment. It is an operating system that is tailored based on the trusted execution control unit and instruction set encapsulation of the underlying chip. It mainly provides functions such as computing resource scheduling, isolated memory space management, and communication mechanism with ordinary computing environments for confidential computing environments.

[0055] Confidential computing platform, which provides a collection of confidential computing infrastructure and supporting software.

[0056] Trusted startup measures the confidential computing environment before the system starts to ensure the integrity and authenticity of the confidential computing environment.

[0057] Measurement, the hash value of the files on the confidential computing server (confidential computing environment and confidential computing applications, etc.) is extended to the trusted hardware. The extension stored in the trusted hardware is the measurement value. The measurement value is the unique value of the measurement object calculated using the corresponding algorithm. If the measurement value of a measurement object changes before and after, it can be considered that the measurement object has changed or been modified. Therefore, the measurement value can be used as evidence to prove the integrity of the corresponding file.

[0058] Remote attestation: The client verifies the integrity of the confidential computing environment and confidential computing applications on the confidential computing server based on verification information such as measurement values.

[0059] Confidential computing is a technology that protects the confidentiality of data while performing calculations. Confidential computing uses a combination of a series of security technologies to ensure the confidentiality of data and applications. Confidential computing usually uses encryption algorithms to protect the confidentiality of data. Unlike traditional encryption technologies, confidential computing encrypts not only during data transmission, but also during calculation and processing. This means that data can remain encrypted during the calculation process, thereby preventing unauthorized access and peeping. Confidential computing has broad application prospects in cloud computing, finance, banking, medical care, blockchain smart contracts, mobile computing devices, and federated learning. For example, in cloud computing scenarios, the ownership of data belongs to the user, and the computing power required for data calculation needs to be completed in the cloud environment. Based on confidential computing, data can be prevented from being stolen or tampered with by attackers (including cloud service providers) during use. For example, in medical scenarios, medical data contains a large amount of personal privacy data such as patient information, user information, and genetic data, which makes it difficult for medical institutions, insurance, pharmaceutical companies, and medical equipment manufacturers to efficiently coordinate data circulation and sharing, and it is difficult to effectively play the value of medical data. Confidential computing can establish a secure data circulation infrastructure for medical data participants and promote the maximum utilization of medical data value. For example, in financial scenarios, financial institutions will use big data to build risk control models to ensure the normal operation of their funds, and use technical means to reduce the possibility of risk events. Financial institutions often need government, corporate, and personal data to provide support in the process of credit risk control and marketing. However, in the traditional model, due to data security issues, it is difficult for financial institutions to obtain corporate and personal data efficiently and in compliance. Confidential computing technology can perform distributed model inference and training without leaking the original data of all parties. Government departments can share government data with financial institutions, conduct compliance data analysis through confidential computing, and achieve precise risk control.

[0060] Confidential VMs are a way to achieve confidential computing. Confidential VMs can perform computing and processing without exposing data, thereby protecting the privacy and security of sensitive data. Confidential VMs also provide complete security isolation to prevent intrusion and attacks by malware and attackers. Malware, for example, includes the hypervisor that controls the confidential VM. Attackers, for example, include system administrators, such as employees of cloud operators, etc.

[0061] In addition to preventing confidential data from being stolen, it is also necessary to prevent programs from being tampered with, which requires two technologies: trusted boot and remote verification. Trusted boot ensures that the system boot process is secure and reliable. It uses hash and digital signature technology to measure the integrity of each component and driver in the device boot process and saves the measurement results in trusted hardware. Remote verification uses hash and digital certificate technology to verify to another computing unit (usually a user of confidential computing) that the hardware and program of the device have not been tampered with.

[0062] Measurement is one of the key technologies of trusted boot, which can solve the problem of system tampering or implantation of malicious code during the boot process of the device, thereby ensuring the integrity of the system during the boot process of the device. Usually, boot measurement (measurement during trusted boot process) is implemented with the help of hardware trusted roots, such as trusted platform module (TPM), trusted cryptography module (TCM) or trusted platform control module (TPCM). The boot measurement process of the operating system follows the principle of "measure first, then run". In trusted boot, each module of the operating system completes the trusted verification step by step, that is, each component in the system boot sequence performs integrity measurement step by step. Specifically, the current stage code is responsible for measuring the code of the next stage, and the current stage code extends the measurement value obtained by measuring the code of the next stage to the platform configuration register (PCR) of the TPM. After that, the code of the next stage becomes the updated current stage code, and the above process is performed on the new code of the next stage, and this cycle is repeated again and again until all the system codes are measured, and then the system is run. The trusted boot process of the operating system is: first start the BIOS or UEFI; then the BIOS / UEFI loads all the code of the operating system's boot loader (Bootloader) into the memory and measures all the code of the Bootloader; after the Bootloader is started, the entire code of the operating system's kernel is loaded into the memory and measured; after the kernel is started, the entire code of the system driver is loaded into the memory and measured... Finally, after the measurement of all the codes of the operating system is completed, the startup of the operating system is completed. That is, the measurement of the entire operating system must be completed before the startup of the operating system can be completed. The measurement value in the PCR is sent to the remote proof initiator by the confidential computing server (the computing power provider that performs confidential computing) as the measurement evidence of the system startup phase to determine whether the confidential computing server is in a trusted state.

[0063] Remote attestation is one of the key technologies in the overall solution of confidential computing. Users can use remote attestation to determine whether the confidential computing server is in a trusted state. The remote attestation process includes: the remote attestation initiator initiates an attestation challenge to the confidential computing server through the remote attestation interface, and the confidential computing server responds to the attestation challenge and sends verification information such as the measurement value in the PCR to the remote attestation initiator. The remote attestation initiator determines whether the confidential computing environment provided by the confidential computing server is trustworthy based on the verification information. Of course, the remote computing server can also be remotely attested by a trusted third-party entity.

[0064] Trusted boot has a measurement step. If the file being measured is large, it will extend the boot speed and cause the trusted boot to be slow. For example, Figure 2 As shown in the figure, taking the kernel of the booting operating system as an example, in order to measure the kernel, the Bootloader needs to load all the kernel code into the memory to calculate its measurement value, and finally the hash value is recorded in the hardware trusted root. In the confidential computing scenario, the entire confidential virtual machine needs to be measured at startup, and the confidential virtual machine includes the confidential operating system and the confidential computing application. The size of the confidential virtual machine is in the order of 1GB to 100GB. If you want to load 10GB into the memory at one time at startup, it takes 5 to 10 seconds.

[0065] In order to solve the above technical problems, the present application provides the following embodiments.

[0066] like Figure 3 As shown, Figure 3 A schematic diagram of the architecture of a confidential computing system provided for the present application. The confidential computing system includes a client device and a confidential computing server device. A secure channel is established between the confidential computing server device and the client device, and data is transmitted based on the secure channel, which can protect the integrity of the data during transmission between the two. The client device can be a mobile phone, computer, laptop, tablet computer, car computer, smart wearable device, etc. The confidential computing server device is the computing power provider. In a cloud computing scenario, the confidential computing server device can be an infrastructure in a public cloud, private cloud, or hybrid cloud, such as a server or a server cluster. Of course, in other scenarios, the confidential computing server device can also be a terminal device with computing power, such as a mobile phone, computer, laptop, tablet computer, car computer, smart wearable device, etc.

[0067] In order to solve the problem of slow startup of confidential virtual machines, in this embodiment, only the root node of the hash tree corresponding to the confidential virtual machine image is measured when the virtual machine is started. Since the amount of data in the root node of the hash tree is small, the measurement can be completed quickly, thereby realizing the rapid startup of the confidential virtual machine. During operation, the data block in the confidential virtual machine image is obtained according to the operation requirements of the confidential virtual machine, and before running the data block, the integrity of the data block is verified according to the hash tree.

[0068] Specifically, in this embodiment, the client device is used to send a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image to the confidential computing server device. The confidential virtual machine image includes software for data analysis (such as a confidential operating system, a confidential computing application, and an algorithm, etc.). The hash tree is used to prove the integrity of the confidential virtual machine image. The confidential computing server device measures the value of the root node of the hash tree to obtain a measurement value, and the measurement value is stored in a trusted module. After the confidential computing server device completes the measurement of the root node of the hash tree, it uses the confidential virtual machine image to start the confidential virtual machine. After the confidential virtual machine is started, the confidential computing server device proves the integrity of the confidential virtual machine to the client device through remote attestation, and the measurement value stored in the trusted module is one of the verification information for verifying the integrity of the confidential virtual machine. After the client device completes the integrity verification of the confidential virtual machine based on the verification information from the confidential computing server device, it confirms that the confidential computing environment of the confidential computing server device is credible, and uploads the data to be analyzed to the confidential computing server device. The confidential virtual machine created and started based on the confidential virtual machine image from the client device running in the confidential computing server device analyzes and calculates the data to be analyzed to obtain the analysis result.

[0069] Since the confidential computing server device only measures the root node of the hash tree of the confidential virtual machine image when it is started, but does not verify the integrity of the confidential virtual machine image. Therefore, when the confidential virtual machine is running, the confidential virtual machine in this embodiment loads the corresponding data block in the confidential virtual machine image according to the running requirements, and verifies the integrity of the data block based on the hash tree and the measurement value. If the verification is successful and the data block is complete, it means that the data block has not been modified and the data block can be run. If the verification fails, the data block and / or hash tree is incomplete, it means that the data block and / or hash tree has been modified, and the operation of the confidential virtual machine is stopped.

[0070] like Figure 4 As shown, Figure 4 The traditional trusted boot provided by this solution is demonstrated. Different from the traditional trusted boot that measures the entire virtual machine at startup to verify the integrity of the virtual machine, this embodiment verifies the integrity of the data blocks in the virtual machine image according to the running requirements when the virtual machine is running. Although it is slower than the traditional trusted boot at runtime, because the virtual machine's operating system does not need to load all the data blocks of the running virtual machine image, the overall time consumption of this solution is still less than the traditional solution.

[0071] Based on the above confidential computing system, this application provides the following method embodiments. Figure 5 As shown, Figure 5 A flowchart of a data processing method provided in this application.

[0072] S501: The client device sends a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image to the confidential computing server device.

[0073] The confidential virtual machine image includes an operating system, confidential computing applications, and algorithms, so that the confidential computing server can create a confidential computing environment based on the confidential virtual machine image, and ensure that the data will not be leaked when the algorithm is subsequently run to analyze and calculate the data, thereby improving the security of data analysis on the confidential computing server device. Confidential computing programs include remote attestation programs, business programs, or service programs in confidential operating systems, etc.

[0074] In this embodiment, the client device also sends a hash tree corresponding to the confidential virtual machine image to the confidential computing server device. Hash tree, also known as Merkle tree, is a tree data structure in cryptography and computer science. The hash tree includes leaf nodes, intermediate nodes (or branch nodes) and root nodes. Each leaf node of the hash tree uses the hash value of the data block as a label, and the nodes other than the leaf nodes use the hash value obtained by hashing the labels of their child nodes as labels. Hash calculation refers to the use of a hash algorithm such as Secure Hash Algorithm (SHA) or message digest algorithm (MD) 5 to hash the data in the block. SHA can specifically be SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512, etc.

[0075] A block is the smallest storage unit of an operating system and is a logical unit. Therefore, in this embodiment, the size of a node of a hash tree can be one or more blocks, and the nodes of a hash tree are sometimes referred to as hash blocks in this embodiment. In addition, a hash calculation can be performed with one or more blocks as the granularity to obtain a corresponding hash value, thereby reducing the number of reads and writes and improving data processing efficiency. The size of a block can be 1KB (kilobytes), 2KB or 4KB, etc., which is not limited here. A leaf node of a hash tree can store hash values ​​corresponding to multiple data blocks (blocks storing data files, applications, operating systems, etc.). An intermediate node of a hash tree can store hash values ​​of its multiple child nodes, such as hash values ​​corresponding to multiple leaf nodes or multiple intermediate nodes. A root node can store hash values ​​of multiple child nodes, such as hash values ​​corresponding to multiple intermediate nodes. In this embodiment, the hash value corresponding to a node (leaf node / intermediate node) refers to a hash calculation of the data stored in the node to obtain a hash value corresponding to the node.

[0076] For example, Figure 6 As shown, Figure 6A schematic diagram of the structure of a hash tree provided for this application. Figure 6 Take a node of the hash tree as a 4K block and the hash algorithm as SHA-256 as an example. Figure 6 In the example, the bottom layer is a plurality of data blocks storing confidential virtual machine images. Each SHA-256 hash value is 256 bits, or 32 bytes, so a 4KB hash block can store up to 4096 / 32=128 SHA-256 hash values. Perform SHA-256 calculation on each data block to obtain a 256-bit hash value corresponding to each data block. Then a hash block in the first layer can store SHA-256 hash values ​​corresponding to 128 data blocks. Similarly, perform SHA-256 calculation on each hash block in the first layer to obtain a 256-bit hash value corresponding to each hash block. A hash block in the second layer can store SHA-256 hash values ​​corresponding to 128 hash blocks in the first layer. And so on, until there is only one hash block in the kth layer, which stores the SHA-256 hash values ​​corresponding to all hash blocks in the k-1th layer (greater than or equal to 2 and less than or equal to 128 hash blocks). The hash block in the kth layer is also called the root node.

[0077] Whether the confidential virtual machine image is modified or the value in the node in the hash tree is modified, the value of the root node will be changed. Therefore, the integrity of the confidential virtual machine image can be verified based on the hash tree.

[0078] S502: The confidential computing server device measures the value of the root node of the hash tree to obtain a first measurement value.

[0079] After receiving the confidential virtual machine image and hash tree, the confidential computing server device stores them on the disk. When starting the confidential virtual machine, the confidential computing server device needs to complete the measurement of the confidential virtual machine. In this embodiment, the confidential computing server device measures the value of the root node of the hash tree to obtain a first measurement value. Since the root node of the hash tree is the size of a block, the measurement can be completed quickly. Compared with the need to complete the measurement of the entire confidential virtual machine in the traditional trusted startup process, this solution can greatly improve the measurement speed, thereby improving the startup speed of the confidential virtual machine.

[0080] Since the hash tree is obtained based on the confidential virtual machine image, the first metric value is obtained based on the root node of the hash tree, and the first metric value can be used to prove the integrity of the confidential virtual machine. Specifically, in this embodiment, the first metric value is used to verify the integrity of the data block that needs to be run in the confidential virtual machine image when the confidential virtual machine image is used to run the confidential virtual machine. If the first metric value is determined to be credible during the remote attestation process, then the confidential virtual machine is also complete and credible.

[0081] The first measurement value may be stored in a trusted module to ensure that the first measurement value is not changed and to ensure the integrity of the first measurement value. The trusted module is, for example, a hardware trusted module, such as a CPU, TPM, TPCM, or TCM. The trusted module may also be a software trusted module, such as a firmware-based TPM (fTPM), a virtual TPM, or a firmware-based TCM.

[0082] S503: The confidential computing server device uses the confidential virtual machine image to run the confidential virtual machine.

[0083] After the confidential computing server-side device completes the measurement of the root node of the hash tree, it uses the confidential virtual machine image to create and start the corresponding confidential virtual machine. Since the measurement process only measures the value of the root node of the hash tree, and does not verify the integrity of the confidential virtual machine itself, this embodiment verifies the integrity of the data blocks that need to be run in the confidential virtual machine image when the confidential virtual machine is running. That is, according to the confidential virtual machine operation requirements, verify the integrity of the part of the data in the confidential virtual machine image that needs to be loaded into the memory for operation, and perform local integrity verification on the confidential virtual machine image as needed. Even if the operation process is slow when running the confidential virtual machine image, since the entire confidential virtual machine image does not need to be loaded and run during actual operation, the total time required for startup is still less than the traditional trusted startup.

[0084] The following describes in detail the process of running a confidential virtual machine on a confidential computing server device. Figure 7 As shown, Figure 7 A flowchart of a confidential virtual machine operation method provided in this application.

[0085] S5031: The confidential computing server device obtains the target data block in the confidential virtual machine image according to the confidential virtual machine operation requirements.

[0086] When the confidential virtual machine is running, it is not necessary to load all the codes of the confidential virtual machine image into the memory for running, but to load the codes required for the current running into the memory on demand for running. In this embodiment, according to the running requirements of the confidential virtual machine, the data block that needs to be loaded from the confidential virtual machine image into the memory is called the target data block. For example, when starting the kernel of the confidential virtual machine, the code required to run the kernel can be loaded from the kernel of the confidential virtual machine image into the memory on demand, without loading the entire kernel into the memory for measurement.

[0087] S5032: The confidential computing server device verifies the integrity of the target data block based on the target data block, the hash tree and the first metric value.

[0088] Before running the target data block, the target data block is verified for integrity. The target data block can be run only after passing the integrity verification.

[0089] Specifically, the confidential computing server device performs a hash calculation on the target data block to obtain a second target hash value. The leaf nodes in the hash tree store the hash values ​​corresponding to all data blocks of the confidential virtual machine image, and thus the first target hash value corresponding to the target data block can be obtained from the target node among the multiple leaf nodes of the hash tree. By comparing the first target hash value and the second target hash value, the integrity of the hash tree and the target data block can be preliminarily verified. If the first target hash value is different from the second target hash value, it is possible that the hash tree has been modified, or it is possible that the target data block has been modified, in which case it can be determined that the target data block or the hash tree is incomplete.

[0090] If the first target hash value is the same as the second target hash value, it is possible that the target data block and the second target hash value have not been changed, or it is possible that the target data block and the second target hash value have been changed. Therefore, it is also necessary to further verify the integrity of the target data block and the target path corresponding to the target data block in the hash tree. The target path includes the target node and the ancestor node of the target node. The ancestor node of the target node is all the nodes on the path from the root node of the hash tree to the target node. The target path includes a node in each layer of the hash tree, and the target path includes the root node of the hash tree. The parent node in the target path stores the hash value corresponding to the child node of the parent node. If the data in the target data block and the node in the target path is changed, the value in the root node will change. The data in the target data block and the node in the target path may be changed, and the first metric value stored in the trusted module will not be changed. Therefore, it is possible to verify whether the target path is credible based on the first metric value. If the target path is credible and the first target hash value and the second target hash value are the same, it can be determined that the target data block is complete. If the target path is not credible, or the first target hash value and the second target hash value are different, it can be determined that the target data block is incomplete.

[0091] The specific method for verifying whether the target path is credible according to the first metric is as follows: measure the root node to obtain the second metric, calculate the hash values ​​of all child nodes in the target path (including nodes other than the root node), and compare them with the hash values ​​corresponding to the child nodes stored in the parent node corresponding to each child node. For example, the target path includes node 1 of the first layer of the hash tree (the leaf node storing the target data block), node 2 of the second layer (the node storing the hash value corresponding to node 1), node 3 of the third layer (the node storing the hash value corresponding to node 2), ..., the root node of the kth layer (the node storing the hash value corresponding to node k-1). Calculate the hash value of node 1 and compare it with the hash value corresponding to node 1 stored in node 2; calculate the hash value of node 2 and compare it with the hash value corresponding to node 2 stored in node 3, and so on for other nodes.

[0092] If the first metric value is the same as the second metric value, and the hash value of each child node is the same as the hash value corresponding to the child node stored in the parent node of the child node, then the target path is credible. If the first metric value is different from the second metric value, or there is a child node whose hash value is different from the hash value corresponding to the child node stored in the parent node of the child node, then the target path is not credible.

[0093] If the target data block is complete, S5033 is executed. If the target data block or the hash tree is incomplete, S5034 is executed.

[0094] S5033: The confidential computing server device runs the target data block.

[0095] S5034: The confidential computing server device stops running the confidential virtual machine.

[0096] Optionally, the confidential computing server device can also notify the client device.

[0097] S504: The client device performs remote attestation with the confidential computing server device and completes integrity verification of the confidential virtual machine based on the first measurement value.

[0098] The client device initiates the remote attestation process, and the confidential computing server device sends the verification information including the first measurement value to the client device, and the client device or a third-party trusted platform connected to the client device verifies the verification information. If the first measurement value meets expectations, the confidential virtual machine image is complete, and the confidential computing environment created based on the confidential virtual machine image is credible. The first measurement value can be a measurement value in plain text or in cipher text, and there is no restriction here.

[0099] Specifically, if the first metric value is credible, it means that the value of the root node of the hash tree has not been changed and is credible. Furthermore, when the confidential virtual machine is running, the result of verifying the integrity of the data block in the confidential virtual machine based on the first metric value and the hash tree (whether the target data block is complete or incomplete) is also credible, that is, the confidential virtual machine is credible and the confidential computing environment is credible.

[0100] The specific process of remote attestation can refer to relevant technical standard materials, such as the remote attestation process architecture document (IETF RATS Working Group: Remote Attestation Procedures Architecture) issued by the Internet Engineering Task Force (IETF) Remote Attestation Working Group. Of course, other remote attestation methods can also be used, which are not limited here.

[0101] S505: The client device sends the data to be analyzed to the confidential computing server device.

[0102] After the client device confirms that the confidential computing environment is trustworthy through remote attestation, it sends the data to be analyzed to the confidential computing server device to use the computing power of the confidential computing server device to perform data analysis.

[0103] S506: The confidential computing server device performs data analysis on the data to be analyzed based on the running confidential virtual machine.

[0104] Confidential computing is based on the confidential computing environment created by the confidential virtual machine image provided by the client device, and performs analysis and calculation on the data to be analyzed. After obtaining the analysis results, the analysis results are sent to the analysis result demander. The analysis result demander can be the client device or other third party.

[0105] In this embodiment, when starting the confidential virtual machine image, only the root node of the hash tree corresponding to the confidential virtual machine image is measured and then the confidential virtual machine is run to achieve rapid startup of the confidential virtual machine. When running the confidential virtual machine, the integrity of the target data block loaded on demand is verified. Since the entire confidential virtual machine is not loaded into the memory during actual operation, the time required to start the confidential virtual machine can be reduced as a whole, thereby improving the startup speed of the confidential virtual machine.

[0106] Due to its integrity requirements, confidential virtual machines are generally allocated independent memory space, so confidential virtual machines will occupy a large amount of memory space on the confidential computing server device. Since the virtual machine manager cannot read the virtual machine memory, the virtual machine manager of the confidential computing server device cannot deduplicate the confidential virtual machine, resulting in low memory utilization.

[0107] Specifically, in order to deduplicate the memory of a confidential virtual machine, the confidential virtual machine needs to actively mark non-confidential memory pages. A memory page can store a data block. A data block in a confidential virtual machine image is loaded into the memory and stored in a memory page of the memory. For example, the program code only has integrity requirements but no confidentiality requirements, while the program input and output data and private algorithms have both integrity and confidentiality requirements. Currently, confidential virtual machines can mark the memory with "encryption attribute" or "merge attribute". The value of the encryption attribute can indicate decrypted memory (set_memory_decrypted) or encrypted memory (set_memory_encrypted). When a memory page has integrity or confidentiality requirements, the encryption attribute of the memory page needs to be set to encrypted memory (set_memory_encrypted). When a memory page has neither integrity nor confidentiality requirements, the encryption attribute of the memory page can be set to decrypted memory (set_memory_decrypted), so that the memory page can be read and written by the virtual machine manager. The value of the merge attribute can indicate mergeable (madv_mergeable) or unmergeable (madv_unmergeable). When there are at least two identical memory pages, and the values ​​of the mergeable attributes of these memory pages all indicate that they can be merged, these memory pages can be merged to deduplicate, that is, only one memory page is retained and the other memory pages are deleted to reduce the memory space occupied by these memory pages. Confidential virtual machines all have integrity requirements, which results in the encryption attributes of the memory pages of confidential virtual machines being set to encrypted memory (set_memory_encrypted). The virtual machine manager cannot read memory pages with the encrypted memory attribute, resulting in the virtual machine manager being unable to deduplicate confidential virtual machines.

[0108] In order to solve the problem that confidential virtual machines cannot deduplicate memory, the present application also provides the following method. The method mainly decouples integrity and confidentiality by adding an "integrity" attribute, so that memory pages with integrity requirements but no confidentiality requirements can be merged and deduplicated.

[0109] Specifically, a memory page includes attributes such as confidentiality attribute, integrity attribute and merge attribute. The value of the confidentiality attribute indicates whether it has confidentiality or not. The value of the confidentiality attribute is independent of integrity, that is, regardless of whether the memory page has integrity requirements, as long as the memory page has confidentiality requirements, the confidentiality attribute can be set to have confidentiality; as long as the memory page has no confidentiality requirements, the confidentiality attribute can be set to have no confidentiality. The confidentiality attribute uses the "encryption attribute", but it does not contain the meaning of the integrity attribute. For example, when the data in the memory page has confidentiality requirements, the Linux kernel set_memory_encrypted interface can be called to set the memory page to have confidentiality, without caring whether the memory page has integrity requirements. When the data in the memory page has no confidentiality requirements, the Linux kernel set_memory_decrypted interface can be called to set the memory page to have no confidentiality, without caring whether the memory page has integrity requirements. The value of the integrity attribute indicates whether it has integrity or not. When the data in the memory page has integrity requirements, the integrity attribute can be set to have integrity. When the data in the memory page has no integrity requirements, the integrity attribute can be set to have no integrity. The value of the merge attribute indicates whether it can be merged or not. When the data in the memory page can be merged with other memory pages with the same data for deduplication, the merge attribute can be set to mergeable. When the data in the memory page cannot be merged with other memory pages with the same data for deduplication, the merge attribute can be set to non-mergeable.

[0110] Therefore, for the non-confidential and mergeable memory pages in the memory of the confidential virtual machine, a merge deduplication operation can be performed to improve memory utilization. Confidential virtual machines can perform memory deduplication between confidential virtual machines, and confidential virtual machines can also perform memory deduplication between ordinary virtual machines (non-confidential virtual machines). For at least two virtual machines (including at least one confidential virtual machine) running on a confidential server device, the same memory pages (memory pages storing the same data) are merged and deduplicated according to the attributes of the memory pages. Specifically, the hypervisor can filter out the target memory pages that are non-confidential and mergeable according to the attributes of all memory pages in the memory, and then determine the memory pages that store the same data in the target memory pages that are non-confidential and mergeable, and then perform a merge operation on these memory pages that store the same data pages to achieve memory merge deduplication of the confidential virtual machine. That is, the merged memory pages are memory pages that store the same data, the value of the confidentiality attribute indicates non-confidentiality, and the value of the merge attribute indicates mergeable. The hypervisor can scan the attributes of the memory pages regularly or irregularly, and merge and dedupe according to the attributes of the memory pages, thereby improving memory utilization.

[0111] For example, Figure 8 As shown, Figure 8Schematic diagram of memory deduplication for confidential virtual machines provided for this application. Figure 8 Take the memory deduplication of two confidential virtual machines, Confidential Virtual Machine 1 and Confidential Virtual Machine 2, as an example. Memory page A stores sensitive data, and Confidential Virtual Machine 1 sets the attribute of memory page A to "confidential, mergeable, and complete". Memory page B does not store sensitive data, such as operating system code, and Confidential Virtual Machine 1 sets the attribute of memory page B to "non-confidential, mergeable, and complete". Memory pages C and D do not store sensitive data, and Confidential Virtual Machine 2 sets the attributes of memory pages C and D to "non-confidential, mergeable, and complete". Based on the attributes of the memory pages, the virtual machine manager determines that the non-confidential and mergeable memory pages are memory page B, memory page C, and memory page D. Based on the content of memory page B in Confidential Virtual Machine 1 and the content of memory page C and memory page D in Confidential Virtual Machine 2, it is determined that memory page B and memory page C are the same memory page, and then memory page B and memory page C can be merged, and only one of memory page B and memory page C is retained, so as to achieve the purpose of memory deduplication and improve memory utilization.

[0112] like Fig. 9 As shown, Fig. 9 A schematic diagram of the structure of a data processing device provided in this application. Fig. 9 The data processing device 900 is used to execute the steps in any of the above data processing method embodiments. The data processing device 900 includes a transceiver module 901 and a processing module 902.

[0113] When the data processing device 900 is applied to the above-mentioned confidential computing server device, the data processing device 900 can be a confidential computing server device, such as a computer, a server, a server cluster, or a terminal device with computing power, etc. The data processing device 900 can also be a hardware module (such as a chip) or a functional module in the confidential computing server device.

[0114] When the data processing device 900 is applied to the above-mentioned confidential computing server device, the transceiver module 901 is used to receive the confidential virtual machine image and the hash tree corresponding to the confidential virtual machine image from the client device. The processing module 902 is used to measure the value of the root node of the hash tree to obtain a measurement value. The processing module 902 is used to run the confidential virtual machine using the confidential virtual machine image, and the first measurement value is used to prove the integrity of the confidential virtual machine.

[0115] In a possible implementation, processing module 902 is used to obtain a target data block from a confidential virtual machine image according to the operation requirements of the confidential virtual machine. Processing module 902 is used to verify the integrity of the target data block according to the target data block, the hash tree, and the first metric value. Processing module 902 is used to run the target data block when the target data block is complete. Processing module 902 is used to stop running the confidential virtual machine when the target data block is incomplete.

[0116] In a possible implementation, the hash tree includes a target path corresponding to the target data block, the target path includes a leaf node storing a first hash value of the target data block, and an ancestor node of the leaf node, the ancestor node including a root node; a processing module 902 is used to calculate a second hash value of the target data block. The processing module 902 is used to determine whether the target path is credible according to the first metric value. The processing module 902 is used to determine that the target data block is complete when the first hash value is the same as the second hash value and the target path is credible. The processing module 902 is used to determine that the target data block is incomplete when the first hash value is different from the second hash value or the target path is not credible.

[0117] In a possible implementation, processing module 902 is used to measure the root node to obtain a second metric value. Processing module 902 is used to calculate the hash values ​​of all child nodes in the target path, where the child nodes are nodes other than the root node in the target path. Processing module 902 is used to compare whether the first metric value is the same as the second metric value, and to compare whether the hash value of each child node is the same as the hash value of the child node stored in the parent node of the child node in the hash tree. Processing module 902 is used to determine that the target path is credible when the first metric value is the same as the second metric value and the hash value of each child node is the same as the hash value of the child node stored in the parent node of the child node in the target path.

[0118] In a possible implementation, processing module 902 is used to obtain attributes of multiple memory pages, the multiple memory pages include data loaded into memory after at least two virtual machines are started, the at least two virtual machines include a confidential virtual machine, the attributes include a confidentiality attribute, an integrity attribute, and a mergeability attribute, the value of the confidentiality attribute indicates confidentiality or non-confidentiality, the value of the integrity attribute indicates integrity or non-integrity, and the value of the mergeability attribute indicates mergeability or non-mergibility. Processing module 902 is used to merge memory pages with the same data in multiple memory pages, the value of the confidentiality attribute indicates non-confidentiality, and the value of the mergeability attribute indicates mergeability according to the attributes of the memory pages.

[0119] In one possible implementation, the processing module 902 is used to obtain, based on the attributes of multiple memory pages, a target memory page in which the value of the confidentiality attribute indicates no confidentiality and the value of the mergeability attribute indicates mergeable; and the processing module is used to merge memory pages with the same data in the target memory page.

[0120] When the data processing device 900 is applied to the above-mentioned client device, the data processing device 900 can be a client device, such as a computer, a mobile phone, a tablet computer, a car machine or a smart wearable device. The data processing device 900 can also be a hardware module (such as a chip) or a functional module in a confidential computing server device.

[0121] When the data processing device 900 is applied to the above-mentioned client device, the transceiver module 901 is used to send the confidential virtual machine image and the hash tree corresponding to the confidential virtual machine image to the confidential computing server device. The hash tree is used to prove the integrity of the confidential virtual machine image, so that the confidential computing server device obtains the first measurement value corresponding to the root node of the hash tree and then uses the confidential virtual machine image to run the confidential virtual machine.

[0122] In a possible implementation, the apparatus further includes a processing module 902. The transceiver module 901 is configured to receive verification information sent by the confidential computing server device, the verification information including a first measurement value, and the first measurement value is used to prove the integrity of the confidential virtual machine. The processing module 902 is configured to determine that the confidential virtual machine is intact according to the verification information. The transceiver module 901 is configured to send the data to be analyzed to the confidential computing server device, so that the confidential virtual machine running on the confidential computing server device analyzes the data to be analyzed.

[0123] In a possible implementation, the processing module 902 is used to determine whether the first metric value meets expectations; the processing module 902 is used to determine that the confidential virtual machine is complete when the first metric value meets expectations.

[0124] The present application also provides a computing device 1000. Fig.10 As shown, computing device 1000 includes: bus 1002, processor 1004, memory 1006 and communication interface 1008. Processor 1004, memory 1006 and communication interface 1008 communicate through bus 1002. Computing device 1000 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in computing device 1000.

[0125] The bus 1002 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 The bus 1002 may include a path for transmitting information between various components of the computing device 1000 (eg, the memory 1006, the processor 1004, and the communication interface 1008).

[0126] The processor 1004 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0127] The memory 1006 may include a volatile memory, such as a random access memory (RAM). The memory 1006 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid state drive (SSD). The memory 1006 stores executable program code, and the processor 1004 executes the executable program code to implement the aforementioned data processing method. Specifically, the memory 1006 stores instructions for executing the data processing method.

[0128] The communication interface 1008 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1000 and other devices or a communication network.

[0129] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a computer, the data processing method flow of any of the above method embodiments is implemented.

[0130] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0131] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical or other forms.

[0132] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0133] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0134] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the technical solution of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A data processing method, characterized in that: The method comprises: Receiving a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image from a client device; Measuring the value of the root node of the hash tree to obtain a first measurement value; The confidential virtual machine image is used to run the confidential virtual machine, and the first measurement value is used to prove the integrity of the confidential virtual machine.

2. The method according to claim 1, characterized in that The using the confidential virtual machine image to run the confidential virtual machine includes: Obtaining a target data block from the confidential virtual machine image according to the operation requirements of the confidential virtual machine; Verifying the integrity of the target data block according to the target data block, the hash tree and the first metric value; If the target data block is complete, executing the target data block; If the target data block is incomplete, the operation of the confidential virtual machine is stopped.

3. The method according to claim 2, characterized in that The hash tree includes a target path corresponding to the target data block, the target path includes a leaf node storing a first hash value of the target data block, and an ancestor node of the leaf node, the ancestor node includes the root node, and verifying the integrity of the target data block according to the target data block, the hash tree and the first metric value includes: Calculating a second hash value of the target data block; Determining whether the target path is credible according to the first metric value; If the first hash value is the same as the second hash value and the target path is credible, then determining that the target data block is complete; If the first hash value is different from the second hash value, or the target path is not credible, it is determined that the target data block is incomplete.

4. The method according to claim 3, characterized in that The determining, according to the first metric value, whether the target path is credible includes: Measuring the root node to obtain a second metric value; Calculate hash values ​​of all child nodes in the target path, where the child nodes are nodes other than the root node in the target path; Comparing whether the first metric value is the same as the second metric value, and comparing whether the hash value of each of the child nodes is the same as the hash value of the child node stored in the parent node of the child node in the hash tree; If the first metric value is the same as the second metric value, and the hash value of each of the child nodes is the same as the hash value of the child node stored in the parent node of the child node in the target path, it is determined that the target path is credible.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Acquire attributes of multiple memory pages, the multiple memory pages include data loaded into memory after at least two virtual machines are started, the at least two virtual machines include the confidential virtual machine, the attributes include a confidentiality attribute, an integrity attribute, and a mergeability attribute, a value of the confidentiality attribute indicates confidentiality or non-confidentiality, a value of the integrity attribute indicates integrity or non-integrity, and a value of the mergeability attribute indicates mergeability or non-mergeability; According to the attributes of the multiple memory pages, memory pages having the same data, a value of the confidentiality attribute indicating no confidentiality, and a value of the mergeability attribute indicating mergeability are merged.

6. The method according to claim 5, characterized in that The step of merging, according to the attributes of the plurality of memory pages, memory pages having the same data, the value of the confidentiality attribute indicating no confidentiality, and the value of the mergeability attribute indicating mergeable memory pages, comprises: According to the attributes of the plurality of memory pages, obtaining a target memory page in which the value of the confidentiality attribute indicates no confidentiality and the value of the mergeability attribute indicates mergeability; Memory pages with the same data in the target memory page are merged.

7. A data processing method, characterized in that: The method comprises: A confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image are sent to a confidential computing server device, where the hash tree is used to prove the integrity of the confidential virtual machine image, so that the confidential computing server device obtains a first metric value corresponding to a root node of the hash tree and then uses the confidential virtual machine image to run the confidential virtual machine.

8. The method according to claim 7, characterized in that The method further comprises: Receiving verification information sent by the confidential computing server device, the verification information including the first measurement value, the first measurement value being used to prove the integrity of the confidential virtual machine; Determining that the confidential virtual machine is complete according to the verification information; The data to be analyzed is sent to the confidential computing server device so that the confidential virtual machine run by the confidential computing server device analyzes the data to be analyzed.

9. The method according to claim 8, characterized in that Determining the integrity of the confidential virtual machine according to the verification information includes: Determining whether the first metric value meets expectations; If the first metric value meets expectations, it is determined that the confidential virtual machine is complete.

10. A data processing device, characterized in that: The device comprises: A transceiver module, used for receiving a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image from a client device; A processing module, configured to measure the value of the root node of the hash tree to obtain a first measurement value; The processing module is used to run a confidential virtual machine using the confidential virtual machine image, and the first measurement value is used to prove the integrity of the confidential virtual machine.

11. The device according to claim 10, characterized in that The processing module is used to obtain a target data block from the confidential virtual machine image according to the operation requirements of the confidential virtual machine; The processing module is used to verify the integrity of the target data block according to the target data block, the hash tree and the first metric value; The processing module is used to run the target data block when the target data block is complete; The processing module is used to stop running the confidential virtual machine when the target data block is incomplete.

12. The device according to claim 11, characterized in that The hash tree includes a target path corresponding to the target data block, the target path includes a leaf node storing a first hash value of the target data block, and an ancestor node of the leaf node, the ancestor node includes the root node; The processing module is used to calculate a second hash value of the target data block; The processing module is used to determine whether the target path is credible according to the first metric value; The processing module is configured to determine that the target data block is complete when the first hash value is the same as the second hash value and the target path is credible; The processing module is used to determine that the target data block is incomplete when the first hash value is different from the second hash value or the target path is not credible.

13. The device according to claim 12, characterized in that The processing module is used to measure the root node to obtain a second measurement value; The processing module is used to calculate the hash values ​​of all child nodes in the target path, where the child nodes are nodes other than the root node in the target path; The processing module is used to compare whether the first metric value is the same as the second metric value, and compare whether the hash value of each of the child nodes is the same as the hash value of the child node stored in the parent node of the child node in the hash tree; The processing module is used to determine that the target path is credible when the first metric value is the same as the second metric value and the hash value of each of the child nodes is the same as the hash value of the child node stored in the parent node of the child node in the target path.

14. The device according to any one of claims 10 to 13, characterized in that The processing module is configured to obtain attributes of a plurality of memory pages, wherein the plurality of memory pages include data loaded into the memory after at least two virtual machines are started, the at least two virtual machines include the confidential virtual machine, the attributes include a confidentiality attribute, an integrity attribute, and a mergeability attribute, the value of the confidentiality attribute indicates confidentiality or non-confidentiality, the value of the integrity attribute indicates integrity or non-integrity, and the value of the mergeability attribute indicates mergeability or non-mergeability; The processing module is used to merge, according to the attributes of the multiple memory pages, the memory pages with the same data, the value of the confidentiality attribute indicating no confidentiality, and the value of the mergeability attribute indicating mergeable memory pages.

15. The device according to claim 14, characterized in that The processing module is configured to obtain, according to the attributes of the multiple memory pages, a target memory page in which the value of the confidentiality attribute indicates no confidentiality and the value of the mergeability attribute indicates mergeability; The processing module is used to merge the memory pages with the same data in the target memory page.

16. A data processing device, characterized in that: The device comprises: A transceiver module is used to send a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image to a confidential computing server device, wherein the hash tree is used to prove the integrity of the confidential virtual machine image so that the confidential computing server device obtains a first metric value corresponding to a root node of the hash tree and then uses the confidential virtual machine image to run the confidential virtual machine.

17. The device according to claim 16, characterized in that The device also includes a processing module; The transceiver module is used to receive verification information sent by the confidential computing server device, wherein the verification information includes the first measurement value, and the first measurement value is used to prove the integrity of the confidential virtual machine; The processing module is used to determine that the confidential virtual machine is complete according to the verification information; The transceiver module is used to send the data to be analyzed to the confidential computing server device, so that the confidential virtual machine run by the confidential computing server device analyzes the data to be analyzed.

18. The device according to claim 17, characterized in that The processing module is used to determine whether the first metric value meets expectations; The processing module is configured to determine that the confidential virtual machine is complete when the first metric value meets expectations.

19. A computing device, characterized in that The computing device includes a processor and a memory, wherein the processor is coupled to the memory, and the processor is configured to execute the data processing method according to any one of claims 1 to 9 based on instructions stored in the memory.

20. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises instructions, which, when the computer-readable storage medium is executed on a computer, causes the computer to execute the data processing method according to any one of claims 1 to 9.

Images