Computer system, application running method and corresponding device

Abstract

The invention provides a computer system which comprises a confidential computing operating system and a general operating system, and the confidential computing operating system comprises a sub-operating system of an independent framework or / and a sub-operating system of a collaborative framework; wherein the sub-operating system of the independent framework is used for independently running applications of a first type, the applications of the first type are applications migrated from the universal operating system, and the applications of the first type are non-CA in the universal operating system; the sub-operating system of the collaborative framework is used for collaboratively operating a second type of application with the universal operating system; wherein a part of codes in the second type of application run in a sub-operating system of the collaborative framework, and the remaining codes, except the part of the codes, in the codes of the second type of application run in a universal operating system. Thus, the sub-operating system running in the confidential computing operating system is selected according to the type of the application, the usability of the confidential computing operating system can be considered, and the safety of the confidential computing operating system can also be considered.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a computer system, a method for running an application, and corresponding devices. Background Art

[0002] An operating system (OS) can include a trusted operating system (Trusted OS) and a rich operating system (Rich OS). A rich OS is also called a general operating system or a universal operating system. A trusted OS runs in a trusted execution environment (TEE), while a rich OS runs in a rich execution environment (REE). Applications running in a REE can include ordinary applications and client applications (CA). Applications running in a TEE are called trusted applications (TA). All code for ordinary applications runs in the REE, while part of the code for a CA runs in the REE and the rest runs in the TEE, running in both the REE and TEE in the form of a CA-TA.

[0003] In cloud scenarios, standard applications in REE face very high migration costs if they want to use TEEs. Migrating the entire standard application code to the TEE, as standard applications typically contain many lines of code, inevitably harboring known and unknown vulnerabilities, potentially posing significant security risks to the trusted operating system. Migrating only a portion of the code and reconfiguring the standard application to run as a CA-TA requires code splitting and modification, resulting in poor usability. Summary of the Invention

[0004] This application provides a computer system and a method for running applications to improve the usability and security of migrating common applications from REE to TEE. This application also provides corresponding devices, computer-readable storage media, and computer program products.

[0005] The first aspect of the present application provides a computer system, including: a confidential computing operating system and a general operating system, the confidential computing operating system includes a sub-operating system of an independent framework and / or a sub-operating system of a collaborative framework; wherein the sub-operating system of the independent framework is used to independently run a first type of application, the first type of application is an application migrated from the general operating system, and the first type of application is a non-client application CA in the general operating system; the sub-operating system of the collaborative framework is used to run a second type of application in collaboration with the general operating system; wherein a part of the code in the second type of application runs in the sub-operating system of the collaborative framework, and the remaining code of the second type of application except for a part of the code runs in the general operating system.

[0006] In this application, the general operating system refers to the operating system running in REE, and the confidential computing operating system refers to the operating system running in TEE.

[0007] In this application, a standalone sub-OS refers to an operating system that runs applications independently within a TEE, without interacting with the general-purpose operating system within the REE. A collaborative sub-OS refers to an operating system that runs within a TEE but collaborates with the general-purpose operating system within the REE to process CA-TA when running applications.

[0008] In this application, the first type of application can be an ordinary application (non-CA) originally running in a general operating system. The first type of application can be migrated to a sub-operating system of an independent framework to run without modifying the code. In this way, the usability of the confidential computing operating system can be improved without modifying the code.

[0009] In this application, the second type of application can be a TA, or a CA-TA. In this way, the second type of application does not need to migrate all the code to the confidential computing operating system. It only needs to migrate part of the code to the sub-operating system of the collaborative framework as needed to run. In this way, there is no need to introduce a large amount of code, which can improve the security of the confidential computing operating system.

[0010] From the first aspect mentioned above, it can be seen that by selecting the sub-operating system to run in the confidential computing operating system based on the type of application, both the ease of use and the security of the confidential computing operating system can be taken into account.

[0011] In one possible implementation, the computer system also includes a switch module; the switch module is used to select a sub-operating system running in the confidential computing operating system based on the format of the application to be loaded.

[0012] In this possible implementation, a switch module can select a sub-OS to run in the confidential computing operating system. The switch module can choose to run a sub-OS in an independent framework, a sub-OS in a collaborative framework, or a sub-OS in an independent framework and a sub-OS in a collaborative framework. In this way, by selecting a sub-OS in the confidential computing operating system through the switch module, the flexibility of running applications in the confidential computing operating system can be improved.

[0013] In one possible implementation, when the format of the application to be loaded indicates that the application to be loaded is an application of the first type, the switch module is used to select a sub-operating system that runs an independent framework in the confidential computing operating system.

[0014] In this possible implementation, when the format of the application to be loaded indicates that the application is a common application (non-CA), the switch module can select the sub-operating system running the independent framework in the confidential computing operating system. In this way, the common application can be run through the sub-operating system of the independent framework. In this way, the common application does not need to modify the code when running in the sub-operating system of the independent framework, which can improve the usability of the confidential computing operating system.

[0015] In one possible implementation, when the format of the application to be loaded indicates that the application to be loaded is an application of the second type, the switch module is used to select a sub-operating system that runs a collaborative framework in the confidential computing operating system.

[0016] In this possible implementation, if the format of the application to be loaded indicates that it is a TA application, the switch module can select the sub-OS running the collaborative framework in the confidential computing operating system. In this way, the application can be run through the sub-OS of the collaborative framework and the general operating system in the REE, thereby improving the security of the confidential computing operating system.

[0017] In one possible implementation, when there are multiple applications to be loaded, the format of the multiple applications to be loaded indicates that the multiple applications to be loaded include first type applications and second type applications, and the switch module is used to select a sub-operating system of an independent framework and a sub-operating system of a collaborative framework to run in the confidential computing operating system.

[0018] In this possible implementation, when the applications to be loaded include both ordinary applications and TA applications, the sub-operating system of the independent framework and the sub-operating system of the collaborative framework can be run simultaneously in the confidential computing operating system. In this way, diverse application needs can be met.

[0019] In a possible implementation, system resources used by the sub-operating system of the independent framework and the sub-operating system of the collaborative framework are isolated through the first container, and the system resources include a file system, a process ID, or a network resource.

[0020] In this possible implementation, system resource isolation refers to software isolation. By using the first container to isolate the sub-operating system of the independent framework and the sub-operating system of the collaborative framework, defects and vulnerabilities cannot be spread, thereby enhancing security.

[0021] In one possible implementation, computing resources and storage resources may also be isolated using a second container.

[0022] A second aspect of the present application provides a method for running an application, which is applied to a computer system, wherein the computer system includes a confidential computing operating system and a general operating system, and the confidential computing operating system includes a sub-operating system of an independent framework and / or a sub-operating system of a collaborative framework. The method includes: obtaining a first application to be loaded; when the first application is a first type of application, independently running the first application through the sub-operating system of the independent framework, the first type of application is an application migrated from the general operating system, and the first type of application is a non-client application CA in the general operating system; when the first application is a second type of application, running the first application in collaboration with the general operating system through the sub-operating system of the collaborative framework; a part of the code in the second type of application runs in the sub-operating system of the collaborative framework, and the remaining code of the second type of application except for a part of the code runs in the general operating system.

[0023] In a possible implementation, the method further includes: when the first application is an application of the first type, starting a sub-operating system of the independent framework.

[0024] In a possible implementation, the method further includes: when the first application is an application of the second type, starting a sub-operating system of the collaborative framework.

[0025] In a possible implementation, the method further includes: when there are multiple first applications, and the multiple first applications include first-type applications and second-type applications, starting the sub-operating system of the independent framework and the sub-operating system of the collaborative framework.

[0026] In a possible implementation, system resources used by the sub-operating system of the independent framework and the sub-operating system of the collaborative framework are isolated through the first container, and the system resources include a file system, a process ID, or a network resource.

[0027] A third aspect of the present application provides a computer device, the computer device including a confidential computing operating system and a general operating system, the confidential computing operating system including a sub-operating system of an independent framework and / or a sub-operating system of a collaborative framework, the computer device including:

[0028] an acquiring unit, configured to acquire a first application to be loaded;

[0029] A processing unit is used to independently run the first application through a sub-operating system of an independent framework when the first application is a first type of application, and the first type of application is an application migrated from a general operating system. The first type of application is a non-client application CA in the general operating system; when the first application is a second type of application, the first application is collaboratively run through a sub-operating system of a collaborative framework and the general operating system; a portion of the code in the second type of application runs in the sub-operating system of the collaborative framework, and the remaining code of the second type of application except for a portion of the code runs in the general operating system.

[0030] In a possible implementation, the processing unit is further configured to start a sub-operating system of an independent framework when the first application is an application of the first type.

[0031] In a possible implementation, the processing unit is further configured to start the sub-operating system of the collaborative framework when the first application is an application of the second type.

[0032] In a possible implementation, the processing unit is further configured to start the sub-operating system of the independent framework and the sub-operating system of the collaborative framework when there are multiple first applications, and the multiple first applications include first-type applications and second-type applications.

[0033] In a possible implementation, system resources used by the sub-operating system of the independent framework and the sub-operating system of the collaborative framework are isolated through the first container, and the system resources include a file system, a process ID, or a network resource.

[0034] In a fourth aspect, the present application provides a computer device comprising a processor and a computer-readable storage medium storing a computer program; the processor is coupled to the computer-readable storage medium, and when the computer program is executed by the processor, the method according to the second aspect or any possible implementation method is implemented.

[0035] In a fifth aspect, the present application provides a computer-readable storage medium storing one or more computer-executable instructions. When the computer-executable instructions are executed by a processor, the processor executes the method described in the second aspect or any possible implementation of the second aspect.

[0036] In a sixth aspect, the present application provides a computer program product storing one or more computer-executable instructions. When the computer-executable instructions are executed by the processor, the processor executes the method of the above-mentioned second aspect or any possible implementation of the second aspect.

[0037] In a seventh aspect, the present application provides a chip system, which includes a processor for supporting a computer device to implement the functions involved in the second aspect or any possible implementation of the second aspect. In one possible design, the chip system may also include a memory for storing program instructions and data necessary for training nodes. The chip system may be composed of a chip or may include a chip and other discrete devices.

[0038] Among them, the technical effects brought about by the second aspect or any possible implementation method of the second aspect to the seventh aspect can refer to the technical effects brought about by the first aspect or different possible implementation methods of the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 is a structural diagram of a computer system provided in an embodiment of the present application;

[0040] Figure 2 This is a schematic diagram of the permission levels of the operating system provided in an embodiment of the present application;

[0041] Figure 3 is another structural diagram of the computer system provided in an embodiment of the present application;

[0042] Figure 4 This is a schematic diagram of the structure of the cloud system provided by the embodiment of the present application;

[0043] Figure 5 is another structural diagram of the computer system provided in an embodiment of the present application;

[0044] Figure 6A This is a schematic diagram of the structure of the confidential computing operating system provided by an embodiment of the present application;

[0045] Figure 6B This is another structural diagram of the confidential computing operating system provided in an embodiment of the present application;

[0046] Figure 6C This is another structural diagram of the confidential computing operating system provided in an embodiment of the present application;

[0047] Figure 7 is another structural diagram of the computer system provided in an embodiment of the present application;

[0048] Figure 8 This is a schematic diagram of an embodiment of a method for running an application provided in an embodiment of the present application;

[0049] Figure 9 is a structural diagram of a computer device provided in an embodiment of the present application;

[0050] Figure 10is another structural diagram of a computer device provided in an embodiment of the present application;

[0051] Figure 11 This is another structural diagram of the computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] The following describes the embodiments of the present application in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of the present application, rather than all the embodiments. Those skilled in the art will appreciate that with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0053] The terms "first," "second," and the like in the specification and claims of this application and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having," as well as any variations thereof, are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to these processes, methods, products, or apparatus.

[0054] Embodiments of the present application provide a computer system and an application running method for improving the usability and security of migrating common applications from a REE to a TEE. This application also provides corresponding apparatus, computer-readable storage media, and computer program products. These are described in detail below.

[0055] To facilitate understanding, the following briefly introduces the technical terms involved in the embodiments of this application:

[0056] 1. TrustZone technology: This technology divides hardware resources into two worlds: the non-secure world and the secure world. The non-secure world is the rich execution environment (REE), while the secure world is the trusted execution environment (TEE). The operating system (OS), which closely interacts with the user, operates in the non-secure world and is referred to as a rich OS. TrustZone, as a hardware security feature, operates in the secure world, and the operating system operating in the secure world is called a trusted OS. The non-secure world does not necessarily mean that the operating system or software running in it is malicious, but rather that the environment it inhabits is less secure than the secure world. When the central processing unit (CPU) operates in the non-secure world, access to the secure world's resources (such as registers, memory, cache, and peripherals) is prohibited. If the CPU attempts to access these resources, the system will crash. For example, TrustZone can configure the TrustZone Address Space Controller (TZASC) and TrustZone Memory Adapter (TZMA) registers to designate sensitive memory as secure memory, preventing access from the non-secure world. When the CPU operates in the secure world, it can access resources in both the secure and non-secure worlds. Because it possesses higher privileges than the non-secure world's operating system, TrustZone can serve as a root of trust, providing a higher level of security protection for the non-secure world's operating system.

[0057] 2. TEE: A secure area within a computer's processor that ensures sensitive data is stored, processed, and protected within a trusted environment. The TEE is authorized security software that provides a secure execution environment for trusted applications (TAs), ensuring end-to-end security by enforcing protection, confidentiality, integrity, and data access permissions.

[0058] 3.REE: Mainly includes the general operating system (Rich OS) running in a general-purpose embedded processor and the client application (CA) on it.

[0059] 4.TA: Trusted application running on the TEE side.

[0060] 5. CA: A client application running on the REE side that can call TEE services, such as face recognition CA, fingerprint recognition CA, etc. The CA in the REE and the TA in the TEE form a client / server-like architecture, with the CA acting as the client and the TA as the server. The CA initiates access operations, and the two exchange data through the REE communication agent, the hardware layer message channel, and the TEE communication agent. The three establish a secure communication channel for the CA and TA, ensuring the security of data transmission to a certain extent. Specifically, the CA calls the TEE client application program interface (API) to communicate with the corresponding TA; the TA calls the TEE internal application program interface (internal API) to use the programming resources provided by the TEE to implement related functions.

[0061] 6. Ordinary applications (non-CA): usually refer to applications running on the REE side that do not need to call data on the TEE side during operation, such as Linux applications.

[0062] For information about the computer system provided in the embodiments of this application, please refer to Figure 1 To understand, such as Figure 1 As shown, the computer system includes: a trusted execution environment and a rich execution environment. The trusted execution environment is specially provided for highly security-sensitive applications and can ensure the confidentiality of the resources and data of the applications. The rich execution environment is provided for general-purpose operating systems (also known as general operating systems) and general-purpose applications. Applications that interact and execute with the TEE side on the rich execution environment side are called CAs, such as third-party payment applications such as banking applications. Applications that execute independently on the REE side can be called ordinary applications or non-CAs. Applications that execute on the trusted execution environment side are called TAs, such as applications that perform key services such as signing, encryption and decryption calculations.

[0063] Because the TA runs in a trusted execution environment (TEE), its deployment and upgrade operations must strictly adhere to the security verification specifications of the TEE issuer, such as the use of digital signatures, to ensure that every aspect of the TEE is truly trustworthy. The TEE includes the trusted execution environment internal application programming interface (TEE Internal API) and trusted operating system components. The TEE Internal API primarily provides trusted operating system component functionality, communicates with client applications (CAs), enables TA-TA communication, and provides secure storage, cryptographic, and time functions. Trusted operating system components primarily include trusted device drivers and the TEE communication agent. The TEE communication agent provides a secure communication channel between the TA and the CA. For example, the TEE communication agent passes messages to the rich execution environment communication agent via platform hardware, enabling interaction between the TA and the CA. Furthermore, a monitor is used to facilitate switching between the REE and the TEE.

[0064] The rich execution environment includes the trusted execution environment client application programming interface (TEE Client API) and a rich operating system. The rich operating system components primarily include public device drivers and a rich execution environment communication agent. The rich execution environment communication agent is used to communicate with the trusted execution environment, providing a secure communication channel between the CA and the trusted agent. The public device driver is used to drive public devices in the platform hardware. The CA uses the TEE Client API and TEE Functional API to access the security services provided by the trusted agent.

[0065] above Figure 1 The computer system shown can also be a virtualized system. In a virtualized system, the above-mentioned monitor can be called a virtual machine monitor (Hypervisor, HYP), and the above-mentioned operating system can run in a virtual machine (VM) created by the Hypervisor. The Hypervisor has higher permissions than the operating system and can be used to monitor the behavior of the operating system and protect sensitive data.

[0066] For more information about operating system permissions, see Figure 2 The architecture shown in the figure is used to understand the structure. Figure 2As shown in the figure, taking the ARMv7 hardware architecture as an example, in the non-secure world, to support CPU hardware virtualization, ARM has added a new hypervisor mode (HYP) to the two CPU modes of user mode (USR) and kernel mode (SVC). The operating system, which is closely connected to the user, runs in user mode and kernel mode in the non-secure world, while the hypervisor runs in the newly added HYP mode.

[0067] HYP mode is the CPU mode with the highest privileges in the non-secure world. When the CPU operates in this mode, it can access all hardware resources in user mode, kernel mode, and HYP mode. However, when the CPU operates in the other two modes, it cannot access HYP-related hardware resources. Therefore, the hypervisor has higher privileges than the operating system.

[0068] Like the non-secure world, the secure world also includes two CPU operating modes: user mode and kernel mode. On ARMv7, the secure world does not support hardware virtualization and therefore does not include HYP mode. However, in the ARMv8.4 architecture, the secure world began to support hardware virtualization. The secure world also includes a special, highest-privilege CPU mode—Monitor mode (MON). Monitor mode is the most privileged CPU mode. When the CPU operates in this mode, it can access all hardware resources in the secure world as well as those in the non-secure world.

[0069] TrustZone can configure hypervisor-related control registers in monitor mode to initialize and activate the hypervisor. Monitor mode is also a gateway for the non-secure world to enter the secure world. In the kernel mode or HYP mode of the non-secure world, executing the Secure Monitor Call (SMC) instruction can actively switch from the non-secure world to the monitor mode of the secure world. When executing the ERET instruction in monitor mode, the CPU decides whether to return to the non-secure world or continue to stay in the secure world by checking the non-secure (NS) bit of the Secure Control Register (SCR) register. When the NS bit is 1, the return operation in monitor mode returns to the kernel in the non-secure world and performs a world switch operation; when the NS bit is 0, the return operation in monitor mode returns to the kernel in the secure world and does not perform a world switch operation.

[0070] A structure of the computer system provided in the embodiment of the present application can also be referred to Figure 3 Understand. Figure 3 As shown, the computer system includes: a confidential computing operating system 301 and a general operating system 302, and the confidential computing operating system 301 includes a sub-operating system 3011 of an independent framework and / or a sub-operating system 3012 of a collaborative framework.

[0071] In this application, the general operating system 302 refers to the operating system running in the REE, and the confidential computing operating system 301 refers to the operating system running in the TEE. The confidential computing operating system 301 is a secure OS deployed in TrustZone. It can support both CA-TA application mode and full application running in TrustZone. This can reduce the cost of migrating ordinary applications from the general operating system to the TEE, thereby improving ease of use.

[0072] The confidential computing operating system can also be understood as deploying a general-purpose OS, such as Linux, in a confidential virtual machine. This can support the seamless migration of existing applications on Linux to the confidential virtual machine, greatly improving ease of use.

[0073] In this application, the independent framework sub-OS 3011 refers to an OS that runs applications independently in the TEE and does not need to interact with the general-purpose OS in the REE to run the corresponding applications. The collaborative framework sub-OS 3012 refers to an OS that runs in the TEE but needs to collaborate with the general-purpose OS in the REE to process CA-TA when running applications.

[0074] The sub-operating system 3011 of the independent framework is used to independently run a first type of application. The first type of application is an application migrated from a general operating system. The first type of application is a non-client application CA in the general operating system.

[0075] The sub-operating system 3012 of the collaborative framework is used to run the second type of application in collaboration with the general operating system; wherein, a part of the code in the second type of application runs in the sub-operating system of the collaborative framework, and the remaining code in the second type of application except for a part of the code runs in the general operating system.

[0076] In this application, the first type of application can be an ordinary application (non-CA) originally running in a general operating system. The first type of application can be migrated to a sub-operating system of an independent framework to run without modifying the code. In this way, the usability of the confidential computing operating system can be improved without modifying the code.

[0077] In this application, the second type of application can be a TA, or a CA-TA. In this way, the second type of application does not need to migrate all the code to the confidential computing operating system. It only needs to migrate part of the code to the sub-operating system of the collaborative framework as needed to run. In this way, there is no need to introduce a large amount of code, which can improve the security of the confidential computing operating system.

[0078] It can be seen from the above technical solution that by selecting the sub-operating system to run in the confidential computing operating system based on the type of application, both the ease of use and the security of the confidential computing operating system can be taken into account.

[0079] The computer system provided in the embodiment of the present application can be run on a terminal device or on the cloud.

[0080] If the system is running on a terminal device, the terminal device may be also known as user equipment (UE), mobile station (MS), mobile terminal (MT), etc., and is a device that includes wireless communication capabilities (providing voice / data connectivity to users), for example, a handheld device with wireless connection capabilities. Currently, some examples of terminal devices include: mobile phones, tablets, laptops, PDAs, notebook computers, wireless routers, mobile internet devices (MIDs), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self-driving cars, wireless terminals in the Internet of Vehicles, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, or wireless terminals in smart homes.

[0081] If the above computer system is running on the cloud, a structure of the cloud system can be referred to Figure 4 Understand. Figure 4As shown, the structure of the cloud system may include: a terminal device 01, a scheduling node 02, a working node cluster 03, and a working node cluster 04. Communication connections can be established between the terminal device 01 and the scheduling node 02, between the scheduling node 02 and the working node cluster 03, between the scheduling node 02 and the working node cluster 04, and between the working node cluster 03 and the working node cluster 04. For example, a communication connection can be established between the terminal device 01 and the scheduling node 02 through a network. Optionally, the network can be a local area network, the Internet, or other networks. In a cloud computing scenario, the network can also be a virtual private cloud (VPC), which is not limited in the embodiments of the present application.

[0082] In this implementation, cloud system operators can interact with scheduling node 02 via terminal device 01. For example, operators can send cloud system deployment instructions to scheduling node 02 via terminal device 01, instructing scheduling node 02 to deploy the cloud system based on the resources of scheduling node 02, worker node cluster 03, and worker node cluster 04. The cloud system manages the resources of worker node cluster 03 and worker node cluster 04 and provides cloud services to tenants based on the resources of worker node cluster 03 and worker node cluster 04.

[0083] The scheduling node 02 can be a cloud server or a cloud physical machine, or a cloud server cluster or a physical machine cluster composed of several cloud servers, or a cloud computing service center. The functions of the scheduling node can be implemented by software or hardware.

[0084] As an example of a software functional unit, a scheduling node may include code running on a computing instance. The computing instance may include at least one of a physical host (computer device), a virtual machine, and a container. Furthermore, the computing instance may be one or more. For example, a scheduling node may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple geographically close data centers. Typically, a region may include multiple AZs.

[0085] Similarly, multiple hosts / virtual machines / containers running the code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Inter-region communication between two VPCs within the same region, or between VPCs in different regions, requires a communication gateway within each VPC to interconnect the VPCs.

[0086] As an example of a hardware functional unit, a scheduling node may include at least one computer device, such as a server. Alternatively, the scheduling node may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0087] The multiple computer devices included in a scheduling node can be distributed in the same area or in different areas. The multiple computer devices included in a scheduling node can be distributed in the same AZ or in different AZs. Similarly, the multiple computer devices included in a scheduling node can be distributed in the same VPC or in multiple VPCs. The multiple computer devices can be any combination of computer devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0088] Worker node cluster 03 and worker node cluster 04 can be a server cluster consisting of several servers, or a cloud computing service center. A large number of basic resources owned by the cloud service provider are deployed in the cloud computing service center. For example, computing resources, storage resources, and network resources are deployed in the cloud computing service center.

[0089] It should be noted that the scheduling node 02, working node cluster 03 and working node cluster 04 in this implementation environment can also be implemented through other resource platforms besides the cloud computing service center, and this embodiment of the application does not specifically limit it.

[0090] It should be understood that the above content is an illustrative description of the cloud system provided in the embodiment of the present application, and does not constitute a limitation on the application scenarios of the deployment method of the cloud resource management system. Ordinary technicians in this field know that as business needs change, its application scenarios can be adjusted according to application needs.

[0091] above Figure 4 The cloud system shown can be a public cloud, private cloud, or hybrid cloud. Within a cloud system, virtualization technology abstracts and transforms the host's physical resources, such as computing, network, and storage resources, into a more tangible form. This breaks down the barriers between the host's physical structures and allows users to utilize these resources in a more efficient manner than their original configurations. Resources utilized through virtualization are called virtualized resources, and they are not restricted by the existing physical resource configurations, location, or physical configuration.

[0092] A physical machine (PM) is a physical resource used to host virtualization technology. A host is also called a physical machine. Typically, a physical server is a host used to deploy virtual instances. A physical machine has multiple physical devices. For example, a physical server has physical devices such as a processor and memory. Multiple virtual instances can be deployed on a single host. Multiple virtual instances deployed on the same host share the host's physical resources. Depending on the usage scenario, a single host can deploy virtual instances belonging to only one user or multiple users.

[0093] A virtual instance runs on the host's operating system. The virtual instance itself has its own operating system, which runs applications that implement user services. Virtual instances can use the host's hardware resources and are isolated from each other. Typically, virtual instances can be virtual machines or containers.

[0094] A VM is a complete computer system that uses virtualization technology to simulate the full functionality of a hardware system and runs in a completely isolated environment. A subset of the VM's instructions can be processed on the host computer, while other instructions can be executed in emulation. A VM is also called a virtual server.

[0095] A virtual machine can be considered a collection of several virtual devices, which is a complete computer system with complete hardware system functions and running in a completely isolated environment. Virtual devices are virtualized based on physical devices that can share resources using virtualization technology. For example, a virtual processor virtualized based on a processor using virtualization technology is a virtual device. For another example, a training card virtualized based on a field-programmable gate array (FPGA) using virtualization technology is also a virtual device.

[0096] Containers provide a lightweight virtual runtime environment. Containers can be obtained by packaging all the code, libraries, and dependencies of a user's application into an image. When the image is executed, the image runs in a virtual runtime environment. At this time, the container is a runtime instance of the image, similar to a lightweight sandbox, which can be started, started, stopped, and deleted. The image does not share the host's memory, processor (such as the central processing unit (CPU)), and disk resources with other images, achieving container isolation between the image and the host, and between the image and other images, ensuring that the process within the container cannot monitor any process or resources outside the container. Container technologies include Docker, Kubernetes, CoreOS, and other container technologies. Containers can achieve isolation of software resources and / or hardware resources.

[0097] The computer system provided in the embodiments of the present application can run on the terminal device or cloud described above. Regardless of whether the computer system runs on a terminal device or on the cloud, different types of applications can be run through the above-mentioned independent framework sub-operating system and / or the collaborative framework sub-operating system.

[0098] There are three situations regarding the sub-operating systems running in the confidential operating system: 1. A sub-operating system running an independent framework in the confidential computing operating system; 2. A sub-operating system running a collaborative framework in the confidential computing operating system; 3. A sub-operating system running an independent framework and a sub-operating system running a collaborative framework in the confidential computing operating system.

[0099] These three situations can be achieved by configuring a switch module in the confidential computing operating system. The switch module can select the sub-operating system running in the confidential computing operating system according to the format of the application to be loaded.

[0100] like Figure 5As shown, another structure of the computer system includes: a confidential computing operating system and a general operating system, the confidential computing operating system includes a sub-operating system of an independent framework and / or a sub-operating system of a collaborative framework, and a switch module.

[0101] When the format of the application to be loaded indicates that the application to be loaded is a first type of application, the switch module is used to select a sub-operating system that runs an independent framework in the confidential computing operating system. That is, in the above case 1, the structure of the confidential computing operating system in this case can be referred to. Figure 6A Understand.

[0102] like Figure 6A As shown, when the format of the application to be loaded indicates that the application is a common application (non-CA), the switch module can select the sub-operating system running the independent framework in the confidential computing operating system. In this way, the common application can be run through the sub-operating system of the independent framework. In this way, the common application does not need to modify the code when running in the sub-operating system of the independent framework, which can improve the usability of the confidential computing operating system.

[0103] When the format of the application to be loaded indicates that the application to be loaded is a second type of application, the switch module is used to select a sub-operating system that runs the collaborative framework in the confidential computing operating system. This is the above-mentioned case 2. The structure of the confidential computing operating system in this case can be referred to. Figure 6B Understand.

[0104] like Figure 6B As shown, if the format of the application to be loaded indicates that the application is a TA application, the switch module can select the sub-OS running the collaborative framework in the confidential computing operating system. In this way, the application can be run through the sub-OS of the collaborative framework and the general operating system in the REE, thereby improving the security of the confidential computing operating system.

[0105] When there are multiple applications to be loaded, and the format of the multiple applications to be loaded indicates that the multiple applications to be loaded include a first type of application and a second type of application, the switch module is used to select the sub-operating system of the independent framework and the sub-operating system of the collaborative framework to run in the confidential computing operating system. That is, the structure of the confidential computing operating system in this case can be referred to in the following example. Figure 6C Understand.

[0106] like Figure 6C As shown in the figure, when the applications to be loaded include both ordinary applications and TA applications, the sub-operating system of the independent framework and the sub-operating system of the collaborative framework can be run simultaneously in the confidential computing operating system. In this way, diverse application needs can be met.

[0107] As can be seen from the above description, the switch module can select the sub-OS running in the confidential computing operating system. The switch module can choose to run a sub-OS in an independent framework, a sub-OS in a collaborative framework, or a sub-OS in both independent and collaborative frameworks. This allows the switch module to select a sub-OS within the confidential computing operating system, thereby increasing the flexibility of the confidential computing operating system in running applications.

[0108] Moreover, the above-mentioned independent-collaborative dual-framework confidential computing OS supports split applications and / or complete applications at the same time. In this way, the confidential computing OS can meet the needs of different periods. The sub-OS of the independent framework has the properties of a general OS and can meet the demand for ease of use of complete applications. The sub-OS of the collaborative framework can improve security. Moreover, when there are multiple needs, the two subsystems of the independent framework and the collaborative framework can be used at the same time, which is compatible with existing businesses and can meet both ease of use and security. In this way, it provides users with more and more flexible choices.

[0109] In addition, the computer system provided in the embodiments of the present application can also use containers to isolate software resources and / or hardware resources. Specifically, the system resources used by the sub-operating systems of the independent framework and the sub-operating systems of the collaborative framework can be isolated through a first container. System resources include file systems, process numbers, or network resources. Computing resources and storage resources can also be isolated using a second container.

[0110] The first container and the second container may be confidential containers, the first container may be a Namespace, and the second container may be a cgroup. When confidential containers are included, the structure of the computer system can refer to Figure 7 Understand. Figure 7 As shown, the sub-operating system of the independent framework also includes a confidential container, which can be a first container and / or a second container.

[0111] In the embodiment of the present application, software isolation is performed on the sub-operating system of the independent framework and the sub-operating system of the collaborative framework through the first container, so that defects and vulnerabilities cannot spread and security is enhanced.

[0112] The above introduces the computer system. Based on the above computer system, Figure 8 As shown, an embodiment of the present application provides a method for running an application, the method comprising:

[0113] 801. Obtain the first application to be loaded.

[0114] 802. When the first application is a first type application, the first application is independently run through the sub-operating system of the independent framework. The first type application is an application migrated from a general operating system. The first type application is a non-client application CA in the general operating system.

[0115] 803. When the first application is a second type of application, the first application is run in collaboration with the general operating system through the sub-operating system of the collaborative framework; a portion of the code in the second type of application runs in the sub-operating system of the collaborative framework, and the remaining code in the second type of application except for a portion of the code runs in the general operating system.

[0116] The method for running an application provided in an embodiment of the present application selects a sub-operating system to run in a confidential computing operating system based on the type of application, which can take into account both the ease of use and the security of the confidential computing operating system.

[0117] Optionally, the method further includes: when the first application is an application of the first type, starting a sub-operating system of the independent framework.

[0118] Optionally, the method further includes: when the first application is an application of the second type, starting a sub-operating system of the collaborative framework.

[0119] Optionally, the method further includes: when there are multiple first applications, and the multiple first applications include first-type applications and second-type applications, starting the sub-operating system of the independent framework and the sub-operating system of the collaborative framework.

[0120] like Figure 9 As shown, an embodiment of the present application provides a computer device 90, further comprising a confidential computing operating system and a general operating system, wherein the confidential computing operating system comprises a sub-operating system of an independent framework and / or a sub-operating system of a collaborative framework, and the computer device 90 comprises:

[0121] An acquiring unit 901 is configured to acquire a first application to be loaded;

[0122] Processing unit 902 is used to independently run the first application through the sub-operating system of an independent framework when the first application is a first type of application. The first type of application is an application migrated from a general operating system, and the first type of application is a non-client application CA in the general operating system; when the first application is a second type of application, the first application is collaboratively run through the sub-operating system of a collaborative framework and the general operating system; a portion of the code in the second type of application runs in the sub-operating system of the collaborative framework, and the remaining code of the second type of application except for a portion of the code runs in the general operating system.

[0123] Optionally, the processing unit 902 is further configured to start a sub-operating system of an independent framework when the first application is an application of the first type.

[0124] Optionally, the processing unit 902 is further configured to start a sub-operating system of the collaborative framework when the first application is an application of the second type.

[0125] Optionally, the processing unit 902 is further configured to start the sub-operating system of the independent framework and the sub-operating system of the collaborative framework when there are multiple first applications, and the multiple first applications include first-type applications and second-type applications.

[0126] Optionally, system resources used by the sub-operating system of the independent framework and the sub-operating system of the collaborative framework are isolated through the first container, and the system resources include a file system, a process number or a network resource.

[0127] Figure 10 As shown, a possible logical structure diagram of the computer device 100 involved in the above-mentioned embodiments provided in the embodiments of the present application. The computer device 100 includes a confidential computing operating system and a general operating system, and the confidential computing operating system includes a sub-operating system of an independent framework or / and a sub-operating system of a collaborative framework. The computer device 100 includes: a processor 1001, a communication interface 1002, a memory 1003 and a bus 1004. The processor 1001, the communication interface 1002 and the memory 1003 are interconnected through the bus 1004. In the embodiment of the present application, the processor 1001 is used to control and manage the actions of the computer device 100, for example, the processor 1001 is used to execute Figure 8 The communication interface 1002 is used to support the computer device 100 in communicating with the computer device 100. The memory 1003 is used to store program codes and data of the computer device 100.

[0128] Among them, the processor 1001 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute the various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on. The bus 1004 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0129] See also Figure 11 The embodiment of the present application further provides a computer device 110 , comprising: a hardware layer 1107 , a virtual machine monitor (VMM) 1101 running on the hardware layer 1107 , and a plurality of virtual machines 1102 .

[0130] Specifically, virtual machine 1102 is a virtual computer simulated on public hardware resources by virtual machine software, on which operating systems and applications can be installed, and network resources can be accessed. For applications running in the virtual machine, the virtual machine is like working in a real computer.

[0131] Hardware layer 1107: The hardware platform on which the virtualized environment runs, which can be abstracted from the hardware resources of one or more physical hosts. The hardware layer may include various hardware components, such as a processor 1104 (e.g., a CPU) and memory 1105. It may also include a network card 1103 (e.g., an RDMA network card), high-speed and low-speed input / output (I / O) devices, and other devices with specific processing functions.

[0132] The virtual machine 1102 runs the executable program based on the VMM and the hardware resources provided by the hardware layer 1107 to implement the steps in the above method embodiment. For the sake of brevity, no further details are given here.

[0133] Furthermore, the computer device 110 may also include a host machine (Host): as a management layer, it is used to complete the management and allocation of hardware resources; present a virtual hardware platform to the virtual machine; and realize the scheduling and isolation of the virtual machine. Among them, the Host may be a virtual machine monitor (VMM); or it may be a combination of a VMM and a privileged virtual machine. Among them, the virtual hardware platform provides various hardware resources to each virtual machine running on it, such as providing a virtual processor (such as VCPU), virtual memory, virtual disk, virtual network card, etc. Among them, the virtual disk may correspond to a file or a logical block device of the Host. The virtual machine runs on the virtual hardware platform prepared for it by the Host, and one or more virtual machines run on the Host. The VCPU of the virtual machine 1102 implements or executes the method steps described in the above-mentioned method embodiments of this application by executing the executable program stored in its corresponding virtual memory.

[0134] The present application also provides a chip system, which includes a processor for supporting the above-mentioned computer device to implement its related functions, such as receiving or processing the data involved in the above-mentioned method embodiments. In one possible design, the chip system also includes a memory, which is used to store program instructions and data necessary for the computer device. The chip system can be composed of a chip or can include a chip and other discrete devices.

[0135] In another embodiment of the present application, a computer-readable storage medium is further provided. The computer-readable storage medium stores computer-executable instructions. When at least one processor of the device executes the computer-executable instructions, the device executes the above-mentioned Figure 8 The method described in the embodiment.

[0136] In another embodiment of the present application, a computer program product is further provided. The computer program product includes computer-executable instructions, which are stored in a computer-readable storage medium. At least one processor of the device can read the computer-executable instructions from the computer-readable storage medium, and at least one processor executes the computer-executable instructions so that the device performs the above-mentioned Figure 8 Some of the methods described in the examples.

[0137] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of this application.

[0138] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0139] In the several embodiments provided in the embodiments of the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0140] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0141] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0142] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Claims

1. A computer system, characterized in that: include: A confidential computing operating system and a general operating system, wherein the confidential computing operating system includes a sub-operating system of an independent framework and / or a sub-operating system of a collaborative framework; wherein, The sub-operating system of the independent framework is used to independently run a first type of application, where the first type of application is an application migrated from the general operating system, and the first type of application is a non-client application CA in the general operating system; The sub-operating system of the collaborative framework is used to run a second type of application in collaboration with the general operating system; wherein, a portion of the code in the second type of application runs on the sub-operating system of the collaborative framework, and the remaining code in the second type of application except the portion of the code runs on the general operating system.

2. The computer system according to claim 1, wherein: The computer system further includes a switch module; The switch module is used to select the sub-operating system running in the confidential computing operating system according to the format of the application to be loaded.

3. The computer system according to claim 2, wherein: When the format of the application to be loaded indicates that the application to be loaded is an application of the first type, the switch module is used to select a sub-operating system that runs the independent framework in the confidential computing operating system.

4. The computer system according to claim 2, wherein: When the format of the application to be loaded indicates that the application to be loaded is an application of the second type, the switch module is used to select a sub-operating system that runs the collaborative framework in the confidential computing operating system.

5. The computer system according to claim 2, wherein: When there are multiple applications to be loaded, the format of the multiple applications to be loaded indicates that the multiple applications to be loaded include the first type of applications and the second type of applications, then the switch module is used to select the sub-operating system of the independent framework and the sub-operating system of the collaborative framework to run in the confidential computing operating system.

6. The computer system according to any one of claims 1 to 5, characterized in that: System resources used by the sub-operating system of the independent framework and the sub-operating system of the collaborative framework are isolated through the first container, and the system resources include a file system, a process number or a network resource.

7. A method for running an application, characterized in that: The method is applied to a computer system, the computer system including a confidential computing operating system and a general operating system, the confidential computing operating system including a sub-operating system of an independent framework and / or a sub-operating system of a collaborative framework, and the method includes: Get the first application to be loaded; When the first application is a first type of application, independently running the first application through the sub-operating system of the independent framework, the first type of application is an application migrated from the general operating system, and the first type of application is a non-client application CA in the general operating system; When the first application is a second type of application, the first application is run in collaboration with the general operating system through the sub-operating system of the collaborative framework; a part of the code in the second type of application runs on the sub-operating system of the collaborative framework, and the remaining code in the second type of application except the said part of the code runs on the general operating system.

8. The method according to claim 7, characterized in that The method further comprises: When the first application is an application of the first type, the sub-operating system of the independent framework is started.

9. The method according to claim 7, characterized in that The method further comprises: When the first application is an application of the second type, the sub-operating system of the collaborative framework is started.

10. The method according to claim 7, characterized in that The method further comprises: When there are multiple first applications, and the multiple first applications include the first type of applications and the second type of applications, the sub-operating system of the independent framework and the sub-operating system of the collaborative framework are started.

11. The method according to any one of claims 7 to 10, characterized in that: System resources used by the sub-operating system of the independent framework and the sub-operating system of the collaborative framework are isolated through the first container, and the system resources include a file system, a process number or a network resource.

12. A computer device, characterized in that: The confidential computing operating system includes a confidential computing operating system and a general operating system. The confidential computing operating system includes a sub-operating system of an independent framework and / or a sub-operating system of a collaborative framework. The computer device includes: an acquiring unit, configured to acquire a first application to be loaded; A processing unit is configured to independently run the first application through the sub-operating system of the independent framework when the first application is a first type of application, the first type of application is an application migrated from the general operating system, and the first type of application is a non-client application CA in the general operating system; and to collaboratively run the first application through the sub-operating system of the collaborative framework and the general operating system when the first application is a second type of application; a portion of the code in the second type of application runs in the sub-operating system of the collaborative framework, and the remaining code of the second type of application except the portion of the code runs on the general operating system.

13. A computer device, characterized in that: comprising a processor and a computer-readable storage medium storing a computer program; The processor is coupled to the computer-readable storage medium, and when the computer program is executed by the processor, the method according to any one of claims 7 to 11 is implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 7 to 11 is implemented.

15. A computer program product, characterized in that The computer program product comprises a computer program code, which, when run on a computer device, causes the computer device to perform the method according to any one of claims 7 to 11.

16. A chip system, characterized in that: The method comprises a processor, wherein the processor is called to execute the method according to any one of claims 7 to 11.

Images