Resource allocation method, data processing method, computer system and related device

Abstract

The embodiment of the invention provides a resource configuration method, a data processing method, a computer system and a related device.The resource configuration method comprises the steps that a virtual machine starting signal comprising a virtual machine type identifier is obtained; when it is determined that the virtual machine is a secure virtual machine according to the virtual machine type identifier, a secure device and a secure memory are configured to the secure virtual machine, the secure memory is a virtual machine manager operated by the processor and a virtual resource determined in the initialization process, and data of the secure memory is encrypted data; the security device is a non-virtualized resource determined by the virtual machine manager in an initialization process; and starting the secure virtual machine based on the virtual machine starting signal. According to the technical scheme provided by the embodiment of the invention, data protection in equipment use is conveniently realized.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and specifically to a resource configuration method, a data processing method, a computer system, and related devices. Background Art

[0002] Confidential computing technology is a cloud computing technology that protects data during the processing process. It provides a computing model that protects data in use by executing computing processes in a hardware-based Trusted Execution Environment (TEE). Confidential computing technology can protect data in use by the CPU (central processing unit). However, as the amount of data that needs to be processed in data processing scenarios continues to increase, the number of hardware devices performing data processing has also increased. For example, in massive data processing scenarios such as video processing and machine learning, both the CPU and GPU (Graphics Processing Unit) can be used simultaneously. In addition to the CPU, the GPU's data in use also needs to be protected.

[0003] Therefore, in this context, how to provide a technical solution to facilitate the protection of data during device use has become a technical problem that technical personnel in this field urgently need to solve. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a resource configuration method, a data processing method, a computer system, and related devices to facilitate the protection of data during device use.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions.

[0006] In a first aspect, an embodiment of the present invention provides a resource configuration method, applied to a processor supporting hardware virtualization, the method comprising:

[0007] Obtaining a virtual machine startup signal, wherein the virtual machine startup signal includes a virtual machine type identifier;

[0008] When the virtual machine is determined to be a secure virtual machine according to the virtual machine type identifier, a security device and a secure memory are configured for the secure virtual machine, the secure memory being a virtualized resource determined by the virtual machine manager during the initialization process, and the data in the secure memory being encrypted data, and the virtual machine manager running on the processor; the security device being a non-virtualized resource determined by the virtual machine manager during the initialization process;

[0009] The secure virtual machine is started based on the virtual machine start signal.

[0010] In a second aspect, an embodiment of the present invention provides a data processing method, applied to a processor supporting hardware virtualization, the method comprising:

[0011] Obtaining a data processing request, where the address of the data processing request is located in the secure memory;

[0012] When it is determined that the data processing request is to be accelerated by a security device, the data processor request is sent to the security device; wherein the operating environment of the security device is a secure isolation environment corresponding to a secure virtual machine, the secure virtual machine is run by the processor, and the security device interacts with a secure memory configured for the secure virtual machine;

[0013] A data processing response from the security device to the data processing request is obtained.

[0014] In a third aspect, an embodiment of the present invention provides a data processing method, applied to a security device, comprising:

[0015] receiving a data processing request transmitted by the secure virtual machine, where an address of the data processing request is located in the secure memory;

[0016] Retrieving encrypted data from the secure memory according to the address of the data processing request, and decrypting the encrypted data;

[0017] Process the decrypted data, encrypt the processing result and write it into the secure memory, and obtain a data processing response to the data processing request;

[0018] The operating environment of the security device is a secure isolation environment corresponding to the secure virtual machine.

[0019] In a fourth aspect, an embodiment of the present invention provides a resource configuration device, applied to a processor supporting hardware virtualization, the device comprising:

[0020] A startup signal acquisition module, configured to acquire a virtual machine startup signal, wherein the virtual machine startup signal includes a virtual machine type identifier;

[0021] a resource configuration module, configured to, when a virtual machine is determined to be a secure virtual machine based on the virtual machine type identifier, configure a security device and a secure memory to the secure virtual machine, wherein the secure memory is a virtualized resource determined by the virtual machine manager during initialization, and the data in the secure memory is encrypted data, and the virtual machine manager runs on the processor; and the security device is a non-virtualized resource determined by the virtual machine manager during initialization;

[0022] A startup module is used to start the secure virtual machine based on the virtual machine startup signal.

[0023] In a fifth aspect, an embodiment of the present invention provides a data processing device, applied to a processor supporting hardware virtualization, the device comprising:

[0024] A data processing request acquisition module, configured to acquire a data processing request, wherein the address of the data processing request is located in the secure memory;

[0025] a data processing request transmission module, configured to, when determining that the data processing request is to be accelerated by a security device, transmit the data processing request to the security device; wherein the operating environment of the security device is a secure isolation environment corresponding to a secure virtual machine, the secure virtual machine is run by the processor, and the security device interacts with a secure memory configured for the secure virtual machine;

[0026] The data processing response acquisition module is used to obtain a data processing response from the security device to the data processing request.

[0027] In a sixth aspect, an embodiment of the present invention provides a data processing apparatus, applied to a security device, the apparatus comprising:

[0028] A data processing request receiving module, configured to receive a data processing request transmitted by the secure virtual machine, wherein the address of the data processing request is located in the secure memory;

[0029] an encrypted data processing module, configured to obtain encrypted data from the secure memory according to the address of the data processing request and decrypt the encrypted data;

[0030] The data processing module is used to process the decrypted data, encrypt the processing results and write them into the secure memory, and obtain a data processing response to the data processing request;

[0031] The operating environment of the security device is a secure isolation environment corresponding to the secure virtual machine.

[0032] In a seventh aspect, an embodiment of the present invention provides a computer system, including:

[0033] a processor, wherein the processor supports hardware virtualization and runs a secure virtual machine and a virtual machine manager;

[0034] safety equipment;

[0035] Memory, including secure memory, wherein the data in the secure memory is encrypted data;

[0036] The secure virtual machine is started by a virtual machine manager. When the virtual machine manager starts the secure virtual machine, the secure memory is configured to the secure virtual machine as a virtualized resource, and the security device is configured to the secure virtual machine as a non-virtualized resource, so that the security device interacts with the secure memory of the secure virtual machine.

[0037] In an eighth aspect, an embodiment of the present invention provides an electronic device comprising a memory and a processor, wherein the memory stores a program, and the processor calls the program stored in the memory to execute the resource configuration method as described in the first aspect, or executes the data processing method as described in the second aspect, or executes the data processing method as described in the third aspect.

[0038] In the ninth aspect, an embodiment of the present invention provides a storage medium, which stores a program, and when the program is executed, it implements the resource configuration method as described in the first aspect, or implements the data processing method as described in the second aspect, or implements the data processing method as described in the third aspect.

[0039] In the tenth aspect, an embodiment of the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements the resource configuration method as described in the first aspect, or implements the data processing method as described in the second aspect, or implements the data processing method as described in the third aspect.

[0040] An embodiment of the present invention provides a resource configuration method, which is applied to a processor that supports hardware virtualization, and includes: obtaining a virtual machine startup signal, the virtual machine startup signal including a virtual machine type identifier; when the virtual machine is determined to be a secure virtual machine based on the virtual machine type identifier, configuring a security device and a secure memory to the secure virtual machine, the secure memory being a virtualized resource determined during the initialization process by the virtual machine manager running the processor, and the data in the secure memory being encrypted data; the security device being a non-virtualized resource determined during the initialization process by the virtual machine manager; and starting the secure virtual machine based on the virtual machine startup signal.

[0041] It can be seen that the technical solution provided by the embodiment of the present invention is that in a processor that supports hardware virtualization, when the virtual machine manager running on the processor starts a virtual machine, the virtual machine manager configures virtualization resources for the virtual machine. Therefore, in the embodiment of the present invention, on the one hand, when the virtual machine manager determines that the virtual machine started at this time is a secure virtual machine based on the virtual machine type identifier in the virtual machine startup signal, it configures the secure memory virtualization resource allocated during the initialization process to the secure virtual machine. The data in the secure memory is encrypted data, which can ensure the security of the interaction between the secure virtual machine and the secure memory; on the other hand, the non-virtualized resource (also called the device configuration of the virtual machine) of the security device allocated during the initialization process is synchronously configured to the secure virtual machine through the virtual machine manager. Since the secure virtual machine can create a secure isolation environment (trusted execution environment) through virtualization technology, after the security device is configured to the secure virtual machine, when the security device needs to assist in accelerating data processing during the data processing process of the secure virtual machine, it can ensure that the security device works in a secure isolation environment, thereby improving the security of the data in use during the data processing process of the security device. It can be seen that the resource configuration of the secure virtual machine, security device and secure memory at the software level is realized by using the virtual machine manager, thereby avoiding the hardware design of the security device to realize data processing of the device in a secure isolation environment. This facilitates the protection of data in use of the device and reduces the difficulty of realizing data protection in use of the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0043] Figure 1 This is a flow chart of a resource configuration method provided by an embodiment of the present invention;

[0044] Figure 2 This is a schematic diagram of the contents of a configuration file provided by an embodiment of the present invention;

[0045] Figure 3 Schematic diagram of the report content of the system resource report provided by an embodiment of the present invention;

[0046] Figure 4 is another flowchart of the resource configuration method provided by an embodiment of the present invention;

[0047] Figure 5This is a schematic diagram of an implementation process of the memory encryption technology provided by an embodiment of the present invention;

[0048] Figure 6 This is a flow chart of a data processing method provided by an embodiment of the present invention;

[0049] Figure 7 is another flowchart of the data processing method provided by an embodiment of the present invention;

[0050] Figure 8 is a structural diagram of a resource configuration device provided by an embodiment of the present invention;

[0051] Figure 9 is a structural diagram of a data processing device provided by an embodiment of the present invention;

[0052] Figure 10 is another structural diagram of a data processing device provided by an embodiment of the present invention;

[0053] Figure 11 is a schematic structural diagram of a computer system provided by an embodiment of the present invention;

[0054] Figure 12 It is another structural diagram of the computer system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0056] As described in the background technology, confidential computing technology can provide protection for the data in use of the processor (CPU), but in data processing scenarios where a GPU is used for data acceleration processing, it cannot provide protection for the data in use of the GPU.

[0057] GPU virtualization technology is usually used to protect the data in use on the GPU. However, GPU virtualization technology requires improvements to the hardware design of the GPU chip. If the GPU chip does not have the function of supporting hardware virtualization, the data in use on the GPU cannot be protected.

[0058] Therefore, for most data processing devices such as GPUs that do not support hardware virtualization functions, the protection of data during GPU use is limited.

[0059] To solve the above problems, an embodiment of the present invention provides a resource configuration method to provide a technical solution for conveniently implementing data protection during use of data processing equipment without having to design the hardware of data processing equipment such as GPU chips.

[0060] Please refer to Figure 1 , Figure 1 The present invention provides a flowchart of a resource configuration method according to an embodiment of the present invention, wherein the method is applied to a processor supporting hardware virtualization.

[0061] like Figure 1 As shown, the method includes:

[0062] Step S101: Acquire a virtual machine startup signal, where the virtual machine startup signal includes a virtual machine type identifier.

[0063] The startup signal of the virtual machine may be an interface parameter input by a system administrator according to an interface provided by the virtual machine manager.

[0064] When starting a virtual machine, the virtual machine start signal received by the virtual machine manager may include:

[0065] Hardware configuration parameters: These parameters define the hardware resources of the virtual machine, such as CPU, memory, hard disk, etc. For example, you can view and modify the configuration of the virtual machine, including CPU, memory, hard disk, etc., through the graphical user interface.

[0066] Boot order: determines which device the virtual machine starts from, such as the hard disk, optical drive, or network.

[0067] Boot device configuration: This includes hard disk settings, optical drive settings, and network boot configuration. For example, the hard disk is the most common boot device, so you need to ensure the virtual machine's hard disk configuration is correct, including adding a hard disk and checking the hard disk type.

[0068] Kernel parameters: These are used to pass specific configurations or instructions to the operating system kernel, typically for debugging or special needs. For example, in a virtual machine's startup configuration file (such as GRUB or LILO), you can add kernel parameters such as nomodeset (disable graphics mode) or init= / bin / bash (start the bash shell).

[0069] Virtual machine software parameters: Different virtual machine software may require specific parameters. For example, you can add additional parameters in the settings, such as firmware="efi" to enable UEFI (Unified Extensible Firmware Interface) boot.

[0070] BIOS (Basic Input / Output System) / UEFI settings: You can perform more advanced configurations in the virtual machine's BIOS / UEFI settings interface, such as adjusting the boot order, enabling / disabling devices, and setting the time and date.

[0071] To facilitate the configuration of a device (security device) to a secure virtual machine and ensure that the device can operate in the secure isolation environment (trusted execution environment) implemented by the secure virtual machine, a virtual machine type identifier is set in the virtual machine's startup signal. For example, an identifier bit can be used as the virtual machine type identifier. When the identifier bit value is "1", the virtual machine is a secure virtual machine, and when it is "0", the virtual machine is a normal virtual machine. Alternatively, a keyword can be used as the virtual machine type identifier, such as "secure" as a keyword to indicate that the virtual machine is a secure virtual machine.

[0072] Step S102: When it is determined according to the virtual machine type identifier that the virtual machine is a secure virtual machine, a secure device and a secure memory are configured for the secure virtual machine.

[0073] The secure memory is a virtualized resource determined by the virtual machine manager during the initialization process, and the data in the secure memory is encrypted data. The virtual machine manager runs on the processor; the security device is a non-virtualized resource determined by the virtual machine manager during the initialization process.

[0074] Virtualized resources primarily refer to hardware abstractions provided by virtualization technology, such as virtual CPUs, virtual memory, virtual hard disks, and virtual networks. These resources are created by converting physical hardware into virtual hardware through the virtualization layer (virtual machine manager) for use by virtual machines or containers.

[0075] The non-virtualized resources mainly refer to the device configuration resources of the virtual machine, rather than the virtualized resources themselves. Device configuration resources are devices added to the virtualization environment to enhance the functionality, compatibility or performance of the virtual machine.

[0076] The devices in the non-virtualized resources may include:

[0077] Virtual CD-ROM drive: can be configured as an IDE (Integrated Drive Electronics), SCSI (Small Computer System Interface), or SATA (Serial Advanced Technology Attachment) device to emulate the functions of a physical CD-ROM drive.

[0078] Network adapter: A virtual device used for virtual machine network communication. You can add multiple virtual network adapters to a virtual machine.

[0079] USB (Universal Serial Bus Host Controller) controller: Allows a virtual machine to use USB devices or smart card readers. A virtual machine must have a USB controller to use these devices.

[0080] Sound Card: If the host system is configured with sound capabilities and has a sound card installed, you can enable the sound function for the virtual machine.

[0081] Parallel Ports: You can attach multiple bidirectional parallel ports to a virtual machine for data transfer.

[0082] Serial Port: You can add multiple serial ports to a virtual machine for data transmission.

[0083] Generic SCSI devices: Allows the guest operating system to directly access SCSI devices connected to the host system, such as scanners and tape drives.

[0084] To quickly and easily protect GPU data during use at the software level, in this embodiment of the present invention, the non-virtualized resources also include a GPU. This allows the GPU to be configured as a device (security device) through software configuration. When the GPU is used during the operation of a secure virtual machine, it can operate in a secure, isolated environment, ensuring the security of GPU data during use.

[0085] The division of the security device may be performed synchronously with the normal division of virtualized resources during the initialization process of the virtual machine manager.

[0086] The virtual machine manager partitions virtualized resources during initialization, ensuring that each virtual machine has dedicated CPU, memory, storage, and network resources, thus avoiding resource contention and interference. Furthermore, pre-partitioning virtualized resources allows system administrators to quickly deploy new virtual machines based on data processing needs without having to reconfigure resources each time they are started.

[0087] Therefore, by dividing the virtualized resources during the initialization process of the virtual machine manager, the non-virtualized resources can be divided at the same time, so as to achieve the matching between the device and the virtual machine and improve the security between the non-virtualized resources.

[0088] Step S103: Start the secure virtual machine based on the virtual machine startup signal.

[0089] After completing the configuration of virtualized resources and non-virtualized resources, you can start the secure virtual machine.

[0090] It can be seen that the technical solution provided by the embodiment of the present invention is that in a processor that supports hardware virtualization, when the virtual machine manager running on the processor starts a virtual machine, the virtual machine manager configures virtualization resources for the virtual machine. Therefore, in the embodiment of the present invention, on the one hand, when the virtual machine manager determines that the virtual machine started at this time is a secure virtual machine based on the virtual machine type identifier in the virtual machine startup signal, it configures the secure memory virtualization resource allocated during the initialization process to the secure virtual machine. The data in the secure memory is encrypted data, which can ensure the security of the interaction between the secure virtual machine and the secure memory; on the other hand, the non-virtualized resource (also called the device configuration of the virtual machine) of the security device allocated during the initialization process is synchronously configured to the secure virtual machine through the virtual machine manager. Since the secure virtual machine can create a secure isolation environment (trusted execution environment) through virtualization technology, after the security device is configured to the secure virtual machine, when the security device needs to assist in accelerating data processing during the data processing process of the secure virtual machine, it can ensure that the security device works in a secure isolation environment, thereby improving the security of the data in use during the data processing process of the security device. It can be seen that the resource configuration of the secure virtual machine, security device and secure memory at the software level is realized by using the virtual machine manager, thereby avoiding the hardware design of the security device to realize data processing of the device in a secure isolation environment. This facilitates the protection of data in use of the device and reduces the difficulty of realizing data protection in use of the device.

[0091] In order to quickly configure the corresponding resources (including virtualized resources and non-virtualized resources) for the virtual machine, in one embodiment, the resources can be divided in advance. Figure 1 .

[0092] like Figure 1 As shown, before step S101, the following steps may also be included:

[0093] Step S100, initializing the virtual machine manager; dividing the virtualized resources determined during the virtual machine manager initialization process into normal memory and secure memory, and dividing the non-virtualized resources into secure devices and normal devices according to the resource configuration file.

[0094] The resource configuration file corresponds to the data processing requirement.

[0095] The data processing requirement may be a business requirement for current data processing.

[0096] The configuration file can be established by a system administrator according to data processing requirements, so that after providing the configuration file to the virtual machine manager, the virtual machine manager can reasonably divide its virtualized resources and non-virtualized resources during the initialization process according to the specific configuration file.

[0097] To understand the contents of the configuration file, please refer to Figure 2 , Figure 2 This is a schematic diagram of the file content of a configuration file provided by an embodiment of the present invention.

[0098] like Figure 2 As shown, for a specific data processing requirement, the configuration file can include virtualized resources defined by the system administrator: the starting address and size of secure memory, the starting address and size of normal memory; and non-virtualized resources: the device number and type of secure devices, and the device number and type of normal devices. This allows the virtual machine manager to accurately and substantively divide virtualized and non-virtualized resources based on the configuration file.

[0099] exist Figure 2 In the figure, the security device in the non-virtualized resource is shown by taking a PCI device as an example. In other implementations, the security device may also be a GPU device. For example, the divided non-virtualized resources are defined in the configuration file:

[0100] Safety equipment:

[0101] {

[0102] Device number: 01:00.0

[0103] Type: GPU device

[0104] }

[0105] }.

[0106] After the system administrator defines the configuration file, it can be provided to the virtual machine manager so that the virtual machine manager can accurately divide the virtualized resources and non-virtualized resources during the initialization process based on the definition in the configuration file to meet the current data processing needs.

[0107] In one embodiment, the initializing the virtual machine manager includes:

[0108] Configuring an operating mode of the processor;

[0109] Initializing system resources, determining virtualizable hardware resources in the system resources as virtualized resources, and determining usable device configuration resources in the system resources as non-virtualized resources;

[0110] Initializing a hardware virtualization module of the processor to implement an interface for running a virtual machine;

[0111] Complete the initialization of the virtual machine manager.

[0112] Configuring the processor (CPU) operating mode refers to configuring how CPU resources are allocated and managed in a virtualized environment. This includes setting up page tables and interrupts. Page table setup is typically performed early during operating system startup to ensure correct memory management; interrupt setup occurs after page table setup to ensure the operating system can properly respond to and handle interrupts. These two steps together ensure the operating system can run securely and efficiently in protected mode.

[0113] During the process of initializing system resources, the virtualizable hardware resources in the system resources (such as CPU, memory, storage and other hardware resources) can be recorded as virtualized resources, so that the virtualized resources can be divided into secure memory and normal memory according to the configuration file later.

[0114] The device configuration resources available in the system resources are:

[0115] Input / output (I / O) resources: Configuration of devices such as USB controllers, sound cards, serial and parallel ports, etc.

[0116] Display and graphics resources: Configuration of the virtual graphics card and display, including settings for graphics acceleration and display output (GPU).

[0117] Other hardware resources: such as the configuration of SCSI and SAS (Serial Attached SCSI) controllers, virtual printers, etc.

[0118] Device configuration resources ensure that virtual machines can emulate the behavior of real hardware, allowing operating systems and applications on virtual machines to run as if they were on physical hardware. The hypervisor configures these device configuration resources through software, allowing virtual machines to access and use the hardware capabilities of the host machine while maintaining isolation and security.

[0119] After initializing system resources, the hardware virtualization module can be initialized to implement the virtual machine interface. This serves as the foundation for interaction between virtual machines and host hardware in a virtualized environment, enabling efficient and secure virtual machine operation. Through this interface, the virtual machine manager can configure and manage the resources used by the virtual machines, realizing the advantages of virtualization technology.

[0120] To facilitate accurate definition of the configuration file, in one embodiment, after the steps of initializing the system resources, determining the virtualizable hardware resources in the system resources as virtualized resources, and determining the device configuration resources in the system resources as non-virtualized resources, the following steps are further included:

[0121] forming a system resource report based on the virtualized resources and the non-virtualized resources;

[0122] The dividing of virtualized resources determined during the initialization of the virtual machine manager into normal memory and secure memory according to the resource configuration file includes:

[0123] Dividing virtualized resources in the system resource report into normal memory and secure memory according to the resource configuration file;

[0124] The division of non-virtualized resources into security devices and common devices includes:

[0125] According to the resource configuration file, the non-virtualized resources in the system resource report are divided into security devices and common devices.

[0126] The system resource report can be found at Figure 3 , Figure 3 This is a schematic diagram of the report content of the system resource report provided by an embodiment of the present invention.

[0127] like Figure 3 As shown, the system resource report may include virtualizable hardware resources provided by the system: memory, and device configuration resources available to the system: PCI devices, PCI bridges.

[0128] exist Figure 3 Based on the system resource report shown, the system administrator divides the virtualized resources (virtualizable hardware resources) in the system resource report into secure memory and ordinary memory, and divides the non-virtualized resources (device configuration resources) into secure devices and ordinary devices according to data processing requirements, and obtains the following: Figure 2 The configuration file shown.

[0129] After the virtual machine manager completes resource division, it can configure corresponding resources for the virtual machine based on the virtual machine identification type during the process of starting the virtual machine.

[0130] Please refer to Figure 4 , Figure 4 This is another flowchart of the resource configuration method provided by an embodiment of the present invention.

[0131] like Figure 4 As shown, the method includes:

[0132] Step S201: Acquire a virtual machine startup signal, where the virtual machine startup signal includes a virtual machine type identifier.

[0133] Step S202: Determine whether the virtual machine is a secure virtual machine according to the virtual machine type identifier. If yes, execute step S203; if not, execute step S205.

[0134] Step S203: configure the security device and the security memory to the security virtual machine.

[0135] To enable the secure virtual machine and the secure device to access the secure memory, in one embodiment, step S203 may include:

[0136] The virtual machine manager uses a page table to map the address of the secure virtual machine accessing the memory to the physical memory address of the secure memory; and uses an input / output memory management unit to map the address of the secure device accessing the memory to the physical memory address of the secure memory.

[0137] In the process of configuring secure memory and secure devices to secure virtual machines, the virtual machine manager uses page tables (including virtual machine page tables and nested page tables) and IOMMU to map the virtual addresses of secure devices and secure virtual machines to the physical memory addresses of secure memory.

[0138] The virtual machine page table refers to the page table used in the guest operating system to convert memory access addresses (guest virtual addresses: GVA, Guest Virtual Address) to guest physical addresses (GPA, Guest Physical Address). It can convert GVA to GPA. Then, using nested page tables, it converts GPA to physical memory addresses (also known as host physical addresses: Host Physical Address, HPA).

[0139] Nested page tables allow the virtual machine manager to create an additional page table hierarchy, enabling virtual machines to run on hardware-assisted virtualization without modifying the guest operating system. This allows the virtual machine manager to control memory access for virtual machines, ensuring that they can only access allocated memory resources, enhancing security. For example, secure virtual machines can access secure memory.

[0140] The main functions of the IOMMU (Input-Output Memory Management Unit) include DMA (Direct Memory Access) remapping and interrupt remapping. DMA remapping allows device access addresses to be translated into physical memory addresses, effectively shielding the physical addresses and improving system security and performance.

[0141] Through IOMMU, the virtual machine can directly map its visible address (device virtual address) to the real physical address (HPA). In this way, IOMMU builds a bridge between the virtual machine and the physical device, ensuring the security and efficiency of data transmission.

[0142] Step S204: Start the secure virtual machine based on the virtual machine startup signal.

[0143] Step S205: Allocate common devices and common memory to the common virtual machine.

[0144] The common memory is a virtualized resource determined by the virtual machine manager during the initialization process, and the common device is a non-virtualized resource determined by the virtual machine manager during the initialization process.

[0145] In one embodiment, step S205 may include:

[0146] The virtual machine manager uses a page table to map the memory access address of a common virtual machine to the physical memory address of the common memory; and uses an input / output memory management unit to map the memory access address of a common device to the physical memory address of the common memory.

[0147] The virtual machine manager manages the physical memory used by secure and standard virtual machines through page tables. When a virtual machine accesses physical memory, it undergoes two levels of address translation. The GVA (Government Value Address) of the virtual machine accessing memory is converted to a Global Address Permit (GPA) through the virtual machine page table. The GPA is then converted to an HPA through a nested page table. The HPA points to the actual physical memory address being accessed. When a device used by a virtual machine accesses physical memory, the GPA is converted to an HPA through the IOMMU page table. The HPA then points to the actual physical memory address being accessed.

[0148] The virtual machine's nested page tables and IOMMU page tables are managed by the virtual machine manager. For secure virtual machines and secure devices, the virtual machine manager can set the nested page tables and IOMMU page tables to point to secure memory; for normal virtual machines and normal devices, the virtual machine manager can set the nested page tables and IOMMU page tables to point to normal memory. In this way, secure virtual machines and secure devices can only use secure memory, while normal virtual machines and normal devices only use normal memory, ensuring the security and efficiency of data transmission.

[0149] In order to further implement data protection, in one embodiment, the method may further include:

[0150] The virtual machine manager sets the encryption identification bit of the page table entry of the secure memory to encrypt data when the secure virtual machine and the security device write data to the secure memory; wherein, the encryption identification bit of the page table entry of the ordinary memory is not set.

[0151] Memory encryption is a technique for encrypting data written to secure memory based on the setting of an encryption flag. Processors that support memory encryption can configure the encryption flag (C bit) in a page table entry to determine whether to encrypt that page of memory.

[0152] The virtual machine manager sets the C bit of the page table entry of the secure memory (for example, the C bit is "1"), and the secure virtual machine automatically encrypts the data when writing to the secure memory; the virtual machine manager does not set the C bit of the page table entry of the normal memory (for example, the C bit is "0"), and the hardware does not encrypt the data when the normal virtual machine writes to the normal memory.

[0153] Secure memory can be used by programs running in secure virtual machines (such as confidential computing programs) and by secure devices for data processing. Confidential data is automatically encrypted by hardware when written to secure memory. The C bit of the page table entry for a normal virtual machine is set to "0." If a normal virtual machine attempts to read secure memory, it will only read encrypted data. The virtual machine manager divides memory into secure memory and normal memory. Normal virtual machines do not have access to secure memory, but secure memory is encrypted and cannot be decrypted by normal virtual machines, further enhancing security.

[0154] To understand the implementation of memory encryption technology, please refer to Figure 5 , Figure 5 This is a schematic diagram of an implementation process of the memory encryption technology provided by an embodiment of the present invention.

[0155] like Figure 5 As shown, the virtual machine manager 81 sets the C bit of the page table (CPU page table 2) that controls the secure virtual machine 82 to access the secure memory 841 to 1, and sets the C bit of the CPU page table 1 that the virtual machine manager 81 uses to access the secure memory 841 to 1, and sets the C bit of the IOMMU page table 1 that controls the security device 83 used by the secure virtual machine 82 to access the secure memory 841 to 1.

[0156] The C bit of the page table (CPU page table 3) that controls the ordinary virtual machine 85 to access the ordinary memory 842 is set to 0, and the C bit of the IOMMU page table 2 that controls the ordinary device 86 used by the ordinary virtual machine 85 to access the ordinary memory 842 is set to 0.

[0157] The CPU page table is the virtual machine page table and the nested page table, which manages the mapping of the virtual machine's GVA to the memory's HPA.

[0158] Step S206: Start the common virtual machine based on the virtual machine startup signal.

[0159] To enable the virtual machine to start normally, in one embodiment, the virtual machine startup signal also includes a virtual machine kernel and initial file system information, and starting the secure virtual machine based on the virtual machine startup signal includes:

[0160] The secure virtual machine is started using the virtual machine kernel and the initial file system information.

[0161] Virtual machine kernel: This refers to the operating system kernel running in a virtual machine. When booting a secure virtual machine, you must specify a kernel image (such as vmlinuz for Linux) and related kernel boot parameters. These parameters can include memory layout, device tree configuration, boot mode, and more, ensuring the kernel loads and boots correctly.

[0162] Initial file system: This refers to the root file system used when the virtual machine boots. In Linux systems, this is usually an initial RAM disk that contains the basic files and drivers needed to start the virtual machine. This initial file system is mounted during the boot process, allowing the kernel to load the necessary modules and then switch to the persistent root file system.

[0163] An embodiment of the present invention also provides a data processing method, which is applied to a processor that supports hardware virtualization to implement the operation of a secure virtual machine based on configuring a security device and secure memory to the secure virtual machine using the resource configuration method described in the aforementioned embodiment.

[0164] Please refer to Figure 6 , Figure 6 It is a flowchart of a data processing method provided by an embodiment of the present invention.

[0165] like Figure 6 As shown, the method may include the following steps:

[0166] Step S301: Obtain a data processing request, where the address of the data processing request is located in a secure memory.

[0167] Step S302: When it is determined that the data processing request is to be accelerated by the security device, the data processing request is sent to the security device.

[0168] The operating environment of the security device is a secure isolation environment corresponding to a secure virtual machine, the secure virtual machine is run by the processor, and the security device interacts with a secure memory configured for the secure virtual machine.

[0169] Step S303: Obtain a data processing response from the security device to the data processing request.

[0170] In one embodiment, the data in the secure memory is encrypted data; and the secure device interacts with the secure memory configured for the secure virtual machine, including:

[0171] The security device performs accelerated operations on the encrypted data in the secure memory based on the address of the data processing request in the secure isolation environment corresponding to the secure virtual machine.

[0172] Since security devices can run in a secure isolation environment implemented by a secure virtual machine, they can directly perform accelerated operations on encrypted data in secure memory without the need for the processor to desensitize the encrypted data before passing it to the security device for processing, which would cause attacks on the data during the data transmission process and reduce data security.

[0173] In one embodiment, the data processing request is generated during the execution of a confidential computing program by the secure virtual machine, and the security device includes a graphics processor.

[0174] After the secure virtual machine is started, confidential computing programs can be run to provide a deeper level of security and protect the data in use on the secure device.

[0175] Graphics processing units (GPUs) have powerful parallel processing capabilities, significantly increasing the speed of encryption algorithms, especially for large-scale data encryption operations. Therefore, GPUs can be used to accelerate operations during the execution of confidential computing programs. In this case, the GPUs act as security devices, running in a secure, isolated environment corresponding to a secure virtual machine. This ensures the security of data while the GPUs are in use, while also improving the processing efficiency of confidential computing programs.

[0176] It can be seen that the technical solution provided by the embodiment of the present invention, when running a secure virtual machine, during the process of starting the secure virtual machine, on the one hand, the virtual machine manager configures the secure memory, a virtualized resource, for the secure virtual machine, and the data in the secure memory is encrypted data, which can ensure the security of the interaction between the secure virtual machine and the secure memory; on the other hand, the virtual machine manager synchronizes the non-virtualized resource (also known as the device configuration of the virtual machine) of the secure device divided during the initialization process to the secure virtual machine. Since the secure virtual machine can create a secure isolated environment (trusted execution environment) through virtualization technology, after the security device is configured to the secure virtual machine, when the secure virtual machine needs the assistance of the security device to accelerate data processing during data processing, it can ensure that the security device operates in a secure isolated environment, thereby improving the security of the data in use during the data processing process of the secure device; it can be seen that the use of the virtual machine manager to implement the resource configuration of the secure virtual machine, the secure device, and the secure memory at the software level avoids the hardware design of the security device to enable the device to process data in a secure isolated environment; thereby facilitating the protection of data in use of the device and reducing the difficulty of implementing data protection in use of the device.

[0177] An embodiment of the present invention also provides a data processing method, which is applied to a security device to ensure that the security device can run in a secure isolation environment implemented by the security virtual machine when the security device needs to perform accelerated computing during the operation of the security virtual machine, thereby ensuring the security of data in use of the security device.

[0178] Please refer to Figure 7 , Figure 7 This is another flowchart of the data processing method provided by an embodiment of the present invention.

[0179] like Figure 7 As shown, the method may include the following steps:

[0180] Step S401: receiving a data processing request transmitted by a secure virtual machine, where the address of the data processing request is located in a secure memory.

[0181] The data processing request may be generated during the execution of a confidential computing program by a secure virtual machine, and the processing of the confidential calculation may be accelerated by a graphics processor.

[0182] Step S402: Obtain encrypted data from the secure memory according to the address of the data processing request, and decrypt the encrypted data.

[0183] The security device operates in the secure, isolated environment corresponding to the secure virtual machine. Because the virtual machine manager configures the security device to the secure virtual machine when the secure virtual machine is started, the security device can operate within the secure, isolated space implemented by the secure virtual machine. Consequently, when the security device interacts with the secure memory, the CPU can avoid decrypting encrypted data in the secure memory, preventing attacks during the transfer of decrypted data to the security device.

[0184] Decryption generally refers to the complete conversion of data from an encrypted state to a plaintext state, without providing confidentiality protection for the data. In a secure virtual machine, even after data is retrieved, it may still be necessary to maintain its encrypted state to ensure the confidentiality of the data in memory is not leaked. Therefore, in an embodiment of the present invention, when the secure virtual machine is started, the security device is synchronously configured as a non-virtualized resource to the secure virtual machine, allowing the security device to operate in a secure, isolated environment implemented by the secure virtual machine. Both the secure virtual machine and the security device access secure memory, so decryption can be omitted when transferring encrypted data to the security device.

[0185] After the security device obtains the encrypted data, it can decrypt the encrypted data and process the decrypted data.

[0186] Step S403: Process the decrypted data, encrypt the processing result and write it into the secure memory to obtain a data processing response to the data processing request.

[0187] After the security device completes the processing of the decrypted data, it encrypts it again and stores it in the secure memory to ensure the security of the final data processing response.

[0188] It can be seen that the technical solution provided by the embodiment of the present invention is that when a secure virtual machine requires a secure device to accelerate computing processing, during the process of starting the secure virtual machine, on the one hand, the virtual machine manager configures the secure memory, a virtualized resource, for the secure virtual machine. The data in the secure memory is encrypted data, which can ensure the security of the interaction between the secure virtual machine and the secure memory. On the other hand, the virtual machine manager synchronizes the non-virtualized resource (also known as the device configuration of the virtual machine) of the secure device allocated during the initialization process to the secure virtual machine. Since the secure virtual machine can create a secure isolated environment (trusted execution environment) through virtualization technology, after the security device is configured to the secure virtual machine, when the secure virtual machine needs the assistance of the security device to accelerate data processing during data processing, it can ensure that the security device operates in a secure isolated environment, thereby improving the security of the data in use during the data processing process. It can be seen that the use of the virtual machine manager to implement the resource configuration of the secure virtual machine, the secure device, and the secure memory at the software level avoids the hardware design of the security device to enable the device to process data in a secure isolated environment. This facilitates the protection of data in use of the device and reduces the difficulty of implementing data protection for the device.

[0189] In one embodiment, obtaining encrypted data from the secure memory according to the address of the data processing request includes:

[0190] The address of the data processing request is converted into a physical memory address by using an input / output memory management unit; and encrypted data is obtained from the secure memory according to the physical memory address.

[0191] The address of the data processing request is the virtual address issued by the device described in the aforementioned embodiment. The IOMMU can be used to convert the virtual address issued by the device into a physical memory address HPA, and then access the secure memory based on the HPA to obtain encrypted data.

[0192] In one embodiment, the data processing request includes an encryption identification bit; and decrypting the encrypted data includes:

[0193] Decrypting the encrypted data according to the setting of the encryption flag to obtain decrypted data;

[0194] The decrypted data is processed, the processing result is encrypted and written into the secure memory, and a data processing response to the data processing request is obtained, including:

[0195] The decrypted data is processed to obtain a processing result, and the processing result is encrypted according to the encryption identification bit and then written into the secure memory to obtain a data processing response to the data processing request.

[0196] The encryption flag bit may be the C bit described in the aforementioned embodiment. When the data is encrypted data, the encryption flag bit is set to C bit=1. At this time, the encrypted data may be decrypted based on the set encryption flag bit to obtain decrypted data.

[0197] After the decrypted data is processed, the processing result can be encrypted according to the set encryption flag and written into the secure memory to ensure the security of the data processing response.

[0198] The embodiment of the present invention further provides a resource configuration device, which is applied to a processor supporting hardware virtualization. Figure 8 , Figure 8 It is a structural diagram of a resource configuration device provided by an embodiment of the present invention.

[0199] like Figure 8 As shown, the device includes:

[0200] A startup signal acquisition module 50 is used to acquire a virtual machine startup signal, wherein the virtual machine startup signal includes a virtual machine type identifier;

[0201] a resource configuration module 51 configured to, when a virtual machine is determined to be a secure virtual machine based on the virtual machine type identifier, configure a security device and a secure memory to the secure virtual machine, wherein the secure memory is a virtualized resource determined by the virtual machine manager during initialization, and the data in the secure memory is encrypted data; and the security device is a non-virtualized resource determined by the virtual machine manager during initialization;

[0202] The startup module 52 is configured to start the secure virtual machine based on the virtual machine startup signal.

[0203] It can be seen that the technical solution provided by the embodiment of the present invention is that in a processor that supports hardware virtualization, when the virtual machine manager running on the processor starts a virtual machine, the virtual machine manager configures virtualization resources for the virtual machine. Therefore, in the embodiment of the present invention, on the one hand, when the virtual machine manager determines that the virtual machine started at this time is a secure virtual machine based on the virtual machine type identifier in the virtual machine startup signal, it configures the secure memory virtualization resource allocated during the initialization process to the secure virtual machine. The data in the secure memory is encrypted data, which can ensure the security of the interaction between the secure virtual machine and the secure memory; on the other hand, the non-virtualized resource (also called the device configuration of the virtual machine) of the security device allocated during the initialization process is synchronously configured to the secure virtual machine through the virtual machine manager. Since the secure virtual machine can create a secure isolation environment (trusted execution environment) through virtualization technology, after the security device is configured to the secure virtual machine, when the security device needs to assist in accelerating data processing during the data processing process of the secure virtual machine, it can ensure that the security device works in a secure isolation environment, thereby improving the security of the data in use during the data processing process of the security device. It can be seen that the resource configuration of the secure virtual machine, security device and secure memory at the software level is realized by using the virtual machine manager, thereby avoiding the hardware design of the security device to realize data processing of the device in a secure isolation environment. This facilitates the protection of data in use of the device and reduces the difficulty of realizing data protection in use of the device.

[0204] The embodiment of the present invention further provides a data processing device, which is applied to a processor supporting hardware virtualization. Figure 9 , Figure 9 It is a structural diagram of a data processing device provided by an embodiment of the present invention.

[0205] like Figure 9 As shown, the device includes:

[0206] The device comprises:

[0207] A data processing request acquisition module 60 is configured to acquire a data processing request, wherein the address of the data processing request is located in the secure memory;

[0208] a data processing request transmission module 61, configured to transmit the data processing request to the security device when determining that the data processing request is to be accelerated by the security device; wherein the operating environment of the security device is the secure isolation environment corresponding to the secure virtual machine, the secure virtual machine is run by the processor, and the security device interacts with the secure memory configured for the secure virtual machine;

[0209] The data processing response obtaining module 62 is configured to obtain a data processing response from the security device to the data processing request.

[0210] It can be seen that the technical solution provided by the embodiment of the present invention, when running a secure virtual machine, during the process of starting the secure virtual machine, on the one hand, the virtual machine manager configures the secure memory, a virtualized resource, for the secure virtual machine, and the data in the secure memory is encrypted data, which can ensure the security of the interaction between the secure virtual machine and the secure memory; on the other hand, the virtual machine manager synchronizes the non-virtualized resource (also known as the device configuration of the virtual machine) of the secure device divided during the initialization process to the secure virtual machine. Since the secure virtual machine can create a secure isolated environment (trusted execution environment) through virtualization technology, after the security device is configured to the secure virtual machine, when the secure virtual machine needs the assistance of the security device to accelerate data processing during data processing, it can ensure that the security device operates in a secure isolated environment, thereby improving the security of the data in use during the data processing process of the secure device; it can be seen that the use of the virtual machine manager to implement the resource configuration of the secure virtual machine, the secure device, and the secure memory at the software level avoids the hardware design of the security device to enable the device to process data in a secure isolated environment; thereby facilitating the protection of data in use of the device and reducing the difficulty of implementing data protection in use of the device.

[0211] The embodiment of the present invention further provides a data processing device, which is applied to a security device. Figure 10 , Figure 10 It is another structural diagram of the data processing device provided by an embodiment of the present invention.

[0212] like Figure 10 As shown, the device includes:

[0213] A data processing request receiving module 70 is configured to receive a data processing request transmitted by the secure virtual machine, wherein the address of the data processing request is located in the secure memory;

[0214] The encrypted data processing module 71 is configured to obtain the encrypted data from the secure memory according to the address of the data processing request and decrypt the encrypted data;

[0215] The data processing module 72 is used to process the decrypted data, encrypt the processing result and write it into the secure memory, and obtain a data processing response to the data processing request;

[0216] The operating environment of the security device is a secure isolation environment corresponding to the secure virtual machine.

[0217] It can be seen that the technical solution provided by the embodiment of the present invention is that when a secure virtual machine requires a secure device to accelerate computing processing, during the process of starting the secure virtual machine, on the one hand, the virtual machine manager configures the secure memory, a virtualized resource, for the secure virtual machine. The data in the secure memory is encrypted data, which can ensure the security of the interaction between the secure virtual machine and the secure memory. On the other hand, the virtual machine manager synchronizes the non-virtualized resource (also known as the device configuration of the virtual machine) of the secure device allocated during the initialization process to the secure virtual machine. Since the secure virtual machine can create a secure isolated environment (trusted execution environment) through virtualization technology, after the security device is configured to the secure virtual machine, when the secure virtual machine needs the assistance of the security device to accelerate data processing during data processing, it can ensure that the security device operates in a secure isolated environment, thereby improving the security of the data in use during the data processing process. It can be seen that the use of the virtual machine manager to implement the resource configuration of the secure virtual machine, the secure device, and the secure memory at the software level avoids the hardware design of the security device to enable the device to process data in a secure isolated environment. This facilitates the protection of data in use of the device and reduces the difficulty of implementing data protection for the device.

[0218] The embodiment of the present invention also provides a computer system for implementing the resource configuration method and data processing method described in the above embodiment. Figure 11 , Figure 11 It is a structural diagram of a computer system provided by an embodiment of the present invention.

[0219] like Figure 11 As shown, the system includes:

[0220] A processor 80 , wherein the processor 80 supports hardware virtualization and runs a secure virtual machine 82 and a virtual machine manager 81 ;

[0221] Safety equipment 83;

[0222] Memory 84, including secure memory 841, wherein the data in the secure memory is encrypted data;

[0223] Among them, the secure virtual machine 82 is started by the virtual machine manager 81. When the virtual machine manager 81 starts the secure virtual machine 82, the secure memory 841 is configured to the secure virtual machine 82 as a virtualized resource, and the security device 83 is configured to the secure virtual machine 82 as a non-virtualized resource, so that the security device 83 interacts with the secure memory 841 of the secure virtual machine 82.

[0224] Please continue to refer to Figure 11 , the processor 80 also runs a common virtual machine 85, and the memory 84 also includes:

[0225] Ordinary memory 842, where data in the ordinary memory 842 is non-encrypted data;

[0226] The computer system further comprises:

[0227] General equipment 86;

[0228] Among them, the ordinary virtual machine 85 is started by the virtual machine manager 81. When the virtual machine manager 81 starts the ordinary virtual machine 85, the ordinary memory 842 is configured to the ordinary virtual machine 85 as a virtualized resource, and the ordinary device 86 is configured to the ordinary virtual machine 85 as a non-virtualized resource, so that the ordinary device 86 interacts with the ordinary memory 842 of the ordinary virtual machine 85.

[0229] When running confidential computing programs on a secure virtual machine, you can use security devices to accelerate computing. Please refer to Figure 12 , Figure 12 FIG. 2 is another structural diagram of a computer system provided by an embodiment of the present invention.

[0230] like Figure 12 As shown, in the processor (CPU) 80, a trusted virtual machine manager ( Figure 12 As shown in FIG. 8 , virtual machine manager 81 divides system memory 84 into normal memory 842 and secure memory 841. Virtual machine manager 81 provides interfaces for running normal virtual machines 85 and secure virtual machines 82. Normal virtual machines 85 can only use normal memory 842 to run normal applications, while secure virtual machines 82 and virtual machine manager 81 only use secure memory 841. This prevents normal virtual machines 85 from accessing data in secure virtual machines 82. Based on business needs, virtual machine manager 81 divides devices into normal devices 86 and secure devices 83. Normal virtual machines 85 use normal devices 86, while secure virtual machines 82 use secure devices 83. If secure virtual machine 82 requires a GPU, the GPU is assigned to secure virtual machine 82, allowing it to assist secure virtual machine 82 in running confidential computing programs.

[0231] It can be seen that the technical solution provided by the embodiment of the present invention is that in a processor that supports hardware virtualization, when a virtual machine is started, the virtual machine manager configures virtualized resources for the virtual machine. Therefore, in the embodiment of the present invention, on the one hand, when the virtual machine manager determines that the virtual machine started at this time is a secure virtual machine based on the virtual machine type identifier in the virtual machine startup signal, it configures the secure memory virtualization resource allocated during the initialization process to the secure virtual machine. The data in the secure memory is encrypted data, which can ensure the security of the interaction between the secure virtual machine and the secure memory. On the other hand, the non-virtualized resource (also known as the device configuration of the virtual machine) of the security device allocated during the initialization process is synchronously configured to the secure virtual machine through the virtual machine manager. Since the secure virtual machine can create a secure isolation environment (trusted execution environment) through virtualization technology, after the security device is configured to the secure virtual machine, when the security device needs to assist in accelerating data processing during the data processing process of the secure virtual machine, it can ensure that the security device works in a secure isolation environment, thereby improving the security of the data in use during the data processing process of the security device. It can be seen that the resource configuration of the secure virtual machine, security device and secure memory at the software level is realized by using the virtual machine manager, thereby avoiding the hardware design of the security device to realize data processing of the device in a secure isolation environment. This facilitates the protection of data in use of the device and reduces the difficulty of realizing data protection in use of the device.

[0232] An embodiment of the present invention provides an electronic device, such as a terminal device, a server device, or other computer device, including a memory and a processor, wherein the memory stores a program, and the processor calls the program stored in the memory to execute the resource configuration method as described in any of the foregoing embodiments, or executes the data processing method applied to a processor supporting hardware virtualization as described in any of the foregoing embodiments, or executes the data processing method applied to a security device as described in any of the foregoing embodiments.

[0233] An embodiment of the present invention provides a storage medium storing a program, which, when executed, implements the resource configuration method described in any of the foregoing embodiments, or implements the data processing method applied to a processor supporting hardware virtualization as described in any of the foregoing embodiments, or implements the data processing method applied to a security device as described in any of the foregoing embodiments.

[0234] An embodiment of the present invention provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the resource configuration method described in any of the foregoing embodiments, or implements the data processing method applied to a processor supporting hardware virtualization as described in any of the foregoing embodiments, or implements the data processing method applied to a security device as described in any of the foregoing embodiments.

[0235] The above describes multiple embodiment schemes provided by the embodiments of the present invention. The various optional methods introduced in each embodiment scheme can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible embodiment schemes, which can all be considered as embodiment schemes disclosed and open in the embodiments of the present invention.

[0236] Although the embodiments of the present invention are disclosed above, the present invention is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be based on the scope defined by the claims.

Claims

1. A resource configuration method, characterized in that: Applied to a processor supporting hardware virtualization, the method includes: Obtaining a virtual machine startup signal, wherein the virtual machine startup signal includes a virtual machine type identifier; When the virtual machine is determined to be a secure virtual machine according to the virtual machine type identifier, a security device and a secure memory are configured for the secure virtual machine, the secure memory being a virtualized resource determined by the virtual machine manager during the initialization process, and the data in the secure memory being encrypted data, and the virtual machine manager running on the processor; the security device being a non-virtualized resource determined by the virtual machine manager during the initialization process; The secure virtual machine is started based on the virtual machine start signal.

2. The resource allocation method according to claim 1, wherein: Before the step of obtaining the virtual machine startup signal, the method further includes: Initialize the virtual machine manager; The virtualized resources determined during the initialization of the virtual machine manager are divided into normal memory and secure memory, and the non-virtualized resources are divided into secure devices and normal devices according to a resource profile corresponding to the data processing requirements.

3. The resource allocation method according to claim 2, wherein: The initializing the virtual machine manager includes: Configuring an operating mode of the processor; Initializing system resources, determining virtualizable hardware resources in the system resources as virtualized resources, and determining usable device configuration resources in the system resources as non-virtualized resources; Initializing a hardware virtualization module of the processor to implement an interface for running a virtual machine; Complete the initialization of the virtual machine manager.

4. The resource allocation method according to claim 3, wherein: After the steps of initializing the system resources, determining the virtualizable hardware resources in the system resources as virtualized resources, and determining the usable device configuration resources in the system resources as non-virtualized resources, the method further includes: forming a system resource report based on the virtualized resources and the non-virtualized resources; The dividing of virtualized resources determined during the initialization of the virtual machine manager into normal memory and secure memory according to the resource configuration file includes: Dividing virtualized resources in the system resource report into normal memory and secure memory according to the resource configuration file; The division of non-virtualized resources into security devices and common devices includes: According to the resource configuration file, the non-virtualized resources in the system resource report are divided into security devices and common devices.

5. The resource allocation method according to any one of claims 1 to 4, characterized in that: Also includes: When the virtual machine is determined to be a common virtual machine according to the virtual machine type identifier, allocating common devices and common memory to the common virtual machine; The common memory is a virtualized resource determined by the virtual machine manager during the initialization process, and the common device is a non-virtualized resource determined by the virtual machine manager during the initialization process; The common virtual machine is started based on the virtual machine start signal.

6. The resource allocation method according to claim 5, characterized in that: The configuring of a security device and a security memory to the secure virtual machine when the virtual machine is determined to be a secure virtual machine according to the virtual machine type identifier includes: The virtual machine manager uses the page table to map the address of the secure virtual machine access memory to the physical memory address of the secure memory; And, using the input-output memory management unit, the address of the secure device accessing the memory is mapped to the physical memory address of the secure memory.

7. The resource allocation method according to claim 5, wherein: When the virtual machine is determined to be a common virtual machine according to the virtual machine type identifier, allocating common devices and common memory to the common virtual machine includes: The virtual machine manager uses the page table to map the memory address accessed by the ordinary virtual machine to the physical memory address of the ordinary memory; And, the input-output memory management unit is used to map the address of the ordinary device access memory to the physical memory address of the ordinary memory.

8. The resource allocation method according to claim 6 or 7, characterized in that: Also includes: The virtual machine manager sets the encryption identification bit of the page table entry of the secure memory to encrypt data when the secure virtual machine and the security device write data to the secure memory; wherein, the encryption identification bit of the page table entry of the ordinary memory is not set.

9. The resource allocation method according to claim 5, wherein: The virtual machine startup signal also includes a virtual machine kernel and initial file system information, and starting the secure virtual machine based on the virtual machine startup signal includes: The secure virtual machine is started using the virtual machine kernel and the initial file system information.

10. The resource allocation method according to any one of claims 1 to 4, characterized in that: The security device includes a graphics processor.

11. A data processing method, characterized in that: Applied to a processor supporting hardware virtualization, the method includes: Obtaining a data processing request, where the address of the data processing request is located in the secure memory; When it is determined that the data processing request is to be accelerated by the security device, the data processing request is sent to the security device; wherein the operating environment of the security device is a secure isolation environment corresponding to a secure virtual machine, the secure virtual machine is run by the processor, and the security device interacts with a secure memory configured for the secure virtual machine; A data processing response from the security device to the data processing request is obtained.

12. The data processing method according to claim 11, wherein: The data in the secure memory is encrypted data; and the secure device interacts with the secure memory configured for the secure virtual machine, including: The security device performs accelerated operations on the encrypted data in the secure memory based on the address of the data processing request in the secure isolation environment corresponding to the secure virtual machine.

13. The data processing method according to claim 12, wherein: The data processing request is generated during the process of the secure virtual machine running a confidential computing program, and the security device includes a graphics processor.

14. A data processing method, characterized in that: Used in security equipment, including: receiving a data processing request transmitted by the secure virtual machine, where an address of the data processing request is located in the secure memory; Retrieving encrypted data from the secure memory according to the address of the data processing request, and decrypting the encrypted data; Process the decrypted data, encrypt the processing result and write it into the secure memory, and obtain a data processing response to the data processing request; The operating environment of the security device is a secure isolation environment corresponding to the secure virtual machine.

15. The data processing method according to claim 14, wherein: The obtaining of encrypted data from the secure memory according to the address of the data processing request includes: Converting the address of the data processing request into a physical memory address using an input / output memory management unit; Obtain encrypted data from the secure memory according to the physical memory address.

16. The data processing method according to claim 15, wherein: The data processing request includes an encryption identification bit; and decrypting the encrypted data includes: Decrypting the encrypted data according to the setting of the encryption flag to obtain decrypted data; The decrypted data is processed, the processing result is encrypted and written into the secure memory, and a data processing response to the data processing request is obtained, including: The decrypted data is processed to obtain a processing result, and the processing result is encrypted according to the encryption identification bit and then written into the secure memory to obtain a data processing response to the data processing request.

17. A resource allocation device, characterized in that: Applicable to a processor supporting hardware virtualization, the device comprising: A startup signal acquisition module, configured to acquire a virtual machine startup signal, wherein the virtual machine startup signal includes a virtual machine type identifier; a resource configuration module, configured to, when a virtual machine is determined to be a secure virtual machine based on the virtual machine type identifier, configure a security device and a secure memory to the secure virtual machine, wherein the secure memory is a virtualized resource determined by the virtual machine manager during initialization, and the data in the secure memory is encrypted data, and the virtual machine manager runs on the processor; and the security device is a non-virtualized resource determined by the virtual machine manager during initialization; A startup module is used to start the secure virtual machine based on the virtual machine startup signal.

18. A data processing device, characterized in that: Applicable to a processor supporting hardware virtualization, the device comprising: A data processing request acquisition module, configured to acquire a data processing request, wherein the address of the data processing request is located in the secure memory; a data processing request transmission module, configured to, when determining that the data processing request is to be accelerated by a security device, transmit the data processing request to the security device; wherein the operating environment of the security device is a secure isolation environment corresponding to a secure virtual machine, the secure virtual machine is run by the processor, and the security device interacts with a secure memory configured for the secure virtual machine; The data processing response acquisition module is used to obtain a data processing response from the security device to the data processing request.

19. A data processing device, characterized in that: Applied to safety equipment, the device comprises: A data processing request receiving module, configured to receive a data processing request transmitted by the secure virtual machine, wherein the address of the data processing request is located in the secure memory; an encrypted data processing module, configured to obtain encrypted data from the secure memory according to the address of the data processing request and decrypt the encrypted data; The data processing module is used to process the decrypted data, encrypt the processing results and write them into the secure memory, and obtain a data processing response to the data processing request; The operating environment of the security device is a secure isolation environment corresponding to the secure virtual machine.

20. A computer system, characterized in that: include: a processor, wherein the processor supports hardware virtualization and runs a secure virtual machine and a virtual machine manager; safety equipment; Memory, including secure memory, wherein the data in the secure memory is encrypted data; The secure virtual machine is started by a virtual machine manager. When the virtual machine manager starts the secure virtual machine, the secure memory is configured to the secure virtual machine as a virtualized resource, and the security device is configured to the secure virtual machine as a non-virtualized resource, so that the security device interacts with the secure memory of the secure virtual machine.

21. The computer system of claim 20, wherein: The processor also runs a common virtual machine, and the memory further includes: Ordinary memory, where the data in the ordinary memory is non-encrypted data; The computer system further comprises: Common equipment; The ordinary virtual machine is started by the virtual machine manager. When the virtual machine manager starts the ordinary virtual machine, the ordinary memory is configured to the ordinary virtual machine as a virtualized resource, and the ordinary device is configured to the ordinary virtual machine as a non-virtualized resource, so that the ordinary device interacts with the ordinary memory of the ordinary virtual machine.

22. An electronic device, characterized in that: It includes a memory and a processor, the memory stores a program, and the processor calls the program stored in the memory to execute the resource configuration method according to any one of claims 1 to 10, or executes the data processing method according to any one of claims 11 to 13, or executes the data processing method according to any one of claims 14 to 16.

23. A storage medium, characterized in that The storage medium stores a program, and when the program is executed, it implements the resource configuration method according to any one of claims 1 to 10, or implements the data processing method according to any one of claims 11 to 13, or implements the data processing method according to any one of claims 14 to 16.

24. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, it implements the resource configuration method according to any one of claims 1 to 10, or implements the data processing method according to any one of claims 11 to 13, or implements the data processing method according to any one of claims 14 to 16.

Images