Construction of Confidential Computing Environment and Trusted Execution Isolation Methods in High-Sensitive Data Spaces

Abstract

This invention relates to the field of computer technology and discloses a method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space. The method includes: configuring a dedicated high-sensitivity data memory region and implementing address isolation; performing static analysis on the task instruction stream to generate an access obfuscation strategy; injecting false requests into real memory accesses during the execution phase through a hardware controller to achieve indistinguishability of timing and bandwidth characteristics; introducing a dynamic switching mechanism for multiple version instruction paths to disrupt the attacker's long-term observation basis; and simultaneously monitoring the cache and bus status during runtime, triggering context migration to physically isolated resources upon detecting anomalies. The system comprises six modules: high-sensitivity memory configuration, instruction stream analysis, access obfuscation execution, path switching, security monitoring, and migration triggering. This invention, through three layers of collaborative protection, effectively blocks cache side-channel attacks without relying on constant-time programming, balancing security and computational performance.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, specifically relating to a method for constructing a confidential computing environment and isolating trusted execution in a highly sensitive data space. Background Technology

[0002] With the deep penetration of cloud computing, edge computing, and big data processing into highly sensitive, data-intensive fields such as finance, government affairs, and healthcare, the demand for data security protection throughout its entire lifecycle is becoming increasingly urgent. Trusted Execution Environment (TEE), as a hardware-level security isolation technology, ensures that sensitive code and data are protected from snooping and tampering by the operating system and even virtual machine monitors during runtime by building a protected execution region within the processor. Its core value lies in ensuring the confidentiality and integrity of "data in use," and it has become a key infrastructure for privacy computing in high-security scenarios.

[0003] The construction of confidential computing environments in high-sensitivity data spaces focuses on isolating core sensitive information such as encryption keys, identity credentials, and biometrics within the TEE (Trusted Execution Environment). This requires that the execution process not only be logically correct but also that memory access behavior does not leak any semantic information. However, while existing TEE implementations (such as Intel SGX and ARM TrustZone) can effectively defend against direct memory read attacks, they are vulnerable to advanced side-channel attacks based on cache-side channels. Attackers can monitor the access timing and hit patterns of shared caches, inferring the operation trajectory of sensitive data in real time between instruction execution intervals, and thus reconstruct keys or private information.

[0004] While relying on constant-time programming paradigms to eliminate data-related differences in memory access, this approach forces all operation paths to execute the same memory access sequence, leading to a significant increase in computational redundancy and severely limiting performance. Especially in dynamic workload scenarios—such as variable-length encryption operations, irregular data structure traversals, or algorithms with dense conditional branches—constant-time strategies are difficult to universally cover, and global application will cause unacceptable throughput degradation. Summary of the Invention

[0005] This invention provides a method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space. It aims to address the technical problem that the memory access patterns within a trusted execution environment are vulnerable to cache-side channel attacks, leading to the real-time inference of high-sensitivity data during instruction execution intervals. Existing technologies rely on constant-time programming to eliminate access timing differences, but this method severely sacrifices computational performance and cannot adapt to dynamically changing workloads, especially when handling unstructured or variable-length high-sensitivity data computation tasks, where its defense capability significantly decreases. This invention constructs a three-layer collaborative protection architecture that integrates hardware-level memory access obfuscation, software-level execution path randomization, and runtime dynamic resource isolation. Without relying on constant-time programming, it completely blocks the possibility of attackers inferring high-sensitivity data through cache hit / miss timing characteristics, while simultaneously ensuring the execution efficiency and versatility of high-sensitivity computing tasks.

[0006] This invention provides a method for constructing a confidential computing environment and isolating trusted execution in a highly sensitive data space, comprising: During the trusted execution environment initialization phase, a dedicated high-sensitivity data memory region is configured, and physical address remapping and virtual address space isolation are implemented for this region; During the loading phase of the high-sensitivity computing task, static analysis is performed on the task instruction stream to identify all memory access instructions involving high-sensitivity data and generate corresponding access mode obfuscation strategies. During the task execution phase, based on the obfuscation strategy and combined with the dynamic scheduling capability of the hardware memory controller, memory access requests for highly sensitive data are perturbed and filled in real time, so that each access presents indistinguishable timing and bandwidth characteristics at the cache level. At the same time, at the execution unit level, a dynamic switching mechanism for instruction-level execution paths is introduced, which seamlessly switches between multiple instruction sequences that are functionally equivalent but have different memory access trajectories based on a preset pseudo-random sequence. Furthermore, during task execution, the system cache status and memory bus load are continuously monitored. Once an abnormal access pattern cluster is detected, a local execution context migration is immediately triggered, transparently migrating the current high-sensitivity computing subtask to another set of physically isolated computing and storage resources for continued execution.

[0007] As one embodiment of the present invention, the configuration of the dedicated high-sensitivity data memory area specifically includes: reserving a continuous physical memory page frame in the secure world of the trusted execution environment, the size of which is an integer multiple of 4096 bytes; marking the physical memory page frame as a dedicated high-sensitivity data area through the security attribute register of the memory management unit, and prohibiting direct access by non-secure world and unauthorized tasks within the secure world; Meanwhile, in the virtual memory manager, a separate virtual address segment is allocated to this high-sensitivity data-dedicated area, and access permission bits for page table entries are set to allow only certified high-sensitivity computing task code segments to perform read and write operations.

[0008] As one embodiment of the present invention, the static analysis of the task instruction stream specifically includes: before the high-sensitivity computing task binary file is loaded into the trusted execution environment, the trusted verification agent module performs offline disassembly on it; traverse all instructions and identify load and store instructions whose operands contain high-sensitivity data pointers or their derived addresses; For each type of identified memory access instruction, an access pattern feature vector is constructed. The feature vector includes the virtual address offset of the access, the access granularity, the expected access frequency, and the data dependency relationship with other instructions. Based on the feature vector, one or more obfuscation strategies are matched and bound from a pre-set obfuscation strategy library. The obfuscation strategy defines the number of fake accesses to be injected when the instruction is executed, the data filling generation rules, and the interleaving sequence of real accesses and fake accesses.

[0009] As one embodiment of the present invention, the real-time perturbation and filling of memory access requests for highly sensitive data specifically includes: When the central processing unit core issues a high-sensitivity data memory access request, the request is first routed to the high-sensitivity access obfuscation engine located in the memory controller; The obfuscation engine generates a specified number of fake memory access requests according to a pre-bound obfuscation strategy. The target address of the fake requests is located at a random offset position within the exclusive area of ​​high-sensitivity data, and its access granularity is consistent with that of real requests. The obfuscation engine merges real requests with all fake requests into a composite access batch, and submits it all at once in burst transmission mode through the memory bus controller. In the caching subsystem, all requests from this composite batch are considered valid accesses, resulting in uniform cache line filling and replacement activity in both the L1 and L2 caches that is independent of the actual data.

[0010] As one embodiment of the present invention, the dynamic switching mechanism for introducing instruction-level execution paths specifically includes: During the source code compilation phase of high-sensitivity computing tasks, the compiler front-end generates multiple versions of key computing functions. Each version adopts different loop expansion factors, register allocation schemes, and memory access orders while keeping the input and output semantics unchanged. The compiler backend embeds these multi-version function bodies into the final executable image and attaches a lightweight version selection metadata table. During task execution, whenever a critical computation function call point is reached, the runtime scheduler selects a function version from the metadata table for execution based on a pseudo-random sequence driven by a hardware true random number generator. Different versions of the execution path produce drastically different access footprints in the instruction cache and data cache, making it impossible for attackers to establish a stable mapping relationship between access patterns and highly sensitive data through long-term observation.

[0011] As one embodiment of the present invention, the continuous monitoring of the system cache status and memory bus load specifically includes: A cache behavior analyzer is deployed in the monitoring layer of the trusted execution environment. This analyzer periodically samples the miss rate of the L1 data cache, the number of conflicts and misses in the L2 cache, and the instantaneous bandwidth utilization of the memory bus through the performance monitoring unit interface. The sampled multi-dimensional time-series data is input into a lightweight anomaly detection model, which is a pre-trained single-layer autoencoder with a reconstruction error threshold set at 5%. When the reconstruction error exceeds this threshold for three consecutive sampling periods, it is determined that there is potential cache-side channel probing activity.

[0012] As one embodiment of the present invention, the triggering of local execution context migration specifically includes: after determining that a potential attack exists, the migration manager of the trusted execution environment immediately freezes the execution thread of the current high-sensitivity computing subtask; Save the complete register state of the thread, program counter value, and dirty bitmap of modified memory pages in the high-sensitivity data area; allocate a new physical computing core and its associated private cache group in the system's reserved backup secure computing unit pool; Synchronize the saved register states and dirty page data to the context storage area of ​​the newly allocated computing core; Update the page table mapping of the high-sensitivity data-dedicated region so that its base address points to the local memory window of the new computing core; Finally, the execution thread on the new computing core is woken up and execution continues from the point of interruption. The entire migration process is transparent to the upper-layer application.

[0013] This invention provides a confidential computing environment construction and trusted execution isolation system for highly sensitive data spaces, comprising: The high-sensitivity memory region configuration module is used to configure a dedicated high-sensitivity data memory region during the trusted execution environment initialization phase, and to implement physical address remapping and virtual address space isolation for the region. The instruction stream static analysis module is used to perform static analysis on the task instruction stream during the loading phase of high-sensitivity computing tasks, identify all memory access instructions involving high-sensitivity data, and generate corresponding access mode obfuscation strategies. The memory access obfuscation execution module is used to, during the task execution phase, based on the obfuscation strategy and combined with the dynamic scheduling capability of the hardware memory controller, to perturb and fill memory access requests for highly sensitive data in real time. The instruction path dynamic switching module is used to introduce a dynamic switching mechanism for instruction-level execution paths at the execution unit level. Based on a preset pseudo-random sequence, it can seamlessly switch between multiple instruction sequences that are functionally equivalent but have different memory access trajectories. The runtime security monitoring module is used to continuously monitor the system cache status and memory bus load during task execution; The context migration trigger module is used to immediately trigger a local execution context migration when abnormal access patterns are detected to transparently migrate the current high-sensitivity computing subtask to another set of physically isolated computing and storage resources for continued execution.

[0014] As one embodiment of the present invention, the high-sensitivity memory region configuration module is specifically used for: reserving a continuous physical memory page frame in the secure world of the Trusted Execution Environment, the size of which is an integer multiple of 4096 bytes; marking the physical memory page frame as a high-sensitivity data exclusive region through the security attribute register of the memory management unit; allocating an independent virtual address segment for the high-sensitivity data exclusive region in the virtual memory manager, and setting the access permission bits of the page table entries.

[0015] As one embodiment of the present invention, the instruction flow static analysis module is specifically used for: offline disassembling of the binary file of the high-sensitivity computing task; traversing all instructions to identify load and store instructions whose operands contain high-sensitivity data pointers or their derived addresses; constructing an access pattern feature vector for each type of identified memory access instruction; and matching and binding one or more obfuscation strategies from a preset obfuscation strategy library based on the feature vector.

[0016] As one embodiment of the present invention, the memory access obfuscation execution module is specifically used for: when the central processing unit core issues a high-sensitivity data memory access request, the request is routed to the high-sensitivity access obfuscation engine located in the memory controller; the obfuscation engine generates a specified number of fake memory access requests according to a pre-bound obfuscation strategy; the real requests are merged with all fake requests into a composite access batch, and submitted all at once in burst transmission mode through the memory bus controller.

[0017] As one embodiment of the present invention, the instruction path dynamic switching module is specifically used for: generating multiple versions of key computation functions during the source code compilation stage of a high-sensitivity computing task; embedding these multiple version function bodies into the final executable image and attaching a lightweight version selection metadata table; during task execution, whenever the call point of a key computation function is entered, the runtime scheduler selects a function version from the metadata table for jump execution based on a pseudo-random sequence driven by a hardware true random number generator.

[0018] As one embodiment of the present invention, the runtime security monitoring module is specifically used to: periodically sample the miss rate of L1 data cache, the number of conflicts and misses in L2 cache, and the instantaneous bandwidth utilization of memory bus through the performance monitoring unit interface; input the sampled multi-dimensional time-series data into a lightweight anomaly detection model; and determine that there is potential cache-side channel probing activity when the reconstruction error of three consecutive sampling cycles exceeds the threshold of 5%.

[0019] In one embodiment of the present invention, the context transition triggering module is specifically used to: freeze the execution thread of the current high-sensitivity computing subtask; save the complete register state, program counter value, and dirty bitmap of modified memory pages in the high-sensitivity data-dedicated area of ​​the thread; allocate a new physical computing core and its associated private cache group in the system's reserved backup secure computing unit pool; synchronize the saved register state and dirty page data to the context storage area of ​​the newly allocated computing core; update the page table mapping of the high-sensitivity data-dedicated area; and wake up the execution thread on the new computing core to continue execution from the interruption point.

[0020] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention abandons the rigid performance constraints of traditional constant-time programming. Through a three-layer collaborative protection mechanism, it fundamentally eliminates the leakage of memory access pattern information, the basis for cache-side-channel attacks, while maintaining the original performance of highly sensitive computing tasks. The first layer, hardware-level memory access obfuscation, ensures that every real data access is overwhelmed by indistinguishable false accesses, preventing attackers from extracting any valid signals from the cache timing. The second layer, software-level dynamic instruction path switching, undermines the attacker's foundation for long-term pattern accumulation; even when running the same task multiple times, the memory access footprint exhibits high randomness. The third layer, runtime dynamic context migration, provides proactive defense capabilities, immediately severing the observation link when attack behavior first emerges and seamlessly transferring the computing task to a clean execution environment. These three layers are coupled and complementary, jointly constructing a high-performance and robust highly sensitive data confidentiality computing environment that can resist known cache-side-channel attacks and effectively prevent unknown variant attacks. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the overall technical solution architecture of the confidential computing environment construction and trusted execution isolation method for high-sensitivity data space proposed in this invention; Figure 2 This is a schematic diagram of the core principle framework of the three-layer collaborative protection that integrates hardware-level memory access obfuscation, software-level execution path randomization, and runtime dynamic resource isolation in this invention. Figure 3 This is a logical flow diagram of the high-sensitivity computing task loading and instruction flow static analysis stage in this invention; Figure 4 This is a schematic diagram of the collaborative execution framework of memory access obfuscation and dynamic instruction path switching during the task execution phase in this invention; Figure 5 This is a logical flowchart of the runtime security monitoring and anomaly detection mechanism in this invention; Figure 6 This is a schematic diagram of the multi-level interaction relationship and data flow between local execution context migration triggering and transparent resource switching in this invention. Detailed Implementation

[0022] Please refer to Figures 1 to 6 This invention provides a method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space. It aims to address the technical problem that the memory access patterns within a trusted execution environment are vulnerable to cache-side channel attacks, leading to the real-time inference of high-sensitivity data during instruction execution intervals. Existing technologies rely on constant-time programming to eliminate access timing differences, but this method severely sacrifices computational performance and cannot adapt to dynamically changing workloads, especially when handling unstructured or variable-length high-sensitivity data computation tasks, where its defense capability significantly decreases. This invention constructs a three-layer collaborative protection architecture that integrates hardware-level memory access obfuscation, software-level execution path randomization, and runtime dynamic resource isolation. Without relying on constant-time programming, it completely blocks the possibility of attackers inferring high-sensitivity data through cache hit / miss timing characteristics, while simultaneously ensuring the execution efficiency and versatility of high-sensitivity computing tasks.

[0023] The method for constructing a confidential computing environment and isolating trusted execution in a highly sensitive data space includes the following steps: S1, during the trusted execution environment initialization phase, a dedicated high-sensitivity data memory region is configured, and physical address remapping and virtual address space isolation are implemented for this region; S2, during the loading phase of the high-sensitivity computing task, performs static analysis on the task instruction stream, identifies all memory access instructions involving high-sensitivity data, and generates corresponding access mode obfuscation strategies. S3, during the task execution phase, based on the obfuscation strategy and combined with the dynamic scheduling capability of the hardware memory controller, memory access requests for highly sensitive data are perturbed and filled in real time, so that each access presents indistinguishable timing and bandwidth characteristics at the cache level. S4 introduces a dynamic switching mechanism for instruction-level execution paths at the execution unit level, which seamlessly switches between multiple instruction sequences that are functionally equivalent but have different memory access trajectories based on a preset pseudo-random sequence. S5: During task execution, continuously monitor the system cache status and memory bus load; S6: Once an abnormal access pattern aggregation is detected, immediately trigger a local execution context migration, transparently migrating the current high-sensitivity computing subtask to another set of physically isolated computing and storage resources to continue execution.

[0024] In step S1, configuring a dedicated high-sensitivity data memory region specifically includes: reserving a continuous physical memory page frame in the secure world of the trusted execution environment, the size of which is an integer multiple of 4096 bytes; marking this physical memory page frame as a dedicated high-sensitivity data region through the security attribute register of the memory management unit, prohibiting direct access from outside the secure world and from unauthorized tasks within the secure world; simultaneously, allocating an independent virtual address segment for this dedicated high-sensitivity data region in the virtual memory manager, and setting access permission bits for page table entries, allowing only authenticated high-sensitivity computing task code segments to perform read and write operations.

[0025] The starting address of the physical memory page frame is statically reserved from the global physical address space by the trusted firmware during system startup and is uniformly managed by the memory allocator of the secure world operating system kernel. The security attribute register is a control register in the memory management unit specifically used to mark the security attributes of memory regions. Each bit corresponds to a memory page frame. When the bit is set to a high level, it indicates that the corresponding page frame belongs to a high-sensitivity data exclusive area. Any access request from outside the secure world or from a task that has not passed security authentication will be forcibly rejected by the hardware and trigger a security exception.

[0026] The allocation of the virtual address segment is completed by the virtual memory manager in the secure world. Its base address and length are dynamically determined when the high-sensitivity computing task is created. Triple permission control is implemented through user / kernel bits, read / write bits and custom high-sensitivity data access bits in the page table entries to ensure that only the privileged code segment of the task itself can modify the contents of this area in a specific execution context.

[0027] In step S2, the static analysis of the task instruction stream specifically includes: before the high-sensitivity computing task binary file is loaded into the trusted execution environment, the trusted verification agent module performs offline disassembly on it; Traverse all instructions to identify load and store instructions whose operands contain highly sensitive data pointers or their derived addresses; For each type of identified memory access instruction, an access pattern feature vector is constructed. The feature vector includes the virtual address offset of the access, the access granularity, the expected access frequency, and the data dependency relationship with other instructions. Based on the feature vector, one or more obfuscation strategies are matched and bound from a pre-set obfuscation strategy library. The obfuscation strategy defines the number of fake accesses to be injected when the instruction is executed, the data filling generation rules, and the interleaving sequence of real accesses and fake accesses.

[0028] The trusted verification agent module is an independent daemon process running in the secure world. Before the task is loaded, it receives a binary image from the secure world operating system and calls the built-in disassembler to parse the instruction opcodes and operands line by line. For each load or store instruction, if its source or destination operand is in register indirect addressing mode, and the register is traced back to the initial assignment point of the high-sensitivity data pointer in the static single assignment form of the program, then the instruction is determined to be a high-sensitivity memory access instruction.

[0029] The access pattern feature vector is stored in the form of a structure, where the virtual address offset is the offset range formed by the combination of the base address register and the index register in the instruction, the access granularity is the instruction operand width (e.g., 8 bytes, 4 bytes), the expected access frequency is obtained by statically estimating the nesting depth of the loop and the number of iterations, and the data dependency relationship is extracted by constructing the control flow graph and data flow graph between instructions to extract the predecessor and successor node information.

[0030] The obfuscation strategy library is a pre-compiled strategy mapping table. Its keys are the hash values ​​of the feature vectors, and its values ​​are obfuscation parameter structures containing the number of fake accesses (ranging from 1 to 5), data generation rules (such as all 0s, all 1s, or pseudo-random sequences), and interleaving time patterns (such as real-fake-real, fake-real-fake-real). The matching process uses a nearest neighbor search algorithm to find the strategy item with the smallest Euclidean distance in the feature vector space and binds it to the metadata field of the corresponding instruction for subsequent execution phases.

[0031] In step S3, the real-time perturbation and padding of memory access requests for highly sensitive data specifically includes: when the central processing unit core issues a memory access request for highly sensitive data, the request is first routed to the highly sensitive access obfuscation engine located in the memory controller; The obfuscation engine generates a specified number of fake memory access requests according to a pre-bound obfuscation strategy. The target address of the fake requests is located at a random offset position within the exclusive area of ​​high-sensitivity data, and its access granularity is consistent with that of real requests. The obfuscation engine merges real requests with all fake requests into a composite access batch and submits it all at once in burst transfer mode via the memory bus controller. In the caching subsystem, all requests from this composite batch are considered valid accesses, thereby generating uniform cache line filling and replacement activity in the L1 and L2 caches that is independent of the real data.

[0032] The high-sensitivity access obfuscation engine is a dedicated hardware logic unit integrated inside the memory controller. Its input is a memory access request packet from the processor core, which includes the virtual address, access type, data width, and associated obfuscation policy identifier.

[0033] The engine contains an address perturbation generator that uses a seed output from a hardware true random number generator, combined with the base address and length of the high-sensitivity data-dedicated region, to calculate several legitimate random offset addresses, ensuring that all spoofed addresses fall within this region and do not exceed its boundaries. The burst transmission mode is forcibly enabled by the arbitration logic of the memory bus controller. Regardless of whether the original request is a burst type, as long as its target address belongs to the high-sensitivity data-dedicated region, it is converted into a fixed-length burst sequence, the length of which is equal to the sum of the number of real and spoof requests.

[0034] This mechanism prevents external observers from inferring the actual number of accesses based on the burst length or interval of bus transactions. At the cache level, since all requests hit the same memory region, their cache line tags have the same high-order address prefix in both L1 and L2 caches. This makes it impossible for the cache replacement strategy to distinguish between real and false accesses, resulting in constant cache miss latency and bandwidth consumption in terms of timing.

[0035] In step S4, the introduction of a dynamic switching mechanism for instruction-level execution paths specifically includes: during the source code compilation stage of high-sensitivity computing tasks, the compiler front-end generates multiple versions of key computing functions. Each version adopts different loop expansion factors, register allocation schemes, and memory access orders while maintaining the same input and output semantics. The compiler backend embeds these multi-version function bodies into the final executable image and attaches a lightweight version selection metadata table. During task execution, whenever a critical computation function call point is reached, the runtime scheduler selects a function version from the metadata table based on a pseudo-random sequence driven by a hardware true random number generator for jump execution; Different versions of the execution path produce drastically different access footprints in the instruction cache and data cache, making it impossible for attackers to establish a stable mapping relationship between access patterns and highly sensitive data through long-term observation.

[0036] The key computational functions are those marked as containing highly sensitive data processing logic during the static analysis phase. The generation of multiple versions is automatically completed by the compiler plugin. Each version achieves semantically equivalent but execution-path-different code variants by changing the number of loop unrolls (e.g., 2x, 3x, 4x unrolling), adjusting the mapping relationship between variables and registers (e.g., assigning array elements a[i] and b[i] to different register groups), and rearranging the memory access order (e.g., accessing even indices first and then odd indices, or vice versa).

[0037] The version selection metadata table is a read-only data segment that records the entry address list and version identifier of each critical function. The runtime scheduler is a lightweight module in the kernel of the secure world operating system. Before the function call, it intercepts the control flow, reads the current output of the hardware true random number generator, performs a modulo operation on it, uses it as an index to query the metadata table, obtains the entry address of the target version, and completes the switch through an indirect jump instruction.

[0038] The entire switching process does not involve context saving and restoration, only changing the program counter value, thus incurring extremely low overhead. Since each function call may select a different version, even if the same highly sensitive data is processed repeatedly, the corresponding instruction cache line loading sequence and data cache line access sequence exhibit high randomness, completely destroying the pattern stability required for side-channel attacks.

[0039] In step S5, continuously monitoring the system cache status and memory bus load specifically includes: deploying a cache behavior analyzer in the monitoring layer of the trusted execution environment. This analyzer periodically samples the miss rate of the L1 data cache, the number of conflicts and misses in the L2 cache, and the instantaneous bandwidth utilization of the memory bus through the performance monitoring unit interface. The sampled multidimensional time-series data is input into a lightweight anomaly detection model, which is a pre-trained single-layer autoencoder with a reconstruction error threshold of 5%. When the reconstruction error of three consecutive sampling periods exceeds this threshold, it is determined that there is potential cache-side channel probing activity.

[0040] The performance monitoring unit is a set of hardware counters built into the processor core, which can be configured to accumulate the number of occurrences of a specified event in each fixed time window (e.g., every millisecond). The cache behavior analyzer periodically reads the values ​​of these counters and normalizes them into ratios: the L1 cache miss rate is the number of misses divided by the total number of accesses; the L2 cache conflict miss rate is the number of replacements caused by index conflicts; and the instantaneous memory bus bandwidth utilization rate is the number of bytes of effective data transfer on the bus in the current cycle divided by the theoretical maximum bandwidth.

[0041] The single-layer autoencoder consists of a fully connected encoder layer and a fully connected decoder layer. Its weights are trained on a large dataset of cached behavior under normal operating conditions before the system leaves the factory, aiming to minimize the reconstruction error of normal data. During runtime, after the input vector undergoes the encoding-decoding process, its mean square error compared to the original input is calculated. If this error exceeds a preset 5% threshold, it is considered abnormal. Three consecutive exceedances constitute a valid alarm to avoid false triggering caused by transient noise.

[0042] In step S6, triggering the local execution context migration specifically includes: after determining that a potential attack exists, the migration manager of the trusted execution environment immediately freezes the execution thread of the current high-sensitivity computing subtask; Save the complete register state of the thread, program counter value, and dirty bitmap of modified memory pages in the high-sensitivity data area; In the system's reserved backup secure computing unit pool, allocate new physical computing cores and their associated private cache groups; Synchronize the saved register states and dirty page data to the context storage area of ​​the newly allocated computing core; update the page table mapping of the high-sensitivity data-dedicated area so that its base address points to the local memory window of the new computing core; Finally, the execution thread on the new computing core is woken up and execution continues from the point of interruption. The entire migration process is transparent to the upper-layer application.

[0043] The migration manager is a high-priority service thread within the secure world operating system kernel. Upon receiving an alarm signal from the cache behavior analyzer, it immediately sends a pause command to the target thread and waits for it to enter the safe hang point. Register states, including general-purpose registers, floating-point registers, program status words, and the program counter, are all stored in a dedicated context block within secure world memory. The dirty bitmap is automatically maintained by the dirty bits in the page table entries of the memory management unit. The migration manager scans the page table entries corresponding to the high-sensitivity data-specific regions, collecting all page frame indices where the dirty bit is one.

[0044] The backup secure computing unit pool consists of several physical cores reserved at system startup and placed in a low-power standby state, activating only upon migration trigger. The new core's private cache group is automatically zeroed out by hardware before activation, ensuring no residual data. Context synchronization is performed via a high-speed interconnect bus, employing atomic writes to guarantee consistency.

[0045] Page table mapping updates are performed by the virtual memory manager, which modifies the mapping between virtual and physical addresses in the high-sensitivity data region, allowing the new core to access the same logical data region through its local window. After the migration is complete, the original core is returned to the standby pool, its cached contents are invalidated, and the attacker's observation link is completely severed.

[0046] The above methods and steps together constitute a closed-loop proactive defense system. Hardware-level obfuscation ensures that a single access is indistinguishable, software-level path switching disrupts the accumulation of patterns across multiple runs, and runtime monitoring and migration provide the last line of defense. The three work together to fundamentally eliminate the basis for information leakage in cache side-channel attacks.

[0047] As one embodiment of the present invention, the confidential computing environment construction and trusted execution isolation system for the high-sensitivity data space includes: The high-sensitivity memory region configuration module is used to configure a dedicated high-sensitivity data memory region during the trusted execution environment initialization phase, and to implement physical address remapping and virtual address space isolation for the region. The instruction stream static analysis module is used to perform static analysis on the task instruction stream during the loading phase of high-sensitivity computing tasks, identify all memory access instructions involving high-sensitivity data, and generate corresponding access mode obfuscation strategies. The memory access obfuscation execution module is used to, during the task execution phase, based on the obfuscation strategy and combined with the dynamic scheduling capability of the hardware memory controller, to perturb and fill memory access requests for highly sensitive data in real time. The instruction path dynamic switching module is used to introduce a dynamic switching mechanism for instruction-level execution paths at the execution unit level. Based on a preset pseudo-random sequence, it can seamlessly switch between multiple instruction sequences that are functionally equivalent but have different memory access trajectories. The runtime security monitoring module is used to continuously monitor the system cache status and memory bus load during task execution; The context migration trigger module is used to immediately trigger a local execution context migration when abnormal access patterns are detected to transparently migrate the current high-sensitivity computing subtask to another set of physically isolated computing and storage resources for continued execution.

[0048] The high-sensitivity memory region configuration module is specifically used for: In the secure world of a Trusted Execution Environment, a contiguous physical memory page frame is reserved, with a size that is an integer multiple of 4096 bytes; this physical memory page frame is marked as a dedicated area for highly sensitive data through the security attribute register of the memory management unit. In the virtual memory manager, a separate virtual address segment is allocated for this high-sensitivity data region, and access permission bits for page table entries are set. This module is implemented by the memory subsystem of the SecureWorld operating system kernel, which reserves physical memory by calling the firmware interface during system initialization and dynamically allocates virtual address space when a task is created.

[0049] The instruction stream static analysis module is specifically used for: offline disassembling of the binary file of the high-sensitivity computing task; traversing all instructions to identify load and store instructions whose operands contain high-sensitivity data pointers or their derived addresses; For each type of identified memory access instruction, an access pattern feature vector is constructed. Based on the feature vector, one or more obfuscation policies are matched and bound from a pre-configured obfuscation policy library. This module, as part of the trusted verification agent, runs during the security check phase before task loading, and its output is an executable image with obfuscated metadata.

[0050] The memory access obfuscation execution module is specifically used for: when the central processing unit core issues a high-sensitivity data memory access request, the request is routed to the high-sensitivity access obfuscation engine located in the memory controller; the obfuscation engine generates a specified number of dummy memory access requests according to a pre-bound obfuscation strategy; the real requests are merged with all dummy requests into a composite access batch, and submitted all at once in burst transfer mode through the memory bus controller. The hardware part of this module is integrated into the memory controller, and the software part is driven by the metadata bound at task loading time.

[0051] The instruction path dynamic switching module is specifically used to generate multiple versions of key calculation functions during the source code compilation stage of high-sensitivity computing tasks. Embed these multi-version function bodies into the final executable image and attach a lightweight version selection metadata table; During task execution, whenever a critical computation function call is reached, the runtime scheduler selects a function version from the metadata table based on a pseudo-random sequence driven by a hardware true random number generator for execution. This module is implemented collaboratively by the compiler plugin and the runtime scheduler; the former generates multiple versions of code, while the latter performs dynamic selection.

[0052] The runtime security monitoring module is specifically used to: periodically sample the L1 cache miss rate, L2 cache conflict and miss counts, and instantaneous memory bus bandwidth utilization via the performance monitoring unit interface; input the sampled multi-dimensional time-series data into a lightweight anomaly detection model; and determine the existence of potential cache-side channel probing activity when the reconstruction error exceeds a threshold of 5% for three consecutive sampling cycles. This module is implemented by a cache behavior analyzer, which periodically collects hardware performance counter data and executes anomaly detection algorithms.

[0053] The context transition triggering module is specifically used to: freeze the execution thread of the current high-sensitivity computing subtask; save the complete register state, program counter value, and dirty bitmap of the modified memory page in the high-sensitivity data exclusive area of ​​the thread; and allocate a new physical computing core and its associated private cache group in the system's reserved backup secure computing unit pool. Synchronize the saved register states and dirty page data to the context storage area of ​​the newly allocated computing core; Update the page table mapping for the high-sensitivity data area; Wake up the execution thread on the new computing core and resume execution from the point of interruption. This module is implemented by the migration manager, which responds to security alerts and executes the full context migration protocol.

[0054] This invention, through the coordinated implementation of the aforementioned methods and systems, constructs a highly isolated confidential computing environment capable of resisting cache side-channel attacks without sacrificing the performance of high-sensitivity computing tasks. The three-layered protection mechanism supports each other, forming a defense-in-depth system that effectively solves the performance bottlenecks and poor adaptability to dynamic workloads caused by constant-time programming in existing technologies.

Claims

1. A method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space, characterized in that, include: During the trusted execution environment initialization phase, a dedicated high-sensitivity data memory region is configured, and physical address remapping and virtual address space isolation are implemented for this region; During the loading phase of the high-sensitivity computing task, static analysis is performed on the task instruction stream to identify all memory access instructions involving high-sensitivity data and generate corresponding access mode obfuscation strategies. During the task execution phase, based on the obfuscation strategy and combined with the dynamic scheduling capability of the hardware memory controller, memory access requests for highly sensitive data are perturbed and filled in real time, so that each access presents indistinguishable timing and bandwidth characteristics at the cache level. At the execution unit level, a dynamic switching mechanism for instruction-level execution paths is introduced, which seamlessly switches between multiple instruction sequences that are functionally equivalent but have different memory access trajectories based on a preset pseudo-random sequence. During task execution, continuously monitor system cache status and memory bus load; Once an abnormal access pattern cluster is detected, a local execution context migration is immediately triggered, transparently migrating the current high-sensitivity computing subtask to another set of physically isolated computing and storage resources for continued execution.

2. The method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space according to claim 1, characterized in that, The dedicated high-sensitivity data memory area includes: In the secure world of a trusted execution environment, a contiguous physical memory page frame is reserved, the size of which is an integer multiple of 4096 bytes; By using the security attribute register of the memory management unit, this segment of physical memory page frame is marked as a high-sensitivity data exclusive area, prohibiting direct access from the non-secure world and unauthorized tasks within the secure world; In the virtual memory manager, allocate a separate virtual address segment for this high-sensitivity data-dedicated region and set the access permission bits for page table entries, allowing only the certified high-sensitivity computing task code segments to perform read and write operations.

3. The method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space according to claim 2, characterized in that, Static analysis of the task instruction stream specifically includes: Before the binary file of the high-sensitivity computing task is loaded into the trusted execution environment, it is disassembled offline by the trusted verification agent module. Traverse all instructions to identify load and store instructions whose operands contain highly sensitive data pointers or their derived addresses; For each type of identified memory access instruction, an access pattern feature vector is constructed. The feature vector includes the virtual address offset of the access, the access granularity, the expected access frequency, and the data dependency relationship with other instructions. Based on the feature vector, one or more obfuscation strategies are matched and bound from a pre-set obfuscation strategy library. The obfuscation strategy defines the number of fake accesses to be injected when the instruction is executed, the data filling generation rules, and the interleaving sequence of real accesses and fake accesses.

4. The method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space according to claim 3, characterized in that, Real-time perturbation and padding of memory access requests for highly sensitive data specifically includes: When the central processing unit core issues a high-sensitivity data memory access request, the request is first routed to the high-sensitivity access obfuscation engine located in the memory controller; The obfuscation engine generates a specified number of fake memory access requests according to a pre-bound obfuscation strategy. The target address of the fake requests is located at a random offset position within the exclusive area of ​​high-sensitivity data, and its access granularity is consistent with that of real requests. The obfuscation engine merges real requests with all fake requests into a composite access batch and submits it all at once in burst transmission mode via the memory bus controller. In the caching subsystem, all requests from this composite batch are considered valid accesses, resulting in uniform cache line filling and replacement activity in both the L1 and L2 caches that is independent of the actual data.

5. The method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space according to claim 4, characterized in that, The introduction of a dynamic switching mechanism for instruction-level execution paths specifically includes: During the source code compilation phase of high-sensitivity computing tasks, the compiler front-end generates multiple versions of key computing functions. Each version adopts different loop expansion factors, register allocation schemes, and memory access orders while keeping the input and output semantics unchanged. The compiler backend embeds these multi-version function bodies into the final executable image and attaches a lightweight version selection metadata table. During task execution, whenever a critical computation function call point is reached, the runtime scheduler selects a function version from the metadata table based on a pseudo-random sequence driven by a hardware true random number generator for jump execution; Different versions of the execution path produce drastically different access footprints in the instruction cache and data cache, making it impossible for attackers to establish a stable mapping relationship between access patterns and highly sensitive data through long-term observation.

6. The method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space according to claim 5, characterized in that, Continuous monitoring of system cache status and memory bus load specifically includes: A cache behavior analyzer is deployed in the monitoring layer of the trusted execution environment. This analyzer periodically samples the L1 data cache miss rate, the number of conflicts and misses in the L2 cache, and the instantaneous bandwidth utilization of the memory bus through the performance monitoring unit interface. The sampled multidimensional time-series data is input into a lightweight anomaly detection model, which is a pre-trained single-layer autoencoder with a reconstruction error threshold set at 5%. When the reconstruction error exceeds the threshold for three consecutive sampling periods, it is determined that there is potential cache-side channel probing activity.

7. The method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space according to claim 6, characterized in that, Triggering a local execution context transition specifically includes: Upon determining the presence of a potential attack, the Trusted Execution Environment's migration manager immediately freezes the execution thread of the current high-sensitivity computation subtask; Save the complete register state of the thread, program counter value, and dirty bitmap of modified memory pages in the high-sensitivity data area; In the system's reserved backup secure computing unit pool, allocate new physical computing cores and their associated private cache groups; Synchronize the saved register states and dirty page data to the context storage area of ​​the newly allocated computing core; Update the page table mapping of the high-sensitivity data-dedicated region so that its base address points to the local memory window of the new computing core; The execution thread on the new computing core is awakened and continues execution from the point of interruption. The entire migration process is transparent to the upper-layer application.

8. The method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space according to claim 7, characterized in that, The high-sensitivity access obfuscation engine uses a seed output by a hardware true random number generator, combined with the base address and length of the high-sensitivity data-specific region, to calculate several legitimate random offset addresses, ensuring that all fake addresses fall within this region and do not cross the boundary.

9. The method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space according to claim 8, characterized in that, The burst transmission mode is forcibly enabled by the arbitration logic of the memory bus controller. Regardless of whether the original request is a burst type, as long as its target address belongs to the high-sensitivity data exclusive area, it is converted into a burst sequence of fixed length, the length of which is equal to the sum of the number of real requests and fake requests.

10. The method for constructing a confidential computing environment and isolating trusted execution in a high-sensitivity data space according to claim 9, characterized in that, The multi-version function achieves semantically equivalent but execution-path-different code variants by changing the number of loop unrolls, adjusting the mapping between variables and registers, and rearranging the memory access order.

Images