Data processing method and apparatus

Abstract

The application discloses a data processing method and device, and belongs to the technical field of electronic equipment. The method comprises the following steps: sending a service request message to a second electronic device, wherein the service request message is used for instructing the second electronic device to start a business confidential virtual machine and a network proxy confidential virtual machine corresponding to the service request message; wherein the code running in the business confidential virtual machine is closed-source code, and the code running in the network proxy confidential virtual machine is open-source code; under the condition that the business confidential virtual machine and the network proxy confidential virtual machine are both started, sending service data to the business confidential virtual machine through the network proxy confidential virtual machine; receiving response data sent by the business confidential virtual machine through the network proxy confidential virtual machine; wherein the response data is generated by the business confidential virtual machine based on the service data.

Description

Technical Field

[0001] This application belongs to the field of electronic equipment technology, and specifically relates to a data processing method and apparatus. Background Technology

[0002] With the development of mobile terminal computing power and artificial intelligence technology, more and more mobile terminal services need to rely on cloud computing power to complete complex tasks. For example, in large model application scenarios, due to the limitations of computing power, video memory capacity and power consumption of the graphics processing unit (GPU) or neural processing unit (NPU) of mobile terminal devices, it is difficult to complete large-scale model inference or complex data processing tasks locally. Therefore, it is necessary to upload business data from the mobile terminal to the cloud server for processing.

[0003] The existing solution involves preprocessing business data on the mobile terminal before uploading it to the cloud, such as by de-identifying or anonymizing it, to reduce the risk of user privacy leaks. However, de-identifying or anonymizing business data can prevent business functions from working properly.

[0004] To avoid the aforementioned business function failures, another solution is to upload business data to the cloud via the mobile terminal, and then have the cloud process the business data using an open-source business virtual machine. While this solution can protect the confidentiality and integrity of business data during processing with the help of confidential computing technology, the fact that the business virtual machine's code is open source makes it susceptible to security risks of data leakage during transmission and processing. Summary of the Invention

[0005] The purpose of this application is to provide a data processing method and apparatus that can improve the security of business data during transmission and processing, provided that business functions are available.

[0006] In a first aspect, embodiments of this application provide a data processing method, executed by a first electronic device, comprising: A service request message is sent to a second electronic device, the service request message being used to instruct the second electronic device to start a service confidential virtual machine and a network proxy confidential virtual machine corresponding to the service request message; wherein, the code running in the service confidential virtual machine is closed source code, and the code running in the network proxy confidential virtual machine is open source code; When both the business confidential virtual machine and the network proxy confidential virtual machine are started, business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine; Receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine; the response data is generated by the business confidential virtual machine based on the business data.

[0007] Optionally, before sending the service request message to the second electronic device, the method further includes: A communication channel for business data transmission is established between the network agent confidential virtual machine and the business confidential virtual machine; The communication channel is used to send the service data from the network proxy confidential virtual machine to the service confidential virtual machine, and to send the response data from the service confidential virtual machine to the network proxy confidential virtual machine.

[0008] Optionally, sending business data to the business confidential virtual machine via the network proxy confidential virtual machine includes: If the network configuration information indicates that the data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, the business data will be sent to the business confidential virtual machine through the network proxy confidential virtual machine. The receipt of response data sent by the business confidential virtual machine through the network proxy confidential virtual machine includes: If the network configuration information indicates that data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, then receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine.

[0009] Optionally, the network configuration information includes at least one of the following: Network configuration information in the host operating system; network configuration information inside the virtual machine containing the business secrets.

[0010] Optionally, the network configuration information in the host operating system includes at least one of the following: first configuration information; second configuration information; and third configuration information. The first configuration information is used to indicate the network access control method of the host machine; the second configuration information is used to indicate the traffic forwarding method of the virtualization switch; and the third configuration information is used to indicate that external network interfaces should not be allocated to the business confidential virtual machine.

[0011] Optionally, the network configuration information inside the business confidential virtual machine includes at least one of the following: fourth configuration information; fifth configuration information; sixth configuration information; seventh configuration information; The fourth configuration information is used to instruct the removal of the network driver module in the operating system kernel; the fifth configuration information is used to instruct the disabling of the virtual network card driver; the sixth configuration information is used to instruct the deletion of network protocol stack-related components; and the seventh configuration information is used to instruct the prohibition of loading external network device drivers.

[0012] Optionally, when both the business confidential virtual machine and the network proxy confidential virtual machine are started, sending business data to the business confidential virtual machine through the network proxy confidential virtual machine includes: When both the business confidential virtual machine and the network proxy confidential virtual machine are started, the trustworthiness of the business confidential virtual machine is verified to obtain a first verification result, and the trustworthiness of the network proxy confidential virtual machine is verified to obtain a second verification result. If both the first verification result and the second verification result are credible, the business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine.

[0013] Optionally, the step of performing trustworthiness verification on the business confidential virtual machine to obtain a first verification result includes: Obtain first remote authentication information of the business confidential virtual machine; wherein, the first remote authentication information includes: first metric information of the business confidential virtual machine and a first hardware signature of the first metric information; The first hardware signature is verified, and if the verification result of the first hardware signature is true, the first running metric information during the operation of the business secret virtual machine is obtained. If the first metric information is the same as the first runtime metric information, the first verification result of the business secret virtual machine is determined to be that the business secret virtual machine is trustworthy.

[0014] Optionally, the first metric information includes at least one of the following: a first operating system kernel hash value; a first initialization image hash value; and a first boot configuration parameter hash value. The first runtime metric information includes at least one of the following: a second operating system kernel hash value; a second initialization image hash value; and a second startup configuration parameter hash value. Wherein, the second operating system kernel hash value is obtained by hashing the operating system kernel file; the second initialization image hash value is obtained by hashing the initialization image; and the second startup configuration parameter hash value is obtained by hashing the configuration parameters passed when the business secret virtual machine starts.

[0015] Optionally, the step of performing trustworthiness verification on the network agent confidential virtual machine to obtain a second verification result includes: Obtain the second remote authentication information of the network proxy confidential virtual machine; wherein, the second remote authentication information includes: the second metric information of the network proxy confidential virtual machine and the second hardware signature of the second metric information; The second hardware signature is verified, and if the verification result of the second hardware signature is true, the second runtime metric information during the operation of the network agent confidential virtual machine is obtained; If the second runtime metric information is the same as the second metric information, the second verification result of the network agent confidential virtual machine is determined to be that the network agent confidential virtual machine is trustworthy.

[0016] Optionally, the second metric information includes at least one of the following: a first virtual machine image hash value; a first virtual machine kernel image hash value; a first network agent binary file hash value; and a third startup configuration parameter hash value. The second runtime metric information includes at least one of the following: a second virtual machine image hash value; a second virtual machine kernel image hash value; a second network agent binary file hash value; and a fourth startup configuration parameter hash value. Wherein, the hash value of the second virtual machine image is obtained by hashing the complete disk image file of the network agent confidential virtual machine; the hash value of the second virtual machine kernel image is obtained by hashing the kernel file of the operating system of the network agent confidential virtual machine; the hash value of the second network agent program binary file is obtained by hashing the executable file of the network agent program; and the hash value of the fourth startup configuration parameter is obtained by hashing the command line parameters passed to the kernel when the network agent confidential virtual machine starts.

[0017] Secondly, embodiments of this application provide a data processing apparatus, including: The sending module is used to send a service request message to the second electronic device. The service request message is used to instruct the second electronic device to start a service confidential virtual machine and a network proxy confidential virtual machine corresponding to the service request message. The code running in the service confidential virtual machine is closed source code, and the code running in the network proxy confidential virtual machine is open source code. The processing module is configured to send business data to the business confidential virtual machine via the network proxy confidential virtual machine when both the business confidential virtual machine and the network proxy confidential virtual machine are started. A receiving module is configured to receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine; the response data is generated by the business confidential virtual machine based on the business data.

[0018] Optionally, the processing module is further configured to: A communication channel for business data transmission is established between the network agent confidential virtual machine and the business confidential virtual machine; The communication channel is used to send the service data from the network proxy confidential virtual machine to the service confidential virtual machine, and to send the response data from the service confidential virtual machine to the network proxy confidential virtual machine.

[0019] Optionally, when the processing module sends business data to the business confidential virtual machine through the network proxy confidential virtual machine, it is specifically used for: When the network configuration information indicates that the data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, the business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine; When the receiving module receives response data sent by the business confidential virtual machine through the network proxy confidential virtual machine, it is specifically used for: If the network configuration information indicates that data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, then receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine.

[0020] Thirdly, embodiments of this application provide an electronic device including a processor and a memory, wherein the memory stores a program or instructions executable on the processor, and the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0021] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0022] Fifthly, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the method as described in the first aspect.

[0023] In a sixth aspect, embodiments of this application provide a computer program product stored in a storage medium, which is executed by at least one processor to implement the method described in the first aspect.

[0024] In this embodiment, a first electronic device sends a service request message to a second electronic device. This message instructs the second electronic device to launch a business confidential virtual machine (BVM) and a network proxy confidential virtual machine (BVM) corresponding to the service request message. The code running in the BVM is closed-source, while the code running in the BVM is open-source. With both BVMs running, service data is sent to the BVM via the BVM, causing the BVM to generate response data. The first electronic device then receives the response data sent by the BVM via the BVM. This solution, where the first electronic device does not preprocess the service data but directly sends it to the BVM via the BVM, and the closed-source BVM processes the data, not only protects the service data through the confidential computing capabilities of the second electronic device but also avoids the risk of business logic exposure due to open-source code. Furthermore, the completely open-source code in the BVM allows verification that the code running in the BVM is consistent with publicly available code, thus confirming whether the service data forwarding behavior is as expected, preventing malicious code tampering, and improving the security of service data during transmission and processing. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a data processing method provided in some embodiments of this application; Figure 2 This is an architecture diagram of a secure computing system provided by some embodiments of this application; Figure 3 This is a data flow diagram of a secure computing system provided in some embodiments of this application; Figure 4 This is a schematic flowchart illustrating the data processing method provided in some embodiments of this application; Figure 5 This is a schematic flowchart illustrating the data processing method provided in some embodiments of this application; Figure 6 These are schematic diagrams of the structure of a data processing apparatus provided in some embodiments of this application; Figure 7 These are structural block diagrams of electronic devices provided in some embodiments of this application; Figure 8 These are structural block diagrams of electronic devices provided in some embodiments of this application. Detailed Implementation

[0026] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0027] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0028] The data processing method provided in this application will be described below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0029] like Figure 1 As shown in the figure, this application embodiment provides a data processing method, executed by a first electronic device, which may specifically include the following steps: Step 101: Send a service request message to the second electronic device. The service request message is used to instruct the second electronic device to start the service confidential virtual machine and the network proxy confidential virtual machine corresponding to the service request message. The code running in the service confidential virtual machine is closed source code, and the code running in the network proxy confidential virtual machine is open source code.

[0030] Specifically, the first electronic device is a terminal-side device, and the second electronic device is one of the cloud devices in the cloud device cluster. Before sending a service request message, the first electronic device first establishes a secure communication channel with the gateway, for example, by establishing an encrypted secure communication connection through Transport Layer Security (TLS) encryption, device authentication, user authentication, or other secure transmission protocols. After establishing the secure communication channel, the first electronic device sends the service request message to the gateway. The gateway allocates cloud devices according to the load, service policy, data area policy, and service configuration policy in the cloud device cluster, and forwards the service request message to the allocated cloud device, which is the second electronic device. The cloud device cluster includes multiple cloud devices, and the cloud device allocated by the gateway is the second electronic device. The first electronic device, the gateway, and the cloud device cluster together constitute a secure computing system, the architecture of which is shown in the diagram below. Figure 2 As shown.

[0031] The second electronic device simultaneously deploys a business confidential virtual machine and a network proxy confidential virtual machine. The second electronic device starts the business confidential virtual machine and the network proxy confidential virtual machine corresponding to the business request message. These two virtual machines are isolated from each other and both run on hardware platforms that support confidential computing, including but not limited to: Intel Trust Domain eXtension (Intel TDX); AMD Secure Encrypted Virtualization - Secure Nested Paging (AMD SEV-SNP); and NVIDIA GPU Confidential Computing (GPU CC). Confidential computing technology ensures that virtual machine memory is invisible to the host operating system, invisible to the cloud administrator, and that virtual machines have hardware-level isolation capabilities.

[0032] The Business Secrets Virtual Machine (BVM) is used to execute business data processing logic, such as large model inference, business data analysis, recommender system calculations, task generation and processing, etc. To protect the confidentiality of the business data provider, the business code in this BVM can remain closed-source, avoiding the risk of business logic exposure due to open-source code. The Network Proxy Secrets Virtual Machine (NVM) differs from the BVM; its code is completely open-source, allowing for auditing and verification of its logic. This ensures that the NVM does not send business data to unauthorized third parties, thus controlling all data outflows.

[0033] In some optional embodiments of this application, the second electronic device includes one network agent confidential virtual machine and N business confidential virtual machines, where N is an integer greater than or equal to 1.

[0034] In some optional embodiments of this application, each cloud device includes N network proxy confidential virtual machines and N business confidential virtual machines. Deploying multiple network proxy confidential virtual machines in the cloud device can achieve load balancing and disaster recovery.

[0035] Step 102: If both the business confidential virtual machine and the network proxy confidential virtual machine are started, send the business data to the business confidential virtual machine through the network proxy confidential virtual machine.

[0036] Specifically, such as Figure 2 and Figure 3 As shown, if both the business confidential virtual machine 25 and the network proxy confidential virtual machine 24 of the second electronic device 23 are started, the first electronic device 21 sends business data to the second electronic device 23 through the gateway 22. The second electronic device 23 receives the business data through the network proxy confidential virtual machine 24 and forwards the business data to the business confidential virtual machine 25.

[0037] In some optional embodiments of this application, when a user needs to process an image, the business data is the image to be processed. When a user needs to summarize document content, the business data is the document to be processed.

[0038] Step 103: Receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine; the response data is generated by the business confidential virtual machine based on the business data.

[0039] Specifically, after receiving business data, the business confidential virtual machine processes the business data to obtain response data, and sends the response data to the network proxy confidential virtual machine. The network proxy confidential virtual machine then feeds back the response data to the first electronic device via the gateway.

[0040] In some optional embodiments of this application, the business data is an image to be processed, and the response data is the processed image. If the business data is a document to be processed, then the response data is the processed document.

[0041] Deploy the network agent program and traffic control engine within the network agent confidential virtual machine. The network agent program is responsible for: receiving response data from the business confidential virtual machine, parsing network protocol headers, and submitting the response data to the traffic control engine for analysis according to preset data security rules.

[0042] The network agent confidential virtual machine verifies all response data from the business confidential virtual machine. The verification method includes at least one of the following: whether the destination address of the response data is valid; whether the response data contains sensitive user data; and whether the response data complies with user authorization.

[0043] The identification methods for whether the response data contains sensitive user data include, but are not limited to: regular expression matching, Named Entity Recognition (NER) detection, and Data Loss Prevention (DLP) scanning.

[0044] The response data does not conform to the user authorization judgment method, including at least one of the following: the IP address to be accessed by the response data is not in the list of allowed target IPs; the response data is a sensitive data type that is prohibited from being sent out; the data traffic of the response data is greater than or equal to the data traffic rate threshold; the IP address of the response data is inconsistent with the IP address of the first electronic device that sent the business data.

[0045] In some specific examples of this application, the range of data traffic rate threshold values ​​is set according to business needs. For example, the data traffic rate threshold for text is 512KB / s.

[0046] If the response data verification is successful, the network agent confidential virtual machine allows the response data to be sent to the external network; if the response data verification fails, the transmission of the response data to the external network is blocked, a security log is recorded, and the violation event is reported to the monitoring system. Furthermore, auditable network traffic logs can be generated simultaneously.

[0047] In some optional embodiments of this application, a first-level proxy is set up, namely, a network proxy confidential virtual machine that is not only responsible for general network filtering, but also for business-specific de-identification logic.

[0048] In some optional embodiments of this application, a two-level proxy is set up, namely, the network proxy confidential virtual machine is responsible for general network filtering, and the sensitive confidential virtual machine is responsible for business-specific de-identification logic. The de-identification function and the network filtering function are deployed in different virtual machines to adapt to the differentiated needs of different businesses for de-identification function.

[0049] In the above embodiments of this application, the first electronic device does not preprocess the business data, but directly sends the business data to the business confidential virtual machine via the network proxy confidential virtual machine of the second electronic device. The business confidential virtual machine, with its closed-source code, then processes the business data. This not only protects the business data through the confidential computing capabilities of the second electronic device, but also avoids the risk of business logic exposure due to open-source business code. Furthermore, the code in the network proxy confidential virtual machine is completely open-source, which can be used to verify whether the code running in the network proxy confidential virtual machine is consistent with the publicly available code, thereby confirming whether its business data forwarding behavior is as expected, preventing malicious code tampering, and improving the security of business data during transmission and processing.

[0050] In some optional embodiments of this application, before sending the service request message to the second electronic device in step 101, the method further includes: A communication channel for business data transmission is established between the network agent confidential virtual machine and the business confidential virtual machine; The communication channel is used to send the service data from the network proxy confidential virtual machine to the service confidential virtual machine, and to send the response data from the service confidential virtual machine to the network proxy confidential virtual machine.

[0051] Specifically, before the first electronic device sends a service request message to the second electronic device, an internal communication channel is established between the network proxy confidential virtual machine and the service confidential virtual machine. This communication channel is used to send service data from the network proxy confidential virtual machine to the service confidential virtual machine and to send response data from the service confidential virtual machine to the network proxy confidential virtual machine. This communication channel is internal communication for the second electronic device and does not have the ability to access the external network. This communication channel may include, but is not limited to: virtio-vsock; virtual network interface (virtio-net internal bridge); shared memory communication; and inter-process communication (IPC) channels between containers.

[0052] Among them, virtio-vsock is a socket communication mechanism based on the semi-virtualization framework virtio, used for efficient and secure data transmission between virtual machines and the host machine.

[0053] The network agent confidential virtual machine is used to perform at least one of the following functions: Access the physical network card of the second electronic device; receive the service request message from the first electronic device; forward the service request message to the corresponding business confidential virtual machine through the internal communication channel of the second electronic device; receive the response data returned by the business confidential virtual machine; perform security verification on the response data, and return the verified response data to the first electronic device.

[0054] The above embodiments, by controlling the flow of data from all business confidential virtual machines, can protect the confidentiality of business code while ensuring that business data is not illegally transmitted to external networks.

[0055] In some optional embodiments of this application, step 102, which sends the business data to the business confidential virtual machine via the network proxy confidential virtual machine, includes: If the network configuration information indicates that the data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, the business data will be sent to the business confidential virtual machine through the network proxy confidential virtual machine. The receipt of response data sent by the business confidential virtual machine through the network proxy confidential virtual machine includes: If the network configuration information indicates that data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, then receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine.

[0056] Specifically, after the business confidential virtual machine and the network proxy confidential virtual machine in the second electronic device are started and the internal communication channel between the business confidential virtual machine and the network proxy confidential virtual machine is successfully connected, network configuration information is obtained. If the network configuration information indicates that the data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, then the business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine, and the business confidential virtual machine processes the business data to obtain response data. If the network configuration information indicates that the data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, then the response data sent by the business confidential virtual machine through the network proxy confidential virtual machine is received.

[0057] The aforementioned network configuration information specifies the network access permissions for the business confidential virtual machine and the network proxy confidential virtual machine. This ensures that all network communication of the business confidential virtual machine must pass through the network proxy confidential virtual machine. In other words, the external network communication capabilities of the business confidential virtual machine are separated from the business processing environment and centrally deployed in a verifiable network proxy confidential virtual machine. This network proxy confidential virtual machine serves as the only confidential computing environment within the second electronic device with external network communication capabilities. The business confidential virtual machine can only exchange data with other virtual machines through the internal communication channels of the second electronic device.

[0058] The above embodiments, by controlling the flow of data for all business confidential virtual machines through network configuration information, can protect the confidentiality of business code while ensuring that business data is not illegally transmitted to external networks.

[0059] In some optional embodiments of this application, the network configuration information includes, but is not limited to, at least one of the following: network configuration information in the host operating system; and network configuration information inside the business confidential virtual machine.

[0060] Specifically, in order to prevent the business confidential virtual machine from directly sending data to the external network, the network communication function and business processing logic of the business confidential virtual machine deployed in the second electronic device are structurally separated. The operating system of the business confidential virtual machine is modified by at least one of the network configuration information in the host operating system and the network configuration information inside the business confidential virtual machine, so that the business confidential virtual machine cannot establish an external network connection, that is, the business confidential virtual machine cannot directly access the external network.

[0061] In some specific examples of this application, the network configuration information includes network configuration information in the host operating system. Alternatively, the network configuration information includes network configuration information inside the business confidential virtual machine. Or, the network configuration information includes both network configuration information in the host operating system and network configuration information inside the business confidential virtual machine.

[0062] In some optional embodiments of this application, the network configuration information in the host operating system includes, but is not limited to, at least one of the following: first configuration information; second configuration information; third configuration information; The first configuration information is used to indicate the network access control method of the host machine; the second configuration information is used to indicate the traffic forwarding method of the virtualization switch; and the third configuration information is used to indicate that external network interfaces should not be allocated to the business confidential virtual machine.

[0063] Specifically, the first configuration information is used to indicate the network access control method of the host machine. The network access control method is specifically iptables rules. The iptables rules cause all network traffic from the business confidential virtual machine to be blocked and redirected to the network proxy confidential virtual machine.

[0064] In some specific examples of this application, the host machine can use iptables or a similar firewall mechanism to control network access to the virtual interface corresponding to the virtual machine's network adapter. For example, if the virtual machine accesses the network through the tap0 virtual network adapter on the host machine, the initial configuration information can indicate that the virtual machine is allowed to access the 10.0.0.0 / 8 internal network address, but is prohibited from accessing other addresses. In this way, network access control occurs on the host machine's network forwarding path.

[0065] The second configuration information is used to indicate the traffic forwarding method of the virtualization switch. Specifically, the traffic forwarding method is the OpenvSwitch traffic policy, which causes all network traffic from the business confidential virtual machine to be blocked and redirected to the network proxy confidential virtual machine.

[0066] In some specific examples of this application, the virtualized switch is a programmable virtual switch, OpenvSwitch, and the second configuration information can indicate a more granular traffic forwarding method. For example, the second configuration information indicates that Transmission Control Protocol (TCP) traffic from VM-A virtual machine, with a destination address of 10.0.0.20 and a destination port of 443, should be forwarded to the virtual port corresponding to the security detection virtual machine; other traffic should be forwarded to the external network.

[0067] In some specific examples of this application, the virtualization switch forwards traffic based on Layer 2 Media Access Control (MAC) addresses or Virtual Local Area Network (VLAN) addresses. For example, if a virtualization switch br0 is located on the host machine and connects multiple virtual machine network cards, the second configuration information can instruct the virtualization switch to forward traffic from virtual machine VM-A to the virtual port corresponding to virtual machine VM-B, or to the physical network card, based on the destination MAC address and VLAN identifier.

[0068] The third configuration information is used to instruct that external network interfaces be prohibited from being allocated to the confidential business virtual machine, so that all network traffic from the confidential business virtual machine is blocked and redirected to the network proxy confidential business virtual machine. The third configuration information isolates the confidential business virtual machine from the external network exposure surface, that is, the confidential business virtual machine can have no physical network card mapping, no external virtual port, no public IP, and cannot be bound to a virtual switch that can access the external network.

[0069] In some specific examples of this application, it is assumed that two virtual networks exist on the host machine: br-public and br-private. br-public connects to the physical network interface card eth0 and can access external networks or the Internet; br-private is used only within the host machine and does not connect to external networks. Ordinary virtual machines can connect to br-public, but business-secret virtual machines can only connect to the internal network, or are not assigned an external network interface. That is, they are prohibited from being assigned a virtual network interface card to connect to br-public, or from being assigned a network interface card that passes through to the physical network interface card eth0, or from being bound to a public IP address, or are allowed to be assigned a private virtual network interface card that is only visible within the host machine, or are not assigned a network interface at all.

[0070] In some specific examples of this application, it is prohibited to allocate Single Root I / O Virtualization (SR-IOV) or Peripheral Component Interconnect express (PCIe) passthrough to external network cards for business-secret virtual machines. In some high-performance virtualization scenarios, the host machine directly assigns the Virtual Function (VF) of the physical network card to the virtual machine, allowing the virtual machine to bypass part of the host network stack and directly access the external network. However, third-party configuration information can instruct that SR-IOV VF allocation be prohibited, PCIe passthrough to the physical network card be prohibited, external network port binding be prohibited, and communication with the host agent be allowed only through controlled internal communication channels.

[0071] In some specific examples of this application, the network configuration information in the host operating system includes first configuration information. Alternatively, the network configuration information in the host operating system includes second configuration information. Alternatively, the network configuration information in the host operating system includes third configuration information. Alternatively, the network configuration information in the host operating system includes both first and second configuration information. Alternatively, the network configuration information in the host operating system includes both first and third configuration information. Alternatively, the network configuration information in the host operating system includes both second and third configuration information. Alternatively, the network configuration information in the host operating system includes first, second, and third configuration information.

[0072] In some optional embodiments of this application, the network configuration information inside the business confidential virtual machine includes, but is not limited to, at least one of the following: fourth configuration information; fifth configuration information; sixth configuration information; seventh configuration information; The fourth configuration information is used to instruct the removal of the network driver module in the operating system kernel; the fifth configuration information is used to instruct the disabling of the virtual network card driver; the sixth configuration information is used to instruct the deletion of network protocol stack-related components; and the seventh configuration information is used to instruct the prohibition of loading external network device drivers.

[0073] Specifically, the fourth configuration information is used to instruct the removal of network driver modules from the operating system kernel, so that the confidential business virtual machine cannot directly access the external network. The fourth configuration information prevents the confidential business virtual machine from loading drivers for certain network devices at the operating system level, thus preventing the formation of a usable network interface.

[0074] In some specific examples of this application, the virtio-net driver is removed from the kernel of a business-secret virtual machine, or the virtio network driver (CONFIG_VIRTIO_NET) is disabled when the kernel is built, or the virtio_net driver is prevented from being loaded at startup.

[0075] In some specific examples of this application, if the host machine supports PCIe passthrough or SR-IOV, the virtual machine may be assigned to a physical network card or virtual function device. The fourth configuration information instructs the business confidential virtual machine to remove network driver modules such as ixgbe.ko, i40e.ko, ice.ko, mlx5_core.ko, and ena.ko; or disable the corresponding driver in the kernel configuration; or delete the corresponding .ko kernel file from the initial memory file system (initramfs) or root file system (rootfs); or configure a module blacklist to prevent these modules from being loaded automatically.

[0076] The fifth configuration message instructs that the virtual network adapter driver be disabled so that confidential business virtual machines cannot directly access the external network. The fifth configuration message does not remove the driver from the kernel or image; rather, it makes the driver exist but unusable, unloadable, or uninitializable.

[0077] In some specific examples of this application, the fifth configuration information may instruct the business confidential virtual machine to prevent the loading of the virtio_net driver; or even if virtio_net.ko exists in the system image, it may not be allowed to be loaded automatically; or virtual network interface cards such as eth0 and ens3 may not be generated after startup.

[0078] In some specific examples of this application, in certain scenarios, the virtual network interface driver may have been compiled into the kernel, or the system may want to prevent the driver file from being deleted but disable its operation during the startup phase. The fifth configuration information can be used to instruct the system to disable virtual network interface driver initialization via boot parameters or kernel configuration; or to prevent the virtual network interface driver from initializing during startup; or to prevent the virtual network interface from being automatically started; or to prevent the virtual network interface from participating in DHCP, routing configuration, or network namespace configuration. For example, for systemd-based Linux systems, automatic configuration of network interfaces can be disabled.

[0079] The sixth configuration information is used to instruct the removal of network protocol stack-related components, preventing confidential virtual machines from directly accessing external networks. This sixth configuration information trims the operating system image or kernel of the confidential virtual machine, depriving it of the protocol processing or network configuration capabilities required for network communication.

[0080] In some specific examples of this application, a typical operating system typically includes protocol processing components such as IPv4, IPv6, TCP, UDP, and ICMP. The sixth configuration information can instruct the removal or disabling of these protocol stack components when building a business-secret virtual machine image.

[0081] In some specific examples of this application, network communication relies not only on the kernel protocol stack but also on user-space network configuration components. For example, Dynamic Host Configuration Protocol (DHCP) clients, Domain Name System (DNS) resolution components, routing configuration tools, and network management services can be instructed via the sixth configuration information to remove the DHCP client from the business-secret virtual machine operating system, or to remove the DNS resolver configuration; or to remove network configuration tools such as the Linux network configuration toolset (iproute2), network interface configuration commands (ifconfig), and routing table configuration commands (route); or to remove the NetworkManager or systemd network daemon (systemd-networkd); or to remove the automatic routing table configuration component.

[0082] The seventh configuration information is used to indicate that external network device drivers should not be loaded, so that business confidential virtual machines cannot directly access external networks.

[0083] In some specific examples of this application, it is assumed that the host machine supports PCIe device passthrough, which theoretically allows the allocation of physical network cards or SR-IOV virtual function devices to virtual machines. The seventh configuration information can be used to indicate that loading drivers for physical network cards such as ICE, IXGBE, i40E, mlx5_core, and ena is prohibited.

[0084] In some specific examples of this application, the external network device is not necessarily a PCIe network card, but may also be a USB network card, USB Wi-Fi, cellular network module, etc. The seventh configuration information can instruct the business confidential virtual machine to disable loading the USB wired network card driver; or disable loading the Wi-Fi network card driver; or disable loading the cellular network module driver; or disable loading the external network adapter related drivers.

[0085] In some specific examples of this application, the network configuration information inside the confidential virtual machine includes fourth configuration information. Alternatively, the network configuration information in the host operating system includes fifth configuration information. Alternatively, the network configuration information in the host operating system includes sixth configuration information. The network configuration information inside the confidential virtual machine includes seventh configuration information. The network configuration information inside the confidential virtual machine includes both fourth and fifth configuration information. Alternatively, the network configuration information inside the confidential virtual machine includes both fourth and sixth configuration information. Alternatively, the network configuration information inside the confidential virtual machine includes both fourth and seventh configuration information. Alternatively, the network configuration information inside the confidential virtual machine includes fourth, fifth, and sixth configuration information. Alternatively, the network configuration information inside the confidential virtual machine includes fourth, fifth, and seventh configuration information. Alternatively, the network configuration information inside the confidential virtual machine includes fourth, fifth, sixth, and seventh configuration information. Alternatively, the network configuration information inside the confidential virtual machine includes both fifth and sixth configuration information. Alternatively, the network configuration information inside the confidential virtual machine includes both fifth and seventh configuration information. Alternatively, the network configuration information inside the confidential virtual machine includes both fifth, sixth, and seventh configuration information. Alternatively, the network configuration information inside the business-secret virtual machine includes the sixth and seventh configuration information.

[0086] In some specific examples of this application, the network configuration information inside the business-secret virtual machine includes fourth and fifth configuration information. Specifically, the network configuration information inside the business-secret virtual machine instructs the removal of the CONFIG_NET network driver module from the operating system kernel, and the disabling of semi-virtual network interface card (NIC) drivers such as virtio-net or e1000, or fully virtual NIC drivers, to implement the network stack configuration of the business-secret virtual machine. CONFIG_NET is a compilation configuration option in the operating system kernel used to enable the network subsystem.

[0087] In some optional embodiments of this application, the network configuration information inside the business confidential virtual machine is solidified into the operating system image by customizing the business confidential virtual machine image, thereby ensuring that all deployed business confidential virtual machines have the same network configuration information.

[0088] In some optional embodiments of this application, step 102, when both the business confidential virtual machine and the network proxy confidential virtual machine are started, involves sending business data to the business confidential virtual machine through the network proxy confidential virtual machine, specifically including steps 1021 and 1022: Step 1021: With both the business confidential virtual machine and the network proxy confidential virtual machine running, perform a trustworthiness verification on the business confidential virtual machine to obtain a first verification result, and perform a trustworthiness verification on the network proxy confidential virtual machine to obtain a second verification result; Step 1022: If both the first verification result and the second verification result are credible, the business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine.

[0089] Specifically, such as Figure 2 As shown, the second electronic device includes a hardware confidential computing platform 26, which refers to a chip capable of providing confidential computing hardware capabilities. The business confidential virtual machine 25 needs to verify the trustworthiness of its network communication capabilities through the remote attestation mechanism provided by the hardware confidential computing platform 26, thereby confirming whether the business confidential virtual machine 25 has the ability to directly access external networks. If the first verification result indicates that the business confidential virtual machine is trustworthy, then it is confirmed that the business confidential virtual machine 25 does not have the ability to directly access external networks.

[0090] like Figure 2 As shown, to ensure that the network proxy confidential virtual machine 24 does not illegally forward business data, the remote authentication mechanism of the confidential computing hardware platform 26 is needed to verify the trustworthiness of the running code in the network proxy confidential virtual machine 24, thereby confirming whether business data will be illegally sent to the external network. If the second verification result indicates that the network proxy confidential virtual machine is trustworthy, then the network proxy confidential virtual machine 24 is in a trustworthy state, meaning that business data will not be illegally sent to the external network.

[0091] If both the first and second verification results are trustworthy, it means that both the business confidential virtual machine and the network proxy confidential virtual machine are in a trustworthy state. Then, the first electronic device will send the business data to the business confidential virtual machine via the network proxy confidential virtual machine for data processing.

[0092] In some optional embodiments of this application, step 1021 performs a trustworthiness verification on the business confidential virtual machine to obtain a first verification result, including: Obtain first remote authentication information of the business confidential virtual machine; wherein, the first remote authentication information includes: first metric information of the business confidential virtual machine and a first hardware signature of the first metric information; The first hardware signature is verified, and if the verification result of the first hardware signature is true, the first running metric information during the operation of the business secret virtual machine is obtained. If the first metric information is the same as the first runtime metric information, the first verification result of the business secret virtual machine is determined to be that the business secret virtual machine is trustworthy.

[0093] Specifically, the second electronic device signs the first measurement information of the confidential virtual machine through the CPU security module or Trusted Platform Module (TPM) of the confidential computing hardware platform, and provides the first remote authentication information to the first electronic device or a third-party device. The first remote authentication information includes, but is not limited to: the first measurement information, the first hardware signature of the first measurement information, and the first platform certificate chain. The first electronic device can verify whether the confidential virtual machine has the ability to directly access the external network through the first remote authentication information.

[0094] The verification method for whether virtual machines containing business secrets have the ability to directly access external networks is explained: The first hardware signature is verified. If the verification result of the first hardware signature is true, the first running measurement information during the operation of the business confidential virtual machine is obtained and compared with the first measurement information. If the first running measurement information is the same as the first measurement information, it can be confirmed that the business confidential virtual machine does not have the ability to directly access the external network, that is, the business confidential virtual machine is trustworthy.

[0095] In some specific examples of this application, the first running metric information is the hash value calculated on the file to be metric using a hash algorithm such as sha256, for example: f2b3c9a4e6d8f1a0b7c5d2e9f4a8b6c1d3e7f0a9b2c4d6e8f1a3b5c7d9e0f2a4.

[0096] In some optional embodiments of this application, the first measurement information includes, but is not limited to, at least one of the following: a first operating system kernel hash value; a first initialization image hash value; and a first boot configuration parameter hash value. The first runtime metric information includes at least one of the following: a second operating system kernel hash value; a second initialization image hash value; and a second startup configuration parameter hash value. The second operating system kernel hash value is obtained by hashing the operating system kernel file; the second initialization image hash value is obtained by hashing the initialization image; and the second startup configuration parameter hash value is obtained by hashing the configuration parameters passed when the business secret virtual machine starts.

[0097] Specifically, the second electronic device measures the boot image of the business confidential virtual machine through a confidential computing hardware platform to obtain first measurement information, which includes, but is not limited to, at least one of the following: first operating system kernel hash value; first initialization image hash value; first boot configuration parameter hash value.

[0098] The second operating system kernel hash value in the first runtime metric information refers to the hash value obtained by hashing the operating system kernel file using hash algorithms such as SHA256. The second initialization image hash value in the first runtime metric information refers to the hash value obtained by hashing the initialization image using hash algorithms such as SHA256. The second startup configuration parameter hash value in the first runtime metric information refers to the hash value obtained by hashing the configuration parameters passed when the business confidential virtual machine starts using hash algorithms such as SHA256.

[0099] In the above embodiments, by comparing whether the first metric information is the same as the first operational metric information, it is determined whether the business confidential virtual machine is trustworthy, and thus it can be verified whether the business confidential virtual machine has the ability to directly access the external network.

[0100] In some optional embodiments of this application, step 1021 verifies the trustworthiness of the network proxy confidential virtual machine to obtain a second verification result, including: Obtain the second remote authentication information of the network proxy confidential virtual machine; wherein, the second remote authentication information includes: the second metric information of the network proxy confidential virtual machine and the second hardware signature of the second metric information; The second hardware signature is verified, and if the verification result of the second hardware signature is true, the second runtime metric information during the operation of the network agent confidential virtual machine is obtained; If the second runtime metric information is the same as the second metric information, the second verification result of the network agent confidential virtual machine is determined to be that the network agent confidential virtual machine is trustworthy.

[0101] Specifically, the second electronic device signs the second metric information of the network proxy confidential virtual machine through a confidential computing hardware platform and provides second remote authentication information to the first electronic device or a third-party device. The second remote authentication information includes, but is not limited to, the second metric information, a second hardware signature of the second metric information, and a second platform certificate chain. The first electronic device can verify whether the network proxy confidential virtual machine is consistent with the public code through the second remote authentication information.

[0102] In some specific examples of this application, the second runtime metric information is the hash value calculated on the file to be metric using a hash algorithm such as sha256, for example: f2b3c9a4e6d8f1a0b7c5d2e9f4a8b6c1d3e7f0a9b2c4d6e8f1a3b5c7d9e0f2a4.

[0103] In some specific examples of this application, the verification method for whether the network proxy confidential virtual machine is consistent with the public code is described as follows: the second hardware signature is verified. If the verification result of the second hardware signature is true, the second running metric information during the operation of the network proxy confidential virtual machine is obtained, and the second running metric information is compared with the second metric information. If the second running metric information is the same as the second metric information, it can be confirmed that the code running by the network proxy confidential virtual machine is consistent with the public code, the network proxy confidential virtual machine has not been tampered with, the network proxy confidential virtual machine will not send business data to unauthorized third-party devices, and the traffic control method inside the network proxy confidential virtual machine conforms to the public specification.

[0104] In some optional embodiments of this application, the second measurement information includes at least one of the following: a first virtual machine image hash value; a first virtual machine kernel image hash value; a first network agent binary file hash value; and a third startup configuration parameter hash value. The second runtime metric information includes at least one of the following: a second virtual machine image hash value; a second virtual machine kernel image hash value; a second network agent binary file hash value; and a fourth startup configuration parameter hash value. Wherein, the hash value of the second virtual machine image is obtained by hashing the complete disk image file of the network agent confidential virtual machine; the hash value of the second virtual machine kernel image is obtained by hashing the kernel file of the operating system of the network agent confidential virtual machine; the hash value of the second network agent program binary file is obtained by hashing the executable file of the network agent program; and the hash value of the fourth startup configuration parameter is obtained by hashing the command line parameters passed to the kernel when the network agent confidential virtual machine starts.

[0105] Specifically, the second electronic device performs a hash calculation on the system image of the network agent confidential virtual machine through a confidential computing hardware platform to obtain second metric information. The second metric information includes, but is not limited to, at least one of the following: the hash value of the first virtual machine kernel image; the hash value of the first network agent program binary file; and the hash value of the third startup configuration parameters.

[0106] The second virtual machine image hash value in the second runtime metrics refers to the hash value obtained by hashing the complete disk image file of the network agent confidential virtual machine using hash algorithms such as SHA256. The second virtual machine kernel image hash value in the second runtime metrics refers to the hash value obtained by hashing the kernel file of the network agent confidential virtual machine operating system using hash algorithms such as SHA256. The second network agent program binary file hash value in the second runtime metrics refers to the hash value obtained by hashing the executable file of the network agent program using hash algorithms such as SHA256. The fourth startup configuration parameter hash value in the second runtime metrics refers to the hash value obtained by hashing the command-line parameters passed to the kernel when the network agent confidential virtual machine starts using hash algorithms such as SHA256.

[0107] In the above embodiments, by comparing whether the second metric information is the same as the second operational metric information, it is determined whether the network agent confidential virtual machine is trustworthy, and thus it can be verified whether the network agent confidential virtual machine has not been tampered with and whether it will send business data to unauthorized third-party devices.

[0108] In some optional embodiments of this application, the network proxy confidential virtual machine may use a Merkle tree or an append-only log to record auditable logs to prevent log content from being tampered with. Based on the auditable logs recorded by the network proxy confidential virtual machine, the data flow in the second electronic device can be audited and verified to confirm whether business data has been forwarded to unauthorized third-party devices.

[0109] The log types include, but are not limited to: communication logs of all business confidential virtual machines; all outgoing data forwarding logs; and matching logs of control traffic methods.

[0110] The log content includes, but is not limited to: time, source virtual machine (VM), destination address, and data summary.

[0111] In some optional embodiments of this application, the auditable logs recorded by the network agent confidential virtual machine are encrypted and sent to the blockchain to achieve tamper-proof audit trails.

[0112] like Figure 4 As shown, the data processing process of the first electronic device and the second electronic device described above will be explained below through a specific embodiment: Step 401: Establish a communication channel for business data transmission between the network agent confidential virtual machine and the business confidential virtual machine.

[0113] Step 402: Obtain network configuration information, which indicates that data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine.

[0114] Step 403: The first electronic device sends a service request message to the second electronic device, and the second electronic device starts the service confidential virtual machine and the network proxy confidential virtual machine corresponding to the service request message.

[0115] Step 404: With both the business confidential virtual machine and the network proxy confidential virtual machine running, the first electronic device verifies the trustworthiness of the network communication capability of the business confidential virtual machine through the hardware confidential computing platform to confirm whether the business confidential virtual machine has the ability to directly access the external network, and verifies the trustworthiness of the running code in the network proxy confidential virtual machine through the hardware confidential computing platform to confirm whether business data will be illegally sent to the external network.

[0116] Step 405: If both the business confidential virtual machine and the network proxy confidential virtual machine are trusted, the first electronic device sends business data to the business confidential virtual machine through the network proxy confidential virtual machine.

[0117] Step 406: The business confidential virtual machine generates response data based on the business data and returns the response data to the first electronic device through the network proxy confidential virtual machine.

[0118] Step 407: The network agent confidential virtual machine records auditable logs. The first electronic device audits and verifies the data flow in the second electronic device based on the auditable logs recorded by the network agent confidential virtual machine to confirm whether business data is forwarded to unauthorized third-party devices.

[0119] like Figure 5 As shown, the data processing process of the above-mentioned secure computing system will be described below through a specific embodiment: Step 501: The first electronic device establishes a secure communication channel with the gateway.

[0120] Step 502: The first electronic device sends a service request message to the gateway.

[0121] Step 503: The gateway allocates cloud devices based on the load, service policy, data area policy, and business configuration policy in the cloud device cluster, and forwards the business request message to the allocated cloud device, i.e., the second electronic device.

[0122] Step 504: The second electronic device starts the business confidential virtual machine and the network proxy confidential virtual machine corresponding to the business request message. A communication channel for business data transmission is established between the network proxy confidential virtual machine and the business confidential virtual machine.

[0123] Step 505: Obtain network configuration information, which indicates that data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine.

[0124] Step 506: The first electronic device sends a service request message to the second electronic device, and the second electronic device starts the service confidential virtual machine and the network proxy confidential virtual machine corresponding to the service request message.

[0125] Step 507: With both the business confidential virtual machine and the network proxy confidential virtual machine running, the first electronic device verifies the trustworthiness of the network communication capabilities of the business confidential virtual machine through the hardware confidential computing platform to confirm whether the business confidential virtual machine has the ability to directly access the external network, and verifies the trustworthiness of the running code in the network proxy confidential virtual machine through the hardware confidential computing platform to confirm whether business data will be illegally sent to the external network.

[0126] Step 508: If both the business confidential virtual machine and the network proxy confidential virtual machine are trusted, the first electronic device sends business data to the business confidential virtual machine through the network proxy confidential virtual machine.

[0127] Step 509: The business confidential virtual machine generates response data based on the business data and returns the response data to the first electronic device through the network proxy confidential virtual machine.

[0128] Step 510: The network agent confidential virtual machine records auditable logs. The first electronic device audits and verifies the data flow in the second electronic device based on the auditable logs recorded by the network agent confidential virtual machine to confirm whether business data is forwarded to unauthorized third-party devices.

[0129] In summary, the embodiments described above in this application structurally separate network communication capabilities from business computing capabilities within a confidential computing environment. This achieves mandatory control and trustworthiness verification of the business data flow path without requiring the business code to be open-source. By combining a confidential computing environment with a remote verification mechanism, it can be proven that the network proxy confidential virtual machine runs publicly available and tamper-proof code. Simultaneously, the business confidential virtual machine lacks direct external communication capabilities; therefore, all data flow must pass through the network proxy virtual machine. This solution protects the confidentiality of the business data provider's code while achieving verifiable transparency of the business data flow, reducing the risk of unauthorized forwarding or leakage of business data during cloud processing, thereby enhancing user trust in the cloud data processing system. Furthermore, through a remote verification mechanism and tamper-proof audit logs, the data flow process becomes traceable and verifiable. Thus, without disclosing the business processing code, secure isolation, transparent verification, and continuous auditing capabilities are achieved during the cloud processing of business data, further enhancing the overall security, trustworthiness, and regulatory oversight of the system.

[0130] The data processing method provided in this application can be executed by a data processing device. This application uses an example of a data processing device executing the data processing method to illustrate the data processing device provided in this application.

[0131] like Figure 6 As shown in the figure, this application embodiment also provides a data processing device 600, specifically including: The sending module 601 is used to send a service request message to the second electronic device. The service request message is used to instruct the second electronic device to start a service confidential virtual machine and a network proxy confidential virtual machine corresponding to the service request message. The code running in the service confidential virtual machine is closed source code, and the code running in the network proxy confidential virtual machine is open source code. Processing module 602 is used to send business data to the business confidential virtual machine through the network proxy confidential virtual machine when both the business confidential virtual machine and the network proxy confidential virtual machine are started. The receiving module 603 is used to receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine; the response data is generated by the business confidential virtual machine based on the business data.

[0132] Optionally, the processing module 602 is further configured to: A communication channel for business data transmission is established between the network agent confidential virtual machine and the business confidential virtual machine; The communication channel is used to send the service data from the network proxy confidential virtual machine to the service confidential virtual machine, and to send the response data from the service confidential virtual machine to the network proxy confidential virtual machine.

[0133] Optionally, when the processing module 602 sends business data to the business confidential virtual machine through the network proxy confidential virtual machine, it is specifically used for: When the network configuration information indicates that the data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, the business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine; When receiving response data sent by the business confidential virtual machine through the network proxy confidential virtual machine, the receiving module 603 is specifically used for: If the network configuration information indicates that data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, then receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine.

[0134] Optionally, the network configuration information includes at least one of the following: Network configuration information in the host operating system; network configuration information inside the virtual machine containing the business secrets.

[0135] Optionally, the network configuration information in the host operating system includes at least one of the following: first configuration information; second configuration information; and third configuration information. The first configuration information is used to indicate the network access control method of the host machine; the second configuration information is used to indicate the traffic forwarding method of the virtualization switch; and the third configuration information is used to indicate that external network interfaces should not be allocated to the business confidential virtual machine.

[0136] Optionally, the network configuration information inside the business confidential virtual machine includes at least one of the following: fourth configuration information; fifth configuration information; sixth configuration information; seventh configuration information; The fourth configuration information is used to instruct the removal of the network driver module in the operating system kernel; the fifth configuration information is used to instruct the disabling of the virtual network card driver; the sixth configuration information is used to instruct the deletion of network protocol stack-related components; and the seventh configuration information is used to instruct the prohibition of loading external network device drivers.

[0137] Optionally, when the processing module 602 sends business data to the business confidential virtual machine through the network proxy confidential virtual machine, provided that both the business confidential virtual machine and the network proxy confidential virtual machine are started, it is specifically used for: When both the business confidential virtual machine and the network proxy confidential virtual machine are started, the trustworthiness of the business confidential virtual machine is verified to obtain a first verification result, and the trustworthiness of the network proxy confidential virtual machine is verified to obtain a second verification result. If both the first verification result and the second verification result are credible, the business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine.

[0138] Optionally, when the processing module 602 performs trustworthiness verification on the business confidential virtual machine and obtains a first verification result, it is specifically used for: Obtain first remote authentication information of the business confidential virtual machine; wherein, the first remote authentication information includes: first metric information of the business confidential virtual machine and a first hardware signature of the first metric information; The first hardware signature is verified, and if the verification result of the first hardware signature is true, the first running metric information during the operation of the business secret virtual machine is obtained. If the first metric information is the same as the first runtime metric information, the first verification result of the business secret virtual machine is determined to be that the business secret virtual machine is trustworthy.

[0139] Optionally, the first metric information includes at least one of the following: a first operating system kernel hash value; a first initialization image hash value; and a first boot configuration parameter hash value. The first runtime metric information includes at least one of the following: a second operating system kernel hash value; a second initialization image hash value; and a second startup configuration parameter hash value. Wherein, the second operating system kernel hash value is obtained by hashing the operating system kernel file; the second initialization image hash value is obtained by hashing the initialization image; and the second startup configuration parameter hash value is obtained by hashing the configuration parameters passed when the business secret virtual machine starts.

[0140] Optionally, when the processing module 602 performs trustworthiness verification on the network proxy confidential virtual machine and obtains a second verification result, it is specifically used for: Obtain the second remote authentication information of the network proxy confidential virtual machine; wherein, the second remote authentication information includes: the second metric information of the network proxy confidential virtual machine and the second hardware signature of the second metric information; The second hardware signature is verified, and if the verification result of the second hardware signature is true, the second runtime metric information during the operation of the network agent confidential virtual machine is obtained; If the second runtime metric information is the same as the second metric information, the second verification result of the network agent confidential virtual machine is determined to be that the network agent confidential virtual machine is trustworthy.

[0141] Optionally, the second metric information includes at least one of the following: a first virtual machine image hash value; a first virtual machine kernel image hash value; a first network agent binary file hash value; and a third startup configuration parameter hash value. The second runtime metric information includes at least one of the following: a second virtual machine image hash value; a second virtual machine kernel image hash value; a second network agent binary file hash value; and a fourth startup configuration parameter hash value. Wherein, the hash value of the second virtual machine image is obtained by hashing the complete disk image file of the network agent confidential virtual machine; the hash value of the second virtual machine kernel image is obtained by hashing the kernel file of the operating system of the network agent confidential virtual machine; the hash value of the second network agent program binary file is obtained by hashing the executable file of the network agent program; and the hash value of the fourth startup configuration parameter is obtained by hashing the command line parameters passed to the kernel when the network agent confidential virtual machine starts.

[0142] The data processing device in this application embodiment can be an electronic device or a component within an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal or other devices besides a terminal. For example, the electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc. It can also be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc. This application embodiment does not specifically limit the device.

[0143] The data processing device in this application embodiment can be a device with an operating system. The operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit the specific operating system.

[0144] The data processing device provided in this application embodiment can achieve... Figures 1 to 5 The various processes implemented in the method implementation examples will not be described again here to avoid repetition.

[0145] Optionally, such as Figure 7 As shown, this application embodiment also provides an electronic device 900, including a processor 901 and a memory 902. The memory 902 stores a program or instructions that can run on the processor 901. When the program or instructions are executed by the processor 901, they implement the various steps of the above-described data processing method embodiment and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0146] It should be noted that the electronic devices in the embodiments of this application include the mobile electronic devices and non-mobile electronic devices described above.

[0147] Figure 8 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of this application.

[0148] The electronic device 1000 includes, but is not limited to, components such as: radio frequency unit 1001, network module 1002, audio output unit 1003, input unit 1004, sensor 1005, display unit 1006, user input unit 1007, interface unit 1008, memory 1009, and processor 1010.

[0149] Those skilled in the art will understand that the electronic device 1000 may also include a power supply (such as a battery) for supplying power to various components. The power supply may be logically connected to the processor 1010 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system. Figure 8 The electronic device structure shown does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here.

[0150] The radio frequency unit 1001 is used to send a service request message to the second electronic device. The service request message is used to instruct the second electronic device to start a service confidential virtual machine and a network proxy confidential virtual machine corresponding to the service request message. The code running in the service confidential virtual machine is closed source code, and the code running in the network proxy confidential virtual machine is open source code. The processor 1010 is configured to send business data to the business confidential virtual machine via the network proxy confidential virtual machine when both the business confidential virtual machine and the network proxy confidential virtual machine are started. The radio frequency unit 1001 is further configured to receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine; the response data is generated by the business confidential virtual machine based on the business data.

[0151] Optionally, the processor 1010 is further configured to: A communication channel for business data transmission is established between the network agent confidential virtual machine and the business confidential virtual machine; The communication channel is used to send the service data from the network proxy confidential virtual machine to the service confidential virtual machine, and to send the response data from the service confidential virtual machine to the network proxy confidential virtual machine.

[0152] Optionally, when the processor 1010 sends service data to the service confidential virtual machine through the network proxy confidential virtual machine, it is specifically used for: When the network configuration information indicates that the data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, the business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine; When the radio frequency unit 1001 receives response data sent by the business confidential virtual machine through the network proxy confidential virtual machine, it is specifically used for: If the network configuration information indicates that data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, then receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine.

[0153] Optionally, the network configuration information includes at least one of the following: Network configuration information in the host operating system; network configuration information inside the virtual machine containing the business secrets.

[0154] Optionally, the network configuration information in the host operating system includes at least one of the following: first configuration information; second configuration information; and third configuration information. The first configuration information is used to indicate the network access control method of the host machine; the second configuration information is used to indicate the traffic forwarding method of the virtualization switch; and the third configuration information is used to indicate that external network interfaces should not be allocated to the business confidential virtual machine.

[0155] Optionally, the network configuration information inside the business confidential virtual machine includes at least one of the following: fourth configuration information; fifth configuration information; sixth configuration information; seventh configuration information; The fourth configuration information is used to instruct the removal of the network driver module in the operating system kernel; the fifth configuration information is used to instruct the disabling of the virtual network card driver; the sixth configuration information is used to instruct the deletion of network protocol stack-related components; and the seventh configuration information is used to instruct the prohibition of loading external network device drivers.

[0156] Optionally, when the processor 1010 sends business data to the business confidential virtual machine through the network proxy confidential virtual machine, provided that both the business confidential virtual machine and the network proxy confidential virtual machine are started, it is specifically used for: When both the business confidential virtual machine and the network proxy confidential virtual machine are started, the trustworthiness of the business confidential virtual machine is verified to obtain a first verification result, and the trustworthiness of the network proxy confidential virtual machine is verified to obtain a second verification result. If both the first verification result and the second verification result are credible, the business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine.

[0157] Optionally, when the processor 1010 performs trustworthiness verification on the business confidential virtual machine and obtains a first verification result, it is specifically used for: Obtain first remote authentication information of the business confidential virtual machine; wherein, the first remote authentication information includes: first metric information of the business confidential virtual machine and a first hardware signature of the first metric information; The first hardware signature is verified, and if the verification result of the first hardware signature is true, the first running metric information during the operation of the business secret virtual machine is obtained. If the first metric information is the same as the first runtime metric information, the first verification result of the business secret virtual machine is determined to be that the business secret virtual machine is trustworthy.

[0158] Optionally, the first metric information includes at least one of the following: a first operating system kernel hash value; a first initialization image hash value; and a first boot configuration parameter hash value. The first runtime metric information includes at least one of the following: a second operating system kernel hash value; a second initialization image hash value; and a second startup configuration parameter hash value. Wherein, the second operating system kernel hash value is obtained by hashing the operating system kernel file; the second initialization image hash value is obtained by hashing the initialization image; and the second startup configuration parameter hash value is obtained by hashing the configuration parameters passed when the business secret virtual machine starts.

[0159] Optionally, when the processor 1010 performs trustworthiness verification on the network agent confidential virtual machine and obtains a second verification result, it is specifically used for: Obtain the second remote authentication information of the network proxy confidential virtual machine; wherein, the second remote authentication information includes: the second metric information of the network proxy confidential virtual machine and the second hardware signature of the second metric information; The second hardware signature is verified, and if the verification result of the second hardware signature is true, the second runtime metric information during the operation of the network agent confidential virtual machine is obtained; If the second runtime metric information is the same as the second metric information, the second verification result of the network agent confidential virtual machine is determined to be that the network agent confidential virtual machine is trustworthy.

[0160] Optionally, the second metric information includes at least one of the following: a first virtual machine image hash value; a first virtual machine kernel image hash value; a first network agent binary file hash value; and a third startup configuration parameter hash value. The second runtime metric information includes at least one of the following: a second virtual machine image hash value; a second virtual machine kernel image hash value; a second network agent binary file hash value; and a fourth startup configuration parameter hash value. Wherein, the hash value of the second virtual machine image is obtained by hashing the complete disk image file of the network agent confidential virtual machine; the hash value of the second virtual machine kernel image is obtained by hashing the kernel file of the operating system of the network agent confidential virtual machine; the hash value of the second network agent program binary file is obtained by hashing the executable file of the network agent program; and the hash value of the fourth startup configuration parameter is obtained by hashing the command line parameters passed to the kernel when the network agent confidential virtual machine starts.

[0161] It should be understood that, in this embodiment, the input unit 1004 may include a graphics processing unit (GPU) 10041 and a microphone 10042. The GPU 10041 processes image data of still images or videos obtained by an image capture device (such as a camera) in video capture mode or image capture mode. The display unit 1006 may include a display panel 10061, which may be configured in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit 1007 includes at least one of a touch panel 10071 and other input devices 10072. The touch panel 10071 is also called a touch screen. The touch panel 10071 may include a touch detection device and a touch controller. Other input devices 10072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, joysticks, etc., which will not be described in detail here.

[0162] The memory 1009 can be used to store software programs and various data. The memory 1009 may primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, the memory 1009 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DRRAM). The memory 1009 in this embodiment includes, but is not limited to, these and any other suitable types of memory.

[0163] The processor 1010 may include one or more processing units; optionally, the processor 1010 integrates an application processor and a modem processor, wherein the application processor mainly handles operations involving the operating system, user interface, and applications, and the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into the processor 1010.

[0164] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described data processing method embodiments and achieve the same technical effects. To avoid repetition, they will not be described again here.

[0165] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0166] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above data processing method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0167] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0168] This application provides a computer program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the data processing method embodiments described above, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0169] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0170] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0171] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A data processing method, executed by a first electronic device, characterized in that, include: A service request message is sent to a second electronic device, the service request message being used to instruct the second electronic device to start a service confidential virtual machine and a network proxy confidential virtual machine corresponding to the service request message; wherein, the code running in the service confidential virtual machine is closed source code, and the code running in the network proxy confidential virtual machine is open source code; When both the business confidential virtual machine and the network proxy confidential virtual machine are started, business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine; Receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine; the response data is generated by the business confidential virtual machine based on the business data.

2. The method according to claim 1, characterized in that, Before sending the service request message to the second electronic device, the method further includes: A communication channel for business data transmission is established between the network agent confidential virtual machine and the business confidential virtual machine; The communication channel is used to send the service data from the network proxy confidential virtual machine to the service confidential virtual machine, and to send the response data from the service confidential virtual machine to the network proxy confidential virtual machine.

3. The method according to claim 1, characterized in that, The step of sending business data to the business confidential virtual machine via the network proxy confidential virtual machine includes: If the network configuration information indicates that the data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, the business data will be sent to the business confidential virtual machine through the network proxy confidential virtual machine. The receipt of response data sent by the business confidential virtual machine through the network proxy confidential virtual machine includes: If the network configuration information indicates that data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, then receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine.

4. The method according to claim 3, characterized in that, The network configuration information includes at least one of the following: Network configuration information in the host operating system; network configuration information inside the virtual machine containing the business secrets.

5. The method according to claim 4, characterized in that, The network configuration information in the host operating system includes at least one of the following: first configuration information; second configuration information; third configuration information; The first configuration information is used to indicate the network access control method of the host machine; the second configuration information is used to indicate the traffic forwarding method of the virtualization switch; and the third configuration information is used to indicate that external network interfaces should not be allocated to the business confidential virtual machine.

6. The method according to claim 4, characterized in that, The network configuration information inside the business confidential virtual machine includes at least one of the following: fourth configuration information; fifth configuration information; sixth configuration information; seventh configuration information; The fourth configuration information is used to instruct the removal of the network driver module in the operating system kernel; the fifth configuration information is used to instruct the disabling of the virtual network card driver; the sixth configuration information is used to instruct the deletion of network protocol stack-related components; and the seventh configuration information is used to instruct the prohibition of loading external network device drivers.

7. The method according to claim 1, characterized in that, When both the business confidential virtual machine and the network proxy confidential virtual machine are started, sending business data to the business confidential virtual machine through the network proxy confidential virtual machine includes: When both the business confidential virtual machine and the network proxy confidential virtual machine are started, the trustworthiness of the business confidential virtual machine is verified to obtain a first verification result, and the trustworthiness of the network proxy confidential virtual machine is verified to obtain a second verification result. If both the first verification result and the second verification result are credible, the business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine.

8. The method according to claim 7, characterized in that, The process of performing trustworthiness verification on the virtual machine containing business secrets to obtain a first verification result includes: Obtain first remote authentication information of the business confidential virtual machine; wherein, the first remote authentication information includes: first metric information of the business confidential virtual machine and a first hardware signature of the first metric information; The first hardware signature is verified, and if the verification result of the first hardware signature is true, the first running metric information during the operation of the business secret virtual machine is obtained. If the first metric information is the same as the first runtime metric information, the first verification result of the business secret virtual machine is determined to be that the business secret virtual machine is trustworthy.

9. The method according to claim 8, characterized in that, The first metric information includes at least one of the following: a first operating system kernel hash value; a first initialization image hash value; and a first boot configuration parameter hash value. The first runtime metric information includes at least one of the following: a second operating system kernel hash value; a second initialization image hash value; Second startup configuration parameter hash value; Wherein, the second operating system kernel hash value is obtained by hashing the operating system kernel file; the second initialization image hash value is obtained by hashing the initialization image; and the second startup configuration parameter hash value is obtained by hashing the configuration parameters passed when the business secret virtual machine starts.

10. The method according to claim 7, characterized in that, The trustworthiness verification of the network proxy confidential virtual machine, to obtain a second verification result, includes: Obtain the second remote authentication information of the network proxy confidential virtual machine; wherein, the second remote authentication information includes: the second metric information of the network proxy confidential virtual machine and the second hardware signature of the second metric information; The second hardware signature is verified, and if the verification result of the second hardware signature is true, the second runtime metric information during the operation of the network agent confidential virtual machine is obtained; If the second runtime metric information is the same as the second metric information, the second verification result of the network agent confidential virtual machine is determined to be that the network agent confidential virtual machine is trustworthy.

11. The method according to claim 10, characterized in that, The second metric information includes at least one of the following: a first virtual machine image hash value; a first virtual machine kernel image hash value; a first network agent binary file hash value; and a third startup configuration parameter hash value. The second runtime metric information includes at least one of the following: the hash value of the second virtual machine image; Second virtual machine kernel image hash value; The hash value of the second network agent program binary file; the hash value of the fourth startup configuration parameters; Wherein, the hash value of the second virtual machine image is obtained by hashing the complete disk image file of the network agent confidential virtual machine; the hash value of the second virtual machine kernel image is obtained by hashing the kernel file of the operating system of the network agent confidential virtual machine; the hash value of the second network agent program binary file is obtained by hashing the executable file of the network agent program; and the hash value of the fourth startup configuration parameter is obtained by hashing the command line parameters passed to the kernel when the network agent confidential virtual machine starts.

12. A data processing apparatus, characterized in that, include: The sending module is used to send a service request message to the second electronic device. The service request message is used to instruct the second electronic device to start a service confidential virtual machine and a network proxy confidential virtual machine corresponding to the service request message. The code running in the service confidential virtual machine is closed source code, and the code running in the network proxy confidential virtual machine is open source code. The processing module is configured to send business data to the business confidential virtual machine via the network proxy confidential virtual machine when both the business confidential virtual machine and the network proxy confidential virtual machine are started. A receiving module is configured to receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine; the response data is generated by the business confidential virtual machine based on the business data.

13. The apparatus according to claim 12, characterized in that, The processing module is also used for: A communication channel for business data transmission is established between the network agent confidential virtual machine and the business confidential virtual machine; The communication channel is used to send the service data from the network proxy confidential virtual machine to the service confidential virtual machine, and to send the response data from the service confidential virtual machine to the network proxy confidential virtual machine.

14. The apparatus according to claim 12, characterized in that, When the processing module sends business data to the business confidential virtual machine through the network proxy confidential virtual machine, it is specifically used for: When the network configuration information indicates that the data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, the business data is sent to the business confidential virtual machine through the network proxy confidential virtual machine; The receipt of response data sent by the business confidential virtual machine through the network proxy confidential virtual machine includes: If the network configuration information indicates that data transmission between the first electronic device and the business confidential virtual machine passes through the network proxy confidential virtual machine, then receive response data sent by the business confidential virtual machine through the network proxy confidential virtual machine.

15. An electronic device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that run on the processor, the program or instructions being executed by the processor to implement the steps of the data processing method as described in any one of claims 1-11.

Images