A cloud service system and a method for confidential computing in a cloud service system

Abstract

The application provides a cloud service system and a method for confidential calculation in the cloud service system. The trusted execution environment in the cloud service system comprises not only an Enclave virtual machine but also at least one physical device. The at least one physical device can transmit data with a target device and a storage device. The at least one physical device and the target device are configured with a key, so that the target device is a trusted device, and the data is encrypted between the target device and the storage device. The scheme provided by the application can ensure that the data is transmitted safely, and the at least one physical device in the trusted execution environment can directly transmit data with the storage device, bypassing the CPU, so that the data transmission efficiency can be improved in the cloud service scenario, and the confidential calculation can be performed faster.

Description

Technical Field

[0001] This application relates to the fields of cloud computing and confidential computing, and more specifically, to a cloud service system and a method for confidential computing within the cloud service system. Background Technology

[0002] "Confidential computing" is a computing model that builds a secure, isolated, and authenticated confidential computing environment on trusted hardware, combined with firmware and software. It ensures the confidentiality and integrity of data, code, and computation process within the confidential computing environment. Its goal is to effectively address potential data leakage risks by protecting data through encryption while sharing computing resources.

[0003] A cloud service system is a platform built on cloud computing technology that provides on-demand computing resources and application services via the internet. It migrates traditional localized hardware, software, and data storage to remote data centers, allowing users to access these resources anytime via the network without maintaining their own physical infrastructure, significantly improving resource utilization and avoiding waste. While cloud computing brings many conveniences, it also presents a significant security challenge. User data typically needs to be processed and computed on the infrastructure of cloud service providers (e.g., processors, memory, etc.). This means that even if data is encrypted during transmission and storage, it must exist in plaintext or decrypted form in memory and on the processor during computation. This creates a potential security vulnerability; for example, malware running in the cloud environment or external attacks could attempt to access sensitive data in memory.

[0004] Therefore, how to perform confidential computing in cloud service systems and ensure the security of sensitive data has become a technical problem that needs to be solved. Summary of the Invention

[0005] The cloud service system provided in this application embodiment can ensure that the data in the trusted execution environment is secure, and that at least one physical device in the trusted execution environment can directly and securely transmit data with the storage device, that is, the data is transmitted securely, bypassing the CPU, which can improve data transmission efficiency and improve the efficiency of confidential computing in the cloud service scenario.

[0006] In a first aspect, a cloud service system is provided, comprising a first virtual instance and a trusted execution environment, the trusted execution environment comprising a second virtual instance and at least one physical device, the second virtual instance communicating with the at least one physical device via point-to-point transmission, the second virtual instance being connected to the first virtual instance via a virtual socket byte vsock channel, the at least one physical device being used to transmit data between a target device and a storage device, wherein a security key is configured on the at least one physical device and the target device, and data is transmitted encrypted between the target device and the storage device.

[0007] For example, the data is encrypted during transmission between the target device and the storage device using an authentication encryption algorithm.

[0008] For example, this data can be sensitive data. Exemplary examples include sensitive data from model training and sensitive data from users. Sensitive data from model training could include, for example, model parameters, training samples, checkpoint data, the trained model, intermediate data during model training (e.g., metrics, accuracy), prediction results for the test set, rendered result frame data, etc. Sensitive data from users could include, for example, user personal identification information, financial information, medical and health information, user control requests, user configuration information for the Enclave, and the results returned to the user after the Enclave processes the data. Checkpoint data can be understood as the model state saved during model training. These checkpoints typically include model parameters (weights and biases), optimizer state, and other relevant training information. By saving checkpoints, the current state of the model can be periodically saved during training so that training can be resumed or used for model evaluation and inference when needed.

[0009] In this embodiment, the security key is used to indicate that at least one physical device and the target device are trusted devices. It can also be understood that when the security key is configured on the target device and at least one physical device, the Enclave virtual machine, the at least one physical device, and the target device can all be considered trusted devices. In other words, by configuring the security key, the security boundary is extended from the Enclave virtual machine to at least one physical device and the target device, enabling these devices to process data in a protected environment.

[0010] As can be seen, the TEE domain in this application extends the TEE domain to include not only the Enclave virtual machine but also at least one physical device. This allows some of the CPU's computational tasks in the Enclave virtual machine to be offloaded to other physical devices, further improving the speed and efficiency of confidential computing. Furthermore, this at least one physical device can transmit data between the target device and the storage device. Since keys are configured on both the at least one physical device and the target device, the target device is a trusted device, and data is transmitted encrypted between the target device and the storage device. Therefore, the solution provided in this application ensures the security of data within the trusted execution environment, and that at least one physical device within the trusted execution environment can directly and securely transmit data with the storage device, bypassing the CPU. This improves data transmission efficiency and enables faster confidential computing in cloud service scenarios.

[0011] In conjunction with the first aspect, in one possible implementation, the at least one physical device is also used to perform confidential computations on data from the storage device in a trusted execution environment.

[0012] Based on the above technical solution, since the TEE domain is extended in this embodiment, some of the computing tasks of the CPU in the Enclave virtual machine can be offloaded to other physical devices, thereby improving the speed and efficiency of confidential computing.

[0013] In conjunction with the first aspect, in one possible implementation, the second virtual instance is used to directly access at least one physical device; the second virtual instance is also used to perform confidential computation on the data obtained from the at least one physical device in a trusted execution environment.

[0014] Based on the above technical solution, in this embodiment, the Enclave virtual machine can directly obtain data from the physical memory of the physical device through VFIO technology and perform confidential computation. This allows the Enclave virtual machine to obtain data from the parent virtual machine without needing to use the vsock channel, thus improving the efficiency of confidential computation.

[0015] In conjunction with the first aspect, in one possible implementation, the target device is configured with a first mapping relationship, which is used to indicate the user buffer address space of the target device corresponding to the virtual address of at least one physical device.

[0016] In conjunction with the first aspect, in one possible implementation, the first mapping relationship is also used to indicate access permission information corresponding to the virtual addresses of at least one physical device, wherein the access permission information includes at least one of the following: reading data from the user buffer address space of the target device, writing data to the user buffer address space of the target device, or prohibiting access to the user buffer address space of the target device.

[0017] Based on the above technical solution, in this embodiment of the application, a first mapping relationship is configured on the target device, enabling data transmission between the physical device and the target device.

[0018] In conjunction with the first aspect, in one possible implementation, the target device is configured to receive a first traffic message from a storage device, the first traffic message carrying first indication information and data, the first indication information being used to indicate a physical device in a trusted execution environment corresponding to the data; the target device is configured to generate a second traffic message based on the first indication information, the second traffic message carrying second indication information and data, the second indication information being used to mark the second traffic message.

[0019] Based on the above technical solution, in this embodiment of the application, traffic sent to physical devices in a trusted execution environment can be marked to distinguish between ordinary physical devices and physical devices in a trusted execution environment, which facilitates management and control.

[0020] It should be noted that the beneficial effects achieved by the methods, equipment, and other technical solutions provided in the following aspects can be found in the description of the technical effects corresponding to the relevant content in the first aspect above, and will not be repeated here.

[0021] Secondly, a method for confidential computing in a cloud service system is provided. The cloud service system includes a first virtual instance and a trusted execution environment. The trusted execution environment includes a second virtual instance and at least one physical device. The second virtual instance communicates with the at least one physical device via point-to-point transmission. The second virtual instance is connected to the first virtual instance via a virtual socket byte vsock channel. The method includes: at least one physical device transmitting data to a storage device through a target device, wherein a security key is configured on the at least one physical device and the target device, and the data is transmitted encrypted between the target device and the storage device.

[0022] In conjunction with the second aspect, in one possible implementation, the method further includes: at least one physical device performing confidential computation on the data from the storage device in a trusted execution environment.

[0023] In conjunction with the second aspect, in one possible implementation, the method further includes: a second virtual instance performing confidential computation on data from at least one physical device acquired in a trusted execution environment, wherein the second virtual instance is used to directly access at least one physical device.

[0024] In conjunction with the second aspect, in one possible implementation, the target device is configured with a first mapping relationship, which is used to indicate the user buffer address space of the target device corresponding to the virtual address of at least one physical device.

[0025] In conjunction with the second aspect, in one possible implementation, the first mapping relationship is also used to indicate access permission information corresponding to the virtual addresses of at least one physical device, wherein the access permission information includes at least one of the following: reading data from the user buffer address space of the target device, writing data to the user buffer address space of the target device, or prohibiting access to the user buffer address space of the target device.

[0026] In conjunction with the second aspect, in one possible implementation, the method further includes: the target device receiving a first traffic packet from a storage device, the first traffic packet carrying first indication information and data, the first indication information being used to indicate a physical device in a trusted execution environment corresponding to the data; the target device generating a second traffic packet based on the first indication information, the second traffic packet carrying second indication information and the data, the second indication information being used to mark the second traffic packet.

[0027] In conjunction with the second aspect, in one possible implementation, the data is encrypted during transmission between the target device and the storage device using an authentication encryption algorithm.

[0028] Thirdly, a Trusted Execution Environment (TEE) device is provided. This TEE device is configured within a cloud service system, which also includes a first virtual instance. The TEE device includes a second virtual instance and at least one physical device. The second virtual instance communicates with the at least one physical device via point-to-point transmission. The second virtual instance and the first virtual instance are connected via a virtual socket vsock channel. This TEE device is used to execute the method described in the second aspect. Specifically, the TEE device may include units and / or modules for executing the method proposed in this application, such as transceiver units and / or processing units.

[0029] Fourthly, this application provides a Trusted Execution Environment (TEE) device, which is configured in a cloud service system. The cloud service system further includes a first virtual instance. The TEE device includes a second virtual instance and at least one physical device. The second virtual instance communicates with the at least one physical device via point-to-point transmission. The second virtual instance and the first virtual instance are connected via a virtual socket byte vsock channel. The TEE device includes at least one processor for executing computer programs or instructions stored in memory to perform the method described in the second aspect. Optionally, the TEE device further includes a memory for storing computer programs or instructions. Optionally, the TEE device further includes a communication interface through which the processor reads the computer programs or instructions stored in memory.

[0030] In one implementation, the TEE device is a device used to implement the functions of the above-described method in a chip.

[0031] In another implementation, the TEE device is a chip system or circuit used to implement the functions described above in a chip.

[0032] Fifthly, this application proposes a computing device for performing the method described in the second aspect above. Specifically, the device may include units and / or modules for performing the confidential computing method proposed in this application.

[0033] Sixthly, this application provides a computing device comprising: at least one processor for executing a computer program or instructions stored in a memory to perform the method described in the second aspect. Optionally, the device further comprises a memory for storing the computer program or instructions. Optionally, the device further comprises a communication interface through which the processor reads the computer program or instructions stored in the memory. Exemplarily, the device may also be a chip, a chip system, or a circuit.

[0034] In a seventh aspect, this application provides a processor, including: an input circuit, an output circuit, and a processing circuit. The processing circuit is configured to receive signals through the input circuit and transmit signals through the output circuit, causing the processor to execute the method described in the second aspect.

[0035] In specific implementation, the processor can be one or more chips, the input circuit can be input pins, the output circuit can be output pins, and the processing circuit can be transistors, gate circuits, flip-flops, and various logic circuits. The input signal received by the input circuit can be received and input by, for example, but not limited to, a transceiver, and the signal output by the output circuit can be, for example, but not limited to, output to and transmitted by a transmitter. Furthermore, the input circuit and the output circuit can be the same circuit, which is used as both the input circuit and the output circuit at different times. This application does not limit the specific implementation of the processor and various circuits.

[0036] Unless otherwise specified, or if it does not contradict its actual function or internal logic in the relevant description, the transmission and acquisition / reception operations involved in the processor can be understood as processor output and reception, input and other operations, or as transmission and reception operations performed by radio frequency circuits and antennas. This application does not limit them in this regard.

[0037] In an eighth aspect, a processing apparatus is provided, including a processor and a memory. The processor is used to read instructions stored in the memory and to receive signals via a transceiver and transmit signals via a transmitter to execute the method described in the second aspect above.

[0038] Optionally, the processor may be one or more, and the memory may be one or more.

[0039] Optionally, the memory may be integrated with the processor, or the memory may be separated from the processor.

[0040] In specific implementation, the memory can be a non-transitory memory, such as read-only memory (ROM), which can be integrated with the processor on the same chip or set on different chips. The embodiments of this application do not limit the type of memory or the way the memory and processor are set.

[0041] It should be understood that the relevant data interaction process, such as sending indication information, can be the process of the processor outputting indication information, and receiving capability information can be the process of the processor receiving input capability information. Specifically, the data output by the processor can be sent to the transmitter, and the input data received by the processor can come from the transceiver. Here, the transmitter and the transceiver can be collectively referred to as transceivers.

[0042] The processing device mentioned in the eighth aspect above can be one or more chips. The processor in the processing device can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc.; when implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. This memory can be integrated into the processor or located outside the processor and exist independently.

[0043] A ninth aspect provides a computing cluster including at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the computing device cluster to perform the method described in any possible implementation of the second aspect.

[0044] Optionally, the processor can be a general-purpose processor, which can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc.; when implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. This memory can be integrated into the processor or located outside the processor and exist independently.

[0045] In a tenth aspect, a computer-readable storage medium is provided that stores program code for execution by a device, the program code including the method described in the second aspect above.

[0046] Eleventhly, a computer program product containing instructions is provided, which, when run on a computer, causes the computer to perform the method of the second aspect described above.

[0047] In a twelfth aspect, a chip system is provided, including a processor for calling and running a computer program from a memory, causing a device equipped with the chip system to perform the method of the second aspect described above. Attached Figure Description

[0048] Figure 1 This is a schematic diagram of a confidential computing architecture in a cloud service system provided in an embodiment of this application.

[0049] Figure 2 This is a schematic diagram of a Trusted Execution Environment (TEE) provided in an embodiment of this application.

[0050] Figure 3 This is a schematic diagram of data transmission in a cloud service system architecture provided in an embodiment of this application.

[0051] Figure 4This is a schematic flowchart of a confidential computing method 400 in a cloud service system provided in an embodiment of this application.

[0052] Figure 5 This is another schematic diagram of data transmission in a cloud service system architecture provided in this application embodiment.

[0053] Figure 6 This is another schematic diagram of a cloud service system architecture provided in the embodiments of this application.

[0054] Figure 7 This is a schematic block diagram of the Trusted Execution Environment (TEE) device 700 provided in the embodiments of this application.

[0055] Figure 8 This is a schematic diagram of the architecture of a computing device cluster provided in an embodiment of this application.

[0056] Figure 9 This is a schematic diagram showing the connection between computing devices 800A and 800B via a network according to an embodiment of this application.

[0057] Figure 10 This is a schematic flowchart of an Enclave device pass-through provided in an embodiment of this application.

[0058] Figure 11 This is a schematic diagram of a device attack provided in an embodiment of this application.

[0059] Figure 12 This is a schematic diagram of a direct path and a non-direct path provided in the embodiments of this application.

[0060] Figure 13 This is another schematic diagram of a Trusted Execution Environment (TEE) provided in an embodiment of this application.

[0061] Figure 14 This is another schematic diagram of data transmission provided in the embodiments of this application.

[0062] Figure 15 This is a schematic diagram illustrating a method for obtaining a key, as provided in an embodiment of this application.

[0063] Figure 16 This is a schematic diagram of a control plane configuration I / O state provided in an embodiment of this application.

[0064] Figure 17 This is a schematic diagram of a data transmission and message format provided in an embodiment of this application.

[0065] Figure 18 This is another schematic diagram of a cloud service system provided in an embodiment of this application.

[0066] Figures 19-21This is a schematic flowchart illustrating the interaction between an Enclave application and a Key Management Service (KMS) provided in an embodiment of this application. Detailed Implementation

[0067] The technical solutions in this application will now be described with reference to the accompanying drawings.

[0068] To facilitate understanding of the technical solutions provided in the embodiments of this application, the technical terms involved in this application are briefly introduced below. It should be noted that the introduction of technical terms in this application is only for the purpose of helping to understand the technical solutions and should not be construed as limiting the application.

[0069] 1. Trusted Execution Environment (TEE)

[0070] A TEE (Transmission Equipment Environment) is a secure zone isolated from the host system, running as an independent environment alongside the host operating system. TEE technology uses hardware and software to protect data and code, ensuring the confidentiality and integrity of code and data loaded within the secure zone, achieving stronger security guarantees than traditional general-purpose execution environments. Trusted applications running in a TEE can access the full functionality of the platform's main processor and memory, while hardware isolation protects these components from user-installed applications running on the main operating system. A TEE is a secure zone created based on hardware isolation; that is, the TEE runs in a confidential computing environment on isolated hardware, operating in parallel with the operating system.

[0071] 2. Confidential Computing

[0072] Confidential computing is a technology that protects data in use (data currently being computed) by performing computations within a hardware-based trusted execution environment. Typically, confidential computing can be understood as a trusted execution environment based on a trusted central processing unit (CPU) chip. It is not controlled by the kernel or system layer (meaning even those with the highest administrative privileges at the kernel and system levels cannot view, tamper with, or control the data and operations within this secure environment), thus ensuring data security and operational trustworthiness within the trusted execution environment. Confidential computing is divided into two categories: the more mature application (process)-based confidential computing and the newer, still evolving virtual machine-based confidential computing. Confidential computing has wide applications in scenarios such as financial data fusion, blockchain smart contracts, gene analysis, and cloud services.

[0073] 3. Confidential computing architecture in cloud service systems

[0074] Figure 1A schematic diagram of a confidential computing architecture in a cloud service system is shown. Figure 1 As can be seen, assuming the system architecture includes two cloud instances, cloud instance #1 includes an additional virtual machine besides the parent virtual machine. This virtual machine can be understood as an additional, secure, and completely isolated virtual machine placed inside the virtual machine product based on the cloud service system architecture. This virtual machine can be called an "enclave" virtual machine, and the virtual machine that owns the enclave virtual machine from the outside is called the "parent virtual machine." The enclave virtual machine is a completely independent virtual machine with no persistent storage, interactive access, or external network connection. Its memory and CPU come from the resources of its parent virtual machine that have been pre-isolated. The enclave virtual machine typically includes trusted applications (TAs) and sensitive data (the "transmitted data" in the following embodiments of this application can also be understood as "sensitive data" here). For example, "sensitive data" can include sensitive data for model training and sensitive data of users. Among them, "sensitive data for model training" can be, for example, model parameters, training samples, checkpoint data, trained models, intermediate data during model training (e.g., model training metrics, model training accuracy), prediction results for the test set, rendering result frame data, etc. "Sensitive user data" can include, for example, user personal identification information, financial information, medical and health information, user control requests, user configuration information for the Enclave, and the results returned to the user by the Enclave after processing the data. Checkpoint data can be understood as the model state saved during model training. These checkpoints typically include the model's parameters (weights and biases), optimizer state, and other relevant training information. By saving checkpoints, the current state of the model can be periodically saved during training, allowing training to be resumed or used for model evaluation and inference when needed.

[0075] The parent virtual machine is an Elastic Compute Service (ECS) that can isolate and allocate its CPU and memory resources to the Enclave. (In this embodiment, virtual machine, virtual machine instance, elastic cloud server, elastic instance, etc., are interchangeable names.) These resources can be used by the Enclave virtual machine throughout its lifecycle. After the Enclave starts successfully, it can only communicate securely with its parent virtual machine. The local connection channel (local vsock connection) is the only secure local communication channel between the Enclave instance and the parent virtual machine. The parent virtual machine and the Enclave virtual machine communicate through a secure local channel (e.g., a virtual socket (vsock)). Processes, applications, kernels, or users within the parent virtual machine cannot access resources in the Enclave. Typically, the parent virtual machine includes an application (App), codebase, operating system, and tools for processing user instructions.

[0076] The hypervisor can isolate the CPU and memory resources of an Enclave virtual machine from those of its parent virtual machine, providing a completely isolated executable environment and significantly reducing the attack surface. Additionally, peripheral component interconnect express (PCIe) technology allows other components such as network cards to be used by the virtual machine.

[0077] from Figure 1 It can be seen that in the current cloud service system architecture, the Enclave virtual machine needs to transfer sensitive data from the parent virtual machine through a local transmission channel. Typically, this transmission channel can only support data transfers in the hundreds of megabytes (MB) range. For large-scale data (e.g., IoT data, large amounts of text data), transferring to the Enclave virtual machine takes a long time, and the Enclave may not be able to support the encryption and decryption of large amounts of data. Therefore, how to transmit confidential data in the cloud service system, ensure the security of sensitive data, and thus improve the efficiency of confidential computing has become a technical problem that needs to be solved.

[0078] In view of this, this application provides a cloud service system in which the trusted execution environment includes not only an Enclave virtual machine but also at least one physical device. This at least one physical device can transmit data between a target device and a storage device. A key is configured on both the at least one physical device and the target device, thus making the target device a trusted device. Furthermore, the data is encrypted between the target device and the storage device. Therefore, the solution provided by this application ensures the security of data within the trusted execution environment, and allows at least one physical device within the trusted execution environment to directly and securely transmit data with the storage device, bypassing the CPU. This improves data transmission efficiency in cloud service scenarios, enabling faster confidential computation.

[0079] Figure 2 This is a schematic diagram of a TEE field provided in an embodiment of this application, and... Figure 1 Compared to the system architecture shown, this application expands the TEE domain from an Enclave virtual machine to include both an Enclave virtual machine and at least one physical device. In other words, the TEE in this application's embodiments includes not only the Enclave virtual machine but also "at least one physical device" configured by the user according to their needs. In this application's embodiments, the specific physical hardware devices included in this at least one physical device can be flexibly configured by the user according to business characteristics and needs; for example, it may include a graphics processing unit (GPU), a neural network processing unit (NPU), etc.

[0080] For example, each physical device can communicate with the Enclave virtual machine via point-to-point transmission, ensuring secure communication between them. For instance, each physical device can be connected to and communicate with the Enclave virtual machine via a high-speed bus. It can be seen that this embodiment extends the TEE domain to offload some of the CPU's computational tasks from the Enclave virtual machine to other physical devices, further improving the speed and efficiency of confidential computing. Additionally, it facilitates bypassing the CPU during subsequent data transfer, allowing physical devices to directly transmit data to storage devices via the target device.

[0081] Figure 3 This is a schematic diagram of confidential computing in a cloud service system provided in this application, such as... Figure 3As shown in the embodiments of this application, the cloud service system includes a first virtual instance (e.g., a parent virtual machine) and a trusted execution environment. The trusted execution environment includes a second virtual instance (e.g., an Enclave virtual machine) and at least one physical device. The second virtual instance communicates with the at least one physical device through point-to-point transmission. The second virtual instance and the first virtual instance are connected through a local transmission channel, for example, through a virtual socket byte vsock channel.

[0082] In this embodiment, the at least one physical device is used to transmit data between a target device and a storage device. A security key is configured on both the at least one physical device and the target device, and the data is transmitted encrypted between the target device and the storage device.

[0083] In this application embodiment, "virtual instance" can be understood as virtual machine, virtual machine instance, elastic cloud server, elastic instance, elastic server, container or bare metal server, etc.

[0084] In one possible implementation, the "cloud instance" in this application embodiment can be understood as a virtual machine, container, or bare metal server. In one possible implementation, the "trusted execution environment" in this application embodiment can be understood as a virtual machine, container, or bare metal server.

[0085] In this application embodiment, for example, "at least one physical device" can be a GPU, NPU, etc. Alternatively, "at least one physical device" can also be a smart card or an offloadable card.

[0086] In this embodiment of the application, for example, the "target device" may be a data processing unit (DPU) or a service processing unit (SPU). For example, the "storage device" may be an object storage service (OBS) or an object storage device (OSD).

[0087] In this embodiment of the application, the security key is used to indicate that at least one physical device and the target device are trusted devices.

[0088] In one possible scenario, the security key is obtained by a second virtual instance through remote authentication, and then configured on at least one physical device and the target device. For example, the Enclave virtual machine can remotely authenticate to a key management service (KMS). Once the Enclave virtual machine passes the remote authentication, it can obtain the security key from the KMS. For instance, the key can be assigned a master key at the granularity of the composite TEE entity, and data keys can be derived from the master key. For example, the KMS can assign a unique root key (also called a "master key") to each TEE entity (e.g., in this embodiment, the TEE consists of an Enclave virtual machine and at least one physical device, which can be understood as the TEE sharing the same security key), used for encrypting / decrypting sensitive data within the TEE and deriving other keys. For instance, a data key can be generated by encrypting context information (e.g., a data identifier) ​​using the master key through a key derivation function (KDF) or a key encryption mechanism. In this embodiment of the application, the "data key" can be understood as a key used to encrypt / decrypt actual data. Compared with the master key, the data key is used more frequently, and security can be improved by frequently changing it (for example, changing it at the input / output (I / O) granularity).

[0089] In another possible scenario, the security key can also be obtained by the target device through remote authentication. For example, the target device can directly perform remote authentication with the KMS. Once the target device passes the remote authentication, it can then obtain the security key from the KMS. In this case, the "security key" can be obtained at the granularity of I / O streams (e.g., each read or write operation can be understood as an I / O stream), and the key is obtained when loading the storage volume. For example, in this embodiment, each I / O stream (or whenever data is read or written) may require a different key, thereby achieving finer-grained control over the security key (e.g., I / O stream). This can also be understood as at least one physical device and the target device having the same security key configured in the same I / O stream.

[0090] For example, at least one physical device in the TEE can use a security key to encrypt data when transmitting data with the target device, thereby ensuring secure data transmission.

[0091] In this embodiment, the target device and at least one physical device are configured with a security key. Therefore, the Enclave virtual machine, the at least one physical device, and the target device can all be considered trusted devices. That is, the Enclave virtual machine can securely communicate with at least one physical device, and the at least one physical device can securely communicate with the target device. In other words, in this embodiment, if a security key is configured for a device, that device can be considered a trusted device and thus can communicate with the Enclave virtual machine. It can also be understood that in this embodiment, the security boundary extends from the Enclave virtual machine to at least one physical device and the target device, enabling these devices to process data in a protected environment.

[0092] In one possible implementation, the target device is configured with a first mapping relationship, which indicates the user buffer address space of the target device corresponding to the virtual address of each of at least one physical device. Further, the first mapping relationship also indicates access permission information corresponding to the virtual address of each of the at least one physical device, wherein the access permission information includes, but is not limited to, at least one of the following: reading data from the user buffer address space of the target device, writing data to the user buffer address space of the target device, or prohibiting access to the user buffer address space of the target device, etc. For example, the access permission information may also include finer-grained permission control, such as execution permissions, specific operation permissions, etc., depending on the specific hardware design. This application does not limit which permissions the permission information may include.

[0093] For example, a second virtual instance (i.e., an Enclave virtual machine) can configure this first mapping relationship in the target device.

[0094] For example, the target device includes a memory management unit (MMU) engine, and the MMU is configured with a first mapping relationship. This first mapping relationship may include a mapping between the virtual addresses (VAs) of at least one physical device and the user buffer address space (UBA) of the target device (also referred to as the "target device's address space"). Further, the first mapping relationship may also include access permission information corresponding to the virtual addresses of each of the at least one physical device. This can also be understood as at least one physical device using its virtual address for data access, and the target device translating this virtual address into an address within the target device's address space. For example, the target device may first translate the virtual address of at least one physical device into a logical address within its address space, and then the target device may further translate this logical address into a physical address within its address space. In this embodiment, based on the first mapping relationship, the MMU can also manage the access permissions of at least one physical device to the target device's user buffer address space.

[0095] Assuming the first mapping relationship is stored in the form of a table, Table 1 below is an illustration of this first mapping relationship. As shown in Table 1, for physical device #1, its internal virtual addresses start#1 to end#1 correspond to the address spaces start#A1 to end#A2 in the target device, and physical device #1 can read or write data in the target device's address spaces start#A1 to end#A2. Similarly, if physical device #1 uses virtual addresses start#2 to end#2 to access the target device, this corresponds to the address spaces start#A3 to end#A4 in the target device, and in this case, it can only read data from the address spaces start#A3 to end#A4 in the target device, but cannot write to them. Physical devices #2 and #3 can also be understood in the same way as described above, and will not be elaborated further.

[0096] Table 1

[0097]

[0098] For example, suppose physical device #1 can send a data access request to the target device through PCIe or other interconnect interfaces. This data access request is used to request to read data in the virtual address start#1 to virtual address end#1. According to the first mapping relationship, the virtual address start#1 to virtual address end#1 corresponding to physical device #1 can be obtained, which corresponds to A1 to end#A2 in the address space of the target device. Data in this address space can be read and written. After the target device's permission verification is passed, the target device can then perform subsequent processing.

[0099] In this embodiment of the application, the "user buffer address space of the target device" can be understood as a space used to cache data transmitted between the physical device and the storage device.

[0100] Optionally, the first mapping relationship also includes the physical memory address corresponding to the virtual address of at least one physical device. Optionally, the target device has a pre-configured mapping relationship between the virtual address and physical memory address of the physical device.

[0101] For example, when a physical device reads data from a storage device, the target device can store the data from the storage device in the address space of the target device corresponding to the virtual address of the physical device. Then, based on the physical memory address corresponding to the virtual address of the physical device, the data is transferred from the address space of the target device to the physical memory of the physical device. Subsequently, the physical device can use its own virtual address to directly access its own physical memory to obtain the data transferred from the storage device.

[0102] For example, when a physical device needs to write data to a storage device, the physical device can send a write request message to the target device. The target device can obtain the physical memory address of the physical device based on the virtual address of the physical device, and then directly transfer the data from the physical memory of the physical device to the address space of the target device corresponding to the virtual address of the physical device based on direct memory access (GMA) technology. Subsequently, the target device can transfer the data to the storage device for storage.

[0103] It should be understood that the data access request message sent by the physical device to the target device will also include other necessary information, such as the type of data access request (read data request or write data request), data identifier (for example, assuming the storage device is OBS, the data identifier can be understood as the bucket name and object key), data length, etc. Specifically, the specific steps regarding the data access request can be understood by referring to existing publicly available technologies, and will not be elaborated upon here.

[0104] Furthermore, the target device can also be configured with I / O states, thereby achieving finer-grained access control and preventing administrators or attackers from forging or tampering with related configurations. Specifically, the details regarding configuring I / O states can be understood by referring to existing publicly available technologies, and will not be elaborated upon in this application.

[0105] It should be noted that the MMU engine on the target device can also be named by other names, and this application does not limit the specific name.

[0106] As mentioned above, this application enables at least one physical device in the TEE to directly transmit data to the storage device through the target device, thereby bypassing the CPU and eliminating the need for the CPU to participate in data transfer. The data transmission between the physical device and the target device was mainly introduced above in conjunction with the first mapping relationship. The data transmission between the target device and the storage device will be mainly introduced below.

[0107] In this embodiment, data is transmitted encrypted between the target device and the storage device. For example, when transmitting data between the target device and the storage device, a Galois message authentication code (GMAC) algorithm can be used to ensure the confidentiality and integrity of the data transmission between the target device and the storage device. For instance, the target device can encapsulate the physical device's data access request message into a traffic packet conforming to the protocol specifications according to the storage device's (e.g., OSD, OBS) related protocols. For example, the target device can add request headers, authentication information, etc. For instance, the target device can send the encapsulated traffic packet to the storage device through its network interface (e.g., Ethernet or InfiniBand (IB) technology).

[0108] For example, in the case of a read request, the storage device retrieves the requested data from the storage medium and returns the requested data to the target device via a data access response message. Upon receiving the data, the target device writes it to its local address space. Then, the target device uses DMA to transfer the data from its local address space to the physical memory corresponding to the virtual address of the physical device, completing the data transfer.

[0109] For example, when a storage device sends data to a target device, it can divide the transmitted data into 4KB blocks. For each 4KB block, an integrity check value (ICV), for example 16 bytes, is calculated using a pre-negotiated key and the GMAC algorithm. The calculated 16-byte ICV is then appended to the end of the 4KB block, forming multiple 4KB+16-byte data units. When the target device receives a data read response message, it can store the data units including the ICVs and recalculate the ICV' for each received 4KB block using the same key and GMAC algorithm. The ICV and ICV' of each 4KB data unit are then compared. If the ICV and ICV' of a 4KB data unit match, the data integrity check passes, the data has not been tampered with during transmission, and it is safe to use. If the ICV and ICV' of a 4KB data unit do not match, the data may have been tampered with or corrupted during transmission.

[0110] For example, in the case of a write request, the data sent by the physical device is first written to the address space of the target device via the PCIe interface or other interfaces. Simultaneously, the target device reads the data from its local address space as part of the data payload of the request message and sends it to the storage device. Then, the target device stores the data sent by the target device on persistent storage media (such as hard drives or solid-state drives, SSDs).

[0111] For example, the target device can use the GMAC algorithm to encrypt the data to be written. For instance, the data to be written to the storage device can be divided into 4KB blocks. For each 4KB block, an integrity check value (ICV), for example 16 bytes, is calculated using a pre-negotiated key and the GMAC algorithm. The calculated 16-byte ICV is then appended to the end of the 4KB block, forming multiple 4KB+16-byte data units. When the storage device receives a data write request, it stores the data units including the ICV and recalculates the ICV' for each received 4KB data unit using the same key and GMAC algorithm, comparing the ICV and ICV' of each 4KB data unit. If the ICV and ICV' of each 4KB data unit match, the data integrity check passes, the data has not been tampered with during transmission, and the data can be used safely. If the ICV and ICV' of a particular 4KB data unit do not match, the data may have been tampered with or corrupted during transmission.

[0112] It should be understood that the specific process of GMAC algorithm encryption (e.g., the generation of the initialization vector (IV)) can be understood by referring to the existing public information, and will not be described in detail in this application.

[0113] It should be noted that the size of the data block is not limited in the embodiments of this application. For example, the transmitted data can also be divided into 512B data blocks, and the calculated ICV in this case is 8B. In other words, the size of the data unit can be reasonably divided based on the needs of the business and the data situation, and there is no limitation.

[0114] To further ensure the data on storage devices is not tampered with, encryption can be applied. For example, an XOR-encrypted XOR (XEX) tweakable block cipher with ciphertext stealing (XTS) can be used to encrypt data on storage devices (e.g., encrypting static data in storage devices with data units (including sectors, logical disk blocks, etc.) as the underlying infrastructure). Assuming the storage device is an OSD (On-Site Detector), and the data access request is a write request, XTS can be used to encrypt the data written to the disk. If the data access request is a read request, the data read can be the XTS-encrypted data. Subsequently, the encrypted data block is re-encrypted using the GMAC algorithm for authentication. The original plaintext data can then be obtained by decryption and verification of data integrity.

[0115] In one possible implementation of this application, the target device can encrypt or decrypt data transmitted between the physical device and the storage device. For example, the target device can encrypt data that the physical device needs to write to the storage device using the GMAC algorithm; or, for another example, the target device can decrypt data sent from the storage device to the physical device using the GMAC algorithm. In another possible implementation, the physical device itself can directly encrypt and decrypt data that needs to be written to the storage device. In this case, the target device can encapsulate the request message using a protocol and transmit it to the storage device over the network.

[0116] For example, target devices can communicate with each other using Remote Direct Memory Access over Converged Ethernet (RoCE). For instance, message encapsulation formats can be based on the RoCE protocol.

[0117] In this embodiment, the target device can mark traffic packets destined for physical devices in the TEE. For example, it can add indication information to traffic packets destined for the TEE to obtain new traffic packets, thereby distinguishing traffic packets destined for physical devices in the TEE from ordinary traffic packets. This can also be understood as the ability to distinguish between ordinary physical devices and physical devices in the TEE, and to mark traffic that needs to communicate with physical devices in the TEE. For example, when a physical device sends a data access request message to the target device, it can carry a unique identifier, such as the physical device's number or request sequence number. The target device can construct a mapping table to indicate the correspondence between physical devices and this identifier. Subsequently, when the storage device sends a data access response message to the target device, it can also carry this identifier, allowing the target device to determine which physical device the response message is for based on the constructed mapping table. When the target device determines that a data access message is destined for a physical device in the TEE, it can mark the traffic packet.

[0118] That is, the target device in this application can be used to receive a first traffic message from a storage device, the first traffic message carrying first indication information and data, the first indication information being used to indicate the physical device in the trusted execution environment corresponding to the data; the target device is used to generate a second traffic message according to the first indication information, the second traffic message carrying second indication information and data, the second indication information being used to mark the second traffic message.

[0119] For example, the first indication information can be understood as the physical device's serial number, request sequence number, etc.; for example, the second indication information can be understood as a tag field. For example, this indication information can be a traffic identifier, traffic tag, etc. For example, traffic tags can be added using traffic coloring technology.

[0120] Based on the technical solution described above, secure data transmission between physical devices, target devices, and storage devices can be achieved. When data is transmitted to the physical device, the physical device can perform confidential computations on the data from the storage device. For example, the physical device can store the computation results in the storage device via the target data. In other words, the at least one physical device is used to perform confidential computations on the data acquired from the storage device within the TEE. Furthermore, the at least one physical device can transmit the computation results to the storage device for storage via the target device.

[0121] In this embodiment, at least one physical device and the Enclave VM in the TEE can employ Virtual Function I / O (VFIO) technology (also known as a "versatile framework for userspace I / O") to directly map physical devices (such as GPUs, NPUs, etc.) into virtual machines or containers, thereby enabling direct access from physical devices to virtual machines. This can also be understood as the Enclave VM in the TEE directly accessing the physical memory of at least one physical device to obtain data from the physical memory of at least one physical device and perform confidential computations. Therefore, in this embodiment, the second virtual instance is used to directly access the at least one physical device; the second virtual device is also used to perform confidential computations on the data obtained from the at least one physical device within a trusted execution environment.

[0122] For specific implementation steps regarding VFIO technology, please refer to the existing publicly available information for understanding. Figure 10 This application provides a schematic diagram illustrating a specific process for pass-through between an Enclave VM and a physical device, which can be referred to. Figure 10 To understand.

[0123] The above provides a detailed description of the cloud service system provided in this application. The following section will introduce the method for confidential computing based on the cloud service system. Figure 4 A flowchart of a confidential computing method 400 based on a cloud service system provided in this application embodiment. This method can be applied to a cloud service system (see reference). Figures 2 to 3 The cloud service system shown includes: a second virtual instance and at least one physical device, wherein the second virtual instance communicates with the at least one physical device via point-to-point transmission, and the second virtual instance is connected to the first virtual instance via a virtual socket vsock channel. The method 400 includes:

[0124] 401, Physical device and target device obtain security key.

[0125] 402, the physical device sends a data access request message to the target device.

[0126] Correspondingly, the target device receives a data access request message from the physical device.

[0127] 403. The target device determines the user buffer address space corresponding to the virtual address of the physical device according to the first mapping relationship, and verifies the data access permissions of the physical device.

[0128] 404. If the physical device has passed data access permission verification, the target device sends a data access request message to the storage device.

[0129] Correspondingly, the storage device receives a data access request message from the target device.

[0130] 405. The storage device performs a read or write operation based on the data access request message.

[0131] 406, The storage device sends a data access response message to the target device.

[0132] Correspondingly, the target device receives a data access response message from the storage device.

[0133] 407. The target device, based on the data access response message, either transfers data to the physical memory of the physical device or sends a data write success response message to the physical device.

[0134] Optionally, it also includes 408, where the physical device performs confidential computations on data from the storage device in a trusted execution environment.

[0135] Optionally, it also includes 409, whereby the second virtual instance performs confidential computations on the data acquired from the physical device in a trusted execution environment.

[0136] It should be noted that for a detailed understanding and explanation of steps 401 to 409, please refer to [the relevant documentation / reference]. Figure 2 and with Figure 3 The relevant explanatory sections of the illustrated embodiments will not be repeated here.

[0137] As can be seen, the solution provided in this application can achieve secure data transmission between the Enclave virtual machine, at least one physical device, the target device, and the storage device. Therefore, in this cloud service system architecture provided by this application, for example, at least one hardware device can directly obtain data from the storage device, bypassing the CPU, and securely and efficiently obtaining large amounts of data for subsequent confidential computation; or, for example, the Enclave virtual machine can directly obtain data from at least one hardware device, in which case the Enclave virtual machine can obtain data and perform confidential computation without relying on the vsock channel with its parent virtual machine. In other words, the cloud service system architecture provided by this application, while ensuring secure data transmission, can achieve rapid transmission of large amounts of data to a trusted execution environment, improving the efficiency of confidential computation.

[0138] The above-described scheme mainly introduces how physical devices can achieve data transfer between storage devices and target devices, bypassing the CPU and thus improving data transfer speed and the efficiency of confidential computing. This application also proposes another cloud service system, see [link to relevant documentation]. Figure 5 As shown, a high-speed bus-based transmission channel can be established between the parent virtual machine and the Enclave virtual machine, thus solving the problem of low vsock transmission efficiency. Because the high-speed bus can transmit large amounts of data at high speeds, it can be used to... Figure 5 The cloud service architecture provided also improves data transmission speed and the efficiency of confidential computing.

[0139] certainly, Figure 5 The cloud service system architecture shown can also be combined with... Figure 2 and Figure 3 The cloud service architecture shown combines the advantages of high-speed bus to efficiently transfer data with the parent VM, and also allows physical devices to directly transfer data with storage devices through the target device, bypassing the CPU.

[0140] Figure 6 This is another schematic diagram of a cloud service system architecture provided in the embodiments of this application, such as... Figure 6 As shown, this cloud data center includes a cloud management platform, an internal data center network, and multiple identical servers, such as Server 1 and Server 2. Server 1 and Server 2 interact with the cloud management platform via their network interface cards (NICs), the internal data center network, and the cloud management platform. The cloud management platform interacts with clients via the internet. The NICs are installed on offload cards, also known as smart cards, which are standard external devices for servers; each server is equipped with one. The servers also include host machines. The offload cards are inserted into the host machines and establish a communication channel with them. One or more virtual machines (VMs) can run on the host machines, such as VM 1 and VM 2. The host machines are executed through a hypervisor, also known as a virtual machine monitor (VMM).

[0141] Specifically, the cloud management platform provides access interfaces (such as a user interface or API). Tenants can use their clients to remotely access these interfaces, register a cloud account and password on the cloud management platform, and log in. After successful authentication of the cloud account and password, the tenant can further select and purchase virtual machines with specific specifications (processor, memory, disk) on the cloud management platform. After successful purchase, the cloud management platform provides a remote login account and password for the purchased virtual machine. The client can then remotely log in to the virtual machine and install and run the tenant's applications within it. The cloud management platform client receives control plane commands from the cloud management platform and creates and manages the virtual machines throughout their entire lifecycle on the server according to these commands. Therefore, tenants can create, manage, log in to, and operate virtual machines in the cloud data center through the cloud management platform.

[0142] For example, Figure 6 In the architecture shown, virtual machine 1 in server 1 can be understood as... Figure 2 , Figure 3 The parent virtual machine, virtual machine 2, can be understood as... Figure 2 , Figure 3 The Enclave virtual machine in server 1, where the "processor" in the hardware layer can include CPU, GPU, NPU, DPU, SPU, etc.

[0143] It is understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0144] It should also be understood that the ordinal numbers such as "first" and "second" mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the size, content, order, timing, priority or importance of multiple objects.

[0145] It should also be understood that, in this application, "at least one" means one or more, and "more than one" means two or more. "At least one item" or similar expressions mean one or more items, that is, any combination of these items, including any combination of single items or multiple items. For example, at least one of a, b, or c means: a, b, c, a and b, a and c, b and c, or a and b and c.

[0146] It should also be understood that, in the various embodiments of this application, determining B based on A does not mean that B is determined solely based on A; B can also be determined based on A and / or other information.

[0147] It should be understood that the various embodiments in this application can be combined with each other according to their internal implementation logic.

[0148] Those skilled in the art will recognize that, based on the units and algorithm steps described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is implemented in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0149] Figure 7 This is a schematic diagram of a TEE device provided in an embodiment of this application. Figure 7As shown, this TEE device is installed in a cloud service system (see reference). Figure 2 , Figure 3 , Figure 5 The cloud service system shown also includes a first virtual instance.

[0150] The TEE device in this embodiment includes a second virtual instance 710 and a physical device 720. The physical device 720 may include at least one physical device. For example, physical device 720 may include physical device 721 and physical device 72N. The second virtual instance 710 communicates with at least one physical device via a communication interface 730 using a point-to-point transmission method. The second virtual instance 710 includes a central processing unit 711 and a memory 712. For example, the second virtual instance is connected to the first virtual instance via a virtual socket byte vsock channel.

[0151] The memory 712 can be temporary or persistent storage. Furthermore, the central processing unit 711 can be configured to communicate with the memory 712 and execute a series of instructions stored in the memory 712.

[0152] In this embodiment, the physical device 720 can perform the aforementioned... Figure 2 , Figure 3 , Figure 4 The operations performed by the physical device in the illustrated embodiment will not be described in detail here. The second virtual instance 710 can perform the aforementioned operations. Figure 2 , Figure 3 , Figure 4 The operations performed by the Enclave virtual machine in the illustrated embodiment.

[0153] For example, the TEE device may be part of a computing device or a server; in other words, the computing device or server device includes the TEE device.

[0154] It should be noted that the embodiments of this application can also be based on the above method examples and Figure 2 , Figure 3 The description in this paper divides computing devices into functional modules. For example, each function can be divided into its own module, or two or more functions can be integrated into a single processing module. These integrated modules can be implemented in hardware or as software functional modules. It should be noted that the module division in this embodiment is illustrative and represents only one logical functional division; other division methods may be used in actual implementation. For specific details regarding the functions and divisions of each module, please refer to [reference needed]. Figure 2 , Figure 3 , Figure 4 The descriptions in the illustrated embodiments will not be repeated in detail.

[0155] Figure 8 This is a schematic diagram of the architecture of a computing device cluster provided in an embodiment of this application. The computing device cluster includes at least one computing device. This computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone. Figure 8 As shown, the computing device cluster includes at least one computing device 800. The memory 830 of one or more computing devices 800 in the computing device cluster may store the same instructions for performing actions executed by the physical device or the second virtual instance described above.

[0156] In some possible implementations, the memory 830 of one or more computing devices 800 in the computing device cluster may also store partial instructions for performing the actions executed by the method 400 described in the above embodiments. In other words, a combination of one or more computing devices 800 can jointly execute instructions for performing the actions executed by the second virtual instance or physical device described in the above embodiments.

[0157] It should be noted that the memory 830 in different computing devices 800 within the computing device cluster can store different instructions, each used to execute a portion of the functions of the computing device 800. That is, the instructions stored in the memory 830 of different computing devices 800 can implement the functions of one or more modules.

[0158] Alternatively, the memory 830 in different computing devices 800 within the computing device cluster can store different instructions, each used to execute a portion of the functions corresponding to the aforementioned TEE device 700. That is, the instructions stored in the memory 830 of different computing devices 800 can implement the functions of one or more modules.

[0159] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 9 One possible implementation is shown. For example... Figure 9 As shown, the two computing devices 800A and 800B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device.

[0160] It should be understood that Figure 9 The functions of the computing device 800A shown can also be performed by multiple computing devices 800. Similarly, the functions of the computing device 800B can also be performed by multiple computing devices 800.

[0161] In this embodiment, a computer program product containing instructions is also provided. The computer program product may be a software or program product containing instructions capable of running on a computing device cluster or stored on any available medium. When run by the computing device cluster, it causes the computing device cluster to perform the methods provided above, or causes the computing device cluster to implement the functions of the apparatus provided above.

[0162] In this embodiment, a computer-readable storage medium is also provided. This computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital video disc (DVD)), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that, when executed on a computing device, cause the computing device to perform the method described above.

[0163] The above combination Figures 1-9 The solution of this application has been described in detail. To better understand the technical solution of this application, the following will be combined with... Figures 10-21 The specific examples shown further illustrate the solution provided in this application.

[0164] This application, based on supernode confidential computing extensions, focuses on how to solve the bottleneck problem of TEE copying model data. It assumes that, based on a supernode implementation, CPU TEE can be extended to GPU TEE. Figure 10 This is a schematic diagram illustrating the process of the Enclave virtual machine directly obtaining data from the physical device in the TEE based on VFIO technology.

[0165] Example 1

[0166] challenge:

[0167] 1. The Enclave on the CPU cannot communicate directly with the DPU: it requires a vsock channel to communicate through the parent VM;

[0168] 2. The GPU cannot communicate directly with non-TEE environments: Currently, neither the DPU nor the storage devices are TEE environments;

[0169] 3. High risk of external network communication: Storage devices and GPUs are directly connected, bypassing the CPU, and there is a lack of access control and filtering mechanisms on the CPU side, which expands the risk surface;

[0170] 4. Weak GPU security capabilities: It lacks encryption and decryption capabilities, cannot use cryptography to perform source authentication, decryption, and encryption operations on the data surface, and does not have sufficient computing power to perform security checks.

[0171] Security assumptions: The cloud administrator or customer administrator is untrusted, and the storage-side software (including the operating system) is untrusted, such as... Figure 11 As shown:

[0172] • An attacker or an untrusted administrator misconfigures the system and sends malicious data to the GPU;

[0173] • Data stored on the GPU's storage side may be tampered with or have its privacy compromised;

[0174] Problem solved: Enabling sensitive data to reach the GPU securely without bypassing the CPU, thus improving communication efficiency, such as... Figure 12 As shown.

[0175] For example, the application scenarios provided in this application can be: confidential AI, protecting sensitive inputs for inference, model parameters, and sensitive sample data, such as... Figure 13 As shown.

[0176] Figure 14 This is a schematic diagram illustrating confidential computing in a cloud service system provided in an embodiment of this application, such as... Figure 14 As shown, the control plane mainly has the following functions:

[0177] (1) Enclave obtains the security key after remote authentication with KMS and configures the key on the GPU (DPU).

[0178] (2) Enclave securely configures the [VA-UBA] page table and permission information on the DPU, and it is necessary to ensure that the page table for confidential computing is isolated from other page tables.

[0179] (3) The state security configuration of IO is configured in the DPU, so that administrators or attackers cannot forge or tamper with the relevant configuration.

[0180] The data plane mainly has the following functions:

[0181] (1) The DPU (or NPU) can encrypt the traffic coming out of the GPU, providing dual protection of confidentiality and integrity (preventing storage devices from tampering with data, leaking data, and the keys from leaving the DPU).

[0182] (2) The DPU (or NPU) can decrypt the traffic passing through the SPU to the storage device: it can perform integrity verification.

[0183] (3) The DPU (or NPU) can tag the traffic sent to the GPU and add traffic tags.

[0184] from Figure 14 As can be seen, the DPU can act as a proxy for the GPU in encryption and decryption.

[0185] Figure 15 This is the method for obtaining the expanded control plane shown in the embodiments of this application, such as... Figure 15 As shown: Keys can be obtained from KMS via a remotely authenticated enclave. In this implementation, the KMS client on the key deployment SPU directly obtains the key from KMS at the I / O granularity, and then performs encryption and decryption within the TEE environment. In this implementation, the master key is assigned at the granularity of the combined TEE entity; the data key is derived from the master key. Alternatively, the existing key acquisition process can be reused, with the KMS client on the SPU directly obtaining the key from KMS. In this implementation, the key is obtained at the granularity of the I / O stream, acquiring the key when loading the storage volume.

[0186] Figure 16 This is a schematic diagram illustrating the control plane issuing I / O tasks in an embodiment of this application. In this embodiment, the security information of the confidential environment, including keys, addresses, and permission tables, needs to be isolated from other components; and other virtual machines, host operating systems, etc., cannot tamper with or obtain it. The information passed from the Enclave to the user via vsock should be securely protected to prevent tampering by the parent virtual machine; VFIO needs to ensure security and trustworthiness when configuring the Enclave's page table to the DPU after allocating memory.

[0187] Figure 17 This is a schematic diagram illustrating secure data transmission in the data plane, as shown in the embodiments of this application. Figure 17 As shown, by invoking the GMAC algorithm, the reliability of data originating from the storage device can be ensured, and the data stored on the storage device cannot be tampered with. The DPU needs to add traffic tags to traffic destined for the GPU or Enclave. Additionally, Figure 17 A schematic diagram of a traffic packet encapsulation format used when communicating with storage devices, to which this application applies, is also shown.

[0188] Figure 18 This is another schematic diagram of the cloud service system architecture provided in this application.

[0189] The interaction between the Enclave app and KMS is based on HTTPS and uses a RESTful API for communication. However, since the Enclave lacks a network interface, HTTP cannot be used. To address this issue, the AWS Enclave SDK reimplemented the entire HTTPS processing flow and RESTful API. NitroPepper utilizes the local loopback within the Enclave to implement an HTTP-to-vsock channel, such as... Figures 19-21 As shown.

[0190] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0191] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0192] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0193] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0194] In addition, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0195] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to related technologies, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0196] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A cloud service system, characterized in that, The cloud service system includes a first virtual instance and a trusted execution environment. The trusted execution environment includes a second virtual instance and at least one physical device. The second virtual instance communicates with the at least one physical device via point-to-point transmission. The second virtual instance and the first virtual instance are connected via a virtual socket vsock channel. The at least one physical device is used to transmit data between a target device and a storage device, wherein a security key is configured on both the at least one physical device and the target device, and the data is transmitted encrypted between the target device and the storage device.

2. The cloud service system according to claim 1, characterized in that, The at least one physical device is also used to perform confidential computations on the data from the storage device in the trusted execution environment.

3. The cloud service system according to claim 1 or 2, characterized in that, The second virtual instance is used to directly access the at least one physical device; The second virtual instance is also used to perform confidential computations on the data acquired from the at least one physical device in the trusted execution environment.

4. The cloud service system according to any one of claims 1 to 3, characterized in that, The target device is configured with a first mapping relationship, which is used to indicate the user buffer address space of the target device corresponding to the virtual address of each of the at least one physical device.

5. The cloud service system according to claim 4, characterized in that, The first mapping relationship is also used to indicate access permission information corresponding to the virtual addresses of the at least one physical device, wherein the access permission information includes at least one of the following: reading data from the user buffer address space of the target device, writing data to the user buffer address space of the target device, or prohibiting access to the user buffer address space of the target device.

6. The cloud service system according to any one of claims 1 to 5, characterized in that, The target device is configured to receive a first traffic packet from the storage device, the first traffic packet carrying first indication information and data, the first indication information being used to indicate the physical device in the trusted execution environment corresponding to the data; The target device is configured to generate a second traffic packet based on the first indication information. The second traffic packet carries the second indication information and the data. The second indication information is used to mark the second traffic packet.

7. The cloud service system according to any one of claims 1 to 6, characterized in that, The data is transmitted encrypted between the target device and the storage device using an authentication encryption algorithm.

8. A method for confidential computing in a cloud service system, characterized in that, The cloud service system includes a first virtual instance and a trusted execution environment. The trusted execution environment includes a second virtual instance and at least one physical device. The second virtual instance communicates with the at least one physical device via point-to-point transmission. The second virtual instance and the first virtual instance are connected via a virtual socket vsock channel. The method includes: The at least one physical device transmits data to the target device and the storage device, wherein a security key is configured on both the at least one physical device and the target device, and the data is transmitted encrypted between the target device and the storage device.

9. The method according to claim 8, characterized in that, The method further includes: The at least one physical device performs confidential computations on the data from the storage device in the trusted execution environment.

10. The method according to claim 8 or 9, characterized in that, The method further includes: The second virtual instance performs confidential computation on the data of the at least one physical device obtained in the trusted execution environment, wherein the second virtual instance is used to directly access the at least one physical device.

11. The method according to any one of claims 8 to 10, characterized in that, The target device is configured with a first mapping relationship, which is used to indicate the user buffer address space of the target device corresponding to the virtual address of each of the at least one physical device.

12. The method according to claim 11, characterized in that, The first mapping relationship is also used to indicate access permission information corresponding to the virtual addresses of the at least one physical device, wherein the access permission information includes at least one of the following: reading data from the user buffer address space of the target device, writing data to the user buffer address space of the target device, or prohibiting access to the user buffer address space of the target device.

13. The method according to any one of claims 8 to 12, characterized in that, The method also includes The target device receives a first traffic packet from the storage device. The first traffic packet carries first indication information and data. The first indication information is used to indicate the physical device in the trusted execution environment corresponding to the data. The target device generates a second traffic packet based on the first indication information. The second traffic packet carries the second indication information and the data. The second indication information is used to mark the second traffic packet.

14. The method according to any one of claims 8 to 13, characterized in that, The data is transmitted encrypted between the target device and the storage device using an authentication encryption algorithm.

15. A Trusted Execution Environment (TEE) device, characterized in that, The TEE device is set up in a cloud service system, which further includes a first virtual instance. The TEE device includes a second virtual instance and at least one physical device. The second virtual instance communicates with the at least one physical device via point-to-point transmission. The second virtual instance is connected to the first virtual instance via a virtual socket vsock channel. The TEE device is used to execute the method as described in any one of claims 8 to 14.

16. A Trusted Execution Environment (TEE) device, characterized in that, The TEE device is set up in a cloud service system, which also includes a first virtual instance. The TEE device includes a second virtual instance and at least one physical device. The second virtual instance communicates with the at least one physical device through point-to-point transmission. The second virtual instance is connected to the first virtual instance through a virtual socket vsock channel. The TEE device includes a memory and a processor. The memory stores code, and the processor is configured to execute the code. When the code is executed, the TEE device performs the method as described in any one of claims 8 to 14.

17. A computing device cluster, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the method as described in any one of claims 8 to 14.

18. A computer storage medium, characterized in that, The computer storage medium stores a computer program, which, when executed by the computer, causes the computer to perform the method according to any one of claims 8 to 14.

19. A computer program product, characterized in that, The computer program product stores instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 8 to 14.

Images