Data security method, related apparatus, and system

Abstract

The present application relates to the field of virtualization, and provides a data security method, a related apparatus, and a system. The method is applied to a heterogeneous device. Some hardware resources or all hardware resources in a heterogeneous device are divided to a trusted execution environment (TEE) side. Confidential data is preset on the TEE side of the heterogeneous device. The method comprises: a processor of a heterogeneous device verifies on a TEE side thereof whether a virtual machine running on a TEE side of a host can acquire confidential data in the heterogeneous device; and when it is verified that the virtual machine running on the TEE side of the host cannot acquire the confidential data, the TEE side of the heterogeneous device receives an access request of the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device. By implementing the embodiments of the present application, confidential data leakage or theft can be avoided.

Description

Data confidentiality method, related device and system

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on July 18, 2023, with application number 202310882615.0 and application name “A data confidentiality method, related devices and systems”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of virtualization, and in particular to a data confidentiality method, related devices, and systems. Background Art

[0003] Confidential computing is a computing model that uses trusted hardware, combined with firmware and software, to create an encrypted, isolated, and provable computing environment to ensure the confidentiality and integrity of data within the environment, as well as the confidentiality of the computational process. Through isolation mechanisms, the general computing environment is separated from the confidential computing environment, preventing unauthorized applications from accessing the confidential computing environment. Applications running in the confidential computing environment are verified to ensure program integrity and legitimacy. Encryption mechanisms ensure that in-memory computations are encrypted, preventing snooping by privileged software and even hardware.

[0004] The foundation of confidential computing technology lies in the trusted execution environment (TEE) of the hardware architecture. Through the hardware-based isolation mechanism, it ensures that the code and data running in the TEE cannot be accessed or tampered with by untrusted code.

[0005] Confidential computing can be applied to heterogeneous systems for large-scale computing applications such as machine learning and neural networks. However, current trusted execution environment technologies cannot meet the needs of confidential data owners to protect confidential data from being stolen.

[0006] Summary of the Invention

[0007] The present application provides a data confidentiality method, related devices and systems, and proposes a new application scenario. The data confidentiality method meets the needs of the new application scenario and achieves the purpose of preventing confidential data from being leaked and stolen.

[0008] In a first aspect, the present application provides a data confidentiality method, which is applied to a heterogeneous device, wherein some or all hardware resources in the heterogeneous device are divided into a trusted execution environment (TEE) side, and the TEE side of the heterogeneous device is pre-installed with confidential data. The method includes:

[0009] The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, wherein the integrity of the TEE side of the host includes: a virtual machine running on the TEE side of the host does not have the ability to read and write the confidential data in the heterogeneous device, and the heterogeneous device and the host constitute a heterogeneous system;

[0010] When the integrity of the TEE side of the host is verified to be successful, the TEE side of the heterogeneous device receives an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

[0011] This application proposes a new application scenario and demand, namely: the owner of the confidential data does not belong to the cloud service platform, nor to the host and virtual machine tenants. The owner of the confidential data does not want the cloud service platform, the host and the virtual machine tenants to obtain the confidential data, but allows the cloud service platform or the host or the virtual machine tenants to use the confidential data through heterogeneous devices. In response to the new application scenario and demand, this application proposes a data confidentiality method, which places the confidential data that needs to be protected on the TEE side of the heterogeneous device, divides the hardware resources on the host into the TEE side and the REE side, and the processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, wherein the integrity of the TEE side of the host includes: the virtual machine running on the TEE side of the host does not have the ability to read and write confidential data in the heterogeneous device. Only when the integrity verification of the TEE side of the host is passed, the TEE side of the heterogeneous device receives the access request of the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device, and allows the virtual machine running on the TEE side of the host to use the confidential data through the heterogeneous device. The data confidentiality method solves the needs of the newly proposed application scenario and prevents the leakage or theft of confidential data.

[0012] Based on the first aspect, in a possible implementation, the processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, including: the processor of the heterogeneous device verifies the integrity of the virtual machine manager hypervisor on the TEE side of the host on the TEE side, and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host, wherein the integrity of the virtual machine manager hypervisor includes not mapping the target address on the virtual machine manager hypervisor, the target address includes the mapping address of the confidential data in the heterogeneous device on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read operations and write operations on the target address.

[0013] It can be understood that in order to prevent the virtual machine running on the TEE side of the host from having the ability to read and write confidential data in the heterogeneous device, one implementation method may be that the virtual machine manager on the TEE side of the host does not map the target address on the virtual machine manager, so that the virtual machine cannot access the target address, that is, it cannot access the confidential data. Another implementation method may be that the virtual function driver module of the virtual machine running on the TEE side of the host includes a logical code that prohibits the virtual machine from performing read and write operations on the target address, so that the virtual machine cannot access the destination address, that is, it cannot access the confidential data.

[0014] Based on the first aspect, in a possible implementation, the processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, including: the processor of the heterogeneous device generates a random number on the TEE side and sends the random number to the TEE side of the host; the processor of the heterogeneous device receives the measurement value sent by the TEE side of the host on the TEE side, and verifies the integrity of the TEE side of the host based on the measurement value.

[0015] Based on the first aspect, in a possible implementation, the access request carries input data, and the method further includes: the processor of the heterogeneous device uses the confidential data to process according to the input data to obtain a processing result; the processor of the heterogeneous device sends the processing result to the virtual machine running on the TEE side of the host.

[0016] It is understandable that the virtual machine running on the TEE side of the host cannot directly read confidential data, but can use confidential data for data processing operations through heterogeneous devices. Relative to the virtual machine, confidential data is like a "black box". The virtual machine is given input data, and the heterogeneous device uses this "black box" to process the input data and then returns the processing results to the virtual machine, thereby achieving the purpose of using confidential data for calculations while meeting the requirements of the application scenario of this application.

[0017] Based on the first aspect, in a possible implementation, the method further includes: when the integrity verification of the TEE side of the host fails, the TEE side of the heterogeneous device refuses to receive the access request of the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

[0018] In a second aspect, the present application provides a heterogeneous device, wherein some or all of the hardware resources in the heterogeneous device are divided into a trusted execution environment (TEE) side, and the TEE side of the heterogeneous device is pre-installed with confidential data, including:

[0019] a security management module, configured to verify the integrity of the host's TEE side on the TEE side of the heterogeneous device, wherein the integrity of the host's TEE side includes: a virtual machine running on the host's TEE side does not have the ability to read and write confidential data in the heterogeneous device, the heterogeneous device and the host constitute a heterogeneous system, and the security management module is located on the TEE side of the heterogeneous device;

[0020] The communication module is used to receive, on the TEE side of the heterogeneous device, an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device when the integrity of the TEE side of the host is verified.

[0021] Based on the second aspect, in a possible implementation, the security management module is used to: verify the integrity of the virtual machine manager hypervisor on the TEE side of the host, and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host on the TEE side of the heterogeneous device, wherein the integrity of the virtual machine manager hypervisor includes not mapping the target address on the virtual machine manager hypervisor, the target address includes the mapping address of the confidential data in the heterogeneous device on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read and write operations on the target address.

[0022] Based on the second aspect, in a possible implementation,

[0023] The security management module is used to generate a random number on the TEE side of the heterogeneous device;

[0024] The communication module is used to send the random number to the TEE side of the host;

[0025] The communication module is used to receive, on the TEE side of the heterogeneous device, the metric value sent by the TEE side of the host;

[0026] The security management module is used to verify the integrity of the TEE side of the host based on the measurement value.

[0027] Based on the second aspect, in a possible implementation, the access request carries input data, and the heterogeneous device further includes:

[0028] A processing module, configured to process the input data using the confidential data to obtain a processing result;

[0029] The communication module is used to send the processing result to the virtual machine running on the TEE side of the host.

[0030] Based on the second aspect, in a possible implementation, the communication module is also used to refuse to receive access requests from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device on the TEE side of the heterogeneous device when the integrity of the TEE side of the host fails to be verified.

[0031] The functional modules of the second aspect are used to implement the method described in the first aspect and the possible implementation methods of the first aspect.

[0032] In a third aspect, the present application provides a heterogeneous device comprising a memory and a processor, wherein the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the method described in the first aspect and various possible implementation methods of the first aspect.

[0033] In a fourth aspect, the present application provides a computer storage medium comprising program instructions, which, when executed by a processor, enables the processor to execute the method described in the first aspect and various possible implementations of the first aspect.

[0034] In the fifth aspect, the present application provides a data confidentiality system, including a host and a heterogeneous device, wherein some or all of the hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, and some of the hardware resources in the host are divided into a trusted execution environment TEE side. The TEE side of the heterogeneous device is pre-installed with confidential data, and the heterogeneous device is used to execute the method described in the first aspect and each possible implementation method of the first aspect.

[0035] In a sixth aspect, the present application provides a computer program product, including program instructions. When the program instructions are executed on a heterogeneous device, the heterogeneous device executes the method described in the first aspect and various possible implementations of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] FIG1 is a schematic diagram of a scenario provided by this application;

[0037] FIG2 is a schematic diagram of a system structure provided by this application;

[0038] FIG3 is a schematic diagram of a system structure for a confidential computing scenario provided by the present application;

[0039] FIG4 is a schematic diagram of a scenario provided by this application;

[0040] FIG5 is a schematic diagram of a data security system architecture provided by this application;

[0041] FIG6 is a flow chart of a data security method provided by the present application;

[0042] FIG7 is a schematic diagram of a system structure provided by this application;

[0043] FIG8 is a flow chart of a method for verifying the integrity of the TEE side of a host provided by the present application;

[0044] FIG9 is a schematic diagram of a state machine provided by this application;

[0045] FIG10 is a schematic structural diagram of a heterogeneous device provided by the present application;

[0046] FIG11 is a schematic diagram of the physical structure of a heterogeneous device provided in this application. DETAILED DESCRIPTION

[0047] Before introducing the embodiments of the present application, the technical terms involved in the embodiments of the present application are first described.

[0048] Trustzone technology was first introduced as a security extension in the ARMv6 version. It divides the hardware resources of a computing device into two worlds: a trusted execution environment (TEE) and a rich execution environment (REE). TEE can also be called a secure execution environment or a secure world, and REE can also be called a normal execution environment or a non-secure execution environment or a non-secure world.

[0049] The security of the REE environment is lower than that of the TEE environment. When the processor operates on the REE side, REE resources are accessible, but TEE resources (such as registers, memory, cache, and peripherals) are prohibited. When the processor operates on the TEE side, it can access both TEE and REE resources. The fundamental difference between the TEE and REE is the issue of permissions. The TEE side has higher operating permissions than the REE side.

[0050] In practical applications, many different types of processors are involved, such as central processing units (CPUs), graphics processing units (GPUs), and neural network processing units (NPUs). Different processor types have different performance characteristics. For example, CPUs have strong logical control capabilities but weaker computational capabilities, making them particularly limited when faced with large-scale computations. GPUs and NPUs, on the other hand, have weaker logical control capabilities but stronger computational capabilities, making them particularly adept at large-scale computations.

[0051] The CPU is a processor located on a host computer, and the host processes instructions or data through the CPU. The host can be, for example, a desktop computer, a personal laptop, a physical server, etc. In this application, other processors are running on heterogeneous devices, and other processors refer to non-CPUs. For example, a heterogeneous device may run a GPU, and the heterogeneous device processes data through the GPU. Another example is that a heterogeneous device may run an NPU, and the heterogeneous device processes data through the NPU. That is, heterogeneous devices are relative to the host computer, and the processors of heterogeneous devices are heterogeneous relative to the processor of the host computer.

[0052] Heterogeneous devices can exist in the form of Smart NICs. Alternatively, they can be plugged into a host or connected to the host through other means. The processors on the host and the heterogeneous devices work together to achieve efficient computing. A system consisting of heterogeneous devices and hosts is called a heterogeneous system.

[0053] This application proposes a new application requirement, which is introduced as follows.

[0054] Confidential data is pre-installed in a heterogeneous device, or the confidential data is deployed on the heterogeneous device. The owner of the confidential data does not want the confidential data to be obtained by other devices, including not wanting other devices to read the confidential data or modify the parameters in the confidential data, but allows other devices to use the confidential data for calculations through the heterogeneous device. For example, referring to the schematic diagram shown in Figure 1, a manufacturer produces a heterogeneous device, and a big data computing company pre-installs confidential data in the heterogeneous device. The confidential data may be, for example, a neural network model. When the heterogeneous device with pre-installed confidential data is applied on a host, the owner of the confidential data does not want the host or the virtual machine deployed on the host to obtain or modify the confidential data on the heterogeneous device, but allows the host or the virtual machine on the host to use the confidential data through other instructions. For example, the host or the virtual machine on the host issues an instruction to the heterogeneous device, and the instruction carries input data. The heterogeneous device uses the input data and pre-installed confidential data (for example, an AI model) to process and obtain the processing results. The heterogeneous device then reports the processing results to the host or the virtual machine on the host.

[0055] That is, in this application requirement, confidential data is not disclosed to other devices or other users. Other devices refer to any device other than heterogeneous devices, including hosts and virtual machines. Other users include virtual machine tenants and cloud service platforms. For other devices, confidential data is like a "black box," and other devices cannot access the data in the "black box." However, other devices can use the data in the "black box" to perform calculations through heterogeneous devices. When other devices need to use confidential data for calculations, they can send instructions to the heterogeneous devices, which then perform calculations using the confidential data according to the instructions. The heterogeneous devices then send the processing results to the other devices.

[0056] It should be noted that confidential data can be a trained neural network model or other data that needs to be protected. This application does not limit confidential data.

[0057] For the application requirements proposed by this application, traditional data confidentiality methods can no longer meet the requirements of this application scenario. The embodiment of this application provides a data confidentiality method and system. Before introducing the data confidentiality method and system provided by the embodiment of this application, the technology involved in the method of the embodiment of this application is first introduced.

[0058] Referring to Figure 2, Figure 2 is a schematic diagram of a system structure provided by the present application, wherein the system includes a host and heterogeneous devices, and the host and heterogeneous devices constitute a heterogeneous system. The processor on the host establishes a virtual machine on the host operating system through a virtual machine manager.

[0059] In a heterogeneous system, heterogeneous devices provide data space and configuration space. The data space is used to store data, such as data transmitted between the host and heterogeneous devices, and the configuration space is used to store configuration instructions and control instructions, such as those issued by the host to heterogeneous devices. The data space and configuration space on heterogeneous devices cannot be directly accessed by the host. To enable host software to access heterogeneous devices, the host's bus controller (such as the Peripheral Component Interconnect Express (PCIe) controller) allocates an address space in the host's memory. This address space is called memory mapped I / O (MMIO) space. This address space is used to map the data space and configuration space of heterogeneous devices, as shown in Figure 2.

[0060] In the device passthrough scenario, the virtual machine running on the host accesses the data space and configuration space of the heterogeneous device through the virtual address (VA). This requires two stages of mapping: virtual address -> intermediate physical address (IPA) -> MMIO address. The mapping of virtual address -> intermediate physical address is completed by the virtual machine configuration, and the mapping of intermediate physical address -> MMIO is completed by the virtual machine manager configuration.

[0061] See Figure 3, which is a schematic diagram of a system structure applied to a confidential computing scenario provided by an embodiment of the present application. In this scenario, the hardware resources on the host are divided into a trusted execution environment TEE side and a rich execution environment REE side. The hardware resources include computing power resources and memory. A first virtual machine manager (hypervisor) is deployed on the REE side of the host, and virtual machine 1 is run on the first virtual machine manager. A second virtual machine manager is deployed on the TEE side of the host, and virtual machine 2 is run on the second virtual machine manager. It can be understood that the MMIO address space is also divided into the TEE side and the REE side. Virtual machine 1 can only access the MMIO address space on the REE side, and virtual machine 2 can access the MMIO address space on the TEE side. Optionally, virtual machine 2 can also access the MMIO address space on the REE side.

[0062] The hardware resources on a heterogeneous device are divided into the TEE side and the REE side. As shown in Figure 3, the TEE side includes data space 2 and configuration space, and the REE side includes data space 1 and configuration space (not shown in the figure). For ease of description, a number is marked on a certain data space. The address space of the TEE side of the heterogeneous device is mapped to the MMIO space of the TEE side on the host, and the address space of the REE side of the heterogeneous device is mapped to the MMIO space of the REE side on the host, as shown in Figure 3. Therefore, virtual machine 2 can access the address space of the TEE side of the heterogeneous device, and virtual machine 1 can access the address space of the REE side of the heterogeneous device.

[0063] The requirements of the application scenario proposed by this application: confidential data in heterogeneous devices are prohibited from being obtained by virtual machines running on the host, and the virtual machine needs to be unable to access the target address, which includes the mapping address of the confidential data on the heterogeneous device on the host memory. In order to meet the scenario requirements of the embodiment of this application and protect confidential data from being stolen or leaked, confidential data is usually pre-placed in the storage space on the TEE side of the heterogeneous device. For example, confidential data is pre-placed in the data space on the TEE side of the heterogeneous device in Figure 3. If the purpose of prohibiting confidential data from being obtained by virtual machines running on the host is to be achieved, it is necessary that virtual machine 2 cannot access the target address, as shown in Figure 4, so that the mapping relationship between virtual machine 2 and the target address cannot be satisfied, that is, in Figure 4. shown.

[0064] Based on the system architecture shown in Figure 4 above, the present application provides a data confidentiality method and a data confidentiality system. As shown in Figure 5, Figure 5 is a schematic diagram of a data confidentiality system architecture provided by the present application. The data confidentiality system includes a host and a heterogeneous device. The hardware resources of the host are divided into a TEE side and a REE side. The TEE side of the host includes a security management module. The security management module is used to manage the hardware resources of the TEE side of the host. The hardware resources on the heterogeneous device are divided into a TEE side and a REE side. Confidential data is pre-set on the TEE side of the heterogeneous device. The TEE side of the heterogeneous device includes a security management module. The security management module is used to manage the hardware resources of the TEE side of the heterogeneous device.

[0065] Optionally, when the hardware capabilities of heterogeneous devices do not support the division of hardware resources into the TEE side and the REE side, that is, when the hardware capabilities do not support the division of access rights to hardware resources, because the software installed on the heterogeneous devices is simpler and the control logic is weaker, the probability of security vulnerabilities is smaller, and therefore the environment on the heterogeneous devices is considered to be trusted, that is, TEE.

[0066] The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, specifically including: the security management module of the TEE side of the heterogeneous device sends a request to the TEE side of the host, the request is used to verify the integrity of the TEE side of the host, and the request carries a random number; after receiving the request, the security management module of the TEE side of the host calculates the measurement value of the TEE side of the host based on the random number, and returns the measurement value to the security management module of the TEE side of the heterogeneous device; the security management module of the TEE side of the heterogeneous device determines the integrity of the TEE side of the host based on the measurement value. If the integrity of the TEE side of the host is determined to be passed, the TEE side of the heterogeneous device establishes an encrypted channel with the TEE side of the host, and the TEE side of the heterogeneous device receives the access request sent by the TEE side of the host; if the integrity of the TEE side of the host is determined to be failed, the TEE side of the heterogeneous device refuses to receive the access request sent by the TEE side of the host.

[0067] Based on the systems shown in Figures 4 and 5, an embodiment of the present application provides a data confidentiality method. See Figure 6, which is a flow chart of a data confidentiality method provided by the present application. The method includes but is not limited to the description of the following content.

[0068] S101. The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side of the heterogeneous device.

[0069] The integrity of the host's TEE side includes ensuring that the virtual machine running on the host's TEE side does not have the ability to read or write confidential data on the heterogeneous device. For example, in the diagram in Figure 4, virtual machine 2 does not have the ability to read or write confidential data on the heterogeneous device. In other words, the processor of the heterogeneous device verifies on the TEE side that the virtual machine on the host has the ability to read and write confidential data on the heterogeneous device.

[0070] In one implementation, the host's TEE-side virtual machine manager does not map the intermediate physical address (IPA) to the target address, or in other words, does not map the target address on the virtual machine manager. The target address includes the MMIO address of confidential data in the heterogeneous device on the host's memory. In this implementation, the heterogeneous device's processor only needs to verify the integrity of the host's TEE-side virtual machine manager on the TEE side. If the integrity verification of the host's TEE-side virtual machine manager passes, the virtual machine running on the host's TEE side cannot read the confidential data. The integrity of the virtual machine manager includes not mapping the target address on the virtual machine manager.

[0071] In one implementation, the virtual machine running on the TEE side of the host is provided with a function of prohibiting read operations and write operations on the target address. In this implementation, the processor of the heterogeneous device only needs to verify the integrity of the virtual function driver (VF driver) module of the virtual machine running on the TEE side of the host. If the integrity verification of the virtual function driver module of the virtual machine passes, the virtual machine running on the TEE side of the host cannot read confidential data, wherein the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read operations and write operations on the target address. Alternatively, the processor of the heterogeneous device verifies the integrity of the kernel code logic of the virtual machine running on the TEE side of the host. If the integrity verification of the kernel code logic of the virtual machine passes, the virtual machine running on the TEE side of the host cannot read confidential data, wherein the integrity of the kernel code logic includes prohibiting the virtual machine from performing read operations and write operations on the target address.

[0072] In one implementation, the processor of the heterogeneous device verifies the integrity of the virtual machine manager on the TEE side of the host and the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host on the TEE side. If the integrity verification of any one of them passes, the integrity verification of the TEE side of the host passes; if the integrity of both passes, the integrity verification of the host passes; if the integrity of both fails to pass, the integrity verification of the host fails.

[0073] The following describes how to verify the integrity of the host's TEE side with reference to Figure 7. Figure 7 is a schematic diagram of a system structure provided by this application. In Figure 7, the system includes a host and heterogeneous devices.

[0074] The hardware resources on the heterogeneous device are divided into the TEE side and the REE side. The REE side includes hardware device cluster 1, hardware device cluster 2, and a hardware device management module. The hardware device management module is used to manage the hardware devices on the REE side. The REE side also includes a physical function configuration module, which is used to communicate with the first virtual machine manager on the host. The TEE side includes hardware device cluster 3 and a security management module, which is used to manage the hardware devices on the TEE side. Confidential data is pre-installed in hardware device cluster 3 on the TEE side of the heterogeneous device.

[0075] The hardware resources on the host are divided into the TEE side and the REE side. A first virtual machine manager is deployed on the REE side, running virtual machines 1 and 2. A second virtual machine manager is deployed on the TEE side, running virtual machine 3. The TEE side also includes a security management module, which manages the TEE-side memory of the host. Optionally, the second virtual machine manager and the security management module can be integrated into a single module, which has the functions of both the second virtual machine manager and the security management module.

[0076] See Figure 8, which is a flow chart of a method for verifying the integrity of the TEE side of the host provided by this application. The method includes but is not limited to the description below.

[0077] S1011. The processor of the heterogeneous device generates a random number on the TEE side.

[0078] The processor of the heterogeneous device generates a random number (nonce) on the TEE side. In cryptography, a nonce is an abbreviation for "number once." In Figure 7, this step can be performed by the security management module on the TEE side of the heterogeneous device, which generates the nonce.

[0079] S1012. The processor of the heterogeneous device sends the random number to the TEE side of the host on the TEE side.

[0080] The processor of the heterogeneous device sends the random number from the TEE side to the host's TEE side. In the schematic diagram of Figure 7, the security management module writes the generated random number into register R1 of the heterogeneous device and generates an interrupt. After receiving the interrupt signal, the interrupt handling function in the first virtual machine manager on the host processes the interrupt and obtains the random number from register R1 of the heterogeneous device. The first virtual machine manager calls the interface of the security management module on the TEE side and sends the random number to the security management module on the host's TEE side. Register R1 can be located in the configuration space on the REE side of the heterogeneous device.

[0081] S1013. The host processor performs integrity measurement on the TEE side based on the random number to obtain a measurement value.

[0082] The host's processor performs integrity measurement on the TEE side. This step can be performed by the host's TEE side security management module.

[0083] In one example, in the schematic diagram shown in FIG7 , the code logic of the second virtual machine manager does not map a target address to an intermediate physical address, where the target address includes the MMIO address of confidential data in the heterogeneous device on the host memory. The security management module measures the integrity of the second virtual machine manager based on a random number to obtain a measurement value. The security management module is provided with an algorithm for measuring the integrity of the second virtual machine manager, and the security management module calculates the integrity of the second virtual machine manager based on the algorithm.

[0084] In one example, in the schematic diagram shown in FIG7 , the code logic of the virtual function driver module of virtual machine 3 includes code logic prohibiting virtual machine 3 from performing read and write operations on a target address, or the kernel module of virtual machine 3 includes code logic prohibiting virtual machine 3 from performing read and write operations on a target address. The security management module measures the integrity of the virtual function driver module or the kernel module of virtual machine 3 based on a random number to obtain a measurement value. The security management module is provided with an algorithm for measuring the integrity of the virtual function driver module or the kernel module of virtual machine 3, and the security management module calculates the integrity of the virtual function driver module or the kernel module of virtual machine 3 based on the algorithm.

[0085] In one example, as shown in the schematic diagram of FIG7 , the security management module can measure the integrity of both the second virtual machine manager and the integrity of the virtual function driver module (or kernel module) of virtual machine 3 to obtain a measurement value. The security management module is provided with an algorithm for measuring the integrity of the second virtual machine manager and the integrity of the virtual function driver module (or kernel module) of virtual machine 3, and the security management module calculates the integrity of both according to the algorithm.

[0086] S1014. The host processor returns the measurement value to the TEE side of the heterogeneous device on the TEE side.

[0087] The host's processor returns the measurement value on the TEE side to the heterogeneous device's TEE side. In the schematic diagram of Figure 7, the host's TEE-side security management module returns the measurement value to the first virtual machine manager. The first virtual machine manager writes the measurement value to register R2 on the heterogeneous device, and the security management module on the heterogeneous device's TEE side reads the measurement value from register R2. Register R2 can be located in the configuration space of the heterogeneous device.

[0088] S1015. The processor of the heterogeneous device verifies the integrity of the TEE side of the host based on the measurement value on the TEE side.

[0089] After receiving the measurement value on the TEE side, the processor of the heterogeneous device verifies the integrity of the host's TEE side based on the measurement value. In the schematic diagram of Figure 7, this step can be performed by the security management module on the TEE side of the heterogeneous device.

[0090] In one implementation, the security management module on the TEE side of the heterogeneous device is provided with an algorithm for calculating the integrity of the TEE side of the host. The security management module compares the received measurement value with the measurement value calculated by itself according to the algorithm. If they are consistent, the integrity verification of the TEE side of the host is passed; if they are inconsistent, the integrity verification of the TEE side of the host is failed.

[0091] In one implementation, the security management module on the TEE side of the heterogeneous device may not be configured with an algorithm for calculating the integrity of the host's TEE side. After the security management module on the host's TEE side calculates the measurement value, it sends the measurement value to a third-party server. The third-party server stores the algorithm for calculating integrity. The third-party server compares the received measurement value with the measurement value calculated by itself based on the algorithm. If they are consistent, the integrity verification on the host's TEE side passes; if they are inconsistent, the integrity verification on the host's TEE side fails. The third-party server sends the verification pass or failure result to the security management module on the TEE side of the heterogeneous device, and the security management module on the TEE side of the heterogeneous device obtains the verification result.

[0092] S102: When the integrity of the TEE side of the host is verified to be successful, the TEE side of the heterogeneous device receives an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

[0093] After the integrity of the host's TEE is verified, the heterogeneous device's TEE and the host's TEE use a key exchange protocol to generate a session key and establish an encrypted channel. Afterward, the heterogeneous device's TEE and the host's TEE communicate over the encrypted channel. For example, the heterogeneous device's TEE receives access requests from the virtual machine running on the host's TEE over the encrypted channel. The heterogeneous device's TEE processes the confidential data based on the access request, obtains the processing results, and returns the processing results to the host's TEE virtual machine over the encrypted channel.

[0094] For example, in the schematic diagram of Figure 7, after the integrity of the host's TEE is verified, the security management module on the heterogeneous device's TEE side and the security management module on the host's TEE side generate a session key through a key exchange protocol and establish an encrypted channel. The security management module on the heterogeneous device's TEE side receives an access request from virtual machine 3 running on the host's TEE side through the encrypted channel. The security management module on the heterogeneous device's TEE side processes the confidential data based on the access request, obtains a processing result, and returns the processing result to virtual machine 3 on the host's TEE side through the encrypted channel.

[0095] S103: If the integrity of the TEE side of the host fails to be verified, the TEE side of the heterogeneous device refuses to receive the access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

[0096] If the integrity verification of the host's TEE side fails, the TEE side of the heterogeneous device cannot establish an encrypted channel with the host's TEE side, and the TEE side of the heterogeneous device refuses to receive access requests from the virtual machine running on the host's TEE side to the TEE side of the heterogeneous device.

[0097] Optionally, the method further includes: the TEE side of the host verifies the integrity of the TEE side of the heterogeneous device. Specifically, the TEE side of the host sends a request to the TEE side of the heterogeneous device, the request is used to verify the integrity of the TEE side of the heterogeneous device, and the request carries a random number nonce. The TEE side of the heterogeneous device calculates a measurement value based on the random number and sends the measurement value to the TEE side of the host. The TEE side of the host determines the integrity of the TEE side of the heterogeneous device based on the measurement value. The operation of the host's TEE side verifying the integrity of the TEE side of the heterogeneous device can occur before step S101 or after step S101, and this application does not limit it.

[0098] Optionally, in one implementation, when the integrity verification of the TEE side of the heterogeneous device passes and the integrity verification of the TEE side of the host passes, the TEE side of the heterogeneous device and the TEE side of the host generate a session key through a key exchange protocol and establish an encrypted channel. The TEE side of the heterogeneous device and the TEE side of the host communicate through the encrypted channel. In this embodiment of the application, the state machine that the heterogeneous device needs to maintain is shown in Figure 9. In Figure 9,

[0099] Status 1 indicates that the integrity verification of the TEE side of the host on the heterogeneous device is not completed, including the unverified state or the verifying state.

[0100] State 2 indicates that the host's TEE has completed integrity verification of the heterogeneous device's TEE. If the integrity verification fails, the process proceeds to state 5. If the integrity verification fails, the process determines whether the heterogeneous device's TEE contains confidential data. If so, the heterogeneous device verifies the integrity of the host's TEE. If the heterogeneous device does not contain confidential data, the host's TEE communicates directly with the heterogeneous device's TEE, and the process remains operational.

[0101] State 3 indicates that when confidential data exists on the TEE side of the heterogeneous device, the integrity verification of the host TEE side by the TEE side of the heterogeneous device is completed.

[0102] State 4 indicates that the integrity verification on the host's TEE side is completed. If the verification result is passed, the host's TEE side and the heterogeneous device's TEE side are in a communication running state.

[0103] State 5 indicates an error state, including various error situations, such as an error occurring during the integrity verification of the TEE side of the heterogeneous device (from state 1 to state 5), a situation where the integrity verification of the TEE side of the heterogeneous device fails (from state 2 to state 5), a situation where the integrity verification of the host side of the TEE fails (from state 3 to state 5), and a situation where an error occurs during the integrity verification of the host side of the TEE (from state 3 to state 5), etc.

[0104] In heterogeneous devices, a status bit for "whether there is confidential data" is added. In specific implementation, this status bit can be implemented through an electronic fuse (e-fuse). When confidential data is loaded, the electronic fuse is blown to ensure that the heterogeneous device operates in a protected state.

[0105] As can be seen, this application proposes a new application scenario: confidential data is pre-set in a heterogeneous device, and the host and the virtual machine running on the host are required to be unable to obtain the confidential data in the heterogeneous device. The host and the virtual machine running on the host can only send access requests to the heterogeneous device so that the heterogeneous device processes the confidential data according to the access request, and the heterogeneous device returns the processing results to the host or virtual machine, thereby achieving the purpose of the host or virtual machine using the confidential data for calculation. For the new application scenario proposed in this application, in order to protect confidential data from being obtained by other devices, in this application scheme, the resources in the heterogeneous device are divided into the TEE side and the REE side, and the confidential data is pre-set on the TEE side of the heterogeneous device. When the virtual machine running on the TEE side of the host needs to access the confidential data, the TEE side of the heterogeneous device initiates an integrity verification challenge to the TEE side of the host. If the integrity verification on the TEE side of the host passes, the TEE side of the heterogeneous device receives the access request sent by the virtual machine on the TEE side of the host. If the integrity verification on the TEE side of the host fails, the TEE side of the heterogeneous device refuses to receive the access request sent by the virtual machine on the TEE side of the host. The method embodiment of the present application solves the needs of new application scenarios and achieves the purpose of protecting confidential data from being obtained by virtual machines and cloud service platforms.

[0106] The above describes in detail the data confidentiality method provided by the present application. Based on the same inventive concept, the following further introduces the heterogeneous device provided by the present application.

[0107] Referring to FIG. 10 , FIG. 10 is a schematic diagram of the structure of a heterogeneous device 800 provided in this application. Some or all of the hardware resources in the heterogeneous device 800 are divided into a trusted execution environment (TEE) side. The TEE side of the heterogeneous device 800 is pre-installed with confidential data. The heterogeneous device 800 includes:

[0108] A security management module 810 is configured to verify the integrity of the host's TEE on the heterogeneous device 800's TEE side. The integrity of the host's TEE includes: the virtual machine running on the host's TEE side is unable to read or write confidential data on the heterogeneous device 800. The heterogeneous device 800 and the host constitute a heterogeneous system. The security management module 810 is located on the TEE side of the heterogeneous device 800.

[0109] The communication module 820 is used to receive, on the TEE side of the heterogeneous device 800 , an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device 800 , when the integrity of the TEE side of the host is verified.

[0110] In a possible implementation, the security management module 810 is used to: verify the integrity of the virtual machine manager hypervisor on the TEE side of the host, and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host on the TEE side of the heterogeneous device 800, wherein the integrity of the virtual machine manager hypervisor includes not mapping the target address on the virtual machine manager hypervisor, the target address includes the mapping address of confidential data in the heterogeneous device 800 on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read and write operations on the target address.

[0111] In a possible implementation, the security management module 810 is used to generate a random number on the TEE side of the heterogeneous device 800; the communication module 820 is used to send the random number to the TEE side of the host; the communication module 820 is also used to receive the measurement value sent by the TEE side of the host on the TEE side of the heterogeneous device 800; the security management module 810 is used to verify the integrity of the TEE side of the host based on the measurement value.

[0112] In a possible implementation, the access request carries input data, and the heterogeneous device 800 further includes: a processing module 830 for processing the input data using confidential data to obtain a processing result; and a communication module 820 for sending the processing result to a virtual machine running on the TEE side of the host.

[0113] In a possible implementation, the communication module 820 is also used to refuse, on the TEE side of the heterogeneous device 800, to receive access requests from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device 800 if the integrity verification of the TEE side of the host fails.

[0114] It can be understood that the unit modules within the heterogeneous device 800 can also be divided into multiple types. Each module can be a software module, a hardware module, or partly a software module and partly a hardware module. This application does not limit this. Figure 10 is an exemplary introduction to the functions of each module of the heterogeneous device 800. The functions of each module described by way of example are only functions that the heterogeneous device 800 may have in some embodiments of this application. This application does not limit the functions of each module. Specifically, the specific implementation of the various operations performed by the above-mentioned heterogeneous device 800 can refer to the description in the relevant content of the above-mentioned data confidentiality method embodiment. For the sake of brevity of the specification, it will not be repeated here.

[0115] The present application provides a heterogeneous device 900. Referring to FIG11 , FIG11 is a schematic diagram of the physical structure of the heterogeneous device 900 provided by the present application. The heterogeneous device 900 includes:

[0116] Bus 902, processor 904, memory 906, and communication interface 908. Processor 904, memory 906, and communication interface 908 communicate with each other via bus 902. It should be understood that the present application does not limit the number of processors and memories in heterogeneous device 900.

[0117] Bus 902 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, for example. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG11 illustrates a single bus line, but this does not imply a single bus or type of bus. Bus 902 may include a path for transmitting information between various components of heterogeneous device 900 (e.g., memory 906, processor 904, and communication interface 908).

[0118] The processor 904 may include any one or more processors such as a graphics processing unit (GPU), a neural network processing unit (NPU), a microprocessor (MP), or a digital signal processor (DSP).

[0119] The memory 906 may include volatile memory, such as random access memory (RAM). The memory 906 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0120] The memory 906 stores executable codes, and the processor 904 executes the executable codes to implement the functions of the heterogeneous device 800, thereby implementing a data security method. In other words, the memory 906 stores instructions for executing a data security method.

[0121] The communication interface 908 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the heterogeneous device 900 and other devices or communication networks.

[0122] An embodiment of the present application also provides a data confidentiality system, including a host and a heterogeneous device, where some or all hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, and some hardware resources in the host are divided into a trusted execution environment TEE side. The TEE side of the heterogeneous device is pre-installed with confidential data, and the heterogeneous device can be the above-mentioned heterogeneous device 800 or heterogeneous device 900.

[0123] An embodiment of the present application further provides a computer program product comprising instructions, which, when executed on at least one heterogeneous device, enables the at least one heterogeneous device to execute a data security method.

[0124] Embodiments of the present application also provide a readable storage medium. The readable storage medium can be any available medium that can be stored by a heterogeneous device, or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, or a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The readable storage medium includes instructions that instruct the heterogeneous device to execute a data security method.

[0125] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0126] In the above embodiments, it can be implemented in whole or in part by software, hardware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a heterogeneous device, the process or function described in the embodiment of the present application is generated in whole or in part. The heterogeneous device may be a GPU, NPU or other, etc. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium, or a semiconductor medium, etc.

[0127] The above is only a specific embodiment of the present application. Those skilled in the art may conceive of changes or substitutions based on the specific embodiment provided in this application, and all such changes or substitutions shall fall within the scope of protection of this application.

Claims

1. A data confidentiality method, characterized in that: The method is applied to a heterogeneous device, where some or all hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, and the TEE side of the heterogeneous device is pre-set with confidential data. The method includes: The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, wherein the integrity of the TEE side of the host includes: the virtual machine running on the TEE side of the host does not have the ability to read and write the confidential data in the heterogeneous device, and the heterogeneous device and the host constitute a heterogeneous system; When the integrity of the TEE side of the host is verified, the TEE side of the heterogeneous device receives an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

2. The method according to claim 1, characterized in that The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, including: The processor of the heterogeneous device verifies the integrity of the virtual machine manager hypervisor on the TEE side of the host, and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host, wherein the integrity of the virtual machine manager hypervisor includes not mapping the target address on the virtual machine manager hypervisor, the target address includes the mapping address of the confidential data in the heterogeneous device on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read operations and write operations on the target address.

3. The method according to claim 1 or 2, characterized in that: The processor of the heterogeneous device verifies the integrity of the TEE side of the host on the TEE side, including: The processor of the heterogeneous device generates a random number on the TEE side and sends the random number to the TEE side of the host; The processor of the heterogeneous device receives the measurement value sent by the TEE side of the host on the TEE side, and verifies the integrity of the TEE side of the host according to the measurement value.

4. The method according to any one of claims 1 to 3, characterized in that: The access request carries input data, and the method further includes: The processor of the heterogeneous device performs processing using the confidential data according to the input data to obtain a processing result; The processor of the heterogeneous device sends the processing result to the virtual machine running on the TEE side of the host.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: When the integrity verification of the TEE side of the host fails, the TEE side of the heterogeneous device refuses to receive an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device.

6. A heterogeneous device, characterized in that: Part or all of the hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, and the TEE side of the heterogeneous device is pre-set with confidential data, including: A security management module, used for verifying the integrity of the TEE side of the host on the TEE side of the heterogeneous device, wherein the integrity of the TEE side of the host includes: a virtual machine running on the TEE side of the host does not have the ability to read and write the confidential data in the heterogeneous device, the heterogeneous device and the host constitute a heterogeneous system, and the security management module is located on the TEE side of the heterogeneous device; The communication module is used to receive, on the TEE side of the heterogeneous device, an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device when the integrity of the TEE side of the host is verified.

7. The heterogeneous device according to claim 6, characterized in that: The security management module is used for: Verify the integrity of the virtual machine manager hypervisor on the TEE side of the host and / or the integrity of the virtual function driver module of the virtual machine running on the TEE side of the host on the TEE side of the heterogeneous device, wherein the integrity of the virtual machine manager hypervisor includes not mapping the target address on the virtual machine manager hypervisor, the target address includes the mapping address of the confidential data in the heterogeneous device on the host memory, and the integrity of the virtual function driver module includes prohibiting the virtual machine from performing read operations and write operations on the target address.

8. The heterogeneous device according to claim 6 or 7, characterized in that: The security management module is used to generate a random number on the TEE side of the heterogeneous device; The communication module is used to send the random number to the TEE side of the host; The communication module is used to receive, at the TEE side of the heterogeneous device, the metric value sent by the TEE side of the host; The security management module is used to verify the integrity of the TEE side of the host according to the measurement value.

9. The heterogeneous device according to any one of claims 6 to 8, characterized in that: The access request carries input data, and the heterogeneous device further includes: A processing module, used to process the confidential data according to the input data to obtain a processing result; The communication module is used to send the processing result to the virtual machine running on the TEE side of the host.

10. The heterogeneous device according to any one of claims 6 to 9, characterized in that: The communication module is also used to, when the integrity verification of the TEE side of the host fails, refuse to receive an access request from the virtual machine running on the TEE side of the host to the TEE side of the heterogeneous device on the TEE side of the heterogeneous device.

11. A data security system, characterized in that: It includes a host and a heterogeneous device, part of the hardware resources or all of the hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side, part of the hardware resources in the host are divided into a trusted execution environment TEE side, the TEE side of the heterogeneous device is pre-installed with confidential data, and the heterogeneous device is used to execute the method as described in any one of claims 1 to 5.

12. A heterogeneous device, characterized in that: The method comprises a memory and a processor, wherein the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the method according to any one of claims 1 to 5.

13. A computer storage medium, characterized in that: The method comprises program instructions, and when the program instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 5.

14. A computer program product, characterized in that The method comprises program instructions, and when the program instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 5.

Images