Data processing method and related device

Abstract

Disclosed are a data processing method and a related device, which are used for improving the starting speed of confidential virtual machines. The method comprises: receiving a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image from a client device; performing measurement on the value of a root node of the hash tree to obtain a first measurement value; and, according to the confidential virtual machine image, running a confidential virtual machine, the first measurement value being used for attesting the integrity of the confidential virtual machine.

Description

Data processing method and related equipment

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on July 25, 2023, with application number 202310923014.X and invention name “Data Processing Method and Related Equipment”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of Internet technology, and in particular to a data processing method and related equipment. Background Art

[0003] Confidential computing is a technology that protects data confidentiality while performing computations. It employs a combination of security technologies to ensure the confidentiality of data and applications. Confidential computing typically uses encryption algorithms to protect data confidentiality. Unlike traditional encryption technologies, confidential computing encrypts data not only during transmission but also during computation and processing. This means data remains encrypted throughout the computation process, preventing unauthorized access and surveillance.

[0004] One implementation of confidential computing is confidential virtual machines. Confidential VMs typically run on cloud service providers. To prevent tampering with the confidential VM's programs by the cloud provider's hypervisor or staff, trusted boot and remote attestation technologies are required. Trusted boot ensures the confidential VM's boot process is secure and reliable. It uses hashing and digital signature technology to measure the integrity of each component and driver during the confidential VM's boot process, storing the results in trusted hardware. Remote attestation uses hashing and digital certificate technology to prove to another computing unit (typically a confidential computing user) that the confidential VM's hardware and programs have not been tampered with.

[0005] Compared to standard boot, trusted boot adds a measurement step. In confidential computing scenarios, the entire confidential virtual machine needs to be measured. VM sizes range from 1GB to 100GB. Loading 10GB into memory at once during boot takes 5 to 10 seconds, making trusted boot slow.

[0006] Summary of the Invention

[0007] The present application provides a data processing method and related devices to solve the problem of slow startup speed of confidential virtual machines.

[0008] The first aspect provides a data processing method. The method is applied to a confidential computing server device. The confidential computing server device can be a server or a server cluster, and the confidential computing server device can also be a terminal device. The method includes: receiving a confidential virtual machine image from a client device and a hash tree corresponding to the confidential virtual machine image. Measuring the value of the root node of the hash tree to obtain a first measurement value. The first measurement value can be stored in a trusted module of the confidential computing server device to ensure that the first measurement value will not be changed. The confidential virtual machine image is used to run the confidential virtual machine, and the first measurement value is used to prove the integrity of the confidential virtual machine. When starting the confidential virtual machine image, only the root node of the hash tree of the confidential virtual machine image is measured, without measuring the entire confidential virtual machine. The root node of the hash tree has a small amount of data and a short measurement time, which can improve the startup speed of the confidential virtual machine.

[0009] In one possible implementation, running a confidential virtual machine using a confidential virtual machine image includes: obtaining a target data block from the confidential virtual machine image based on the confidential virtual machine's operating requirements; verifying the integrity of the target data block based on the target data block, a hash tree, and a first metric; if the target data block is complete, running the target data block; if the target data block is incomplete, stopping the confidential virtual machine. While the confidential virtual machine is running, the integrity of the data blocks required for operation is verified. In actual operation, a confidential virtual machine often does not need to run all the data in the confidential virtual machine image, but only a portion of it. Therefore, verifying the integrity of the data blocks on demand during runtime can significantly reduce the time required to start the confidential virtual machine.

[0010] In one possible implementation, a hash tree includes a target path corresponding to a target data block, the target path includes a leaf node storing a first hash value of the target data block, and an ancestor node of the leaf node, the ancestor node including a root node. The integrity of the target data block is verified based on the target data block, the hash tree, and the first metric value, including: calculating a second hash value of the target data block; determining whether the target path is trustworthy based on the first metric value; if the first hash value is the same as the second hash value and the target path is trustworthy, then the target data block is determined to be complete; if the first hash value is different from the second hash value, or the target path is untrustworthy, then the target data block is determined to be incomplete. The first metric value in the trusted module is the trust root of the trust chain, and the trust chain is the first metric value in the trusted module → target path → target data block. Under the premise that the first metric value is trustworthy, the target path is trusted based on the first metric value, and the target data block is completely authenticated based on the target path, which can ensure that the target data block is complete, thereby ensuring the trustworthiness of the confidential computing environment.

[0011] In one possible implementation, determining whether a target path is trustworthy based on a first metric value includes: measuring a root node to obtain a second metric value; calculating hash values ​​of all child nodes in the target path, where a child node is a node other than the root node in the target path; comparing whether the first metric value is the same as the second metric value, and comparing whether the hash value of each child node is the same as the hash value of the child node stored in the parent node of the child node in the hash tree; if the first metric value is the same as the second metric value, and the hash value of each child node is the same as the hash value of the child node stored in the parent node of the child node in the target path, determining that the target path is trustworthy.

[0012] In one possible implementation, the method also includes: obtaining attributes of multiple memory pages, the multiple memory pages include data loaded into the memory after at least two virtual machines are started, the at least two virtual machines include a confidential virtual machine, the attributes include a confidentiality attribute, an integrity attribute and a mergeability attribute, the value of the confidentiality attribute indicates confidentiality or non-confidentiality, the value of the integrity attribute indicates integrity or non-integrity, and the value of the mergeability attribute indicates mergeability or non-mergeability; based on the attributes of the multiple memory pages, memory deduplication of the confidential virtual machine can be achieved while ensuring the integrity and confidentiality of the confidential virtual machine, thereby improving memory utilization.

[0013] In one possible implementation, based on the attributes of multiple memory pages, merging memory pages with identical data, a confidentiality attribute value indicating non-confidentiality, and a mergeability attribute value indicating mergeability in the multiple memory pages includes: obtaining, based on the attributes of the multiple memory pages, target memory pages with a confidentiality attribute value indicating non-confidentiality and a mergeability attribute value indicating mergeability; and merging memory pages with identical data in the target memory pages. This allows for memory deduplication of confidential virtual machines while ensuring the integrity and confidentiality of the virtual machines, thereby improving memory utilization.

[0014] The second aspect provides a data processing method. This aspect is applied to a client device. The method includes: calculating the confidential virtual machine image to obtain a corresponding hash tree; sending the confidential virtual machine image and the hash tree to a confidential computing server device, where the hash tree is used to prove the integrity of the confidential virtual machine image, so that the confidential computing server device obtains a first metric value corresponding to the root node of the hash tree and then uses the confidential virtual machine image to run the confidential virtual machine. Because the hash tree is obtained by the client device calculating the confidential virtual machine image, it can be used to prove the integrity of the confidential virtual machine image, so that the confidential computing server device can subsequently verify the integrity of the confidential virtual machine based on the hash tree.

[0015] In one possible implementation, the method further includes: receiving verification information sent by a confidential computing server device, the verification information including a first metric value, the first metric value being used to prove the integrity of the confidential virtual machine; determining the integrity of the confidential virtual machine based on the verification information; and sending data to be analyzed to the confidential computing server device, so that the confidential virtual machine running on the confidential computing server device analyzes the data to be analyzed. After proving that the confidential computing environment on the confidential computing server device is complete and trustworthy based on the first metric value, the data to be analyzed is uploaded, thereby ensuring that the data to be analyzed will not be leaked or stolen, and ensuring the security of the data to be analyzed during the calculation process.

[0016] In a possible implementation, determining that the confidential virtual machine is intact according to the verification information includes: determining whether a first measurement value meets expectations; and determining that the confidential virtual machine is intact if the first measurement value meets expectations.

[0017] A third aspect provides a data processing device. The device includes a transceiver module and a processing module. The transceiver module is configured to receive a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image from a client device. The processing module is configured to measure the value of a root node of the hash tree to obtain a first measurement value. The processing module is configured to run a confidential virtual machine using the confidential virtual machine image, and the first measurement value is used to verify the integrity of the confidential virtual machine.

[0018] In one possible implementation, a processing module is configured to obtain a target data block from a confidential virtual machine image based on the confidential virtual machine's operating requirements. The processing module is configured to verify the integrity of the target data block based on the target data block, the hash tree, and the first metric value. The processing module is configured to execute the target data block if the target data block is complete. The processing module is configured to stop the confidential virtual machine if the target data block is incomplete.

[0019] In one possible implementation, a hash tree includes a target path corresponding to a target data block, the target path including a leaf node storing a first hash value of the target data block and an ancestor node of the leaf node, the ancestor node including a root node; and a processing module configured to calculate a second hash value of the target data block. The processing module is configured to determine whether the target path is trustworthy based on a first metric value. The processing module is configured to determine that the target data block is complete if the first hash value and the second hash value are the same and the target path is trustworthy. The processing module is configured to determine that the target data block is incomplete if the first hash value and the second hash value are different or the target path is untrustworthy.

[0020] In one possible implementation, a processing module is configured to measure a root node to obtain a second metric value; the processing module is configured to calculate hash values ​​of all child nodes in a target path, where a child node is a node other than the root node in the target path; the processing module is configured to compare whether the first metric value is the same as the second metric value, and to compare whether the hash value of each child node is the same as the hash value of the child node stored in the parent node of the child node in the hash tree; and the processing module is configured to determine that the target path is credible when the first metric value is the same as the second metric value and the hash value of each child node is the same as the hash value of the child node stored in the parent node of the child node in the target path.

[0021] In one possible implementation, a processing module is configured to obtain attributes of multiple memory pages, where the multiple memory pages include data loaded into memory after at least two virtual machines are started, the at least two virtual machines including a confidential virtual machine, the attributes including a confidentiality attribute, an integrity attribute, and a mergeability attribute, wherein the value of the confidentiality attribute indicates confidentiality or non-confidentiality, the value of the integrity attribute indicates integrity or non-integrity, and the value of the mergeability attribute indicates whether the data is mergeable or not. The processing module is configured to merge, based on the attributes of the multiple memory pages, memory pages that have identical data, whose confidentiality attribute value indicates non-confidentiality, and whose mergeability attribute value indicates mergeability.

[0022] In one possible implementation, a processing module is used to obtain, based on the attributes of multiple memory pages, a target memory page in which the value of the confidentiality attribute indicates no confidentiality and the value of the mergeability attribute indicates mergeability; and the processing module is used to merge memory pages with the same data in the target memory page.

[0023] A fourth aspect provides a data processing device. The device includes a transceiver module. The transceiver module is configured to send a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image to a confidential computing server. The hash tree is configured to verify the integrity of the confidential virtual machine image, so that the confidential computing server obtains a first metric value corresponding to a root node of the hash tree and then uses the confidential virtual machine image to run the confidential virtual machine.

[0024] In one possible implementation, the apparatus further includes a processing module, a transceiver module configured to receive verification information sent by a confidential computing server device, the verification information including a first metric value used to prove the integrity of the confidential virtual machine; a processing module configured to determine the integrity of the confidential virtual machine based on the verification information; and a transceiver module configured to send data to be analyzed to the confidential computing server device, so that the confidential virtual machine running on the confidential computing server device analyzes the data to be analyzed.

[0025] In a possible implementation, the processing module is configured to determine whether the first metric value meets expectations; and the processing module is configured to determine that the confidential virtual machine is intact when the first metric value meets expectations.

[0026] A fifth aspect provides a data processing method, which includes: obtaining attributes of multiple memory pages, the multiple memory pages including data loaded into the memory after at least two virtual machines are started, the at least two virtual machines including a confidential virtual machine, the attributes including a confidentiality attribute, an integrity attribute and a mergeability attribute, the value of the confidentiality attribute indicating confidentiality or non-confidentiality, the value of the integrity attribute indicating integrity or non-integrity, and the value of the mergeability attribute indicating whether it can be merged or not; according to the attributes of the multiple memory pages, merging the memory pages in the multiple memory pages that have the same data, the value of the confidentiality attribute indicating non-confidentiality, and the value of the mergeability attribute indicating that it can be merged.

[0027] In one possible implementation, based on the attributes of multiple memory pages, memory pages having the same data, whose confidentiality attribute values ​​indicate no confidentiality, and whose mergeability attribute values ​​indicate mergeable are merged are merged, including: based on the attributes of the multiple memory pages, obtaining target memory pages having the confidentiality attribute values ​​indicating no confidentiality, and whose mergeability attribute values ​​indicate mergeable are mergeable; and merging memory pages having the same data in the target memory pages.

[0028] A sixth aspect provides a data processing device, comprising a processing module. The processing module is configured to obtain attributes of multiple memory pages, the multiple memory pages comprising data loaded into memory after at least two virtual machines are started, the at least two virtual machines comprising a confidential virtual machine, the attributes comprising a confidentiality attribute, an integrity attribute, and a mergeability attribute, the value of the confidentiality attribute indicating confidentiality or non-confidentiality, the value of the integrity attribute indicating integrity or non-integrity, and the value of the mergeability attribute indicating whether the data can be merged or not. The processing module is further configured to merge, based on the attributes of the multiple memory pages, memory pages having the same data, having a confidentiality attribute value indicating non-confidentiality, and having a mergeability attribute value indicating mergeability.

[0029] In one possible implementation, a processing module is used to obtain, based on the attributes of multiple memory pages, a target memory page in which the value of the confidentiality attribute indicates no confidentiality and the value of the mergeability attribute indicates mergeability; and the processing module is used to merge memory pages with the same data in the target memory page.

[0030] A fifth aspect provides a computing device. The computing device includes a processor and a memory, wherein the processor is coupled to the memory, and the processor is configured to execute, based on instructions stored in the memory, the data processing method of the first aspect or any possible implementation of the first aspect, the data processing method of the second aspect or any possible implementation of the second aspect, or the data processing method of the fifth aspect or any possible implementation of the second aspect.

[0031] A sixth aspect provides a computer-readable storage medium. The computer-readable storage medium includes instructions that, when executed on a computer, cause the computer to execute the data processing method of the first aspect or any possible implementation of the first aspect, the data processing method of the second aspect or any possible implementation of the second aspect, or the data processing method of the fifth aspect or any possible implementation of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] FIG1 is a schematic diagram of the architecture of a server running a virtual machine;

[0033] FIG2 is a schematic diagram of starting the operating system kernel in a trusted boot;

[0034] FIG3 is a schematic diagram of the architecture of a confidential computing system provided by this application;

[0035] FIG4 is a schematic diagram comparing traditional trusted boot and the trusted boot provided by this application;

[0036] FIG5 is a flow chart of a data processing method provided by the present application;

[0037] FIG6 is a schematic diagram of the structure of a hash tree provided in this application;

[0038] FIG7 is a flow chart of a method for operating a confidential virtual machine provided by this application;

[0039] FIG8 is a schematic diagram of memory deduplication of a confidential virtual machine provided by this application;

[0040] FIG9 is a schematic structural diagram of a data processing device provided by the present application;

[0041] FIG10 is a schematic diagram of the structure of a computing device provided in this application. DETAILED DESCRIPTION

[0042] The present application provides a data processing method and related devices to improve the startup speed of confidential virtual machines.

[0043] The following describes the embodiments of the present application in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of the present application, rather than all the embodiments. Those skilled in the art will appreciate that with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0044] The terms "first," "second," and the like in the specification and claims of this application and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0045] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0046] In order to better explain the technical solution of this application, the relevant terms involved in this application are explained below.

[0047] A virtual machine (VM) is a complete computer system that runs in a completely isolated environment and has complete hardware system functions, simulated by software. Any work that can be done in a server can be done in a virtual machine. When creating a virtual machine in a server, part of the hard disk and memory capacity of the physical machine needs to be used as the hard disk and memory capacity of the virtual machine. Each virtual machine has an independent hard disk and operating system, and the user of the virtual machine can operate the virtual machine just like using a server. As shown in Figure 1, the server includes a hardware layer and a software layer. The hardware layer is the general configuration of the server, such as memory, processor, disk, and peripheral component interconnect (PCI) devices. PCI devices can be, for example, network cards, graphics processing units (GPUs), offload cards, and other devices that can be inserted into the PCI / PCIe slots of the server. The software layer includes the operating system installed and running on the server (referred to as the host operating system, as opposed to the virtual machine's operating system). The host operating system includes a virtual machine monitor (VMM), also known as a hypervisor. The VMM implements compute, network, and storage virtualization for the virtual machines and manages them. Compute virtualization involves providing portions of the server's processor and memory to the virtual machines. Network virtualization involves providing some network interface card functionality (such as bandwidth) to the virtual machines. Storage virtualization involves providing portions of the disk to the virtual machines.

[0048] Confidential computing, based on trusted hardware, builds a secure, isolated, and provable computing environment to protect the confidentiality and integrity of data and code, as well as the confidentiality of the computing process. The computing process refers to the process of program execution, which generates process segments, data segments, process control blocks, and all data involved in process communication.

[0049] A confidential computing virtual machine (Confidential Computing VM) is an operating environment that includes a complete confidential computing operating system and confidential computing applications. The confidential computing operating system can support a complete application or a separate, sensitive portion of an application. Hereinafter, the confidential computing VM will be referred to as a confidential VM.

[0050] A secure channel is a communication channel that provides confidentiality and authenticity for exchanged messages. It ensures the secure transmission of local data to the confidential computing environment.

[0051] Confidentiality is the property of using cryptographic technology to ensure that information is not leaked.

[0052] Integrity: the quality of being accurate and complete.

[0053] A confidential computing environment is a collection of software and related components deployed on a confidential computing platform.

[0054] A general computing environment (GCE) lacks confidential computing capabilities and is a collection of software and related components that only provide basic functions and computing resources. A GCE is an independent operating environment that exists independently of a confidential computing environment.

[0055] A confidential computing application program is an application deployed and run in a confidential computing environment. Application-layer components in a confidential computing environment, including any processing logic involving sensitive data, should be implemented within the confidential computing application program.

[0056] Confidential computing operating system, a system software layer component in a confidential computing environment, is an operating system based on the trusted execution control unit and instruction set encapsulation and tailoring of the underlying chip. It mainly provides functions such as computing resource scheduling, isolated memory space management, and communication mechanism with ordinary computing environments for confidential computing environments.

[0057] Confidential computing platform, which provides a collection of confidential computing infrastructure and supporting software.

[0058] Trusted startup measures the confidential computing environment before the system starts to ensure its integrity and authenticity.

[0059] Measurement extends the hash value of files (such as confidential computing environments and confidential computing applications) on the confidential computing server to the trusted hardware. The extended value stored in the trusted hardware is the measurement value. The measurement value is a unique value of the measurement object calculated using the corresponding algorithm. If the measurement value of a measurement object changes before and after, it can be considered that the measurement object has changed or been modified. Therefore, the measurement value can be used as evidence to prove the integrity of the corresponding file.

[0060] Remote attestation: The client verifies the integrity of the confidential computing environment and confidential computing applications on the confidential computing server based on verification information such as measurement values.

[0061] Confidential computing is a technology that protects data confidentiality while performing computations. It employs a combination of security technologies to ensure the confidentiality of data and applications. Confidential computing typically uses encryption algorithms to protect data confidentiality. Unlike traditional encryption technologies, confidential computing encrypts data not only during transmission but also during computation and processing. This means data remains encrypted during the computation process, preventing unauthorized access and snooping. Confidential computing has broad application prospects in cloud computing, finance, banking, healthcare, blockchain smart contracts, mobile computing devices, and federated learning. For example, in cloud computing, data ownership belongs to the user, while the computing power required for data computation must be performed in the cloud. Confidential computing can prevent data from being stolen or tampered with by attackers (including cloud service providers) during use. For example, in healthcare, medical data contains a large amount of personal privacy, such as patient information, user profiles, and genetic data. This makes it difficult for medical institutions, insurance companies, pharmaceutical companies, and medical device manufacturers to effectively share and collaborate on data, hindering the effective utilization of medical data. Confidential computing can establish a secure data circulation infrastructure for all parties involved in medical data, maximizing the value of medical data. For example, in financial scenarios, to ensure the smooth flow of funds, financial institutions utilize big data to build risk control models and use technical means to reduce the likelihood of risk events. Financial institutions often rely on government, corporate, and personal data to support credit risk control and marketing. However, traditional models have struggled to efficiently and legally obtain corporate and personal data due to data security concerns. Confidential computing technology enables distributed model inference and training without disclosing the original data of all parties. Government departments can share government data with financial institutions, and through confidential computing, they can conduct compliant data analysis and achieve precise risk control.

[0062] Confidential VMs are one way to implement confidential computing. They enable computing and processing without exposing data, protecting the privacy and security of sensitive data. They also provide complete security isolation, preventing intrusion and attacks from malware and attackers. Malware, for example, includes the hypervisor that controls Confidential VMs. Attackers, for example, include system administrators, such as employees of cloud service providers.

[0063] In addition to preventing confidential data from being stolen, programs must also be protected from tampering, which requires trusted boot and remote attestation. Trusted boot ensures a secure and reliable system boot process. It uses hashing and digital signature technology to measure the integrity of each component and driver during the device boot process, storing the results in trusted hardware. Remote attestation uses hashing and digital certificate technology to confirm to another computing unit (typically a confidential computing user) that the device's hardware and programs have not been tampered with.

[0064] Measurement is a key technology in trusted boot, addressing the risk of system tampering or malicious code being implanted during device boot, thereby ensuring system integrity. Typically, boot measurement (measurement during trusted boot) is implemented using a hardware root of trust, such as a trusted platform module (TPM), a trusted cryptography module (TCM), or a trusted platform control module (TPCM). The operating system's boot measurement process follows the principle of "measure first, then run." In trusted boot, each module in the operating system completes trust verification step by step, meaning each component in the system boot sequence undergoes integrity measurement at each step. Specifically, the current stage code measures the next stage code. The current stage code then extends the measurement value obtained from the next stage code into the TPM's Platform Configuration Register (PCR). The next stage code then becomes the updated current stage code, and the above process is repeated for the new next stage code. This cycle repeats until all system code has been measured, and the system is then run. The trusted boot process for an operating system is as follows: first, the BIOS or UEFI is started; then, the BIOS / UEFI loads the entire code of the operating system's boot loader into memory and measures the entire code of the boot loader; after the boot loader starts, the entire code of the operating system's kernel is loaded into memory and measured; after the kernel starts, the entire code of the system drivers is loaded into memory and measured… Finally, after all the code of the operating system has been measured, the operating system boot is completed. In other words, the entire operating system must be measured before the boot is complete. The measurement values ​​in the PCR serve as measurement evidence during the system boot phase and are sent by the confidential computing server (the computing power provider performing confidential computing) to the remote attestation initiator to determine whether the confidential computing server is trusted.

[0065] Remote attestation is a key technology in the overall confidential computing solution. It allows users to verify the confidential computing server's trustworthiness. The remote attestation process involves the remote attestation initiator issuing an attestation challenge to the confidential computing server through the remote attestation interface. The confidential computing server responds to the attestation challenge by sending verification information, such as the PCR measurement values, to the remote attestation initiator. Based on this verification information, the remote attestation initiator determines the trustworthiness of the confidential computing environment provided by the confidential computing server. Alternatively, a trusted third-party entity can also perform remote attestation on the remote computing server.

[0066] Trusted boot involves a measurement step. Larger files can slow down boot times, resulting in slower trusted boot. For example, as shown in Figure 2, when booting the operating system kernel, the bootloader must load all kernel code into memory to calculate its measurement. This hash value is then recorded in the hardware root of trust. In confidential computing scenarios, the entire confidential virtual machine (VM) must be measured during boot. This VM includes the confidential operating system and the confidential computing application. Confidential VMs range in size from 1GB to 100GB. Loading 10GB of data into memory at once during boot takes 5 to 10 seconds.

[0067] In order to solve the above technical problems, the present application provides the following embodiments.

[0068] As shown in Figure 3, Figure 3 is a schematic diagram of the architecture of a confidential computing system provided by this application. The confidential computing system includes a client device and a confidential computing server device. A secure channel is established between the confidential computing server device and the client device, and data is transmitted based on the secure channel, which can protect the integrity of the data during transmission between the two. The client device can be a mobile phone, computer, laptop, tablet computer, car computer and smart wearable device. The confidential computing server device is the computing power provider. In the cloud computing scenario, the confidential computing server device can be an infrastructure in a public cloud, private cloud or hybrid cloud, such as a server or a server cluster. Of course, in other scenarios, the confidential computing server device can also be a terminal device with computing power, such as a mobile phone, computer, laptop, tablet computer, car computer and smart wearable device.

[0069] To address the slow startup of confidential virtual machines, this embodiment measures only the root node of the hash tree corresponding to the confidential virtual machine image during virtual machine startup. Because the hash tree root node contains a small amount of data, the measurement can be completed quickly, enabling rapid startup of the confidential virtual machine. During runtime, data blocks within the confidential virtual machine image are retrieved based on the confidential virtual machine's operational requirements. Before running these blocks, their integrity is verified using the hash tree.

[0070] Specifically, in this embodiment, the client device is used to send a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image to a confidential computing server device. The confidential virtual machine image includes software for data analysis (such as a confidential operating system, confidential computing applications, and algorithms). The hash tree is used to prove the integrity of the confidential virtual machine image. The confidential computing server device measures the value of the root node of the hash tree to obtain a measurement value, which is stored in a trusted module. After the confidential computing server device completes the measurement of the root node of the hash tree, it uses the confidential virtual machine image to start the confidential virtual machine. After the confidential virtual machine is started, the confidential computing server device proves the integrity of the confidential virtual machine to the client device through remote attestation. The measurement value stored in the trusted module is one of the verification information for verifying the integrity of the confidential virtual machine. After the client device completes the integrity verification of the confidential virtual machine based on the verification information from the confidential computing server device, it confirms that the confidential computing environment of the confidential computing server device is trustworthy and uploads the data to be analyzed to the confidential computing server device. The confidential virtual machine created and started based on the confidential virtual machine image from the client device, running on the confidential computing server device, analyzes and calculates the data to be analyzed to obtain an analysis result.

[0071] Because the confidential computing server device only measures the root node of the hash tree of the confidential virtual machine image at startup and does not verify the integrity of the confidential virtual machine image, in this embodiment, when the confidential virtual machine is running, the confidential virtual machine loads the corresponding data block in the confidential virtual machine image according to the operating requirements and verifies the integrity of the data block based on the hash tree and the measurement value. If the verification succeeds and the data block is complete, it means that the data block has not been modified and the data block can be run. If the verification fails and the data block and / or hash tree are incomplete, it means that the data block and / or hash tree have been modified, and the confidential virtual machine is stopped.

[0072] Figure 4 illustrates the trusted boot provided by this solution compared to traditional trusted boot. Unlike traditional trusted boot, which measures the integrity of the entire virtual machine at boot time to verify its integrity, this solution verifies the integrity of data blocks within the virtual machine image during virtual machine operation, based on operational requirements. While slower than traditional trusted boot at runtime, this solution still consumes less time overall than traditional solutions because the virtual machine's operating system does not require loading all data blocks of the virtual machine image to run.

[0073] Based on the above confidential computing system, the present application provides the following method embodiments. As shown in FIG5 , FIG5 is a flow chart of a data processing method provided by the present application.

[0074] S501: The client device sends a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image to the confidential computing server device.

[0075] A confidential virtual machine image includes an operating system, confidential computing applications, and algorithms. This allows the confidential computing server to create a confidential computing environment based on the confidential virtual machine image. This ensures data is not leaked when the algorithm is subsequently run to analyze and calculate data, improving the security of data analysis on the confidential computing server. Confidential computing programs include remote attestation programs, business programs, or service programs within the confidential operating system.

[0076] In this embodiment, the client device also sends a hash tree corresponding to the confidential virtual machine image to the confidential computing server device. Hash tree, also known as Merkle tree, is a tree data structure in cryptography and computer science. The hash tree includes leaf nodes, intermediate nodes (or branch nodes) and root nodes. Each leaf node of the hash tree uses the hash value of the data block as a label, and the nodes other than the leaf nodes use the hash value obtained by hashing the labels of their child nodes as labels. Hash calculation refers to the use of a hash algorithm such as Secure Hash Algorithm (SHA) or message digest algorithm (MD)5 to hash the data in the block. SHA can specifically be SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512, etc.

[0077] A block is the smallest storage unit in an operating system and serves as a logical unit. Therefore, in this embodiment, the size of a hash tree node can be one or more blocks, and in this embodiment, a hash tree node is sometimes referred to as a hash block. Furthermore, hash calculations can be performed at the granularity of one or more blocks to obtain corresponding hash values, thereby reducing read and write times and improving data processing efficiency. Block sizes can be 1KB (kilobytes), 2KB, or 4KB, among other sizes, without limitation. A leaf node in a hash tree can store hash values ​​corresponding to multiple data blocks (blocks storing data files, applications, operating system data, etc.). An intermediate node in a hash tree can store hash values ​​for its multiple child nodes, such as multiple leaf nodes or multiple intermediate nodes. A root node can store hash values ​​for multiple child nodes, such as multiple intermediate nodes. In this embodiment, the hash value corresponding to a node (leaf node / intermediate node) refers to the hash value corresponding to that node obtained by performing a hash calculation on the data stored in that node.

[0078] For example, as shown in Figure 6, Figure 6 is a schematic diagram of the structure of a hash tree provided by the present application. Figure 6 takes a node of the hash tree as a 4K block and the hash algorithm as SHA-256 as an example. In Figure 6, the bottom layer is a plurality of data blocks storing confidential virtual machine images. Each SHA-256 hash value is 256 bits, that is, 32 bytes, so a 4KB hash block can store up to 4096 / 32=128 SHA-256 hash values. SHA-256 calculation is performed on each data block to obtain a 256-bit hash value corresponding to each data block. Then a hash block in the first layer can store the SHA-256 hash values ​​corresponding to 128 data blocks. Similarly, SHA-256 calculation is performed on each hash block in the first layer to obtain a 256-bit hash value corresponding to each hash block. A hash block in the second layer can store 128 SHA-256 hash values ​​corresponding to the hash blocks in the first layer. And so on, until there is only one hash block at the kth layer, which stores the SHA-256 hash values ​​corresponding to all hash blocks at the k-1th layer (greater than or equal to 2 and less than or equal to 128 hash blocks). The hash block at the kth layer is also called the root node.

[0079] Whether the confidential virtual machine image is modified or the value of the node in the hash tree is modified, the value of the root node will be changed. Therefore, the integrity of the confidential virtual machine image can be verified based on the hash tree.

[0080] S502: The confidential computing server device measures the value of the root node of the hash tree to obtain a first measurement value.

[0081] After receiving the confidential virtual machine image and hash tree, the confidential computing server device stores them on disk. When starting the confidential virtual machine, the confidential computing server device needs to complete the measurement of the confidential virtual machine. In this embodiment, the confidential computing server device measures the value of the root node of the hash tree to obtain a first measurement value. Since the root node of the hash tree is the size of a block, the measurement can be completed quickly. Compared with the traditional trusted startup process that requires the measurement of the entire confidential virtual machine, this solution can greatly improve the measurement speed, thereby improving the startup speed of the confidential virtual machine.

[0082] Because the hash tree is derived from the confidential virtual machine image, and the first metric is derived from the root node of the hash tree, the first metric can be used to prove the integrity of the confidential virtual machine. Specifically, in this embodiment, the first metric is used to verify the integrity of the data blocks in the confidential virtual machine image that need to be executed when the confidential virtual machine is executed using the confidential virtual machine image. If the first metric is determined to be credible during the remote attestation process, then the confidential virtual machine is also intact and credible.

[0083] The first measurement value may be stored in a trusted module to ensure that the first measurement value is not altered, thereby ensuring the integrity of the first measurement value. The trusted module may be, for example, a hardware trusted module, such as a CPU, a TPM, a TPCM, or a TCM. The trusted module may also be a software trusted module, such as a firmware-based TPM (fTPM), a virtual TPM, or a firmware-based TCM.

[0084] S503: The confidential computing server device uses the confidential virtual machine image to run the confidential virtual machine.

[0085] After the confidential computing server device completes the measurement of the root node of the hash tree, it uses the confidential virtual machine image to create and start the corresponding confidential virtual machine. Since the measurement process only measures the value of the root node of the hash tree and does not perform integrity verification on the confidential virtual machine itself, this embodiment performs integrity verification on the data blocks that need to be run in the confidential virtual machine image when the confidential virtual machine is running. That is, according to the confidential virtual machine operation requirements, the integrity of the part of the data in the confidential virtual machine image that needs to be loaded into the memory for operation is verified, and the confidential virtual machine image is partially verified on demand. Even if the operation process is slow when running the confidential virtual machine image, since the entire confidential virtual machine image does not need to be loaded and run during actual operation, the total time required for startup is still less than that of the traditional trusted startup.

[0086] The following describes in detail the process of running a confidential virtual machine on a confidential computing server device. As shown in FIG7 , FIG7 is a flow chart of a confidential virtual machine running method provided by the present application.

[0087] S5031: The confidential computing server device obtains the target data block in the confidential virtual machine image according to the confidential virtual machine operation requirements.

[0088] When a confidential virtual machine is running, it is not necessary to load all code from the confidential virtual machine image into memory for execution. Instead, it loads the code required for the current operation into memory on demand. In this embodiment, the data blocks that need to be loaded from the confidential virtual machine image into memory based on the confidential virtual machine's operating requirements are called target data blocks. For example, when starting the kernel of a confidential virtual machine, the code required to run the kernel can be loaded from the kernel of the confidential virtual machine image into memory on demand, without having to load the entire kernel into memory for measurement.

[0089] S5032: The confidential computing server device verifies the integrity of the target data block based on the target data block, the hash tree and the first metric value.

[0090] Before executing the target data block, the target data block is verified for integrity. The target data block can be executed only after passing the integrity verification.

[0091] Specifically, the confidential computing server device performs a hash calculation on the target data block to obtain a second target hash value. The leaf nodes in the hash tree store the hash values ​​corresponding to all data blocks of the confidential virtual machine image, and thus the first target hash value corresponding to the target data block can be obtained from the target node among the multiple leaf nodes of the hash tree. By comparing the first target hash value and the second target hash value, the integrity of the hash tree and the target data block can be preliminarily verified. If the first target hash value is different from the second target hash value, it is possible that the hash tree has been modified, or it is possible that the target data block has been modified, in which case it can be determined that the target data block or the hash tree is incomplete.

[0092] If the first target hash value and the second target hash value are the same, it's possible that neither the target data block nor the second target hash value have been altered, or it's possible that both have been altered. Therefore, further verification of the integrity of the target data block and the target path corresponding to the target data block in the hash tree is required. The target path includes the target node and its ancestor nodes. The ancestor nodes of a target node are all nodes along the path from the root node of the hash tree to the target node. The target path includes a node in each layer of the hash tree, and the target path includes the root node of the hash tree. The parent node in the target path stores the hash value corresponding to the child node of that parent node. If the data in the target data block and the nodes in the target path are altered, the value in the root node will change. While the data in both the target data block and the nodes in the target path may be altered, the first metric value stored in the trusted module will not be altered. Therefore, the trustworthiness of the target path can be verified based on the first metric value. If the target path is trustworthy and the first and second target hash values ​​are the same, the target data block can be determined to be intact. If the target path is not credible, or the first target hash value and the second target hash value are different, it can be determined that the target data block is incomplete.

[0093] The specific method for verifying whether the target path is trustworthy based on the first metric is as follows: measure the root node to obtain the second metric, calculate the hash value of all child nodes in the target path (including nodes other than the root node), and compare it with the hash value corresponding to the child node stored in the parent node corresponding to each child node. For example, the target path includes node 1 of the first layer of the hash tree (the leaf node storing the target data block), node 2 of the second layer (the node storing the hash value corresponding to node 1), node 3 of the third layer (the node storing the hash value corresponding to node 2), ..., the root node of the kth layer (the node storing the hash value corresponding to node k-1). Calculate the hash value of node 1 and compare it with the hash value corresponding to node 1 stored in node 2; calculate the hash value of node 2 and compare it with the hash value corresponding to node 2 stored in node 3, and so on for other nodes.

[0094] If the first metric value is the same as the second metric value, and the hash value of each child node is the same as the hash value corresponding to the child node stored in the parent node of the child node, then the target path is credible. If the first metric value is different from the second metric value, or the hash value of any child node is different from the hash value corresponding to the child node stored in the parent node of the child node, then the target path is untrustworthy.

[0095] If the target data block is complete, execute S5033. If the target data block or hash tree is incomplete, execute S5034.

[0096] S5033: The confidential computing server device runs the target data block.

[0097] S5034: The confidential computing server device stops running the confidential virtual machine.

[0098] Optionally, the confidential computing server device can also notify the client device.

[0099] S504: The client device and the confidential computing server device perform remote attestation and complete the integrity verification of the confidential virtual machine based on the first measurement value.

[0100] The client device initiates the remote attestation process. The confidential computing server sends verification information, including the first measurement value, to the client device. The client device or a third-party trusted platform connected to the client device verifies the verification information. If the first measurement value meets expectations, the confidential virtual machine image is complete, and the confidential computing environment created based on the confidential virtual machine image is trustworthy. The first measurement value can be in plaintext or encrypted form, without limitation.

[0101] Specifically, if the first metric is trustworthy, then the root node value of the hash tree has not been altered and is therefore trustworthy. Furthermore, when running the confidential virtual machine, the integrity of the data blocks in the confidential virtual machine (whether the target data blocks are complete or incomplete) verified based on the first metric and the hash tree is also trustworthy, indicating that the confidential virtual machine is trustworthy and the confidential computing environment is trustworthy.

[0102] For detailed information on remote attestation procedures, please refer to relevant technical standards, such as the Remote Attestation Procedures Architecture document published by the Internet Engineering Task Force (IETF) Remote Attestation Working Group (IETF RATS Working Group). Other remote attestation methods are also possible and are not limited here.

[0103] S505: The client device sends the data to be analyzed to the confidential computing server device.

[0104] After the client device confirms that the confidential computing environment is trustworthy through remote attestation, it sends the data to be analyzed to the confidential computing server device to utilize the computing power of the confidential computing server device for data analysis.

[0105] S506: The confidential computing server device performs data analysis on the data to be analyzed based on the running confidential virtual machine.

[0106] Confidential computing uses a confidential computing environment created by a confidential virtual machine image provided by a client device to analyze the data being analyzed. The analysis results are then sent to the requester, who can be the client device or a third party.

[0107] In this embodiment, when starting a confidential virtual machine image, only the root node of the hash tree corresponding to the confidential virtual machine image is measured before the confidential virtual machine is run, enabling rapid startup of the confidential virtual machine. While running the confidential virtual machine, the integrity of the target data blocks loaded on demand is verified. Since the entire confidential virtual machine is not loaded into memory during actual runtime, this can reduce the time required to start the confidential virtual machine and improve its startup speed.

[0108] Due to their integrity requirements, confidential VMs are typically allocated independent memory space. Consequently, confidential VMs occupy a significant amount of memory on confidential computing server devices. However, because the VM manager cannot read VM memory, it is unable to deduplicate confidential VMs, resulting in low memory utilization.

[0109] Specifically, to dedupe confidential VM memory, confidential VMs must proactively mark non-confidential memory pages. A memory page can store a data block. When a data block in a confidential VM image is loaded into memory, it is stored within a memory page. For example, program code may only require integrity, not confidentiality, while program input and output data, as well as proprietary algorithms, may require both integrity and confidentiality. Currently, confidential VMs can mark memory with either an "encryption attribute" or a "merge attribute." The encryption attribute value can indicate decrypted memory (set_memory_decrypted) or encrypted memory (set_memory_encrypted). When a memory page requires either integrity or confidentiality, the encryption attribute must be set to encrypted memory (set_memory_encrypted). When a memory page requires neither integrity nor confidentiality, the encryption attribute can be set to decrypted memory (set_memory_decrypted), allowing the virtual machine manager to read and write the memory page. The merge attribute value can indicate mergeable (madv_mergeable) or unmergeable (madv_unmergeable). When there are at least two identical memory pages, and the values ​​of the mergeable attributes of these memory pages all indicate that they are mergeable, these memory pages can be merged to remove duplication. This means that only one memory page is retained, and the others are deleted to reduce the memory space occupied by these memory pages. Confidential VMs all have integrity requirements, which results in the encryption attribute of their memory pages being set to encrypted memory (set_memory_encrypted). The virtual machine manager cannot read memory pages with the encrypted memory attribute, resulting in the virtual machine manager being unable to deduplicate confidential VMs.

[0110] To address the issue of confidential virtual machines being unable to perform memory deduplication, this application also provides the following method. This method primarily decouples integrity and confidentiality by adding an "integrity" attribute, thereby enabling memory pages that require integrity but not confidentiality to be merged and deduplicated.

[0111] Specifically, a memory page includes attributes such as confidentiality, integrity, and mergeability. The value of the confidentiality attribute indicates whether the page is confidential or not. The confidentiality attribute value is independent of integrity. That is, regardless of whether the page has integrity requirements, as long as the page has confidentiality requirements, the confidentiality attribute can be set to confidential; as long as the page does not have confidentiality requirements, the confidentiality attribute can be set to non-confidential. The confidentiality attribute follows the "encryption attribute" but does not include the meaning of the integrity attribute. For example, if the data in a memory page has confidentiality requirements, the Linux kernel's set_memory_encrypted interface can be called to set the page to confidentiality, regardless of whether the page has integrity requirements. If the data in a memory page does not have confidentiality requirements, the Linux kernel's set_memory_decrypted interface can be called to set the page to non-confidentiality, regardless of whether the page has integrity requirements. The value of the integrity attribute indicates whether the page has integrity or not. If the data in the memory page has integrity requirements, the integrity attribute can be set to integrity. If the data in the memory page does not have integrity requirements, the integrity attribute can be set to non-integrity. The value of the mergeability attribute indicates whether the page is mergeable or not. When the data in a memory page can be merged with other memory pages with the same data for deduplication, the merge attribute can be set to mergeable. When the data in a memory page cannot be merged with other memory pages with the same data for deduplication, the merge attribute can be set to non-mergeable.

[0112] Therefore, a merge and deduplication operation can be performed on non-confidential and mergeable memory pages in the memory of a confidential virtual machine to improve memory utilization. Confidential virtual machines can perform memory deduplication between each other, and can also perform memory deduplication between confidential virtual machines and ordinary virtual machines (non-confidential virtual machines). For at least two virtual machines (including at least one confidential virtual machine) running on a confidential server device, identical memory pages (memory pages storing the same data) are merged and deduplicated based on the attributes of the memory pages. Specifically, the hypervisor can filter out target memory pages that are non-confidential and mergeable based on the attributes of all memory pages in memory, then identify memory pages that store the same data among the target memory pages that are non-confidential and mergeable, and then perform a merge operation on these memory pages storing the same data, thereby achieving memory merge and deduplication for the confidential virtual machine. That is, the memory pages to be merged are memory pages that store the same data, have a confidentiality attribute value indicating non-confidentiality, and a mergeability attribute value indicating mergeability. The hypervisor can scan the attributes of memory pages regularly or irregularly and perform merge and deduplication based on the attributes of the memory pages, thereby improving memory utilization.

[0113] For example, as shown in Figure 8, Figure 8 is a schematic diagram of memory deduplication for confidential virtual machines provided herein. Figure 8 uses the memory deduplication of two confidential virtual machines, Confidential Virtual Machine 1 and Confidential Virtual Machine 2, as an example. Memory page A stores sensitive data, and Confidential Virtual Machine 1 sets the attributes of memory page A to "confidential, mergeable, and integrity." Memory page B stores non-sensitive data, such as operating system code. Confidential Virtual Machine 1 sets the attributes of memory page B to "non-confidential, mergeable, and integrity." Memory pages C and D store non-sensitive data, and Confidential Virtual Machine 2 sets the attributes of memory pages C and D to "non-confidential, mergeable, and integrity." Based on the memory page attributes, the virtual machine manager determines that the non-confidential and mergeable memory pages are memory pages B, C, and D. Based on the contents of memory page B in Confidential Virtual Machine 1 and the contents of memory pages C and D in Confidential Virtual Machine 2, it is determined that memory pages B and C are the same memory page. Memory pages B and C can then be merged, retaining only one of them, achieving memory deduplication and improving memory utilization.

[0114] As shown in Figure 9, Figure 9 is a schematic diagram of the structure of a data processing device provided by this application. The data processing device 900 in Figure 9 is used to execute the steps of any of the above-mentioned data processing method embodiments. The data processing device 900 includes a transceiver module 901 and a processing module 902.

[0115] When the data processing device 900 is applied to the above-mentioned confidential computing server device, the data processing device 900 can be a confidential computing server device, such as a computer, server, server cluster, or terminal device with computing power. The data processing device 900 can also be a hardware module (such as a chip) or functional module in the confidential computing server device.

[0116] When data processing apparatus 900 is applied to the aforementioned confidential computing server device, transceiver module 901 is configured to receive a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image from a client device. Processing module 902 is configured to measure the value of the root node of the hash tree to obtain a measurement value. Processing module 902 is configured to run the confidential virtual machine using the confidential virtual machine image, and the first measurement value is used to prove the integrity of the confidential virtual machine.

[0117] In one possible implementation, processing module 902 is configured to obtain a target data block from the confidential virtual machine image based on the confidential virtual machine's operating requirements. Processing module 902 is configured to verify the integrity of the target data block based on the target data block, the hash tree, and the first metric value. Processing module 902 is configured to execute the target data block if the target data block is complete. Processing module 902 is configured to stop executing the confidential virtual machine if the target data block is incomplete.

[0118] In one possible implementation, a hash tree includes a target path corresponding to a target data block, the target path including a leaf node storing a first hash value of the target data block and an ancestor node of the leaf node, the ancestor node including a root node; and a processing module 902 configured to calculate a second hash value of the target data block. Processing module 902 is configured to determine whether the target path is trustworthy based on the first metric value. Processing module 902 is configured to determine that the target data block is complete if the first hash value and the second hash value are the same and the target path is trustworthy. Processing module 902 is configured to determine that the target data block is incomplete if the first hash value and the second hash value are different or the target path is untrustworthy.

[0119] In one possible implementation, processing module 902 is configured to measure the root node to obtain a second metric value. Processing module 902 is configured to calculate hash values ​​of all child nodes in the target path, where a child node is a node other than the root node in the target path. Processing module 902 is configured to compare whether the first metric value is the same as the second metric value, and to compare whether the hash value of each child node is the same as the hash value of the child node stored in the parent node of the child node in the hash tree. Processing module 902 is configured to determine that the target path is trustworthy when the first metric value is the same as the second metric value and the hash value of each child node is the same as the hash value of the child node stored in the parent node of the child node in the target path.

[0120] In one possible implementation, processing module 902 is configured to obtain attributes of multiple memory pages, where the multiple memory pages include data loaded into memory after at least two virtual machines are started, the at least two virtual machines including a confidential virtual machine, the attributes including a confidentiality attribute, an integrity attribute, and a mergeability attribute, wherein the value of the confidentiality attribute indicates confidentiality or non-confidentiality, the value of the integrity attribute indicates integrity or non-integrity, and the value of the mergeability attribute indicates whether the data can be merged or not. Processing module 902 is configured to merge, based on the attributes of the memory pages, memory pages with identical data, whose confidentiality attribute value indicates non-confidentiality, and whose mergeability attribute value indicates mergeability.

[0121] In one possible implementation, the processing module 902 is used to obtain, based on the attributes of multiple memory pages, a target memory page in which the value of the confidentiality attribute indicates no confidentiality and the value of the mergeability attribute indicates mergeable; and the processing module is used to merge memory pages with the same data in the target memory page.

[0122] When the data processing device 900 is applied to the above-mentioned client device, the data processing device 900 can be a client device, such as a computer, a mobile phone, a tablet computer, a car computer, or a smart wearable device. The data processing device 900 can also be a hardware module (such as a chip) or functional module in a confidential computing server device.

[0123] When the data processing device 900 is applied to the above-mentioned client device, the transceiver module 901 is used to send the confidential virtual machine image and the hash tree corresponding to the confidential virtual machine image to the confidential computing server device. The hash tree is used to prove the integrity of the confidential virtual machine image, so that the confidential computing server device obtains the first measurement value corresponding to the root node of the hash tree and then uses the confidential virtual machine image to run the confidential virtual machine.

[0124] In one possible implementation, the apparatus further includes a processing module 902. A transceiver module 901 is configured to receive verification information sent by a confidential computing server device, the verification information including a first metric value used to verify the integrity of the confidential virtual machine. The processing module 902 is configured to determine the integrity of the confidential virtual machine based on the verification information. The transceiver module 901 is configured to send data to be analyzed to the confidential computing server device, so that the confidential virtual machine running on the confidential computing server device analyzes the data to be analyzed.

[0125] In a possible implementation, the processing module 902 is configured to determine whether the first metric value meets expectations; and the processing module 902 is configured to determine that the confidential virtual machine is intact when the first metric value meets expectations.

[0126] This application also provides a computing device 1000. As shown in Figure 10, computing device 1000 includes a bus 1002, a processor 1004, a memory 1006, and a communication interface 1008. Processor 1004, memory 1006, and communication interface 1008 communicate with each other via bus 1002. Computing device 1000 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in computing device 1000.

[0127] Bus 1002 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG6 shows a single line, but this does not imply a single bus or type of bus. Bus 1002 may include a path for transmitting information between various components of computing device 1000 (e.g., memory 1006, processor 1004, and communication interface 1008).

[0128] The processor 1004 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0129] The memory 1006 may include a volatile memory, such as a random access memory (RAM). The memory 1006 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD). The memory 1006 stores executable program code, and the processor 1004 executes the executable program code to implement the aforementioned data processing method. Specifically, the memory 1006 stores instructions for executing the data processing method.

[0130] The communication interface 1008 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1000 and other devices or a communication network.

[0131] The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a computer, implements the data processing method flow of any of the above-mentioned method embodiments.

[0132] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0133] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical or other forms.

[0134] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0135] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0136] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the technical solution of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Claims

1. A data processing method, characterized in that: The method comprises: Receiving a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image from a client device; Measuring the value of the root node of the hash tree to obtain a first measurement value; The confidential virtual machine image is used to run the confidential virtual machine, and the first measurement value is used to prove the integrity of the confidential virtual machine.

2. The method according to claim 1, characterized in that The using the confidential virtual machine image to run the confidential virtual machine includes: Obtaining a target data block from the confidential virtual machine image according to the operation requirements of the confidential virtual machine; Verifying the integrity of the target data block according to the target data block, the hash tree and the first metric value; If the target data block is complete, executing the target data block; If the target data block is incomplete, the operation of the confidential virtual machine is stopped.

3. The method according to claim 2, characterized in that The hash tree includes a target path corresponding to the target data block, the target path includes a leaf node storing a first hash value of the target data block, and an ancestor node of the leaf node, the ancestor node includes the root node, and verifying the integrity of the target data block according to the target data block, the hash tree and the first metric value includes: Calculating a second hash value of the target data block; Determining whether the target path is credible according to the first metric value; If the first hash value is the same as the second hash value and the target path is credible, then determining that the target data block is complete; If the first hash value is different from the second hash value, or the target path is not credible, it is determined that the target data block is incomplete.

4. The method according to claim 3, characterized in that The determining, according to the first metric value, whether the target path is credible includes: Measuring the root node to obtain a second metric value; Calculate hash values ​​of all child nodes in the target path, where the child nodes are nodes other than the root node in the target path; Comparing whether the first metric value is the same as the second metric value, and comparing whether the hash value of each of the child nodes is the same as the hash value of the child node stored in the parent node of the child node in the hash tree; If the first metric value is the same as the second metric value, and the hash value of each of the child nodes is the same as the hash value of the child node stored in the parent node of the child node in the target path, it is determined that the target path is credible.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Acquire attributes of multiple memory pages, the multiple memory pages include data loaded into memory after at least two virtual machines are started, the at least two virtual machines include the confidential virtual machine, the attributes include a confidentiality attribute, an integrity attribute, and a mergeability attribute, a value of the confidentiality attribute indicates confidentiality or non-confidentiality, a value of the integrity attribute indicates integrity or non-integrity, and a value of the mergeability attribute indicates mergeability or non-mergeability; According to the attributes of the multiple memory pages, memory pages having the same data, a value of the confidentiality attribute indicating no confidentiality, and a value of the mergeability attribute indicating mergeability are merged.

6. The method according to claim 5, characterized in that The step of merging, according to the attributes of the plurality of memory pages, memory pages having the same data, the value of the confidentiality attribute indicating no confidentiality, and the value of the mergeability attribute indicating mergeable memory pages, comprises: According to the attributes of the plurality of memory pages, obtaining a target memory page in which the value of the confidentiality attribute indicates no confidentiality and the value of the mergeability attribute indicates mergeability; Memory pages with the same data in the target memory page are merged.

7. A data processing method, characterized in that: The method comprises: A confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image are sent to a confidential computing server device, where the hash tree is used to prove the integrity of the confidential virtual machine image, so that the confidential computing server device obtains a first metric value corresponding to a root node of the hash tree and then uses the confidential virtual machine image to run the confidential virtual machine.

8. The method according to claim 7, characterized in that The method further comprises: Receiving verification information sent by the confidential computing server device, the verification information including the first measurement value, the first measurement value being used to prove the integrity of the confidential virtual machine; Determining that the confidential virtual machine is complete according to the verification information; The data to be analyzed is sent to the confidential computing server device so that the confidential virtual machine run by the confidential computing server device analyzes the data to be analyzed.

9. The method according to claim 8, characterized in that Determining the integrity of the confidential virtual machine according to the verification information includes: Determining whether the first metric value meets expectations; If the first metric value meets expectations, it is determined that the confidential virtual machine is complete.

10. A data processing device, characterized in that: The device comprises: A transceiver module, used for receiving a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image from a client device; A processing module, configured to measure the value of the root node of the hash tree to obtain a first measurement value; The processing module is used to run a confidential virtual machine using the confidential virtual machine image, and the first measurement value is used to prove the integrity of the confidential virtual machine.

11. The device according to claim 10, characterized in that The processing module is used to obtain a target data block from the confidential virtual machine image according to the operation requirements of the confidential virtual machine; The processing module is used to verify the integrity of the target data block according to the target data block, the hash tree and the first metric value; The processing module is used to run the target data block when the target data block is complete; The processing module is used to stop running the confidential virtual machine when the target data block is incomplete.

12. The device according to claim 11, characterized in that The hash tree includes a target path corresponding to the target data block, the target path includes a leaf node storing a first hash value of the target data block, and an ancestor node of the leaf node, the ancestor node includes the root node; The processing module is used to calculate a second hash value of the target data block; The processing module is used to determine whether the target path is credible according to the first metric value; The processing module is configured to determine that the target data block is complete when the first hash value is the same as the second hash value and the target path is credible; The processing module is used to determine that the target data block is incomplete when the first hash value is different from the second hash value or the target path is not credible.

13. The device according to claim 12, characterized in that The processing module is used to measure the root node to obtain a second measurement value; The processing module is used to calculate the hash values ​​of all child nodes in the target path, where the child nodes are nodes other than the root node in the target path; The processing module is used to compare whether the first metric value is the same as the second metric value, and compare whether the hash value of each of the child nodes is the same as the hash value of the child node stored in the parent node of the child node in the hash tree; The processing module is used to determine that the target path is credible when the first metric value is the same as the second metric value and the hash value of each of the child nodes is the same as the hash value of the child node stored in the parent node of the child node in the target path.

14. The device according to any one of claims 10 to 13, characterized in that The processing module is configured to obtain attributes of a plurality of memory pages, wherein the plurality of memory pages include data loaded into the memory after at least two virtual machines are started, the at least two virtual machines include the confidential virtual machine, the attributes include a confidentiality attribute, an integrity attribute, and a mergeability attribute, the value of the confidentiality attribute indicates confidentiality or non-confidentiality, the value of the integrity attribute indicates integrity or non-integrity, and the value of the mergeability attribute indicates mergeability or non-mergeability; The processing module is used to merge, according to the attributes of the multiple memory pages, the memory pages with the same data, the value of the confidentiality attribute indicating no confidentiality, and the value of the mergeability attribute indicating mergeable memory pages.

15. The device according to claim 14, characterized in that The processing module is configured to obtain, according to the attributes of the multiple memory pages, a target memory page in which the value of the confidentiality attribute indicates no confidentiality and the value of the mergeability attribute indicates mergeability; The processing module is used to merge the memory pages with the same data in the target memory page.

16. A data processing device, characterized in that: The device comprises: A transceiver module is used to send a confidential virtual machine image and a hash tree corresponding to the confidential virtual machine image to a confidential computing server device, wherein the hash tree is used to prove the integrity of the confidential virtual machine image so that the confidential computing server device obtains a first metric value corresponding to a root node of the hash tree and then uses the confidential virtual machine image to run the confidential virtual machine.

17. The device according to claim 16, characterized in that The device also includes a processing module; The transceiver module is used to receive verification information sent by the confidential computing server device, wherein the verification information includes the first measurement value, and the first measurement value is used to prove the integrity of the confidential virtual machine; The processing module is used to determine that the confidential virtual machine is complete according to the verification information; The transceiver module is used to send the data to be analyzed to the confidential computing server device, so that the confidential virtual machine run by the confidential computing server device analyzes the data to be analyzed.

18. The device according to claim 17, characterized in that The processing module is used to determine whether the first metric value meets expectations; The processing module is configured to determine that the confidential virtual machine is complete when the first metric value meets expectations.

19. A computing device, characterized in that The computing device includes a processor and a memory, wherein the processor is coupled to the memory, and the processor is configured to execute the data processing method according to any one of claims 1 to 9 based on instructions stored in the memory.

20. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises instructions, which, when the computer-readable storage medium is executed on a computer, causes the computer to execute the data processing method according to any one of claims 1 to 9.

Images