Method for proving security of computing system, and computing system

Abstract

Provided in the embodiments of the preset invention are a method for proving the security of a computing system, and a computing system. In the method, a first user program instance in a computing system can send a second proof request to a control program instance in the computing system while responding to a first proof request, and then the first user program instance can prove the security of the control program instance on the basis of a response result of the second proof request, which is fed back by the control program instance. A first user program can also feed a first response result of the first proof request back to a user client, and thus the user client proves the security of the first user program. In the method, after a user client serving as a verifier initiates a first proof request, proof of the security of different program instances can be asynchronously performed, that is, the start of the verification of the security of a control program instance does not depend on the end of the verification of the security of a first user program instance, and thus the time required for proof of security can be shortened.

Description

Computing system security proof method and computing system

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on July 31, 2023, with application number 202310961573.X and application name “Method and system for proving the security of a computing system”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present invention relates to the field of data security technology, and in particular to a method for proving the security of a computing system and a computing system. Background Art

[0003] Leveraging the powerful computing power of cloud computing, a growing number of services are being provided to users, such as database services and machine learning-based artificial intelligence services. Each of these services can be deployed in a cloud computing system, with the computing power provided by this system ensuring the proper functioning of the service. Furthermore, as these services are used, users have increasingly stringent requirements for the security of the data generated during use. This necessitates proving the security of the computing system. Since a computing system typically consists of multiple program instances running in concert, proving the security of the computing system can be used to verify the security of each program instance within the system.

[0004] In practice, there is often a need to increase the speed of proving the security of computing systems, so how to increase the speed of proving becomes an urgent problem to be solved.

[0005] Summary of the Invention

[0006] In view of this, an embodiment of the present invention provides a method and a computing system for proving the security of a computing system, so as to improve the speed of security proof.

[0007] In a first aspect, an embodiment of the present invention provides a method for proving the security of a computing system, which is applied to a first user program instance in the computing system, comprising:

[0008] Responding to a first certification request generated by a user client to generate a first response result;

[0009] In response to receiving the first attestation request, sending a second attestation request to a control program instance in the computing system;

[0010] Proving the security of the control program instance according to a second response result corresponding to the second proof request generated by the control program instance;

[0011] The first response result is sent, so that the user client can prove the security of the first user instance according to the first response result.

[0012] In a second aspect, an embodiment of the present invention provides a computing system, comprising: a computing unit running a first user program instance and a control program instance;

[0013] The first user program instance is configured to respond to a first certification request sent by a user client to generate a first response result; in response to receipt of the first certification request, send a second certification request to the control program instance; certify the security of the control program instance based on a second response result corresponding to the second certification request; and send the first response result to the user client, so that the user client certifies the security of the first user program instance based on the received first response result.

[0014] The control program instance is used to respond to the second certification request to generate the second response result.

[0015] In a third aspect, an embodiment of the present invention provides an electronic device comprising a computing system and a memory, wherein the memory is configured to store one or more computer instructions, wherein the one or more computer instructions, when executed by the computing system, implement the method for proving the security of a computing system according to the first aspect. The electronic device may also include a communication interface for communicating with other devices or a communication network.

[0016] In a fourth aspect, an embodiment of the present invention provides a non-transitory machine-readable storage medium having executable code stored thereon. When the executable code is executed by a computing system of an electronic device, the computing system can at least implement the method for proving the security of the computing system as described in the first aspect.

[0017] In a method for proving the security of a computing system provided by an embodiment of the present invention, a first user program instance in the computing system can simultaneously send a second proof request to a control program instance in the computing system while responding to a first proof request generated by a user client. The control program instance can respond to the second proof request to generate a second response. The first user program instance can then further prove the security of the control program instance based on the second response provided by the control program instance. Simultaneously, the first user program can also provide the first response to the first proof request back to the user client, allowing the user client to prove the security of the first user program.

[0018] In the above method, after the user client initiates the first proof request as the verifier, the first user program instance can respond to the first proof request as the verifier. At the same time, it can also initiate the second proof request to the control program instance as the verifier, and prove the security of the control program instance based on the second response result fed back by the control program instance.

[0019] It can be seen that in the above method, the start of the security proof of the control program instance does not depend on the end of the security proof of the first user program instance, that is, the security proof of the control program instance can also be started without performing the security proof of the first user program instance, that is, the security verification of the first user program instance and the control program instance can be performed asynchronously, which can shorten the time required for the security proof of the computing system and make the security proof process more flexible. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0021] FIG1 is a schematic diagram of the structure of a computing system provided by an embodiment of the present invention;

[0022] FIG2 is a signaling diagram of a method for proving the security of a computing system provided by an embodiment of the present invention;

[0023] FIG3 is a schematic diagram of a method for proving the security of a computing system provided by an embodiment of the present invention;

[0024] FIG4 is a flowchart of a method for proving the security of a computing system provided by an embodiment of the present invention;

[0025] FIG5 is a schematic diagram of another method for proving the security of a computing system provided by an embodiment of the present invention;

[0026] FIG6 is a schematic diagram of another computing system provided by an embodiment of the present invention;

[0027] FIG7 is a signaling diagram of another method for proving the security of a computing system provided by an embodiment of the present invention;

[0028] FIG8 is a schematic diagram of another method for proving the security of a computing system provided by an embodiment of the present invention;

[0029] FIG9 is a flowchart of another method for proving the security of a computing system provided by an embodiment of the present invention;

[0030] FIG10 is a schematic diagram of another method for proving the security of a computing system provided by an embodiment of the present invention;

[0031] FIG11 is a schematic diagram of the structure of another computing system provided in an embodiment of the present invention;

[0032] FIG12 is a schematic diagram of the structure of a computing system security certification device provided by an embodiment of the present invention;

[0033] FIG13 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0034] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0035] The terms used in the embodiments of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The singular forms "a," "the," and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates otherwise. "A plurality" generally includes at least two, but does not exclude the inclusion of at least one.

[0036] It should be understood that the term "and / or" as used herein is merely a description of the relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0037] As used herein, the words “if” and “if” may be interpreted as “at the time of” or “when” or “in response to determining” or “in response to identifying,” depending on the context. Similarly, the phrases “if it is determined” or “if (stated condition or event) is identified” may be interpreted as “when it is determined” or “in response to determining” or “when identifying (stated condition or event)” or “in response to identifying (stated condition or event),” depending on the context.

[0038] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0039] It should also be noted that the terms "include," "comprises," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a product or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such product or system. In the absence of further limitations, an element defined by the phrase "comprises a..." does not exclude the presence of other identical elements in the product or system comprising the element.

[0040] Before describing the following embodiments of the present invention in detail, it is also possible to first introduce the relevant concepts involved in the following embodiments:

[0041] Trusted Execution Environment (TEE): A combination of hardware and software technologies that ensures application and data security. It's a secure software environment that protects programs and data running within it from malicious manipulation or tampering, ensuring the safe operation of services. It also effectively prevents intrusion and forgery, protecting sensitive data generated during application execution.

[0042] Enclave: A software program running in the TEE.

[0043] Computing system: A system composed of at least one computing unit. Common computing units include central processing units (CPUs), graphics processing units (GPUs), field programmable gate arrays (FPGAs), digital signal processing (DSP) chips, application-specific integrated circuits (ASICs), coprocessors, and so on.

[0044] Heterogeneous computing system: A computing system with at least two types of computing units.

[0045] Verifier: The party that initiates an attestation request and performs security verification. This means the Verifier can generate an attestation request and, based on the response to the attestation request, verify the Prover's security locally or through a third-party server. The security verification result can be presented as an attestation report. The Verifier can be a software program.

[0046] Prover: Responds to the proof request initiated by the Verifier and generates a response result, which can also be fed back to the Verifier. The Prover can also be a software program.

[0047] Remote attestation: The verifier and the prover run on different hardware devices.

[0048] Local attestation: The verifier and prover run on the same hardware device.

[0049] The following describes some embodiments of the present invention in detail with reference to the accompanying drawings. The following embodiments and features thereof may be combined with one another unless they conflict with each other. Furthermore, the sequence of steps in the following method embodiments is provided for illustrative purposes only and is not intended to be a strict limitation.

[0050] Figure 1 is a schematic diagram of the structure of a computing system provided by an embodiment of the present invention. As shown in Figure 1, the computing system may include: a computing unit running a user program instance and a control program instance.

[0051] Optionally, the computing system can be deployed in the cloud and include at least one computing unit of the same type. Each computing unit can leverage its high computing performance to provide users with at least one service. Examples include database services, machine learning-based artificial intelligence services, and other services. Machine learning-based artificial intelligence services can specifically include facial recognition, voice recognition, and intelligent recommendations. Each service can include multiple functions. For example, a database service might include adding, deleting, modifying, and querying data. A facial recognition service, part of an artificial intelligence service, might include collecting facial images and recognizing them using a machine learning model.

[0052] Optionally, a user program instance in any computing unit of a computing system corresponds to all or part of the functionality of a service. The control program instance in a computing unit directs and coordinates the computing work of the computing unit to ensure the normal operation of the user program instance within the computing unit. More specifically, during the execution of the user program instance, the control program instance controls the execution of instructions and the transmission of data within the user program instance.

[0053] Optionally, the computing unit in the computing system also provides a TEE to ensure the secure operation of different program instances. To ensure data security, under normal circumstances, user program instances and control program instances can run in the TEE provided by the computing unit. Optionally, the computing unit in this computing system can specifically be a CPU.

[0054] Optionally, the user program instance and the control program instance can run in the same computing unit.

[0055] For clarity of subsequent description, the user program instance corresponding to the target service may be referred to as a first user program instance. The target service may be the aforementioned database service, artificial intelligence service, or any service implemented with the aid of a computing system.

[0056] In this embodiment, the computing system may include a computing unit, which may run a first user program instance corresponding to the target service and a control program instance corresponding to the computing unit. When the first user program instance and the control program instance run normally and untampered within the TEE provided by the computing unit, the target service can be securely provided to the user.

[0057] Since a computing system includes at least one computing unit, proving the security of the computing system is equivalent to proving the security of each computing unit in the computing system, and further, it is equivalent to proving the security of each program instance in each computing unit.

[0058] The following describes the security proof process using any computing unit in the computing system shown in Figure 1 as an example:

[0059] The first user program instance included in any computing unit in the computing system can respond to the first certification request sent by the user client to generate a first response result. At the same time, in response to the receipt of the first certification request, a second certification request is further sent to the control program instance in the computing unit. The control program instance can respond to the second certification request to generate a second response result corresponding to the second certification request. The first user program instance can prove the security of the control program instance based on the second response result and send the first response result to the user client. Finally, the user client can further prove the security of the first user program instance based on the received first response result.

[0060] Optionally, the user client may be a terminal device for the user to use various services provided by the computing system. The timing of the user client generating the first certification request can be referred to the relevant description in the embodiment shown in FIG4 .

[0061] Regarding the deployment of the first user program instance, optionally, in response to the user's application for the target service, the computing unit can obtain the first user program instance, that is, the first user program instance can be deployed to the computing unit so that the first user program instance can run in the TEE provided by the computing unit.

[0062] In this embodiment, the first user program instance in the computing unit can also send a second certification request to the control program instance in the computing system while responding to the first certification request generated by the user client. The control program instance can respond to the second certification request and generate a second response result. The first user program instance can then further verify the security of the control program instance based on the second response result provided by the control program instance. Simultaneously, the first user program can also provide the first response result of the first certification request back to the user client, allowing the user client to verify the security of the first user program.

[0063] In the above method, after the user client initiates the first proof request as the verifier, the first user program instance can respond to the first proof request as the verifier. At the same time, without feedback of the first response result, the first user program instance can also initiate a second proof request to the control program instance as the verifier, and prove the security of the control program instance based on the second response result feedback from the control program instance.

[0064] It can be seen that in the above method, the start of the security proof of the control program instance does not depend on the end of the security proof of the first user program instance, that is, the security proof of the control program instance can also be started without performing the security proof of the first user program instance, that is, the security verification of the first user program instance and the control program instance can be performed asynchronously, which can shorten the time required for the security proof of the computing system and make the security proof process more flexible.

[0065] Furthermore, as can be seen from the descriptions of the above embodiments, proving the security of the computing system shown in FIG1 can include two stages: sending a proof request and proving the security of the program instance. The technical effects achieved by the embodiments shown in FIG1 through FIG4 can also be understood as follows: during the security proof process, sending and responding to the proof request and proving the security of the program instance are performed independently and independently, thereby enabling the security proof of different program instances in the computing system to be performed asynchronously.

[0066] In the computing system shown in Figure 1, after security verification is performed on the first user program instance and the control program instance in any computing unit, corresponding certification results can be generated. For clarity in the subsequent description, the certification result reflecting the security of the control program instance can be referred to as the first certification result, and the certification result reflecting the security of the first user program instance can be referred to as the second certification result.

[0067] Optionally, the first user program instance may also send the first attestation result to the user client. Optionally, the first response result and the first attestation result may be included in an attestation report generated by the first user program instance, namely, a first attestation report. The first user program instance may feed back the first response result and the first attestation result to the user client by sending the attestation report.

[0068] Ultimately, the first proof result reflecting the security of the control program instance and the second proof result reflecting the security of the first user program instance can be displayed to the user, so that the user can know the security of each program instance in the computing system and have a clearer understanding of the security status of the entire computing system.

[0069] The proof process provided in the above embodiments can also be understood in conjunction with Figures 2 and 3. The specific process of the above proof can also be described in detail in the method embodiment shown in Figure 4.

[0070] Based on the above system embodiment, the specific process of proving the security of a computing system will be described below from a methodological perspective. Figure 4 is a flow chart of a method for proving the security of a computing system provided by an embodiment of the present invention. This generation method provided by an embodiment of the present invention can be executed by a first user program instance in a computing unit included in the computing system. As shown in Figure 4, this method may include the following steps:

[0071] S101, responding to a first certification request generated by a user client and generating a first response result.

[0072] S102 , in response to receiving the first certification request, sending a second certification request to a control program instance in the computing system.

[0073] S103: Prove the security of the control program instance according to the second response result corresponding to the second proof request generated by the control program instance.

[0074] S104: Send a first response result, so that the user client can prove the security of the first user instance according to the first response result.

[0075] As described in the embodiment shown in Figure 1, after the user client applies for the target service, the first user program instance corresponding to the target service and the control program instance corresponding to the computing unit can be deployed to the computing unit so that the computing unit is used to provide the target service for the user.

[0076] Furthermore, optionally, to ensure the normal and secure use of the target service, the user client can, in one case, proactively initiate a security verification of the computing system after all program instances in the computing unit are deployed. Alternatively, the user client can initiate a security verification of the computing system in real time while the target service is in use.

[0077] As for the specific process of proving the security of the computing system: the user client as the verifier can first actively send a first proof request to the first user program instance. Afterwards, the first user program instance can respond to the first proof request as the prover to generate a first response result corresponding to the first proof request. At the same time, the first user program instance can also initiate a second proof request to the control program instance as the verifier. The control program instance can respond to the second proof request as the prover to generate a second response result. Then, the first user program instance can further prove the security of the control program instance as the verifier based on the second response result fed back by the control program instance. Optionally, the proof result reflecting the security of the control program instance can be included in the proof report generated by the first user program instance.

[0078] In addition, the first user program instance may also feed back the generated first response result to the user client, so that the user client can further verify the security of the first user program instance based on the first response result. Optionally, the verification result reflecting the security of the first user program instance may also be included in a verification report generated by the user client. Ultimately, the user can understand the security of the computing system based on the verification report generated by the user client.

[0079] Optionally, the security of the first user program instance and the control program instance may be proven by any achievable method in the prior art, and the specific process will not be described in detail here.

[0080] It should be noted that steps S101 and S102 are actually executed synchronously. That is, the first user program instance can respond to the first certification request as the proving party and send a second certification request to the control program instance as the verifying party, thereby further verifying the security of the control program instance based on the second response provided by the control program instance. Furthermore, this synchronous execution process ensures that the start of the security verification of the control program instance is independent of the completion of the security verification of the first user program instance. This means that the security verification of the control program instance can begin without performing security verification on the first user program instance. This means that the security verification of the first user program instance and the control program instance can be performed asynchronously.

[0081] It should also be noted that because the user client and the computing system run on different hardware devices, the first attestation request is essentially a remote attestation request. In practice, when the first user program instance and the control program instance run on the same hardware device, the second attestation request is essentially a local attestation request.

[0082] The process in this embodiment can also be understood in conjunction with FIG. 2 and FIG. 3 .

[0083] In this embodiment, after the user client initiates the first proof request as the verifier, the first user program instance can respond to the first proof request as the verifier. At the same time, without feeding back the first response result, the first user program instance can also initiate the second proof request to the control program instance as the verifier, and prove the security of the control program instance based on the second response result fed back by the control program instance.

[0084] It can be seen that in the above embodiment, the start of the security proof of the control program instance does not depend on the end of the security proof of the first user program instance, that is, the security proof of the control program instance can also be started without performing the security proof of the first user program instance, that is, the security verification of the first user program instance and the control program instance can be performed asynchronously, which can shorten the time required for the security proof of the computing system and make the security proof process more flexible.

[0085] At step S104, the first user program instance may also optionally send the first attestation result to the user client. Optionally, the first response result and the first attestation result may be included in an attestation report generated by the first user program, namely a first attestation report. With this first attestation report, the user can understand the security of the first user program and the security of the control program instance in the computing system.

[0086] In this embodiment, the first proof result reflecting the security of the control program instance and the second proof result reflecting the security of the first user program instance can be displayed to the user, so that the user can know the security of each program instance in the computing system and have a clearer understanding of the security status of the entire computing system.

[0087] The technical effects mentioned in the embodiments shown in FIG. 1 to FIG. 4 can also be understood from another perspective:

[0088] For the computing system shown in Figure 1 , the security verification method for any computing unit can be described as follows: a user client can first send a first verification request to a first user program instance, and the first user program instance can then return a first response to the request to the user client. The user client can then verify the security of the first user program instance based on the first response. The user client then displays a second verification result reflecting the security of the first user program instance for the user to understand.

[0089] Afterward, the user client no longer directly participates in the control program instance's certification process. Instead, the first user program instance, which meets security requirements, sends a second certification request to the control program instance on behalf of the user client, receiving a second response from the control program instance. The first user program can further attest to the security of the control program instance based on the second response. The process of this certification method can also be understood in conjunction with Figure 5.

[0090] Compared with the proof method provided in the embodiments shown in FIG1 to FIG4 , the above proof method has the following problems:

[0091] 1. The proof of the security of the control program instance needs to be performed after the security proof of the first user program instance is completed. That is, the security proof of the program instance has a strict sequence and the security proof cannot be performed asynchronously, which greatly increases the time required for the security proof of the computing system.

[0092] 2. Since the user client only participates in the verification process of the security of the first user program instance, the user client cannot know the security of the control program instance, and the user cannot fully understand the security status of the computing system.

[0093] Comparing Figures 3 and 5 demonstrates the process differences between different attestation methods. Furthermore, using the system and method provided by the embodiments shown in Figures 1 through 4 , after the first user program instance generates a first response result, this first response result is not immediately fed back to the user client. Instead, after the security of the control program instance is proven, both the first attestation result and the first response result are fed back to the user client, allowing the user client to further prove the security of the first user program instance. This delayed response result feedback allows for asynchronous security attestation of different program instances, shortening the attestation time. This also allows users to fully understand the security status of the computing system.

[0094] In practice, the target service used by a user client often provides multiple functions, and different functions have different computing power requirements. For example, when the target service is a database service, the service's functions may include adding, deleting, modifying, and querying data. Data querying, however, requires higher computing power than other functions. When the target service is a facial recognition service within an AI service, the service's functions may include collecting facial images and recognizing them using machine learning models. Machine learning facial recognition obviously requires higher computing power.

[0095] In order to ensure the normal use of different functions in the target service, that is, to ensure the overall service quality of the target service, the computing power of the computing system can optionally be accelerated. Figure 6 is a structural schematic diagram of another computing system provided by an embodiment of the present invention. The computing system includes a computing unit, which can specifically be a plurality of types of computing units with different computing speeds, so that these plurality of types of computing units can jointly provide a service. It is precisely because of the different types of computing units in the computing system that the computing system shown in Figure 6 is essentially a heterogeneous computing system. And the heterogeneous computing system introduces another computing unit with higher computing power into the computing system composed of computing units of the same type. Therefore, heterogeneous computing systems often have higher computing power.

[0096] The heterogeneous computing system shown in FIG6 includes, in addition to a computing unit represented by a CPU, a computing unit represented by any one of GPUs, FPGAs, DSP chips, ASICs, and coprocessors.

[0097] On the other hand, in order to adapt to the heterogeneous computing system shown in Figure 6, in practice, the various functions provided by the target service can be split and encapsulated into different user program instances according to the requirements for computing power. Different user programs can run in computing units of different types and with different computing speeds.

[0098] Specifically, functions that require less computational power, such as adding, deleting, and modifying data in a database service, can be encapsulated within a first user program instance; functions that require more computational power, such as querying data in a database service, can be encapsulated within a second user program instance. The first user program instance can run within a first computing unit with lower computational speed, while the second user program instance can run within a second computing unit with higher computational speed, such as a GPU, FPGA, or ASIC.

[0099] For the deployment of the first user program instance, optionally, in response to the user's application for the target service, the first computing unit can obtain the first user program instance, that is, can deploy the first user program instance to the first computing unit, so that the first user program instance can run in the TEE provided by the first computing unit. Similarly, for the deployment of the second user program instance, optionally, in response to the user's application for the target service, the second computing unit can obtain the second user program instance, that is, can deploy the second user program instance to the second computing unit, so that the second user program instance can run in the TEE provided by the second computing unit.

[0100] Alternatively, the first computing unit in the embodiment shown in FIG6 may be a CPU, and the second computing unit may be another type of computing unit other than the CPU mentioned in the embodiment shown in FIG1 , and the computing capabilities of the aforementioned computing units increase in descending order of CPU, GPU, FPGA, and ASIC. Alternatively, a common heterogeneous computing system architecture is described in which the first computing unit is a CPU and the second computing unit is an FPGA. Alternatively, the second computing unit may be a GPU or an ASIC.

[0101] Based on the above description, the security verification process of the heterogeneous computing system shown in Figure 6 can be described as follows:

[0102] The user client can send a first proof request. The first user program instance running in the first computing unit can respond to the first proof request to generate a first response result. Among them, the timing of sending the first proof request can refer to the relevant description in the embodiment shown in Figure 2, which will not be repeated here. At the same time, the first user program instance can also respond to the reception of the first proof request and send a second proof request to the control program instance in the first computing unit. Further, the control program instance can respond to the second proof request to generate a second response result. At the same time, in response to the reception of the second proof request, the control program instance can also send a third proof request to the second user program instance in the second computing unit. The second user program instance can respond to this third proof request to generate a third response result. The control program instance can prove the security of the second user program instance based on the third response result to obtain a third proof result.

[0103] Afterwards, the control program can generate a second proof report including the third proof result and the second response result, and feed back this second proof report to the first user program instance. The first user program instance can further prove the security of the control program instance based on the second response result in the second proof report to generate a first proof result. In the above-mentioned proof process of proving the security of the control program instance and the second user program instance, the first user program instance can also respond to the first proof request to generate a first response result. Furthermore, the first user program instance can also generate a third proof report including the first proof result reflecting the security of the control program instance, the third proof result reflecting the security of the second user program instance, and the first response result, and send this report to the user client.

[0104] Finally, the user client can further verify the security of the first user program instance based on the first response result in the third attestation report to obtain a second attestation result, thus completing the attestation of the security of the entire heterogeneous computing system. The user client can display all three attestation results to the user to fully understand the security status of the heterogeneous computing system.

[0105] The above proof process can also be understood in conjunction with FIG7 and FIG8.

[0106] In this embodiment, the security attestation of a heterogeneous computing system occurs in two phases: the first, sending an attestation request, and the second, responding to that request to attest the security of the program instance. Ultimately, the user client receives attestation results reflecting the security of each program instance in the heterogeneous computing system and displays them to the user, allowing them to better understand the security status of the heterogeneous computing system.

[0107] Specifically, combining the embodiments shown in Figures 7 and 8 , we can see that during the certification request sending phase, certification requests are issued in a hierarchical manner. That is, the first user program instance, the control program instance, and the second user program instance in the computing system can receive certification requests in sequence, thereby initiating the security certification of each program instance in turn. Furthermore, the initiation of security certification for a subsequent program instance does not depend on the completion of security certification for the previous program instance; that is, the initiation of security certification for different program instances is asynchronous.

[0108] During the security verification phase, after the second user program instance, the control program instance, and the first user program instance are sequentially verified, the verification results are fed back to the next program instance in a step-by-step manner. The verification results reflecting the security of the previous program instance are also synchronized to the next program instance in the form of a verification report. This asynchronous security verification approach shortens the time required to verify the security of the computing system and makes the security verification process more flexible.

[0109] In addition, for the contents not described in detail in this embodiment and the technical effects that can be achieved, please refer to the relevant descriptions in the embodiments shown in Figures 1 to 4, and will not be repeated here.

[0110] FIG9 is a flowchart of another method for proving the security of a computing system, based on the heterogeneous computing system shown in FIG6 , provided by an embodiment of the present invention. The generation method provided by an embodiment of the present invention can be executed by the first user program instance in the first computing unit shown in FIG6 . As shown in FIG9 , the method may include the following steps:

[0111] S201, responding to a first certification request generated by a user client and generating a first response result.

[0112] S202 , in response to receiving the first certification request, sending a second certification request to a control program instance in the computing system.

[0113] The specific execution process of steps S201 to S202 can be found in the relevant description of the embodiment shown in FIG4 , and will not be repeated here.

[0114] Right 4: S203, receiving a certification report including the second response result and a certification result reflecting the security of the second user program instance.

[0115] S204: Prove the security of the control program instance according to the second response result corresponding to the second proof request generated by the control program instance.

[0116] As can be seen from the description of the embodiments shown in Figures 6 to 8, before the first user program instance completes the security verification of the control program instance, the control program instance has already completed the security verification of the second user program instance and generated a verification report including the second response result and the third verification result, i.e., the second verification report in the embodiment shown in Figure 6. This second verification report can be sent by the control program instance to the first user program instance.

[0117] The first user program instance can then further verify the security of the control program instance based on the second response result in the second verification report to obtain a first verification result reflecting the security of the control program instance. The first user program instance can generate a verification report including the first verification result, the third verification result, and the first response result, i.e., the third verification report in the embodiment shown in FIG6 , and further send the third verification report to the user client.

[0118] S205 , sending a certification report including a certification result reflecting the security of the second user program instance in the computing system and the first response result to the user client, so that the user client can prove the security of the first user instance according to the first response result.

[0119] Finally, after receiving the third attestation report, the user client can understand the security of both the control program instance and the second user program instance. Furthermore, the security of the first user program instance can be attested based on the first response in the third attestation report. Ultimately, the user client obtains an attestation result reflecting the security of each program instance in the heterogeneous computing system. This attestation result can also be displayed to the user, allowing them to gain a detailed understanding of the security status of the heterogeneous computing system.

[0120] In addition, for the contents not described in detail in this embodiment and the technical effects that can be achieved, please refer to the relevant descriptions in the embodiments shown in Figures 6 to 8, and will not be repeated here.

[0121] The technical effects mentioned in the embodiments shown in FIG. 6 to FIG. 9 can also be understood from another perspective:

[0122] For the heterogeneous computing system shown in FIG6 , in conjunction with FIG10 , another security proof method can be described as follows: a user client can first send a first proof request to a first user program instance, and the first user program instance can then feed back a first response result obtained in response to the request to the user client. The user client can then prove the security of the first user program instance based on the first response result. The user client then displays a second proof result reflecting the security of the first user program instance for the user to understand.

[0123] Afterward, the user client no longer directly participates in the control program instance's attestation process. Instead, the first user program instance, which meets security requirements, sends a second attestation request to the control program instance on behalf of the user client, and the control program instance receives a second response. The first user program can then further attest to the security of the control program instance based on the second response.

[0124] Furthermore, the control program instance that meets the security requirements further sends a third certification request to the second user program instance, and proves the security of the second user program instance based on the third certification result obtained by the second user program instance in response to the third certification request.

[0125] According to the above description, compared with the methods and systems provided in the embodiments shown in Figures 6 to 9, the proof method shown in Figure 10, similar to Figure 5, still has the problem that security proof is time-consuming and users cannot fully understand the security status of the computing system.

[0126] The difference between different proof methods can be seen by comparing Figures 8 and 10. In the system or method provided by the embodiments shown in Figures 6 to 9, the first response result generated by the first user program instance and the second response result generated by the control program instance are not immediately fed back to the user client. Instead, after the proof of the security of the second user program instance is completed, the third proof result and the second response result are fed back to the control program instance together, so that the control program instance can prove the security of the second user program instance and obtain the first proof result. After the first user program instance generates the first proof result, the first proof result, the third proof result and the first response result are fed back to the user client together, so that the user client can obtain the proof results of each program instance in the computing system after completing the proof of the security of the first user program instance.

[0127] That is, the embodiments shown in Figures 6 to 9 can achieve asynchronous security verification of different program instances in a computing system by delaying the feedback of response results, thereby shortening the verification time. At the same time, it can also enable users to fully understand the security status of the computing system.

[0128] To facilitate understanding, we can use a specific computing system to illustrate the security proof process.

[0129] Assuming that the computing unit of the computing system shown in FIG1 is specifically represented by a CPU, the first user program instance and the control program instance running therein can provide users with office automation (OA) services with less computing power.

[0130] The user client can be installed with an application corresponding to the OA service, which can also be deployed to the computing system, i.e., the first user program instance in the computing unit. After the first user program instance is deployed or while the user is using the OA service, the user client can proactively generate a first certification request to initiate certification of the computing system security. The specific process and technical effects of this computing system security certification can be found in the relevant descriptions of the embodiments shown in Figures 1 to 4, and will not be repeated here.

[0131] Assume that the heterogeneous computing system shown in Figure 6 can be specifically represented as Figure 11. Figure 11 is a schematic diagram of the structure of another computing system provided by an embodiment of the present invention. In this computing system, a first user program instance and a control program instance can run in a first computing unit represented by a CPU, and a second user program instance can run in a second computing unit represented by an FPGA. This computing system can provide users with the database services or artificial intelligence services mentioned in the above embodiments, etc.

[0132] When the target service is a database service, the first user program instance in the CPU is used to provide the database service's add, delete, and modify functions, while the second user program instance in the faster FPGA is used to provide the database service's query functions. When the target service is a facial recognition service, in the computing system shown in Figure 11, the first user program instance in the CPU collects facial images, while the second user program instance in the faster FPGA is used to perform facial recognition based on the facial images.

[0133] The user client can install an application corresponding to the target service, and the application can also be deployed to the computing system, that is, the first user program instance in the computing unit. After the first user program instance is deployed or when the user uses the target service, the user client can actively generate a first certification request to start the certification of the computing system security.

[0134] The specific process and technical effects of the security proof of the heterogeneous computing system shown in FIG11 can be found in the relevant descriptions in the embodiments shown in FIG6 to FIG8 , and will not be repeated here.

[0135] The following describes in detail one or more embodiments of the present invention to prove the security of a computing system. Those skilled in the art will appreciate that these proof devices can be constructed using commercially available hardware components and configured according to the steps taught in this solution.

[0136] FIG12 is a schematic diagram of a structure of a proof of computing system security provided by an embodiment of the present invention. As shown in FIG12 , the apparatus includes:

[0137] The response module 11 is configured to respond to a first certification request generated by a user client to generate a first response result.

[0138] The sending module 12 is configured to send a second certification request to the control program instance in the computing system in response to receiving the first certification request.

[0139] The certification module 13 is used to prove the security of the control program instance according to the second response result corresponding to the second certification request generated by the control program instance.

[0140] The sending module 12 is configured to send the first response result, so that the user client can prove the security of the first user instance according to the first response result.

[0141] Optionally, the sending module 12 is configured to send a certification report including a certification result reflecting the security of the control program instance to the user client, wherein the first response result and the certification result reflecting the security of the control program instance are included in the same certification report generated by the first user program instance.

[0142] Optionally, the sending module 12 is used to send a certification report containing a certification result reflecting the security of the second user program instance in the computing system to the user client, wherein the first user program instance and the second user program instance correspond to the target service used by the user client, and the first response result and the certification result reflecting the respective security of the second user program instance and the control program instance are included in the same certification report generated by the first user program instance.

[0143] Among them, the first user program instance and the second user program instance run in computing units with different computing speeds in the computing system; the control program instance and the first user program instance run in the same computing unit; each computing unit in the computing system provides a trusted execution environment for the running of different program instances.

[0144] Optionally, the apparatus further comprises: a receiving module 14, configured to receive a certification report including the certification result reflecting the security of the second user program instance, wherein the second response result and the certification result reflecting the security of the second user program instance are included in the same certification report generated by the control program instance;

[0145] In which, the control program instance sends a third proof request to the second user program instance in response to receiving the second proof request; the second user program instance generates a third response result in response to the third proof request and sends the third response result to the control program instance; the control program instance proves the security of the second user program instance based on the third response result.

[0146] The computing speed of the computing unit running the second user program instance is higher than the computing speed of the computing unit running the first user program.

[0147] The device shown in FIG12 can execute the method of the embodiment shown in FIG4 or FIG9. For the parts not described in detail in this embodiment, please refer to the relevant description of the embodiment shown in FIG4 or FIG9. The execution process and technical effects of this technical solution are described in the embodiment shown in FIG4 or FIG9, and will not be repeated here.

[0148] In one possible design, the computing system security proofing methods provided in the above embodiments can be applied to an electronic device, as shown in FIG13 . The electronic device may include a computing system 21 and a memory 22. The memory 22 is used to store a program that supports the electronic device in executing the computing system security proofing methods provided in the embodiments shown in FIG4 or FIG9 . The computing system 21 is configured to execute the program stored in the memory 22.

[0149] The program includes one or more computer instructions, wherein the one or more computer instructions, when executed by the computing system 21, can implement the following steps:

[0150] Responding to a first certification request generated by a user client to generate a first response result;

[0151] In response to receiving the first attestation request, sending a second attestation request to a control program instance in the computing system;

[0152] Proving the security of the control program instance according to a second response result corresponding to the second proof request generated by the control program instance;

[0153] The first response result is sent, so that the user client can prove the security of the first user instance according to the first response result.

[0154] Optionally, the computing system 21 is further configured to execute all or part of the steps in the embodiment shown in FIG. 4 or FIG. 9 .

[0155] The structure of the electronic device may further include a communication interface 23 for the electronic device to communicate with other devices or a communication network.

[0156] In addition, an embodiment of the present invention provides a computer storage medium for storing computer software instructions used by the above-mentioned electronic device, which includes a program involved in executing the method for proving the security of the computing system shown in Figure 4 or Figure 9 above.

[0157] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for proving the security of a computing system, characterized in that: A first user program instance applied to the computing system includes: Responding to a first certification request generated by a user client to generate a first response result; In response to receiving the first attestation request, sending a second attestation request to a control program instance in the computing system; Proving the security of the control program instance according to a second response result corresponding to the second proof request generated by the control program instance; The first response result is sent so that the user client can prove the security of the first user instance according to the first response result.

2. The method according to claim 1, characterized in that The method further comprises: A certification report including a certification result reflecting the security of the control program instance is sent to the user client, wherein the first response result and the certification result reflecting the security of the control program instance are included in the same certification report generated by the first user program instance.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: A certification report including a certification result reflecting the security of a second user program instance in the computing system is sent to the user client, wherein the first user program instance and the second user program instance correspond to a target service used by the user client, and a first response result and a certification result reflecting the respective security of the second user program instance and the control program instance are included in the same certification report generated by the first user program instance.

4. The method according to claim 3, characterized in that The method further comprises: receiving a certification report including the certification result reflecting the security of the second user program instance, wherein the second response result and the certification result reflecting the security of the second user program instance are included in the same certification report generated by the control program instance; Among them, the control program instance sends a third proof request to the second user program instance in response to receiving the second proof request; the second user program instance generates a third response result in response to the third proof request and sends the third response result to the control program instance; the control program instance proves the security of the second user program instance based on the third response result.

5. The method according to claim 3, characterized in that: The first user program instance and the second user program instance are run in computing units with different computing speeds in the computing system; the control program instance and the first user program instance are run in the same computing unit; Each computing unit in the computing system provides a trusted execution environment for running different program instances.

6. The method according to claim 5, characterized in that The computing speed of the computing unit running the second user program instance is higher than the computing speed of the computing unit running the first user program.

7. A computing system, characterized in that: include: a computing unit running a first user program instance and a control program instance; The first user program instance is used to respond to a first certification request sent by a user client to generate a first response result; in response to receiving the first certification request, send a second certification request to the control program instance; Proving the security of the control program instance according to the second response result corresponding to the second certification request; sending the first response result to the user client, so that the user client proves the security of the first user program instance according to the received first response result; The control program instance is used to respond to the second certification request to generate the second response result.

8. The system according to claim 7, characterized in that The first user program instance is used to generate a certification report including the first response result and a certification result reflecting the security of the control program instance; and send the first certification report to the user client.

9. The system according to claim 7, characterized in that The computing unit includes computing units with different computing speeds, the first user program instance and the control program instance run in the same computing unit; the first user program instance and the second user program instance run in different computing units, and the first user program instance and the second user program instance correspond to a target service used by the user client; the control program instance, to send a third certification request to the second user program instance in response to receipt of the second certification request; Prove the security of the second user program instance according to the third response result corresponding to the third proof request; send a second proof report including the second response result and the proof result reflecting the security of the second user program instance to the first user program instance; The second user program instance is used to respond to the third certification request to generate the third response result; Sending the third response result to the control program instance; the first user program instance being configured to receive the second attestation report; A third attestation report including the first response result and an attestation result reflecting the respective security of the control program instance and the second user program instance is sent to the user client.

10. The system according to claim 9, characterized in that The first user program instance and the second user program instance run in the first computing unit and the second computing unit in the computing system respectively; the computing speed of the second computing unit is higher than the computing speed of the first computing unit; the first computing unit and the second computing unit provide a trusted execution environment for the running of program instances.

11. The system according to claim 10, characterized in that The first computing unit is configured to obtain, in response to an application for the target service, the first user program instance corresponding to the target service, so that the first user program instance runs in a trusted execution environment provided by the first computing unit; The second computing unit is used to obtain the second user program instance corresponding to the target service in response to the application of the target service, so that the second user program instance runs in the trusted execution environment provided by the second computing unit.

12. An electronic device, characterized in that: include: A memory and a computing system; wherein the memory stores executable code, and when the executable code is executed by the computing system, the computing system executes the computing system security proof method according to any one of claims 1 to 6.

13. A non-transitory machine-readable storage medium, characterized in that: The non-transitory machine-readable storage medium stores executable code, and when the executable code is executed by a computing system of an electronic device, the computing system is caused to execute the computing system security certification method according to any one of claims 1 to 6.

Images