WO2021218976A1 - 应用程序的处理方法、装置、云环境、介质及程序产品 - Google Patents

应用程序的处理方法、装置、云环境、介质及程序产品 Download PDF

Info

Publication number
WO2021218976A1
WO2021218976A1 PCT/CN2021/090317 CN2021090317W WO2021218976A1 WO 2021218976 A1 WO2021218976 A1 WO 2021218976A1 CN 2021090317 W CN2021090317 W CN 2021090317W WO 2021218976 A1 WO2021218976 A1 WO 2021218976A1
Authority
WO
WIPO (PCT)
Prior art keywords
enclave
class
application
entry function
application program
Prior art date
Application number
PCT/CN2021/090317
Other languages
English (en)
French (fr)
Inventor
江健宇
陈旭升
李梓安
王成
崔鹤鸣
王森
王鹏
张弓
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21796229.9A priority Critical patent/EP4141717A4/en
Publication of WO2021218976A1 publication Critical patent/WO2021218976A1/zh
Priority to US17/975,163 priority patent/US20230106435A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/629—Protecting access to data via a platform, e.g. using keys or access control rules to features or functions of an application
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45575—Starting, stopping, suspending or resuming virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/033—Test or assess software

Definitions

  • the embodiments of the present application relate to communication technology, and in particular, to an application processing method, device, cloud environment, medium, and program product.
  • Cloud computing is a type of distributed computing.
  • efficient data processing applications such as Spark applications, etc.
  • Cloud computing technology enables the widespread deployment of efficient data processing applications.
  • Applications deployed in a cloud environment usually require high stability and security. For example, these applications need to not easily crash when processing a large number of requests, and not leak user privacy data when attacked by external attackers.
  • Java language has the characteristics of simplicity, object-oriented, distributed, robustness, security, platform independence and portability, multi-threading, dynamics, etc., many applications deployed in the cloud environment use Java Language for writing.
  • SGX software guard extensions
  • the execution environment provided by the enclave is the execution environment of C/C++ language. Due to the limited memory area of the enclave, application developers need to manually divide the original program code of the application into a trusted part and an untrusted part, and manually rewrite the trusted part of the code from Java language to C/
  • the C++ language method runs the trusted part of the application in the enclave to ensure that the application has a smaller trusted computing base (TCB) and attack surface.
  • TDB trusted computing base
  • this manual code rewriting method results in a large amount of code rewriting and low code rewriting efficiency.
  • the embodiments of the present application provide an application processing method, device, cloud environment, medium, and program product to solve how to maintain a small TCB and attack surface while reducing the workload of manual code rewriting , The problem of running the trusted part of the application in an enclave.
  • an embodiment of the present application provides a method for processing an application program.
  • the method includes: first, receiving a startup request sent by a first client, where the startup request is used to start the application program.
  • the manifest file includes: description information of the enclave entry function of the application program, and/or description information of the enclave exit function of the application program.
  • the code of the trusted part of the application can be loaded based on the application manifest file, the application’s enclave entry function and the dependency relationship of the static dependent class, In this way, part of the application code (that is, the enclave entry function and static dependency class) written in high-level language can be directly run in the enclave, which can improve the security of the trusted part of the application and keep the application small
  • the TCB and attack surface improve the execution efficiency of the application in the enclave. At the same time, it also reduces the amount of manual code rewriting of the application and improves the ease of use of the application in the enclave.
  • the following methods can be used to obtain the dependency between the enclave entry function of the application and the static dependent class:
  • One way According to the code of the application, the description file of the class marked with the first annotation in the application is obtained. Wherein, the first annotation mark is used to characterize that the class marked by the first annotation is an enclave entry function.
  • the dependency relationship between the enclave entry function of the application and the static dependent class is obtained.
  • the second method receiving the dependency relationship between the enclave entry function of the application and the static dependent class sent by the first client.
  • the third way Obtain the dependency relationship between the enclave entry function of the application and the static dependent class from the storage database.
  • the manifest file of the application program may be obtained in the following manner: receiving the manifest file of the application program sent by the first client. Or, obtain the manifest file of the application from the storage database.
  • the flexibility of obtaining the manifest file of the application program is improved.
  • the high-level language runtime environment may be pre-run in the above enclave, or, before the dependency relationship between the manifest file of the loaded application and the enclave entry function of the application and the static dependent class It can include: loading the high-level language operating environment in the enclave to verify the integrity of the high-level language operating environment.
  • the way to run the high-level language runtime environment in the enclave is expanded, as well as the way to run the application in the enclave.
  • the method may further include: verifying the integrity of the static dependent class of the loaded enclave entry function.
  • the hash value of the application is generated according to the hash value of the static dependent class of the enclave entry function and the manifest file.
  • the hash value of the application program is sent to the first client, and the hash value of the application program is used by the first client to verify the integrity of the static dependency class of the enclave entry function loaded in the enclave.
  • the computing device and the client can respectively verify the integrity of the static dependent classes of the enclave entry function loaded in the enclave.
  • the operation of verifying the integrity can be performed at any time after loading the enclave entry function of the application and the static dependent classes of the enclave entry function and before running the enclave entry function of the application, which is not limited. .
  • the method may further include: after the integrity verification of the static dependent class of the enclave entry function is passed, switching to the flying enclave entry function when calling the first enclave entry function of the application through the first thread
  • the ground allocates the first memory area for the first thread. Create and execute the static dependent class object of the first enclave entry function in the first memory area.
  • the method further includes: obtaining the dependency relationship between the first dynamic dependency class and the static dependency class; according to the first dynamic dependency class and the static dependency class Depending on the dependency of the dependent class, the first dynamic dependent class is dynamically loaded; the integrity of the first dynamic dependent class is verified; after the integrity verification of the first dynamic dependent class is passed, the first dynamic dependency is created and executed in the first memory area Object of the class.
  • the first enclave entry function has a calling relationship with the first enclave exit function.
  • the method also includes: switching from the high-level language operating environment of the enclave to the non-enclave environment, and in the non-enclave environment Execute the first enclave exit function and return to the high-level language runtime environment of the enclave.
  • the method further includes: after the first enclave entry function exits execution, if the object of the first enclave entry function is not accessed by other threads, clearing the first thread and the first memory area The mapping relationship.
  • the first memory area allocated for the first thread can be cleaned up in time, so that the memory pages included in the first memory area can be allocated to other threads for use. Thereby, the memory of the enclave can be released in time, and the efficiency of garbage collection in the memory of the enclave can be improved.
  • the method further includes: after the first enclave entry function exits execution, if the first object of the first enclave entry function is accessed by other threads, then synchronously stop executing all threads in the enclave Enclave entry function called. Determine at least one second thread to access the first object. According to the number of at least one second thread, the first object is copied. Clear the mapping relationship between the first thread and the first memory area. For example, performing copy processing on the first object according to the number of at least one second thread may include: if the number of the second thread is 1, copy the first object to the second memory area corresponding to the second thread; or, If the number of second threads is greater than 1, the first object is copied to the global memory area of the enclave.
  • the first memory area allocated for the first thread can be cleaned up in time, so that the memory pages included in the first memory area can be allocated to other threads for use. Thereby, the memory of the enclave can be released in time, and the efficiency of garbage collection in the memory of the enclave can be improved.
  • an embodiment of the present application provides a processing method for an application program.
  • the method includes: first, according to the code of the application program, obtaining a class that contains the first annotation annotation in the application program, and/or contains the second annotation annotation the type.
  • the first annotation mark is used to characterize the class marked by the first annotation as an enclave entry function
  • the second annotation mark is used to characterize the class marked by the second annotation as an enclave exit function.
  • the manifest file of the application is generated.
  • the manifest file includes: description information of the enclave entry function of the application program, and/or description information of the enclave exit function of the application program.
  • any device that can obtain the code of the application (for example, the device of the developer of the application, or the client that uses the application, etc.) can be based on the class marked with the first annotation, and /Or, the class with the second annotation is generated, and the manifest file of the application program is generated.
  • the method may further include: obtaining the static dependent class of the enclave entry function of the application according to the description file of the class marked with the first annotation. According to the hash value of the static dependent class of the enclave entry function and the manifest file, the hash value of the application is generated, and the hash value of the application is used to verify the integrity of the static dependent class. Through this possible implementation, the hash value of the application can be obtained. Later, when using the application remotely, the user can verify the integrity of the code running in the enclave of the cloud environment based on the hash value and the hash value returned by the cloud environment.
  • the method may further include: obtaining the dependency relationship between the enclave entry function of the application program and the static dependent class according to the description file of the class marked with the first annotation.
  • an embodiment of the present application provides a processing device for an application program.
  • the device includes a receiving module and a processing module.
  • the receiving module is used to receive the start request sent by the first client, and the start request is used to start the application program.
  • the processing module is used to load the application manifest file and the dependency relationship between the application enclave entry function and the static dependent class in the enclave's high-level language operating environment according to the startup request; according to the manifest file and the enclave entry The dependency between the function and the static dependent class, and the static dependent class of the enclave entry function that loads the application.
  • the manifest file includes: description information of the enclave entry function of the application program, and/or description information of the enclave exit function of the application program.
  • the processing module is also used to obtain the application’s code of the class marked with the first annotation before loading the dependency between the application’s enclave entry function and the static dependent class.
  • Description file according to the description file of the class marked by the first annotation in the application, the dependency relationship between the enclave entry function of the application and the static dependent class is obtained; wherein the first annotation is used to characterize the class marked by the first annotation Enclave entry function.
  • the processing module is also used to receive the enclave entry function and the enclave entry function and The dependency of the static dependent class; or, the processing module, which is also used to obtain the dependency of the application’s enclave entry function and the static dependent class from the storage database before loading the dependency of the application’s enclave entry function and the static dependent class relation.
  • the processing module is also used to receive the manifest file of the application program sent by the first client through the receiving module before loading the manifest file of the application program; or, the processing module is also used to Before loading the application manifest file, obtain the application manifest file from the storage database.
  • the processing module is also used to load the high-level language runtime environment in the enclave before loading the manifest file of the application and the dependency of the application’s enclave entry function and the static dependent class to verify The integrity of the high-level language runtime environment.
  • the device may further include: a sending module.
  • the processing module is also used to verify the integrity of the static dependent class of the loaded enclave entry function after loading the static dependent class of the enclave entry function of the application; the integrity verification of the static dependent class of the enclave entry function passes the integrity verification Then, the hash value of the application is generated according to the hash value of the static dependency class of the enclave entry function and the manifest file.
  • the sending module is used to send the hash value of the application program to the first client; the hash value of the application program is used by the first client to verify the integrity of the static dependency class of the enclave entry function loaded in the enclave .
  • the processing module is also used to switch to the fly when the first enclave entry function of the application is called through the first thread after the integrity verification of the static dependent class of the enclave entry function is passed.
  • the earth allocates the first memory area for the first thread, and creates and executes the static dependent class object of the first enclave entry function in the first memory area.
  • the first enclave entry function also includes the first dynamic dependency class.
  • the processing module is also used to obtain the dependency relationship between the first dynamic dependency class and the static dependency class; dynamically load the first dynamic dependency class according to the dependency relationship between the first dynamic dependency class and the static dependency class; The integrity of the first dynamic dependent class, and after the integrity verification of the first dynamic dependent class is passed, an object of the first dynamic dependent class is created and executed in the first memory area.
  • the first enclave entry function has a calling relationship with the first enclave exit function.
  • the processing module is also used to switch from the high-level language operating environment of the enclave to the non-enclave environment; execute the first enclave exit function in the non-enclave environment; and return to the high-level language operating environment of the enclave.
  • the processing module is also used to clear the first thread and the first memory after the first enclave entry function exits execution, if the object of the first enclave entry function is not accessed by other threads The mapping relationship of the area.
  • the processing module is also used to synchronously stop executing all the enclaves in the enclave after the first enclave entry function exits execution, if the first object of the first enclave entry function is accessed by other threads Enclave entry function called by the thread; determine at least one second thread that accesses the first object; perform copy processing on the first object according to the number of at least one second thread; clear the mapping relationship between the first thread and the first memory area.
  • the processing module is specifically configured to copy the first object to the second memory area corresponding to the second thread when the number of second threads is 1, or to copy the first object when the number of second threads is greater than 1. Copy to the global memory area of the enclave.
  • beneficial effects of the application processing apparatus provided by the foregoing third aspect and each possible implementation manner of the third aspect may refer to the beneficial effects brought about by the foregoing first aspect and each possible implementation manner of the first aspect. This is not repeated here.
  • an embodiment of the present application provides a processing device for an application program, and the device includes a processing module.
  • the processing module is used to obtain the class with the first annotation annotation in the application program according to the code of the application program, and/or the class with the second annotation annotation; according to the class with the first annotation annotation, and/or,
  • the class containing the second annotation mark is used to generate the manifest file of the application; where the first annotation mark is used to characterize the class marked by the first annotation as the enclave entry function, and the second annotation mark is used to characterize the second annotation mark.
  • the class is an enclave export function
  • the manifest file includes: description information of the enclave entry function of the application, and/or description information of the enclave exit function of the application.
  • the processing module is also used to obtain the static dependent class of the enclave entry function of the application according to the description file of the class marked with the first annotation; according to the static dependent class of the enclave entry function
  • the value and manifest file are used to generate the hash value of the application, and the hash value of the application is used to verify the integrity of the static dependent class.
  • the processing module is also used to obtain the dependency relationship between the enclave entry function of the application program and the static dependent class according to the description file of the class marked with the first annotation.
  • an embodiment of the present application provides a processing device for an application program.
  • the processing device for an application program includes a processor and a memory.
  • the memory is used to store computer executable program code
  • the program code includes computer execution instructions; when the processor executes the computer execution instructions, the computer execution instructions cause the processing device of the application program to perform the first aspect or the first aspect.
  • the method provided by the implementation method includes a processor and a memory.
  • an embodiment of the present application provides a processing device for an application program.
  • the processing device for an application program includes a processor and a memory.
  • the memory is used to store computer executable program code
  • the program code includes computer execution instructions; when the processor executes the computer execution instructions, the computer execution instructions cause the processing device of the application program to perform the possible operations of the second aspect or the second aspect.
  • the method provided by the implementation method includes a processor and a memory.
  • an embodiment of the present application provides an application processing device, including a unit, module, or circuit for executing the above method provided in the first aspect or each possible implementation of the first aspect.
  • the processing device of the application program may be a computing device in a cloud environment, or a module applied to a computing device in a cloud environment, for example, it may be a chip of a computing device applied in a cloud environment.
  • an embodiment of the present application provides an application processing device, including a unit, module, or circuit for executing the above method provided in the second aspect or each possible implementation manner of the second aspect.
  • the processing device of the application program may be a client in the cloud environment, or a module applied to the client in the cloud environment, for example, may be a chip applied to the client in the cloud environment.
  • an embodiment of the present application provides a network device with a computer program stored on the network device.
  • the computer program is executed by the network device, the above-mentioned possible implementation manners or first aspects such as the first aspect or the first aspect are implemented.
  • the network device may be a chip, for example.
  • an embodiment of the present application provides a network device, which includes a processor and an interface circuit.
  • the interface circuit is used to receive computer-executed instructions and transmit them to the processor; the processor runs the computer-executed instructions to execute each possible implementation manner of the first aspect or the first aspect or the second aspect or the second aspect.
  • the method provided by the implementation method may be a chip, for example.
  • an embodiment of the present application provides a network device, which includes a processor and a memory.
  • the memory is used to store computer-executable instructions;
  • the processor is used to execute the computer-executable instructions stored in the memory, so that the network device executes the possible implementations of the first aspect or the first aspect or the second aspect or the second aspect.
  • the network device may be a chip, for example.
  • an embodiment of the present application provides a network device, which includes a processor, a memory, and a transceiver.
  • the transceiver is used to receive signals or send signals;
  • the memory is used to store computer programs;
  • the processor is used to call the computer programs from the memory to execute the possible implementations of the first aspect or the first aspect or the second aspect Or the method provided by each possible implementation of the second aspect.
  • the network device may be a chip, for example.
  • the embodiments of the present application provide a computer program product.
  • the computer program product includes computer program code.
  • the computer program code When the computer program code is run on a computer, the computer can execute various possibilities such as the first aspect or the first aspect. Or the method provided by the second aspect or each possible implementation of the second aspect.
  • the embodiments of the present application provide a computer-readable storage medium.
  • the computer-readable storage medium is used to store a computer program or computer-executable instructions.
  • the computer program or computer-executable instructions When the computer program or computer-executable instructions are run on a computer, the computer executes such as The method provided by the first aspect or each possible implementation manner of the first aspect or the second aspect or each possible implementation manner of the second aspect.
  • an embodiment of the present application provides a cloud environment, which includes: the application processing device according to any one of the third aspect and the application processing device according to any one of the fourth aspect.
  • the cloud environment includes: the application processing device according to any one of the fifth aspect and the application processing device according to any one of the sixth aspect.
  • the application processing method, device, cloud environment, medium, and program product provided by the embodiments of the application can be based on the application manifest file and the application enclave entry function in the high-level language operating environment of the enclave.
  • the dependence relationship with the static dependent class load the trusted part of the application code, so that the part of the application code (that is, the enclave entry function and the static dependent class) written in high-level language can be directly run in the enclave, which can improve
  • the security of the trusted part of the application allows the application to maintain a small TCB and attack surface, improves the execution efficiency of the application in the enclave, and at the same time reduces the amount of manual code rewriting of the application, which improves The ease of use that the application can run in the enclave.
  • FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the application
  • FIG. 2 is a schematic diagram of a programming model provided by an embodiment of the application.
  • FIG. 3 is a schematic flowchart of an application processing method provided by an embodiment of the application.
  • FIG. 4 is a schematic diagram of a memory management provided by an embodiment of the application.
  • FIG. 5 is a schematic flowchart of another application processing method provided by an embodiment of the application.
  • FIG. 6 is a schematic flowchart of yet another application processing method provided by an embodiment of the application.
  • FIG. 7 is a schematic flowchart of yet another application processing method provided by an embodiment of the application.
  • FIG. 8 is a schematic flowchart of yet another application processing method provided by an embodiment of the application.
  • FIG. 9 is a schematic flowchart of yet another application processing method provided by an embodiment of this application.
  • FIG. 10 is a schematic flowchart of yet another application processing method provided by an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of an application processing apparatus provided by an embodiment of this application.
  • FIG. 12 is a schematic structural diagram of another application processing apparatus provided by an embodiment of this application.
  • FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the application.
  • the application can be deployed in a cloud environment.
  • the cloud environment is an entity that uses basic resources to provide cloud services to users in the cloud computing mode.
  • the cloud environment includes a cloud data center and a cloud service platform.
  • the cloud data center includes a large number of basic resources (including computing resources, storage resources, and network resources) owned by a cloud service provider.
  • the computing resources included in the cloud data center can be a large number of computing resources.
  • Device for example, server).
  • the computing resources included in the cloud data center are servers running virtual machines as an example
  • applications can be independently deployed on servers or virtual machines (VMs) in the cloud data center, and applications can also be distributed It is deployed on multiple servers in a cloud data center, or distributed on multiple virtual machines in a cloud data center, or distributed on servers and virtual machines in a cloud data center.
  • VMs virtual machines
  • the application program can be abstracted by the cloud service provider into a cloud service on the cloud service platform and provided to the user. After the user purchases the cloud service on the cloud service platform (for example, it can be pre-charged and then settled according to the use of the final resource).
  • the environment uses applications deployed in the cloud data center to provide cloud services to users.
  • the user can specify the operation that needs to be performed by the application through the application program interface (API) or GUI.
  • API application program interface
  • GUI application program interface
  • the application in the cloud environment performs the corresponding operation, and sends the application to the user through the API or GUI. Return the execution result.
  • the above-mentioned application program deployed in a cloud environment may also be referred to as an application program using a user-server model.
  • the server running the application is a server in a cloud environment.
  • the applications deployed on the cloud environment may encounter the following privileged attacks: external privileged attackers, for example, control the operating system of the cloud environment through operating system vulnerabilities, so as to attack the applications running on the operating system. For example, extracting and tampering with the data of applications running on the operating system.
  • an internal privileged attacker for example, a staff member of a cloud environment provider (cloud provider for short), etc.
  • Enclaves can provide two security features: confidentiality and integrity.
  • the memory area storing data and code in the enclave is isolated from ordinary untrusted memory. Therefore, the data and code running in the enclave cannot be snooped, extracted, or tampered with by a privileged attacker. Therefore, the enclave can guarantee the confidentiality and integrity of applications running on the enclave.
  • the enclave can provide a remote attestation mechanism.
  • the remote verification mechanism can measure the integrity of the operating environment running in the enclave, and generate a verification report (for example, the hash value of the operating environment) and provide it to the client remotely using the application. , So that the client verifies the operating environment running in the enclave.
  • the metrics mentioned here can also be called verification.
  • the enclave can provide two interfaces for applications, namely the enclave entry function (ECall) and the enclave exit function (OCall).
  • ECall enclave entry function
  • OCall enclave exit function
  • the enclave entry function is a trusted function defined by the application and executed in the enclave.
  • the enclave exit function is a function that is called when the enclave entry function is executed in the enclave and is executed in the untrusted execution environment.
  • Enclave exit functions are usually used to execute privileged instructions, such as operating system functions (System Call). It should be understood that the enclave entry function may have at least one enclave exit function with a calling relationship, or there may be no enclave exit function, which may be related to whether the enclave entry function needs to execute a privileged instruction or not.
  • the enclave entry function when an enclave entry function of an application is called by an untrusted environment, the enclave entry function is executed in the execution environment of the enclave to decrypt the encrypted data provided by the user and perform calculations.
  • the enclave entry function needs to call the enclave exit function, it will exit the enclave execution environment and execute the corresponding enclave exit function in the untrusted execution environment.
  • the result calculated by the enclave entry function is encrypted, it exits the execution environment of the enclave and returns the encrypted execution result to the user.
  • Enclaves can reduce TCB and attack surface.
  • the traditional system trusts the system software, operating system, and BIOS. Therefore, the TCB of the traditional system includes all these software and hardware, so the interaction of these system software with untrusted users will become the attack surface.
  • the enclave provided by TEE only trusts all the code running in the enclave (ie TCB), and the attack surface is only the interaction part between the enclave and the untrusted environment (such as the enclave exit function and the enclave entry function). Therefore, you can Reduce TCB and attack surface.
  • Enclave execution can reduce computational and storage costs.
  • the execution environment provided by the enclave is the execution environment of the C/C++ language, that is, the enclave entry function and the enclave exit function provided by the enclave are C/C++ interface functions. Therefore, in the prior art, the following methods are provided to enable the application program to run in the enclave:
  • the developer of the application manually divides the original program code of the application into a trusted part and an untrusted part.
  • the trusted part handles decrypted sensitive data
  • the untrusted part manages encrypted data
  • the operating system calls and manages the enclave.
  • the application developer manually rewrites the trusted part of the code from Java language to C/C++ language, and adds encryption and decryption logic, so that the trusted part of the application can run in the enclave.
  • the operating system calls the enclave exit function written by the application developer and transmits it to the untrusted environment for execution and verifies the returned result.
  • the TCB of the application includes the application and its dependent libraries, the library system (or container daemon), and the trusted hardware itself.
  • the library system or container daemon
  • the library system may contain hundreds of thousands of lines of code. Vulnerabilities in any code in the TCB may cause the application to crash or be attacked, leading to damage to the confidentiality and integrity of the application.
  • enclave execution usually provides limited memory capacity, for example, the maximum memory capacity is about 100M.
  • the maximum memory capacity is about 100M.
  • the data will be processed by pagging that is 1000X higher than the memory. That is, the data is stored in the untrusted memory by page swap, and when the data is used, it is read from the untrusted memory to the enclave.
  • the current execution environment provided by the enclave is the execution environment of the C/C++ language, that is, the enclave entry function and the enclave exit function provided by the enclave are C/C++ interface functions.
  • This low-level C/C++ interface function leads to problems with the security of the trusted part of the application.
  • the C/C++ language has non-memory safety features. Therefore, a privileged attacker can use the vulnerability of C/C++ to attack it.
  • C/C++ language also has non-type-safe features, and can easily affect the confidentiality and integrity of application programs. For example, a trusted part written in C/C++ language may have a buffer overflow error, which may pollute the execution stack of the application program, thereby affecting the execution control flow of the application program.
  • the embodiment of this application proposes a method of running a high-level language operating environment in an enclave, and directly running part of the code of an application program written in the high-level language in the enclave. That is, the operating environment of the high-level language running in the enclave and the trusted code of the application are trusted, while other parts (such as the operating system, BIOS, and other operating environments running outside the enclave) are not trusted of.
  • the high-level language mentioned here can be any object-oriented high-level language, such as Java language, Scala language, etc.
  • the high-level language has the good characteristics of type safety and memory safety, which can easily protect the trusted part of the application from traditional memory attacks, and can also prevent memory errors and improve the security of the trusted part of the application.
  • the first aspect Provides two annotation-based programming interfaces, namely the first interface JECall and the second interface JOCall.
  • the first interface JECall corresponds to the first annotation @JECall
  • the second interface JOCall corresponds to the second annotation @JOCall.
  • the first annotation @JECall is used to signify that the class marked by the first annotation @JECall is an enclave entry function
  • the second annotation @JOCall is used to signify that the class marked by the second annotation @JOCall is an enclave exit function.
  • the class marked with the first annotation is the class running in the enclave
  • the class marked with the second annotation is the class running in the enclave called by the class running in the enclave (for example, Operating system calls, etc.).
  • the non-enclave environment mentioned here can also be called an untrusted environment.
  • JECall, JOCall, @JECall, and @JOCall are only used to describe the first interface, the second interface, the first annotation, and the second annotation. And the specific name used in the second note is not limited.
  • FIG. 2 is a schematic diagram of a programming model provided by an embodiment of the application.
  • the application developer can use the above-mentioned first comment and second comment to the application in the programming model
  • the code is divided into the trusted part and the untrusted part.
  • the application in Figure 2 includes: handle_request function, decrypt function, store function.
  • the handle_request function calls the decrypt function and the store function during execution.
  • the handle_request function is marked as JECall by the application developer and the store function is marked as JOCall, it means that both the handle_request function and the decrypt function it calls will run in the enclave.
  • the store function called by the handle_request function will run in an untrusted environment. That is, when the handle_request function is called in an untrusted environment, it will switch to the enclave to execute the handle_request function.
  • the decryption function can be used to decrypt the encrypted data provided by the client.
  • the store function When the store function is called, it will switch from the enclave to the untrusted environment to execute the function and return the result.
  • the execution of JECall When the execution of JECall is completed, it exits the enclave and returns the encrypted calculation result.
  • Figure 2 takes the programming model as an example, how to use the above-mentioned first comment and second comment to divide the trusted part and the untrusted part of the application code. It should be understood that the developer of the application program may also adopt other methods, using the first comment and the second comment to divide the trusted part and the untrusted part of the code of the application program, which is not limited.
  • the second aspect Taking the high-level language Java language as an example, applications written in Java language use dynamic class loading for code loading, and the use of dynamic class loading in an enclave (that is, a trusted operating environment) will reveal the enclave (ie Trusted operating environment) code control flow information. For example, if a sensitive information executes function A at 0, otherwise executes B, and the loading of functions A and B will expose sensitive information. At the same time, dynamic loading in the enclave (that is, the trusted operating environment) makes it impossible for trusted users to know or verify all the code that may be executed.
  • enclave that is, a trusted operating environment
  • embodiments of the present application provide a code loading method that can ensure code integrity.
  • the code loading method may be based on the manifest file of the application, the enclave entry function of the application, and static dependencies.
  • the dependency of the class the code that loads the trusted part of the application. In this way, only a small part of the code (ie enclave entry functions and static dependent classes) needs to be loaded when the application starts.
  • FIG. 3 is a schematic flowchart of an application processing method provided by an embodiment of the application.
  • the execution subject of this method can be any device that can obtain the code of the application, for example, the device of the developer of the application, or the client that uses the application, etc.
  • the method includes:
  • the manifest file (manifest) of the application program may include: description information of the enclave entry function of the application program, and/or description information of the enclave exit function of the application program.
  • the description information mentioned here may include, for example, a function name, a list of parameters to be called (such as parameter types and execution order), return types, and the like.
  • the static dependent class of the enclave entry function of the application can be obtained according to the description file of the class marked with the first annotation. Then, according to the hash value of the static dependency class and the manifest file of each enclave entry function of the application, the hash value H 0 of the application is generated, and the hash value H 0 is used to verify the static dependency class Completeness.
  • the hash value H 0 mentioned here, for example, may be obtained by using any hash algorithm, for example, a SHA256 hash value, which is not limited in the embodiment of the present application.
  • the description file of the class usually describes the information of the static dependent class of the class. Therefore, according to the description file of the class marked with the first comment, the static dependent classes of the class can be obtained, and then the static dependent classes of these static dependent classes can be obtained according to the description files of these static dependent classes, and so on, until the acquisition To all static dependent classes.
  • the static dependent classes of class A are known as class B and class C according to the description file of class A1
  • the static dependency of class B is obtained according to the description file of class B.
  • Dependent classes include class B1 and class B2.
  • the static dependent classes of class B2 are class B21 and class B22.
  • class B1 has no static dependent classes.
  • class C is obtained.
  • Table 1 shows the specific dependency relationship
  • class A1 is an enclave entry function of the application
  • the static dependent classes of class A1 include class B, class B1, class B2, class B21, class B22, and class C.
  • the dependency relationship between the enclave entry function of the application program and the static dependent class can also be obtained according to the description file of the class marked with the first comment.
  • the dependency relationship can be represented by, for example, an adjoining table or a dependency graph, which is not limited.
  • FIG. 4 is a schematic diagram of a memory management provided by an embodiment of the application.
  • the embodiment of the present application allocates a memory area in the following manner: When a thread calls the enclave entry function of the application, an independent and expandable memory area can be allocated to the thread in the enclave. In other words, the memory areas between the threads are independent of each other.
  • FIG. 4 shows that the memory area allocated for thread 1 in the enclave memory is independent of the memory area allocated for thread 2 when thread 1 and thread 2 respectively call the enclave entry function of the application.
  • the enclave entry function called by thread 1 and thread 2 may be the same or different.
  • FIG. 5 is a schematic flowchart of another application processing method provided by an embodiment of the application.
  • the execution subject of this method may be a computing device in a cloud environment. As shown in Fig. 5, the method includes:
  • S201 Receive a start request sent by a first client, where the start request is used to start an application.
  • the user when the user needs to use the application, the user can remotely send a start request to start the application through the first client.
  • the high-level language operating environment of the enclave mentioned here is the same as the language used for developing applications.
  • the application program is an application program written in the high-level language Java language
  • the high-level language runtime environment of the enclave is the Java language runtime environment.
  • the high-level language runtime environment can have the following functions:
  • the high-level language runtime environment may be pre-run in the enclave, or the computing device may load the high-level language runtime environment in the enclave after receiving the startup request, and verify the integrity of the high-level language runtime environment .
  • a preset remote verification protocol of a trusted operating environment can be invoked to verify the integrity of the high-level language operating environment.
  • the computing device may generate the hash value Hx of the running environment based on the high-level language running environment, and send the hash value of the running environment to the first client.
  • the first client stores a hash value H x '. If the hash value H x 'is the same as the hash value H x , the integrity verification of the high-level language runtime environment loaded in the enclave passes. Then, the computing device and the first client can exchange keys. In this way, subsequent communications between the computing device and the first client can be encrypted using the exchanged key.
  • the above-mentioned hash value H x 'stored by the first client may be a hash value generated by the first client running a high-level language runtime environment, or it may be a credible obtained by other means and used for verification of flight
  • the hash value of the high-level language runtime environment loaded in the ground is not limited in this embodiment of the application.
  • the manifest file of the application program loaded in the high-level language operating environment of the enclave may be a manifest file generated offline using the method shown in FIG. 3 above. This embodiment does not limit the manner in which the computing device obtains the manifest file.
  • the computing device may receive the manifest file sent by the first client.
  • the first client may carry the manifest file in the activation request and send it to the computing device, or may send the manifest file together with the activation request to the computing device, or the first client may separately send the manifest file to the computing device.
  • the device sends the manifest file and activation request.
  • the computing device may obtain the stored manifest file of the application from the storage database in the cloud environment.
  • the manifest file of the application stored in the storage database may be pre-stored in the storage database by maintenance personnel of the cloud environment, application developers, etc., or a computing device in the cloud environment may When the application is started once, the obtained manifest file is stored in the storage database.
  • the dependency relationship between the enclave entry function and the static dependent class of the application loaded in the high-level language runtime environment of the enclave can be generated offline using the method described above.
  • This embodiment does not limit the manner in which the computing device obtains the dependency relationship between the enclave entry function of the application program and the static dependent class.
  • the computing device may receive the dependency between the enclave entry function of the application and the static dependent class sent by the first client. .
  • how to send the dependency relationship between the enclave entry function of the application and the static dependency class please refer to the description of sending the manifest file above, which will not be repeated here.
  • the computing device can obtain the stored enclave entry function and static state of the application from the storage database of the cloud environment before loading the dependency relationship between the enclave entry function of the application and the static dependent class.
  • the dependency of the dependent class can be pre-stored in the storage database by the maintainer of the cloud environment, the developer of the application, etc., or the cloud environment.
  • a computing device in the computer starts the application at a certain time in history, it stores the obtained dependency relationship between the enclave entry function of the application and the static dependency class in the storage database.
  • the dependency relationship between the enclave entry function and the static dependent class of the application loaded in the high-level language runtime environment of the enclave can be generated online. That is, the computing device is generated online after receiving the startup request.
  • the computing device before loading the dependency between the enclave entry function of the application and the static dependent class, the computing device can obtain the description of the class marked with the first comment in the application according to the code of the application document. Then, the computing device may obtain the dependency relationship between the enclave entry function of the application program and the static dependent class according to the description file of the class marked with the first annotation in the application program.
  • S203 Load the static dependent class of the enclave entry function of the application according to the manifest file and the dependency relationship between the enclave entry function and the static dependent class.
  • the code of the application program can be stored in a cloud environment, for example, a storage database in the cloud environment.
  • the computing device After the computing device obtains the dependency relationship between the manifest file and the enclave entry function and the static dependent class, it can change the enclave entry function of the application based on the dependency relationship between the manifest file and the enclave entry function and the static dependent class. Static dependent classes are loaded in the enclave.
  • the computing device can verify the validity of the static dependent class content of the loaded enclave entry function and the hash value of the static dependent class in the enclave to determine the integrity of the static dependent class.
  • the content of the static dependent class and the hash value are both legal, it is determined that the integrity verification of the static dependent class passes.
  • step S205 may be executed.
  • the integrity verification of the static dependent class is illegal, or the hash value is illegal, it is determined that the integrity verification of the static dependent class has failed.
  • a message that the loading of the trusted part of the application program failed may be returned to the first client.
  • the hash value H 0 ′ may be the same as the foregoing calculation method of obtaining the hash value H 0 .
  • the hash value H 0 'can indicate all codes loaded into the enclave by the application.
  • the first client side stores the hash value H 0 generated offline in the foregoing manner.
  • the first client receives the hash value H 0 ′ of the application program sent by the computing device, it can compare the hash value H 0 ′ with the hash value H 0 . If the two are the same, the integrity verification of the static dependent class of the enclave entry function loaded in the enclave passes. If the two are different, the integrity verification of the static dependent class of the enclave entry function loaded in the enclave fails.
  • step S204-step S206 can be executed at any time after loading the static dependent class of the enclave entry function of the application and before running the enclave entry function of the application, which is not limited.
  • FIG. 6 is a schematic flowchart of yet another application processing method provided by an embodiment of the application. As shown in Figure 6, the JVM of the computing device can perform the following steps after receiving the application startup request sent by the client:
  • the static dependent classes of the loaded enclave entry function are compiled into binary runtime code and run in the enclave.
  • the method of the embodiment of this application can load the application program based on the application manifest file (manifest), the dependency relationship between the application enclave entry function and the static dependent class in the high-level language operating environment of the enclave.
  • the trusted part of the code so that part of the application code (that is, the enclave entry function and static dependency class) written in high-level language can be directly run in the enclave, which can improve the security of the trusted part of the application and make the application
  • the program maintains a small TCB and attack surface, which improves the execution efficiency of the application in the enclave. At the same time, it also reduces the amount of manual code rewriting of the application and improves the ease of use of the application that can be run in the enclave. sex.
  • the above content describes how to run part of the code (ie enclave entry function and static dependent class) of an application written in a high-level language in the enclave.
  • the following specifically describes the process of how the computing device calls the enclave entry function after the integrity verification of the above-mentioned enclave entry function and the static dependent class is passed.
  • FIG. 7 is a schematic flowchart of another application processing method provided by an embodiment of the application. As shown in Figure 7, the method includes:
  • S301 When calling the first enclave entry function of the application program through the first thread, switch to the enclave to allocate a first memory area for the first thread. That is, switching from a non-enclave environment to an enclave's high-level language operating environment.
  • the aforementioned first enclave entry function can be any enclave entry function of the application.
  • the first memory area may include at least one memory page, and each memory page may be, for example, 32 kilobytes (kilobyte, KB) of memory.
  • the computing device may initially allocate a memory page for the first memory area.
  • a memory page can be added to the thread. That is, the size of the first memory area is dynamically expanded. For example, it is possible to search for free memory pages among the memory pages closest to the memory area and allocate them to the first thread, so as to ensure the continuity of the first memory area. If the memory page closest to the memory area cannot meet the memory requirement of the first thread, multiple consecutive memory pages can be found for the first thread in the memory of the enclave as the first memory area.
  • the computing device After the computing device allocates the first memory area for the first thread in the foregoing manner, it can create and execute the static dependent class object of the first enclave entry function in the first memory area.
  • the computing device For how to create objects of the class, please refer to the description of the prior art, which will not be repeated here.
  • the first enclave entry function may also have a static dependent class that can be executed without creating an object.
  • static dependent class when the first enclave entry function is executed, it is directly executed. Yes, I won’t repeat it here.
  • static dependent classes in addition to static dependent classes, it may also include dynamic dependent classes and/or the first enclave exit function with a calling relationship. The following describes how to execute the dynamic dependency class and the enclave exit function during the execution of the first enclave entry function:
  • FIG. 8 is a schematic flowchart of yet another application processing method provided by an embodiment of the application. Take the first dynamic dependency class as an example, that is, the first enclave entry function also includes the first dynamic dependency class. As shown in Figure 8, the computing device can perform the following operations:
  • the computing device may determine the dynamic class of the first enclave entry function to be executed based on the operation requested when the first thread calls the first enclave entry function, so as to obtain the dependency relationship between the dynamic dependent class and the static dependent class.
  • the dependency relationship mentioned here includes the dependency relationship between the dynamic dependent class and all of its static dependent classes.
  • the dynamic dependent class mentioned here may be, for example, a class file that is dynamically called by the first enclave entry function reflection.
  • the code of the application program can be stored in a cloud environment, for example, a storage database in the cloud environment.
  • the computing device may load the first dynamic dependency class in the enclave based on the dependency relationship between the first dynamic dependency class and the static dependency class.
  • an interface for loading dynamic dependent classes may be provided, and the interface may be loadClass(classname), for example.
  • classname is the name of the dynamic dependent class to be loaded. In this way, the computing device can load the classname into the enclave through this interface.
  • the computing device may verify the validity of the content of the static dependent class of the loaded first dynamic dependent class and the hash value of the static dependent class in the enclave to determine the integrity of the first dynamic dependent class.
  • the content of the static dependent class of the first dynamic dependent class and the hash value of the static dependent class of the first dynamic dependent class are both legal, it is determined that the integrity verification of the first dynamic dependent class passes.
  • step S404 may be executed.
  • the content of the static dependent class of the first dynamic dependent class is illegal, or the hash value of the static dependent class of the first dynamic dependent class is illegal, it is determined that the integrity verification of the first dynamic dependent class has failed.
  • a message indicating that the loading of the first dynamic dependent class has failed may be returned to the first client.
  • the hash value Hc of the first dynamic dependent class can be generated according to the hash value of the static dependent class on which the first dynamic dependent class depends,
  • the hash value Hc is sent to the client that calls the first enclave entry function through the first thread, so that the client verifies the integrity of the first dynamic dependent class loaded in the enclave.
  • verify please refer to the aforementioned method for the client to verify the static dependent class of the enclave entry function. The implementation is similar, so I will not repeat it here.
  • Enclave exit function called for the first enclave entry function:
  • the computing device can also perform the following operations:
  • the computing device can first switch from the high-level language operating environment of the enclave to the non-enclave environment, that is, the untrusted environment. Then, the computing device can execute the first enclave exit function in a non-enclave environment. Finally, return to the enclave's high-level language runtime environment to continue executing the first enclave entry function. Regarding how to switch to a non-enclave environment to execute an enclave exit function, the implementation method is similar to the method of switching to a non-enclave environment to execute an enclave exit function in the prior art, and will not be repeated here.
  • the above content describes how the computing device calls the first enclave entry function of the application program through the first thread during the running process of the application program.
  • the following explains how to perform garbage collection (that is, to clean up the first memory area allocated for the first thread) after the first enclave entry function is called, that is, after the first enclave entry function is executed:
  • FIG. 9 is a schematic flowchart of yet another application processing method provided by an embodiment of the application. As shown in Figure 9, after the first enclave entry function exits execution, the computing device can perform the following operations:
  • S501 Determine whether the object of the first enclave entry function is accessed by other threads. If not, execute S505, and if yes, execute S503.
  • the object mentioned here can be an object of a static dependent class of the first enclave entry function created, or an object of a dynamic dependent class of the first enclave entry function.
  • the other thread mentioned here refers to the thread in the enclave that is calling the enclave entry function of the application.
  • the other thread and the first thread may call the same enclave entry function of the application program, or a different enclave entry function.
  • the first memory area is the memory independent of the first thread. Area, directly clearing the first memory area will not affect other threads. If the object of the first enclave entry function is accessed by at least one other thread, it means that the object of the first enclave entry function is shared with other threads. At this time, the first memory area is not a memory area independent of the first thread, that is, directly clearing the first memory area will affect other threads. In some embodiments, the access by other threads mentioned here can also be described as access to the enclave entry function of the application called by other threads, which is not limited in the embodiment of the present application.
  • the object of thread 1 is accessed by thread 2, indicating that the object is shared with thread 2.
  • the memory area of thread 1 is not an independent memory area of thread 1, that is, directly cleaning up the memory area of thread 1 will affect thread 2.
  • all threads that stop execution herein refer to all threads in the enclave that call the enclave entry function of the application program (that is, the other threads mentioned above). These threads can call the same enclave entry function, or they can call different enclave entry functions, or some threads call the same enclave entry function, and some call different enclave entry functions. .
  • S503 Determine at least one second thread that accesses the first object.
  • S504 Perform copy processing on the first object according to the number of at least one second thread.
  • the memory area in the enclave may also include a global memory area, and the global memory area may be used to store static variables and objects with a lifetime longer than one thread.
  • the first object is copied to the second memory area corresponding to the second thread. If the number of second threads is greater than 1, copy the first object to the global memory area of the enclave, so that multiple second threads can access the first object by accessing the global memory area, saving the memory space of the enclave .
  • step S505 may be performed to clean up the first memory area allocated for the first thread.
  • the memory pages included in the first memory area can be allocated to other threads in the enclave for use, so that the enclave’s memory can be released in time and garbage is increased. The efficiency of collection.
  • the first memory area allocated for the first thread can be cleaned up in time, so that the memory pages included in the first memory area can be allocated to other threads for use, so that it can be used in time
  • the release of the enclave's memory improves the efficiency of garbage collection in the enclave's memory.
  • this embodiment of the application proposes a multi-threaded garbage collection synchronization method without operating system participation.
  • This method captures the object of an enclave entry function by recording whether there are cross-region write operations in different threads. Whether to escape the original memory area, that is, whether it is accessed by other threads.
  • the embodiment of the present application is to capture whether the enclave entry function has escaped objects, the computing device inserts a check on global variables into the code of the trusted part of the application program, and the global variable is used to capture whether the enclave entry function has escaped objects.
  • Object Object
  • GC garbage collection
  • nThd The total number of threads executing in the enclave
  • nGCThd The total number of threads that stopped executing in the enclave
  • the computing device can check the memory area to which the target object belongs. If the identifier of the memory area to which the target object belongs (such as the ID or index of the memory area, etc.) is different from the identifier of the memory area being written, it will include the memory area of the target object and the memory area written to the target object The record of is written into the escape object list of the thread to which the target object belongs, and is written into the escape object list of the thread corresponding to the memory area of the target object.
  • the computing device can determine whether there is an escaped object based on the list of escaped objects. When there is no escape object, that is, when the list is empty, the mapping relationship between the thread and the allocated memory area can be cleared. When there is an escaped object, that is, when the list is not empty, the multi-thread synchronization mechanism is called to reclaim the escaped object (that is, the GC thread).
  • the execution of all threads is stopped synchronously to prevent other threads from accessing these escaped objects at the same time.
  • all threads stop scan the execution stack and escape object list of all threads, and find all objects belonging to the memory area of the current thread. For each escaped object, if it escapes to the memory area of another thread, it is copied to the memory area of that thread. If the escaped object escapes to the memory area of multiple threads, it is copied to the global memory area of the enclave.
  • nGCThd when the needGC setting is successful, it means that the multi-thread synchronization is successfully called. Then, the computing device performs an atomic addition operation on the global variable nGCThd.
  • nGCThd executes the atom plus one operation.
  • the variables nGCThd and nThd are equal, it means that all threads in the enclave have stopped executing, and the escaped objects can be recovered. After completing the recovery of the escaped object, reduce nGCThd and nThd and set needGC to 0, which means that other threads except the first thread can resume execution.
  • the computing device inserts a needGC check (non-atomic) in the loop check and function entry in the trusted code of the generated application.
  • needGC non-atomic
  • the thread stops executing until needGC becomes 0.
  • the thread increases the value of nGCThd to notify the GC that the thread has stopped executing.
  • needGC the thread resumes execution.
  • the first memory area allocated for the first thread can be cleaned up in time, so that the memory pages included in the first memory area can be allocated to other threads for use, so that it can be used in time
  • the release of the enclave's memory improves the efficiency of garbage collection in the enclave's memory.
  • garbage collection method does not require the participation of the operating system, that is, the garbage collection operation and the call dependency of the operating system are lifted, so that there is no need to interact with the operating system during garbage collection, so that garbage collection can be free from privileges.
  • Attacks include side-channel attacks and iago attacks.
  • the side channel attack mentioned here refers to an attack method in which an attacker guesses the private data of the application running in the enclave by observing the side channel (for example, execution time, enclave exit function, etc.). For example, when a sensitive data is 1, two enclave exit functions are executed, and when the sensitive data is 0, an enclave exit function is executed. The attacker can observe the number of executions of the enclave exit function to guess the value of the sensitive data.
  • the Igu attack mentioned here refers to an attack in which an attacker manipulates an untrusted operating system to provide input to an application program running in the enclave, so that the control flow of the application program running in the enclave is changed.
  • an application running in an enclave relies on a file input, and this file contains an integer number.
  • the integer number is 1, the application program running in the enclave executes the do_one function, and when the integer number is 0, the application program running in the enclave executes do_zero. Therefore, when an attacker manipulates an untrusted operating system to change the input provided to an application program running in an enclave, the integrity of the enclave program will be destroyed.
  • FIG. 10 is a schematic flowchart of another application processing method provided by an embodiment of the application. As shown in Figure 10, the method includes:
  • S601 Switch from a non-enclave environment to an enclave.
  • the computing device may initially allocate a memory page for the first memory area.
  • the memory page may be 32KB of memory, for example.
  • the object mentioned here can be an object of a static dependent class or an object of a dynamically dependent class.
  • this step is executed.
  • FIG. 11 is a schematic structural diagram of an application processing apparatus provided by an embodiment of the application.
  • the processing device of the application program may be the aforementioned computing device or the chip of the computing device.
  • the processing device of the application program includes: a receiving module 11 and a processing module 12.
  • the processing device of the application program may further include: a sending module 13.
  • the receiving module 11 is configured to receive a start request sent by the first client, and the start request is used to start an application program.
  • the processing module 12 is used to load the manifest file of the application and the dependency relationship between the enclave entry function of the application and the static dependency class in the high-level language operating environment of the enclave according to the startup request; according to the manifest file and the enclave The dependency between the entry function and the static dependent class, and the static dependent class of the enclave entry function that loads the application.
  • the manifest file includes: description information of the enclave entry function of the application program, and/or description information of the enclave exit function of the application program.
  • the processing module 12 is also used to obtain the class with the first annotation in the application according to the code of the application before loading the dependency between the enclave entry function of the application and the static dependent class. According to the description file of the class marked with the first annotation in the application, obtain the dependency relationship between the enclave entry function of the application and the static dependent class; where the first annotation annotation is used to characterize the first annotation annotation
  • the class is the enclave entry function.
  • the processing module 12 is also used to receive the enclave entry of the application sent by the first client through the receiving module 11 before loading the dependency relationship between the enclave entry function of the application and the static dependent class.
  • the dependency relationship between the function and the static dependent class; or, the processing module 12 is also used to obtain the enclave entry function and static dependency of the application from the storage database before loading the dependency relationship between the enclave entry function of the application and the static dependent class The dependencies of the class.
  • the processing module 12 is also used to receive the manifest file of the application program sent by the first client through the receiving module 11 before loading the manifest file of the application program; or, the processing module 12 also It is used to obtain the manifest file of the application from the storage database before loading the manifest file of the application.
  • the processing module 12 is also used to load the high-level language runtime environment in the enclave before loading the manifest file of the application and the dependency between the application’s enclave entry function and the static dependent class. Verify the integrity of the high-level language operating environment.
  • the processing module 12 is also used to verify the integrity of the static dependent class of the loaded enclave entry function after loading the static dependent class of the enclave entry function of the application; in the enclave entry function After the integrity verification of the static dependent class of the enclave is passed, the hash value of the application is generated according to the hash value of the static dependent class of the enclave entry function and the manifest file.
  • the sending module 13 is used to send the hash value of the application program to the first client; the hash value of the application program is used by the first client to verify the integrity of the static dependency class of the enclave entry function loaded in the enclave sex.
  • the processing module 12 is also used to switch to the first enclave entry function of the application through the first thread after the integrity verification of the static dependent class of the enclave entry function is passed.
  • the enclave allocates a first memory area for the first thread, and creates and executes the static dependent class object of the first enclave entry function in the first memory area.
  • the first enclave entry function also includes the first dynamic dependency class.
  • the processing module 12 is further configured to obtain the dependency relationship between the first dynamic dependency class and the static dependency class; dynamically load the first dynamic dependency class according to the dependency relationship between the first dynamic dependency class and the static dependency class; verify The integrity of the first dynamic dependent class, and after the integrity verification of the first dynamic dependent class is passed, an object of the first dynamic dependent class is created and executed in the first memory area.
  • the first enclave entry function has a calling relationship with the first enclave exit function.
  • the processing module 12 is also used to switch from the high-level language operating environment of the enclave to the non-enclave environment; execute the first enclave exit function in the non-enclave environment; and return to the high-level language operating environment of the enclave.
  • the processing module 12 is also used to clear the first thread and the first enclave entry function after the first enclave entry function exits execution, if the object of the first enclave entry function is not accessed by other threads.
  • the mapping relationship of the memory area is also used to clear the first thread and the first enclave entry function after the first enclave entry function exits execution, if the object of the first enclave entry function is not accessed by other threads.
  • the processing module 12 is also used to stop the execution of the enclave in synchronization if the first object of the first enclave entry function is accessed by other threads after the first enclave entry function exits execution.
  • Enclave entry function called by all threads; determine at least one second thread to access the first object; copy the first object according to the number of at least one second thread; clear the mapping relationship between the first thread and the first memory area .
  • the processing module 12 is specifically configured to copy the first object to the second memory area corresponding to the second thread when the number of the second thread is 1, or, when the number of the second thread is greater than 1, to copy the first object The object is copied into the global memory area of the enclave.
  • receiving module 11 and sending module 13 may be integrated in the transceiver module, or may be separated.
  • the application processing apparatus provided in the embodiment of the present application can execute the actions of the computing device shown in FIG. 5 to FIG. 10 in the foregoing method embodiment, and its implementation principles and technical effects are similar, and will not be repeated here.
  • the processing device of the application program may further include at least one storage module, the storage module may include data and/or instructions, and the processing module and/or the transceiver module (or the receiving module and the sending module) may read the storage module The data and/or instructions in the implementation of the corresponding method.
  • the embodiment of the present application also provides a schematic structural diagram of an application processing device.
  • the processing device of the application program may be the aforementioned device capable of obtaining the code of the application program, or may be a chip of the device.
  • the processing device of the application program includes: a processing module 21.
  • the processing module 21 is used to obtain, according to the code of the application, the class with the first annotation and/or the class with the second annotation; according to the class with the first annotation, and/or the class with the first annotation
  • the class marked by the second annotation is used to generate the manifest file of the application; where the first annotation annotation is used to characterize the class marked by the first annotation as an enclave entry function, and the second annotation annotation is used to characterize the class marked by the second annotation.
  • the manifest file includes: description information of the enclave entry function of the application, and/or description information of the enclave exit function of the application.
  • the processing module 21 is also used to obtain the static dependent class of the enclave entry function of the application according to the description file of the class marked with the first annotation; according to the static dependent class of the enclave entry function
  • the hash value and the manifest file are used to generate the hash value of the application, and the hash value of the application is used to verify the integrity of the static dependent class.
  • the processing module 21 is further configured to obtain the dependency relationship between the enclave entry function of the application program and the static dependent class according to the description file of the class marked with the first annotation.
  • the processing device of the above application program may also include a transceiver module (or a receiving module and a sending module), and the processing module may perform communication between the transceiver module (or the receiving module and the sending module) and other peripherals. Communication, this embodiment of the application does not limit this.
  • the application processing apparatus provided in the embodiment of the present application can execute the actions of the device capable of obtaining the code of the application shown in FIG. 3 in the foregoing method embodiment, and its implementation principles and technical effects are similar, and will not be repeated here.
  • the processing device of the application program may further include at least one storage module, the storage module may include data and/or instructions, and the processing module 21 may read the data and/or instructions in the storage module to implement the corresponding method. .
  • the processing module can be implemented in the form of software called by processing elements; it can also be implemented in the form of hardware.
  • the processing module may be a separate processing element, or it may be integrated in a chip of the above-mentioned device for implementation.
  • it may also be stored in the memory of the above-mentioned device in the form of program code, and a certain processing element of the above-mentioned device Call and execute the functions of the above processing module.
  • all or part of these modules can be integrated together or implemented independently.
  • the processing element described here may be an integrated circuit with signal processing capability. In the implementation process, each step of the above method or each of the above modules can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.
  • the above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASIC), or one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (FPGA), etc.
  • ASIC application specific integrated circuit
  • DSP digital signal processor
  • FPGA field programmable gate arrays
  • the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processors that can call program codes.
  • CPU central processing unit
  • these modules can be integrated together and implemented in the form of a system-on-a-chip (SOC).
  • SOC system-on-a-chip
  • FIG. 12 is a schematic structural diagram of another application processing apparatus provided by an embodiment of this application.
  • the processing device of the application program may include: a processor 31 (such as a CPU) and a memory 32; the memory 32 may include a high-speed random-access memory (random-access memory, RAM), or may also include A non-volatile memory (NVM), such as at least one disk memory, can store various instructions in the memory 32 to complete various processing functions and implement the method steps of the present application.
  • the processing device of the application program involved in the present application may further include: a power supply 33, a communication bus 34, and a communication port 35.
  • the communication bus 34 is used to implement communication connections between components.
  • the above-mentioned communication port 35 is used to realize connection and communication between the processing device of the application program and other peripherals.
  • the aforementioned memory 32 is used to store computer executable program code, and the program code includes instructions.
  • the instruction causes the processing device of the application program to perform the actions of the computing device in the foregoing method embodiment; or, when the processor 31 executes the instruction, the instruction causes the processing device of the application program to execute the method described in the foregoing method embodiment.
  • the action of the device that obtains the code of the application program has similar implementation principles and technical effects, and will not be repeated here.
  • the embodiment of the present application also provides a computer-readable storage medium on which is stored computer instructions for implementing the method executed by the computing device in the foregoing method embodiment or the method executed by the device capable of obtaining the code of the application program.
  • the processing device of the application program can implement the method executed by the computing device in the foregoing method embodiment or the method executed by the device capable of obtaining the code of the application program.
  • the embodiments of the present application also provide a computer program product containing instructions, which when executed, cause the computer to implement the method executed by the computing device in the foregoing method embodiments, or the method executed by the device capable of obtaining the code of the application program .
  • the embodiment of the present application also provides a cloud environment, which includes the computing device and the client described in the foregoing embodiment.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it can be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application are generated in whole or in part.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • computer instructions can be transmitted from a website, computer, server, or data center through a cable (such as Coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) to transmit to another website site, computer, server or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state drive (SSD)).
  • plural herein refers to two or more.
  • the term “and/or” in this article is only an association relationship describing the associated objects, which means that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, exist alone B these three situations.
  • the character "/" in this article generally indicates that the associated objects before and after are in an "or” relationship; in the formula, the character "/" indicates that the associated objects before and after are in a "division" relationship.
  • the size of the sequence numbers of the foregoing processes does not mean the order of execution.
  • the execution order of the processes should be determined by their functions and internal logic, and should not be used for the implementation of this application.
  • the implementation process of the example constitutes any limitation.

Abstract

一种应用程序的处理方法、装置、云环境、介质及程序产品，该方法包括：接收第一客户端发送的启动请求，其中，该启动请求用于启动应用程序（S201）；根据启动请求，在飞地的高级语言运行环境中，加载应用程序的舱单文件和应用程序的飞地入口函数与静态依赖类的依赖关系（S202）；其中，舱单文件包括：应用程序的飞地入口函数的描述信息，和/或，应用程序的飞地出口函数的描述信息；根据舱单文件和飞地入口函数与静态依赖类的依赖关系，加载应用程序的飞地入口函数的静态依赖类（S203）。该方法可以在保持较小的TCB和攻击面、且又能够减少手动改写代码的工作量的情况下，将应用程序的可信部分运行在飞地中。

Description

应用程序的处理方法、装置、云环境、介质及程序产品
本申请要求于2020年04月30日提交中国专利局、申请号为202010366539.4、申请名称为“应用程序的处理方法、装置、云环境及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术，尤其涉及一种应用程序的处理方法、装置、云环境、介质及程序产品。
背景技术
云计算(cloud computing)是分布式计算的一种，通过云计算技术，可以将高效的数据处理应用程序(例如Spark应用程序等)远程部署到云环境上，从而使用户通过云服务可以远程使用这些数据处理应用程序。云计算技术使得高效的数据处理应用程序的广泛部署成为可能。部署在云环境上的应用程序通常需要较高的稳定性和安全性。例如，这些应用程序需要在处理大量请求时不轻易崩溃，也不会在遭受外部攻击者攻击时泄露用户隐私数据等。由于计算机编程语言Java语言具有简单性、面向对象、分布式、健壮性、安全性、平台独立与可移植性、多线程、动态性等特点，因此，许多部署在云环境上的应用程序使用Java语言进行编写。
云环境上部署的应用程序可能会遭遇特权攻击(privileged attacks)。由于Java语言不能防止云环境的特权攻击，因此，为了避免云环境的特权攻击，与不可信运行环境隔离运行的可信运行环境(trusted execution environment，TEE)近年成为保护应用程序的一个重要工具。英特尔的软件防护扩展(software guard extensions，SGX)是目前最流行的可信运行环境产品。SGX提供了一个飞地(enclave)执行的抽象(abstraction)，运行在enclave中的应用程序和数据存储在一个与普通执行环境隔离的内存区域中，使得可以控制操作系统，基本输入输出系统(basic input output system，BIOS)的特权攻击者都无法提取或篡改其数据。
目前飞地提供的执行环境为C/C++语言的执行环境。由于飞地的内存区域有限，因此，应用程序的开发者需要采用手动将应用程序的原程序代码划分为可信部分和不可信部分，并手动将可信部分的代码从Java语言改写为C/C++语言的方式，将应用程序的可信部分运行在飞地中，以保障该应用程序具有一个较小的可信计算基础(trusted computing base，TCB)和攻击面(attack surface)。但是该手动改写代码的方式，导致代码改写量较大，代码改写效率较低。
故，如何在保持较小的TCB和攻击面、且又能够减少手动改写代码的工作量的情况下，将应用程序的可信部分运行在飞地中，是一个亟待解决的问题。
发明内容
本申请实施例提供一种应用程序的处理方法、装置、云环境、介质及程序产品，用于解决如何在保持较小的TCB和攻击面、且又能够减少手动改写代码的工作量的情况下，将应用程序的可信部分运行在飞地中的问题。
第一方面，本申请实施例提供一种应用程序的处理方法，该方法包括：首先，接收第一客户端发送的启动请求，该启动请求用于启动应用程序。其次，根据启动请求，在飞地的高级语言运行环境中，加载应用程序的舱单文件和应用程序的飞地入口函数与静态依赖类的依赖关系。其中，该舱单文件包括：应用程序的飞地入口函数的描述信息，和/或，应用程序的飞地出口函数的描述信息。然后，根据舱单文件和飞地入口函数与静态依赖类的依赖关系，加载应用程序的飞地入口函数的静态依赖类。
通过该方法，在飞地运行的高级语言的运行环境中，可以基于应用程序的舱单文件、应用程序的飞地入口函数与静态依赖类的依赖关系，加载应用程序的可信部分的代码，从而将使用高级语言编写的应用程序的部分代码(即飞地入口函数与静态依赖类)直接运行在飞地中，可以提高应用程序的可信部分的安全性，使应用程序保持一个较小的TCB和攻击面，提高了应用程序在飞地中的执行效率，同时，也减少了应用程序的代码手动改写量，提高了将应用程序可以运行在飞地中的易用性。
作为一种可能的实现方式，在加载应用程序的飞地入口函数与静态依赖类的依赖关系之前，可以采用如下几种方式，获取应用程序的飞地入口函数与静态依赖类的依赖关系：第一种方式：根据应用程序的代码，获取应用程序中含有第一注释标注的类的描述文件。其中，第一注释标注用于表征该第一注释标注的类为飞地入口函数。根据应用程序中含有第一注释标注的类的描述文件，获取应用程序的飞地入口函数与静态依赖类的依赖关系。第二种方式：接收第一客户端发送的应用程序的飞地入口函数与静态依赖类的依赖关系。第三种方式：从存储数据库获取应用程序的飞地入口函数与静态依赖类的依赖关系。通过该可能的实现方式，提高了获取应用程序的飞地入口函数与静态依赖类的依赖关系的灵活性。
作为一种可能的实现方式，在加载应用程序的舱单文件之前，可以采用如下方式获取应用程序的舱单文件：接收第一客户端发送的应用程序的舱单文件。或者，从存储数据库获取应用程序的舱单文件。通过该可能的实现方式，提高了获取应用程序的舱单文件的灵活性。
作为一种可能的实现方式，上述飞地中可以预先运行有高级语言运行环境，或者，在上述加载应用程序的舱单文件和应用程序的飞地入口函数与静态依赖类的依赖关系之前，还可以包括：在飞地中加载高级语言运行环境，验证高级语言运行环境的完整性。通过该可能的实现方式，扩展了在飞地中运行高级语言运行环境的方式，以及，将应用程序运行在飞地中的实现方式。
作为一种可能的实现方式，在上述加载应用程序的飞地入口函数的静态依赖类之后，该方法还可以包括：验证所加载的飞地入口函数的静态依赖类的完整性。在飞地入口函数的静态依赖类的完整性验证通过后，根据飞地入口函数的静态依赖类的哈希值和舱单文件，生成应用程序的哈希值。向第一客户端发送应用程序的哈希值，该应用程序的哈希值用于 第一客户端验证飞地中加载的飞地入口函数的静态依赖类的完整性。通过该可能的实现方式，可以使计算设备和客户端分别验证飞地中加载的飞地入口函数的静态依赖类的完整性。
应理解，验证完整性的操作可以在加载应用程序的飞地入口函数和飞地入口函数的静态依赖类之后、且运行该应用程序的飞地入口函数之前的任意时刻执行，对此不进行限定。
作为一种可能的实现方式，该方法还可以包括：在飞地入口函数的静态依赖类的完整性验证通过后，在通过第一线程调用应用程序的第一飞地入口函数时，切换至飞地中为第一线程分配第一内存区域。在第一内存区域中创建并执行第一飞地入口函数的静态依赖类的对象。通过该可能的实现方式，可以通过无操作系统参与的、且线程独立的内存管理方式为运行在飞地中的应用程序分配内存，从而避免应用程序的开发者手动管理内存，提高了内存管理效率。
作为一种可能的实现方式，若第一飞地入口函数还包括第一动态依赖类，该方法还包括：获取第一动态依赖类与静态依赖类的依赖关系；根据第一动态依赖类与静态依赖类的依赖关系，动态加载第一动态依赖类；验证第一动态依赖类的完整性；在第一动态依赖类的完整性验证通过后，在第一内存区域中创建并执行第一动态依赖类的对象。通过该可能的实现方式，可以在飞地中运行应用程序的飞地入口函数时，可以动态加载所需要的类函数。
作为一种可能的实现方式，第一飞地入口函数与第一飞地出口函数具有调用关系，该方法还包括：从飞地的高级语言运行环境切换至非飞地环境，在非飞地环境执行第一飞地出口函数，返回飞地的高级语言运行环境。通过该可能的实现方式，可以在飞地中运行应用程序的飞地入口函数时，可以执行飞地入口函数所调用的飞地出口函数。
作为一种可能的实现方式，该方法还包括：在第一飞地入口函数退出执行后，若第一飞地入口函数的对象均未被其他线程访问，则清除第一线程与第一内存区域的映射关系。通过该可能的实现方式，在执行完第一飞地入口函数后，可以及时清理为第一线程分配的第一内存区域，以将第一内存区域所包括的内存页可以分配给其他线程使用，从而可以及时的释放飞地的内存，提高了飞地内存中的垃圾收集的效率。
作为一种可能的实现方式，该方法还包括：在第一飞地入口函数退出执行后，若第一飞地入口函数的第一对象被其他线程访问，则同步停止执行飞地中的所有线程调用的飞地入口函数。确定访问第一对象的至少一个第二线程。根据至少一个第二线程的数量，对第一对象进行拷贝处理。清除第一线程与第一内存区域的映射关系。例如，根据至少一个第二线程的数量，对第一对象进行拷贝处理，可以包括：若第二线程的数量为1，则将第一对象拷贝至第二线程对应的第二内存区域；或者，若第二线程的数量大于1，则将第一对象拷贝至飞地的全局内存区域中。通过该可能的实现方式，在执行完第一飞地入口函数后，可以及时清理为第一线程分配的第一内存区域，以将第一内存区域所包括的内存页可以分配给其他线程使用，从而可以及时的释放飞地的内存，提高了飞地内存中的垃圾收集的效率。
第二方面，本申请实施例提供一种应用程序的处理方法，该方法包括：首先，根据应用程序的代码，获取应用程序中含有第一注释标注的类，和/或，含有第二注释标注的类。其中，第一注释标注用于表征该第一注释标注的类为飞地入口函数，第二注释标注用于表征第二注释标注的类为飞地出口函数。然后，根据含有第一注释标注的类，和/或，含有第 二注释标注的类，生成应用程序的舱单文件。其中，该舱单文件包括：应用程序的飞地入口函数的描述信息，和/或，应用程序的飞地出口函数的描述信息。
通过该方法，任一能够获取到该应用程序的代码的设备(例如，应用程序的开发者的设备，或者，使用该应用程序的客户端等)，可以根据含有第一注释标注的类，和/或，含有第二注释标注的类，生成应用程序的舱单文件。
作为一种可能的实现方式，该方法还可以包括：根据含有第一注释标注的类的描述文件，获取应用程序的飞地入口函数的静态依赖类。根据飞地入口函数的静态依赖类的哈希值和舱单文件，生成应用程序的哈希值，该应用程序的哈希值用于验证静态依赖类的完整性。通过该可能的实现方式，可以得到该应用程序的哈希值。后续，用户在远程使用该应用程序时，可以基于该哈希值和云环境所返回的哈希值，验证运行在云环境的飞地中的代码的完整性。
作为一种可能的实现方式，该方法还可以包括：根据含有第一注释标注的类的描述文件，获取应用程序的飞地入口函数与静态依赖类的依赖关系。
第三方面，本申请实施例提供一种应用程序的处理装置，该装置包括：接收模块、处理模块。其中，接收模块，用于接收第一客户端发送的启动请求，启动请求用于启动应用程序。处理模块，用于根据启动请求，在飞地的高级语言运行环境中，加载应用程序的舱单文件和应用程序的飞地入口函数与静态依赖类的依赖关系；根据舱单文件和飞地入口函数与静态依赖类的依赖关系，加载应用程序的飞地入口函数的静态依赖类。其中，舱单文件包括：应用程序的飞地入口函数的描述信息，和/或，应用程序的飞地出口函数的描述信息。
作为一种可能的实现方式，处理模块，还用于在加载应用程序的飞地入口函数与静态依赖类的依赖关系之前，根据应用程序的代码，获取应用程序中含有第一注释标注的类的描述文件；根据应用程序中含有第一注释标注的类的描述文件，获取应用程序的飞地入口函数与静态依赖类的依赖关系；其中，第一注释标注用于表征该第一注释标注的类为飞地入口函数。
作为一种可能的实现方式，处理模块，还用于在加载应用程序的飞地入口函数与静态依赖类的依赖关系之前，通过接收模块接收第一客户端发送的应用程序的飞地入口函数与静态依赖类的依赖关系；或者，处理模块，还用于在加载应用程序的飞地入口函数与静态依赖类的依赖关系之前，从存储数据库获取应用程序的飞地入口函数与静态依赖类的依赖关系。
作为一种可能的实现方式，处理模块，还用于在加载应用程序的舱单文件之前，通过接收模块接收第一客户端发送的应用程序的舱单文件；或者，处理模块，还用于在加载应用程序的舱单文件之前，从存储数据库获取应用程序的舱单文件。
作为一种可能的实现方式，处理模块，还用于在加载应用程序的舱单文件和应用程序的飞地入口函数与静态依赖类的依赖关系之前，在飞地中加载高级语言运行环境，验证高级语言运行环境的完整性。
作为一种可能的实现方式，该装置还可以包括：发送模块。处理模块，还用于在加载应用程序的飞地入口函数的静态依赖类之后，验证加载的飞地入口函数的静态依赖类的完整性；在飞地入口函数的静态依赖类的完整性验证通过后，根据飞地入口函数的静态依赖 类的哈希值和舱单文件，生成应用程序的哈希值。发送模块，用于向第一客户端发送应用程序的哈希值；该应用程序的哈希值用于第一客户端验证飞地中加载的所述飞地入口函数的静态依赖类的完整性。
作为一种可能的实现方式，处理模块，还用于在飞地入口函数的静态依赖类的完整性验证通过后，在通过第一线程调用应用程序的第一飞地入口函数时，切换至飞地中为第一线程分配第一内存区域，并在第一内存区域中创建并执行第一飞地入口函数的静态依赖类的对象。
作为一种可能的实现方式，第一飞地入口函数还包括第一动态依赖类。处理模块，还用于获取所述第一动态依赖类与静态依赖类的依赖关系；根据所述第一动态依赖类与静态依赖类的依赖关系，动态加载所述第一动态依赖类；验证所述第一动态依赖类的完整性，并在所述第一动态依赖类的完整性验证通过后，在所述第一内存区域中创建并执行所述第一动态依赖类的对象。
作为一种可能的实现方式，第一飞地入口函数与第一飞地出口函数具有调用关系。处理模块，还用于从飞地的高级语言运行环境切换至非飞地环境；在非飞地环境执行第一飞地出口函数；返回飞地的高级语言运行环境。
作为一种可能的实现方式，处理模块，还用于在第一飞地入口函数退出执行后，若第一飞地入口函数的对象均未被其他线程访问，则清除第一线程与第一内存区域的映射关系。
作为一种可能的实现方式，处理模块，还用于在第一飞地入口函数退出执行后，若第一飞地入口函数的第一对象被其他线程访问，则同步停止执行飞地中的所有线程调用的飞地入口函数；确定访问第一对象的至少一个第二线程；根据至少一个第二线程的数量，对第一对象进行拷贝处理；清除第一线程与第一内存区域的映射关系。例如，处理模块，具体用于在第二线程的数量为1时，将第一对象拷贝至第二线程对应的第二内存区域；或者，在第二线程的数量大于1时，将第一对象拷贝至飞地的全局内存区域中。
上述第三方面和第三方面的各可能的实现方式所提供的应用程序的处理装置，其有益效果可以参见上述第一方面和第一方面的各可能的实现方式所带来的有益效果，在此不加赘述。
第四方面，本申请实施例提供一种应用程序的处理装置，该装置包括：处理模块。其中，处理模块，用于根据应用程序的代码，获取应用程序中含有第一注释标注的类，和/或，含有第二注释标注的类；根据含有第一注释标注的类，和/或，含有第二注释标注的类，生成应用程序的舱单文件；其中，第一注释标注用于表征该第一注释标注的类为飞地入口函数，第二注释标注用于表征第二注释标注的类为飞地出口函数，舱单文件包括：应用程序的飞地入口函数的描述信息，和/或，应用程序的飞地出口函数的描述信息。
作为一种可能的实现方式，处理模块，还用于根据含有第一注释标注的类的描述文件，获取应用程序的飞地入口函数的静态依赖类；根据飞地入口函数的静态依赖类的哈希值和舱单文件，生成应用程序的哈希值，该应用程序的哈希值用于验证静态依赖类的完整性。
作为一种可能的实现方式，处理模块，还用于根据含有第一注释标注的类的描述文件，获取应用程序的飞地入口函数与静态依赖类的依赖关系。
上述第四方面和第四方面的各可能的实现方式所提供的应用程序的处理装置，其有益效果可以参见上述第二方面和第二方面的各可能的实现方式所带来的有益效果，在此不加 赘述。
第五方面，本申请实施例提供一种应用程序的处理装置，该应用程序的处理装置包括：处理器、存储器。其中，存储器用于存储计算机可执行程序代码，程序代码包括计算机执行指令；当处理器执行计算机执行指令时，计算机执行指令使该应用程序的处理装置执行如第一方面或第一方面的各可能的实现方式所提供的方法。
第六方面，本申请实施例提供一种应用程序的处理装置，该应用程序的处理装置包括：处理器、存储器。其中，存储器用于存储计算机可执行程序代码，程序代码包括计算机执行指令；当处理器执行计算机执行指令时，计算机执行指令使该应用程序的处理装置执行如第二方面或第二方面各可能的实现方式所提供的方法。
第七方面，本申请实施例提供一种应用程序的处理装置，包括用于执行以上如第一方面或第一方面的各可能的实现方式所提供的方法的单元、模块或电路。该应用程序的处理装置可以为云环境中的计算设备，也可以为应用于云环境中的计算设备的一个模块，例如，可以为应用于云环境中的计算设备的芯片。
第八方面，本申请实施例提供一种应用程序的处理装置，包括用于执行以上如第二方面或第二方面的各可能的实现方式所提供的方法的单元、模块或电路。该应用程序的处理装置可以为云环境中的客户端，也可以为应用于云环境中的客户端的一个模块，例如，可以为应用于云环境中的客户端的芯片。
第九方面，本申请实施例提供一种网络装置，该网络装置上存储有计算机程序，在计算机程序被网络装置执行时，实现上述如第一方面或第一方面的各可能的实现方式或第二方面或第二方面的各可能的实现方式所提供的方法。该网络装置例如可以为芯片。
第十方面，本申请实施例提供一种网络装置，该网络装置包括处理器和接口电路。其中，接口电路，用于接收计算机执行指令并传输至处理器；处理器运行计算机执行指令以执行如第一方面或第一方面的各可能的实现方式或第二方面或第二方面的各可能的实现方式所提供的方法。该网络装置例如可以为芯片。
第十一方面，本申请实施例提供一种网络装置，该网络装置包括处理器和存储器。其中，存储器用于存储计算机执行指令；处理器用于执行存储器所存储的计算机执行指令，以使网络装置执行如第一方面或第一方面的各可能的实现方式或第二方面或第二方面的各可能的实现方式所提供的方法。该网络装置例如可以为芯片。
第十二方面，本申请实施例提供一种网络装置，该网络装置包括处理器、存储器和收发器。其中，收发器，用于接收信号或者发送信号；存储器，用于存储计算机程序；处理器，用于从存储器调用计算机程序执行如第一方面或第一方面的各可能的实现方式或第二方面或第二方面的各可能的实现方式所提供的方法。该网络装置例如可以为芯片。
第十三方面，本申请实施例提供一种计算机程序产品，该计算机程序产品包括计算机程序代码，当该计算机程序代码在计算机上运行时，使得计算机执行如第一方面或第一方面的各可能的实现方式或第二方面或第二方面的各可能的实现方式所提供的方法。
第十四方面，本申请实施例提供一种计算机可读存储介质，计算机可读存储介质用于存储计算机程序或计算机执行指令，当计算机程序或计算机执行指令在计算机上运行时，使得计算机执行如第一方面或第一方面的各可能的实现方式或第二方面或第二方面的各可能的实现方式所提供的方法。
第十五方面，本申请实施例提供一种云环境，该云环境包括：第三方面任一项所述的应用程序的处理装置和第四方面任一项所述的应用程序的处理装置。或者，该云环境包括：第五方面任一项所述的应用程序的处理装置和第六方面任一项所述的应用程序的处理装置。
本申请实施例提供的应用程序的处理方法、装置、云环境、介质及程序产品，在飞地运行的高级语言的运行环境中，可以基于应用程序的舱单文件、应用程序的飞地入口函数与静态依赖类的依赖关系，加载应用程序的可信部分的代码，从而将使用高级语言编写的应用程序的部分代码(即飞地入口函数与静态依赖类)直接运行在飞地中，可以提高应用程序的可信部分的安全性，使应用程序保持一个较小的TCB和攻击面，提高了应用程序在飞地中的执行效率，同时，也减少了应用程序的代码手动改写量，提高了将应用程序可以运行在飞地中的易用性。
附图说明
图1为本申请实施例提供的一种应用场景示意图；
图2为本申请实施例提供的一种编程模型的示意图；
图3为本申请实施例提供的一种应用程序的处理方法的流程示意图；
图4为本申请实施例提供的一种内存管理的示意图；
图5为本申请实施例提供的另一种应用程序的处理方法的流程示意图；
图6为本申请实施例提供的又一种应用程序的处理方法的流程示意图；
图7为本申请实施例提供的又一种应用程序的处理方法的流程示意图；
图8为本申请实施例提供的又一种应用程序的处理方法的流程示意图；
图9为本申请实施例提供的又一种应用程序的处理方法的流程示意图；
图10为本申请实施例提供的又一种应用程序的处理方法的流程示意图；
图11为本申请实施例提供的一种应用程序的处理装置的结构示意图；
图12为本申请实施例提供的另一种应用程序的处理装置的结构示意图。
具体实施方式
图1为本申请实施例提供的一种应用场景示意图。如图1所示，应用程序可部署在云环境中。云环境是云计算模式下利用基础资源向用户提供云服务的实体。云环境包括云数据中心和云服务平台，所述云数据中心包括云服务提供商拥有的大量基础资源(包括计算资源、存储资源和网络资源)，云数据中心包括的计算资源可以是大量的计算设备(例如服务器)。例如，以云数据中心包括的计算资源是运行有虚拟机的服务器为例，应用程序可以独立地部署在云数据中心中的服务器或虚拟机(virtual machine，VM)上，应用程序也可以分布式地部署在云数据中心中的多台服务器上、或者分布式地部署在云数据中心中的多台虚拟机上、再或者分布式地部署在云数据中心中的服务器和虚拟机上。
应用程序例如可以由云服务提供商在云服务平台抽象成一种云服务提供给用户，用户在云服务平台购买该云服务后(例如，可预充值再根据最终资源的使用情况进行结算)，云环境利用部署在云数据中心的应用程序向用户提供云服务。用户在远程使用该应用程序 时，可以通过应用程序接口(application program interface，API)或者GUI指定需要该应用程序执行的操作，云环境中的该应用程序执行相应操作，并通过API或者GUI向用户返回执行结果。
在一些实施例中，上述部署在云环境中的应用程序也可以称为使用用户-服务器模型的应用程序。也就是说，运行应用程序的服务器为云环境中的服务器。
云环境上部署的应用程序可能会遭遇如下特权攻击(privileged attacks)：外部的特权攻击者例如通过操作系统漏洞控制云环境的操作系统，从而可以攻击运行在操作系统上的应用程序。例如，提取和篡改运行在操作系统上的应用程序的数据等。或者，内部的特权攻击者(例如云环境的提供商(简称云提供商)的工作人员等)可以从物理上(physically)攻击运行在云环境中的应用程序。
目前，由于Java语言不能防止云环境的特权攻击。因此，为了避免云环境的特权攻击，与不可信运行环境隔离运行的可信运行环境近年成为保护云应用程序的一个重要工具。英特尔的SGX是目前最流行的可信运行环境产品。SGX提供了一个飞地(enclave)执行的抽象(abstraction)。飞地具有如下特点：
1、飞地可以提供两个安全特性，分别为：保密性(confidentiality)和完整性(integrity)。
具体地，由于飞地中存储数据和代码的内存区域与普通不可信内存隔离。所以，运行在飞地中的数据和代码无法被特权攻击者窥探、提取和篡改。因此，飞地可以保障运行在飞地上的应用程序的保密性和完整性。
2、飞地可以提供远程验证(remote attestation)的机制。
具体地，该远程验证的机制可以度量(measure)运行在飞地中的运行环境的完整性，并生成一个验证报告(例如该运行环境的哈希值)提供给远程使用该应用程序的客户端，以使客户端验证运行在飞地中的运行环境。这里所说的度量也可以称为验证。
3、飞地可以为应用程序提供两个接口，分别为飞地入口函数(ECall)和飞地出口函数(OCall)。
具体地，飞地入口函数是由应用程序定义的、且在飞地中执行的可信函数。飞地出口函数是飞地入口函数在飞地中执行时调用的、且在不可信执行环境执行的函数。飞地出口函数通常用于执行特权指令，例如操作系统函数(System Call)等。应理解，飞地入口函数可以存在至少一个具有调用关系的飞地出口函数，也可以无飞地出口函数，具体可以根据飞地入口函数是否需要执行特权指令相关。
例如，当应用程序的一个飞地入口函数被不可信环境调用时，在飞地的执行环境中执行该飞地入口函数，以对用户提供的加密数据进行解密，并进行计算。在计算过程中，若该飞地入口函数需要调用飞地出口函数，则退出飞地的执行环境，在不可信执行环境中执行相应地飞地出口函数。在执行完毕后，返回飞地的执行环境继续执行该飞地入口函数。最后，该飞地入口函数计算得到的结果进行加密后，退出飞地的执行环境并将加密的执行结果返回给用户。
4、飞地可以减少TCB和攻击面。
具体地，传统系统信任系统软件、操作系统和BIOS，因此，传统系统的TCB包括所有的这些软件硬件，所以这些系统软件与不可信的用户的交互都会成为攻击面。而TEE提供的飞地只信任所有运行在飞地的代码(即TCB)，而攻击面仅为飞地与不可信环境的交 互部分(如飞地出口函数和飞地入口函数)，因此，可以减少TCB和攻击面。
5、飞地执行可以减少计算开销和存储开销。
具体地，传统可信计算使用同态加密可信用户数据，使得云环境可以直接对加密数据进行运算。这些运算的操作通常有限，如加法，乘法及幂运算。另外，同态加密/解密的计算消耗较长时间，导致应用程序造的计算成本开销(10X～1000X)较大。同时，因为支持不同计算需要使用不同的同态加密，造成额外的存储开销(2X-4X)。而飞地可以支持所有计算操作，因而，可以减少计算开销和存储开销。
目前，飞地提供的执行环境为C/C++语言的执行环境，即，飞地提供的飞地入口函数和飞地出口函数为C/C++接口函数。因此，现有技术中提供采用如下方式使应用程序可以运行在飞地中：
应用程序的开发者手动将应用程序的原程序代码划分为可信部分和不可信部分。其中，可信部分处理解密的敏感数据，不可信部分管理加密数据，操作系统调用和管理飞地。然后，应用程序的开发者手动将可信部分的代码从Java语言改写为C/C++语言，并加入加解密逻辑，从而使应用程序的可信部分可以运行在飞地中。操作系统调用则由应用程序的开发者编写的飞地出口函数传送到非可信环境执行并验证其返回的结果。
通过上述手动划分和手动改写的方式，可以使应用程序的一部分代码运行在飞地中，用于处理和存储敏感的数据。因此，采用该方式可以使应用程序保持一个较小的TCB和攻击面。但是上述将可信部分的代码从Java语言改写为C/C++语言的方式，需要将所有可信Java代码，及其所有依赖的Java库函数改写为C/C++代码，并把所有操作系统函数改写成飞地出口函数。而一个Java依赖库可能包含数万行代码，因此，上述方式导致改写量较大，改写效率较低，致使将应用程序可以运行在飞地中的易用性存在问题。
此外，由于C/C++不具有自动管理内存的能力，因此，上述将应用程序的可信部分的代码从Java语言改写为C/C++语言的方式，需要在飞地中运行该应用程序的可信部分时，手动管理运行该应用程序的可信部分的内存。
考虑到上述改写量较大的问题，还有一些方案提出将整个应用程序运行在飞地中。例如，多个系统(如Graphene-SGX和SCONE)结合库系统(library OS)或容器(container)把整个完整的应用程序运行在飞地中。具体地，将一个修改的库系统程序或容器守护程序(Container Daemon)运行在飞地中，然后，该程序将一个完整的、无需更改的应用程序或容器镜像(image)度量并加载并运行在飞地中。加载过程产生的哈希值将用于用户验证运行在飞地中的应用程序的完整性。
通过上述将一个完整的应用程序运行在飞地中的方式，虽然无需再手动划分应用程序的可信部分和不可信部分，也无需对应用程序的可信部分进行改写，但是，将一个应用程序完全运行在飞地中，又衍生了新的问题，具体如下：
(1)、造成一个较大的TCB和攻击面。
具体地，该应用程序的TCB包含应用程序及其依赖库、库系统(或容器守护程序)、及可信硬件本身等。其中，库系统(或容器守护程序)可能包含数十万行代码。TCB中任何代码中存在的漏洞，都可能造成该应用程序的崩溃或者遭受攻击，导致该应用程序的保密性和完整性遭受破坏。
(2)、应用程序在飞地中的执行效率低。
具体地，由于飞地执行通常提供有限的内存容量，例如内存容量最大约100M。目前，当飞地的内存不足时，将会采用比内存执行高1000X的页交换(pagging)对数据进行处理。即，将数据采用页交换的方式存储至不可信内存中，在使用该数据时，再从该不可信内存中读取至飞地中。
当采用上述方式在飞地中运行一个完整无更改的应用程序时，应用程序的所有数据和代码，无论是否处理敏感数据，都需要存储在飞地的内存中。因此，采用该方式在飞地中运行应用程序，可能会因频繁页交换导致应用程序的执行效率低。例如，Java虚拟机在初始化完成后占有超过100MB内存，因此使用上述方式运行一个完整Java虚拟机，可能会因频繁页交换导致Java虚拟机的执行效率较低。
故，如何在保持较小的TCB和攻击面、且又能够减少手动改写代码的工作量的情况下，将应用程序的可信部分运行在飞地中，是一个亟待解决的问题。
如前所述，目前飞地提供的执行环境为C/C++语言的执行环境，即，飞地提供的飞地入口函数和飞地出口函数为C/C++接口函数。该低层级的C/C++接口函数导致应用程序的可信部分的安全性存在问题。具体地，C/C++语言具有非内存安全的特性，因此，特权攻击者可以利用C/C++的漏洞对其进行攻击。C/C++语言还具有非类型安全的特性、也易影响应用程序的保密性和完整性。例如，一个采用C/C++语言编写的可信部分可能存在一个缓冲区溢出错误，这个错误可能会污染应用程序的执行栈，从而影响应用程序的执行控制流。
因此，考虑到前述方式存在的安全性、效率性和易用性的问题，结合面向对象的高级语言(例如Java语言)具有内存安全、类型安全等特性，以及，当前大部分应用程序采用面向对象的高级语言编写的特点，本申请实施例提出在飞地中运行高级语言的运行环境，并将使用高级语言编写的应用程序的部分代码直接在飞地中运行的方法。即，飞地中运行高级语言的运行环境，以及，应用程序的可信代码是信任的，而其他部分(例如操作系统、BIOS、以及，其他运行在飞地外的运行环境等)是不可信的。此处所说的高级语言可以为任一面向对象的高级语言，例如Java语言、Scala语言等。
该方法具有如下效果：
1)、高级语言具有类型安全和内存安全的良好特性，易于保护应用程序的可信部分免于遭受传统内存攻击，也可以防止内存错误，提高了应用程序的可信部分的安全性。
2)、应用程序的开发者在对应用程序进行可信代码和非可信代码的划分后，若应用程序的可信部分无加解密逻辑，则应用程序的开发者仅需手动在可信部分加入加解密逻辑即可，若应用程序的可信部分本身存在加解密逻辑，则无需再手动改写应用程序，减少了应用程序的代码手动改写量，提高了将应用程序可以运行在飞地中的易用性。
3)、将应用程序的一部分代码运行在飞地中，可以使应用程序保持一个较小的TCB和攻击面，同时在运行时也不会占用飞地过多的内存，提高了应用程序在飞地中的执行效率。
为了实现上述方法，本申请实施例提出如下改进：
第一方面：提供两个基于注释(annotation)的编程接口，分别为第一接口JECall和第 二接口JOCall。其中，第一接口JECall对应第一注释@JECall，第二接口JOCall对应第二注释@JOCall。第一注释@JECall标注用于表征该第一注释@JECall标注的类为飞地入口函数，第二注释@JOCall标注用于表征第二注释@JOCall标注的类为飞地出口函数。即，使用第一注释标注的类为运行在飞地中的类，使用第二注释标注的类为运行在飞地中的类调用的在非飞地环境中运行在飞地中的类(例如操作系统调用等)。这里所说的非飞地环境也可以称为不可信环境。
应用程序的开发者可以使用第一注释@JECall和第二注释@JOCall对应用程序中的类进行标注。这样，标注为JECall的类及其依赖类将自动运行在飞地中，而标注为JOCall的类在飞地中运行时，将退出飞地执行。
应理解，上述JECall、JOCall、@JECall和@JOCall仅是用于说明第一接口、第二接口、第一注释和第二注释，本申请实施例对第一接口、第二接口、第一注释和第二注释所采用的具体名称不进行限定。
示例性的，图2为本申请实施例提供的一种编程模型的示意图。如图2所示，以编程模型应用于一个key-value数据库的应用程序为例，应用程序的开发者可以在该编程模型中，采用上述所说的第一注释和第二注释对该应用程序的代码进行可信部分和不可信部分的划分。
例如，图2中的应用程序包括：handle_request函数、decrypt函数、store函数。其中，handle_request函数在执行时会调用decrypt函数，以及，store函数。假定handle_request函数被应用程序的开发者标注为JECall，store函数被标注为JOCall，则说明handle_request函数与其所调用的decrypt函数都将运行飞地中。而handle_request函数调用的store函数将在不可信环境中运行。即，当handle_request函数在不可信环境被调用时，将会切换至飞地中执行该handle_request函数。在飞地中执行该handle_request函数的过程中，可以使用解密函数对客户端提供的加密数据进行解密。当store函数被调用时，将从飞地切换到不可信环境中执行该函数并返回结果。当JECall执行完成时，其退出飞地并返回加密的计算结果。
图2虽然以编程模型为例，对如何采用上述所说的第一注释和第二注释对该应用程序的代码进行可信部分和不可信部分的划分。应理解，应用程序的开发者也可以采用其他方式，使用第一注释和第二注释对该应用程序的代码进行可信部分和不可信部分的划分，对此不进行限定。
第二方面：以高级语言Java语言为例，Java语言编写的应用程序采用动态类加载的方式进行代码加载，而在飞地(即可信运行环境)中使用动态类加载会泄露飞地(即可信运行环境)的代码控制流信息。例如，假如一个敏感信息在0时执行函数A，否则执行B，而函数A和B的加载则会暴露敏感信息。同时，在飞地(即可信运行环境)进行动态加载使得可信用户无法知道或验证所有可能会被执行的代码。
因此，考虑到该问题，本申请实施例提供一种可以保证代码完整性的代码加载方式，该代码加载方式可以基于应用程序的舱单文件(manifest)、应用程序的飞地入口函数与静态依赖类的依赖关系，加载应用程序的可信部分的代码。这样，只有少部分的代码(即飞地入口函数与静态依赖类)需要在应用程序启动时被加载。
作为一种可能的实现方式，在应用程序的开发者采用上述第一注释和第二注释对应用 程序完成标注后，可以采用下述方式获取应用程序的舱单文件(manifest)。图3为本申请实施例提供的一种应用程序的处理方法的流程示意图。该方法的执行主体可以为任一能够获取到该应用程序的代码的设备，例如，应用程序的开发者的设备，或者，使用该应用程序的客户端等。如图3所示，该方法包括：
S101、根据应用程序的代码，获取该应用程序中含有第一注释标注的类，和/或，含有第二注释标注的类。
例如，可以遍历应用程序的代码中是否存在第一注释、第二注释，以获取该应用程序中含有第一注释标注的类，和/或，含有第二注释标注的类。
S102、根据含有第一注释标注的类，和/或，含有第二注释标注的类，生成应用程序的舱单文件。
其中，应用程序的舱单文件(manifest)可以包括：应用程序的飞地入口函数的描述信息，和/或，应用程序的飞地出口函数的描述信息。示例性的，这里所说的描述信息例如可以包括：函数名、调用的参数列表(例如参数类型和执行顺序等)、返回类型等。
进一步地，可以根据含有第一注释标注的类的描述文件，获取该应用程序的飞地入口函数的静态依赖类。然后，根据该应用程序的每个飞地入口函数的静态依赖类的哈希值和舱单文件，生成该应用程序的哈希值H 0，该哈希值H 0用于验证静态依赖类的完整性。这里所说的哈希值H 0例如可以是采用任意哈希算法得到的，例如，SHA256哈希值，本申请实施例对此不进行限定。
具体地，类的描述文件通常描述有类的静态依赖类的信息。因此，可以根据含有第一注释标注的类的描述文件，获取该类的静态依赖类，进而根据这些静态依赖类的描述文件，再获取这些静态依赖类的静态依赖类，以此类推，直至获取到所有的静态依赖类。
示例性的，以含有第一注释标注的类为类A1为例，假定根据类A1的描述文件获知类A的静态依赖类有类B和类C，根据类B的描述文件获知类B的静态依赖类有类B1和类B2，根据类B2的描述文件获知类B2的静态依赖类有类B21和类B22，根据类B1描述文件获知类B1无静态依赖类，根据类C描述文件获知类C无静态依赖类，具体的依赖关系可以如下述表1所示：
表1
Figure PCTCN2021090317-appb-000001
则在该示例下，类A1即为该应用程序的一个飞地入口函数，类A1的静态依赖类有类B、类B1、类B2、类B21、类B22、类C。
假定该应用程序一共有5个飞地入口函数，分别为类A1、类A2、类A3、类A4、类A5，则可以根据类A1的每个静态依赖类的哈希值、类A2的每个静态依赖类的哈希值、类A3的每个静态依赖类的哈希值、类A4的每个静态依赖类的哈希值、类A5的每个静态依赖类的哈希值、采用步骤S102的方式所得到的舱单文件进行哈希运算，得到该应用程序的哈希值H 0。 后续，用户在远程使用该应用程序时，可以通过哈希值H 0验证运行在飞地中的代码的完整性。具体如何验证，可以参见后续描述。
可选地，作为一种可能的实现方式，还可以根据含有第一注释标注的类的描述文件，获取应用程序的飞地入口函数与静态依赖类的依赖关系。该依赖关系例如可以采用临接表或者依赖图来表示，对此不进行限定。
第三方面：提供无操作系统参与的、且线程独立的内存管理方式，从而避免应用程序的开发者手动管理内存。图4为本申请实施例提供的一种内存管理的示意图。如图4所示，本申请实施例采用如下方式分配内存区域：当一个线程调用该应用程序的飞地入口函数时，可以在飞地中为该线程分配一个独立且可扩展的内存区域。也就是说，各线程之间的内存区域相互独立。
例如，图4示出了线程1和线程2在分别调用应用程序的飞地入口函数时，在飞地内存中为线程1分配的内存区域，与，为线程2分配的内存区域相互独立。在该示例中，线程1与线程2调用的飞地入口函数可以相同，也可以不同。
下面结合具体地实施例对如何加载应用程序的代码进行详细说明。下面这几个具体的实施例可以相互结合，对于相同或者相似的概念或者过程可能在某些实施例不再赘述。
图5为本申请实施例提供的另一种应用程序的处理方法的流程示意图。该方法的执行主体可以为云环境中的计算设备如图5所示，该方法包括：
S201、接收第一客户端发送的启动请求，其中，该启动请求用于启动应用程序。
例如，当用户需要使用该应用程序时，用户可以远程通过第一客户端发送启动该应用程序的启动请求。
S202、根据启动请求，在飞地的高级语言运行环境中，加载应用程序的舱单文件和应用程序的飞地入口函数与静态依赖类的依赖关系。
应理解，此处所说的飞地的高级语言运行环境，与开发应用程序所使用的语言相同。例如，应用程序为采用高级语言Java语言编写的应用程序，则飞地的高级语言运行环境为Java语言的运行环境。
该高级语言运行环境可以具有如下功能：
1)加载应用程序的可信部分并传输到飞地中，产生一个对应的哈希值H′ o，用于客户端验证其所加载的可信部分完整性。
2)从应用程序的不可信部分的执行切换到应用程序的可信部分的执行。即，从不可信环境切换到飞地的可信环境中执行该应用程序的可信代码。在切换过程中，可信部分的函数的描述信息和所需调用的参数从不可信内存复制到可信的飞地内存中。
3)将运行在飞地的函数编译为二进制运行码，并运行在飞地中。
可选地，飞地中可以预先运行有该高级语言运行环境，或者，计算设备可以在接收到该启动请求之后，在飞地中加载高级语言运行环境，并验证该高级语言运行环境的完整性。例如，可以调用预设的可信运行环境的远程验证协议，以验证该高级语言运行环境的完整性。
示例性的，计算设备可以基于高级语言运行环境生成该运行环境的哈希值Hx，并将该运行环境的哈希值发给第一客户端。相应地，第一客户端存储有一个哈希值H x'。若哈希值H x'与哈希值H x相同，则飞地中加载的该高级语言运行环境的完整性验证通过。然后， 计算设备与第一客户端可以进行密钥交换。这样，计算设备与第一客户端此后的通信都可以使用交换的密钥进行加密。
上述第一客户端所存储的哈希值H x'，可以是第一客户端自己运行高级语言运行环境生成的哈希值，也可以是采用其他方式获取的可信的、且用于验证飞地中加载的该高级语言运行环境的哈希值，本申请实施例对此不进行限定。
在飞地的高级语言运行环境中所加载的应用程序的舱单文件，可以为利用前述图3所示的方式线下生成的舱单文件。本实施例不限定计算设备获取该舱单文件的方式。作为一种可选的方式，计算设备在加载该舱单文件之前，可以接收第一客户端发送的该舱单文件。示例性的，第一客户端可以将该舱单文件携带在启动请求中发送给计算设备，也可以将该舱单文件与启动请求一同发送给计算设备，或者，第一客户端可以分别向计算设备发送该舱单文件与启动请求。
作为另一种可选的方式，计算设备在加载该舱单文件之前，可以从云环境的存储数据库获取存储的该应用程序的舱单文件。此时，存储数据库所存储的该应用程序的舱单文件可以为云环境的维护人员、应用程序的开发者等预先存储在该存储数据库中的，或者，云环境中的一个计算设备在历史某一次启动该应用程序时，将所获取到的舱单文件存储在该存储数据库的。
在飞地的高级语言运行环境中所加载的应用程序的飞地入口函数与静态依赖类的依赖关系，可以为利用前述所描述的方式线下生成的。本实施例不限定计算设备获取应用程序的飞地入口函数与静态依赖类的依赖关系的方式。作为一种可选的方式，计算设备在加载应用程序的飞地入口函数与静态依赖类的依赖关系之前，可以接收第一客户端发送的应用程序的飞地入口函数与静态依赖类的依赖关系。关于如何发送应用程序的飞地入口函数与静态依赖类的依赖关系，可以参见上述发送舱单文件的描述，对此不再赘述。
作为另一种可选的方式，计算设备在加载该应用程序的飞地入口函数与静态依赖类的依赖关系之前，可以从云环境的存储数据库获取存储的该应用程序的飞地入口函数与静态依赖类的依赖关系。此时，存储数据库所存储的该应用程序的飞地入口函数与静态依赖类的依赖关系可以为云环境的维护人员、应用程序的开发者等预先存储在该存储数据库中的，或者，云环境中的一个计算设备在历史某一次启动该应用程序时，将所获取到的应用程序的飞地入口函数与静态依赖类的依赖关系存储在该存储数据库的。
在飞地的高级语言运行环境中所加载的应用程序的飞地入口函数与静态依赖类的依赖关系，可以为在线生成的。即，计算设备在接收到启动请求之后在线生成的。作为一种可选的方式，计算设备在加载该应用程序的飞地入口函数与静态依赖类的依赖关系之前，可以根据该应用程序的代码，获取应用程序中含有第一注释标注的类的描述文件。然后，计算设备可以根据应用程序中含有第一注释标注的类的描述文件，获取应用程序的飞地入口函数与静态依赖类的依赖关系。
S203、根据舱单文件和飞地入口函数与静态依赖类的依赖关系，加载应用程序的飞地入口函数的静态依赖类。
作为一种可能的实现方式，应用程序的代码可以存储在云环境中，例如，云环境的存储数据库等。计算设备在获取到舱单文件和飞地入口函数与静态依赖类的依赖关系后，可以基于该舱单文件和飞地入口函数与静态依赖类的依赖关系，将应用程序的飞地入口函数 的静态依赖类加载在飞地中。
继续参照图5，作为一种可能的实现方式，在完成应用程序的飞地入口函数的静态依赖类的加载之后，可以执行如下操作：
S204、验证加载的飞地入口函数的静态依赖类的完整性。
例如，计算设备可以在飞地中验证加载的飞地入口函数的静态依赖类的内容，与该静态依赖类的哈希值的合法性，以判断该静态依赖类的完整性。当该静态依赖类的内容，以及，哈希值均合法时，确定该静态依赖类的完整性验证通过。在飞地入口函数的静态依赖类的完整性验证通过后，可以执行步骤S205。当该静态依赖类的内容非法，或，哈希值非法时，确定该静态依赖类的完整性验证失败。在所述飞地入口函数的静态依赖类的完整性验证失败后，例如可以向第一客户端返回应用程序的可信部分加载失败的消息。
S205、根据飞地入口函数的静态依赖类的哈希值和舱单文件，生成应用程序的哈希值H 0'。
应理解，上述哈希值H 0'的计算方式可以与前述获取哈希值H 0的计算方式相同。该哈希值H 0'可以标示应用程序所有加载进入飞地的代码。
S206、向第一客户端发送该应用程序的哈希值H 0'，该应用程序的哈希值H 0'用于第一客户端验证飞地中加载的飞地入口函数的静态依赖类的完整性。
例如，第一客户端侧存储有采用前述方式线下生成的哈希值H 0。当第一客户端接收到计算设备发送的应用程序的哈希值H 0'时，可以将哈希值H 0'与哈希值H 0进行比较。若两者相同，则飞地中加载的飞地入口函数的静态依赖类的完整性验证通过，若两者不同，则飞地中加载的飞地入口函数的静态依赖类的完整性验证失败。
应理解，步骤S204-步骤S206可以在加载应用程序的飞地入口函数的静态依赖类之后、且运行该应用程序的飞地入口函数之前的任意时刻执行，对此不进行限定。
下面通过一个具体的示例来对本实施例的方法进行示例说明，其中，计算设备上运行有JVM，采用Java语言编写的应用程序部署在JVM的飞地上。图6为本申请实施例提供的又一种应用程序的处理方法的流程示意图。如图6所示，计算设备的JVM在接收到客户端发送的应用程序的启动请求之后，可以执行如下步骤：
①在飞地中加载高级语言运行环境。
②根据加载的应用程序的舱单文件和应用程序的飞地入口函数与静态依赖类的依赖关系，将应用程序的飞地入口函数的静态依赖类加载到飞地中。
③验证所加载的飞地入口函数的静态依赖类的完整性，并在完整性验证通过后，根据飞地入口函数的静态依赖类的哈希值和舱单文件，生成应用程序的哈希值H 0'。
④与客户端之间进行高级语言运行环境的验证，以及，密钥的交换。
应理解，④所示的动作也可以在①之后、⑤之前的任一时刻执行。
⑤将应用程序的哈希值H 0'发送给客户端，以使客户端基于存储的哈希值H 0与哈希值H 0'，对飞地中加载的飞地入口函数的静态依赖类的完整性进行验证。
⑥在客户端完成应用程序的可信部分的完整性验证后，将加载的飞地入口函数的静态依赖类编译为二进制运行码，并运行在飞地中。
本申请实施例的方法，在飞地运行的高级语言的运行环境中，可以基于应用程序的舱单文件(manifest)、应用程序的飞地入口函数与静态依赖类的依赖关系，加载应用程序的可信部分的代码，从而将使用高级语言编写的应用程序的部分代码(即飞地入口函数与静态依赖类)直接运行在飞地中，可以提高应用程序的可信部分的安全性，使应用程序保持一个较小的TCB和攻击面，提高了应用程序在飞地中的执行效率，同时，也减少了应用程序的代码手动改写量，提高了将应用程序可以运行在飞地中的易用性。
上述内容描述的是如何将使用高级语言编写的应用程序的部分代码(即飞地入口函数与静态依赖类)运行在飞地中的内容。下面具体描述在上述飞地入口函数与静态依赖类的完整性验证通过后，计算设备如何调用飞地入口函数的过程。
图7为本申请实施例提供的又一种应用程序的处理方法的流程示意图。如图7所示，该方法包括：
S301、在通过第一线程调用应用程序的第一飞地入口函数时，切换至飞地中为第一线程分配第一内存区域。即，从非飞地环境切换至飞地的高级语言的运行环境中。
上述第一飞地入口函数可以为该应用程序的任一飞地入口函数。
可选地，第一内存区域可以包括至少一个内存页，每个内存页例如可以为32千字节(kilobyte，KB)的内存。
例如，计算设备可以初始为第一内存区域分配一个内存页。在执行该第一线程所调用的第一飞地入口函数的过程中，若存在内存分配需求，可以为该线程添加内存页。即，动态扩展第一内存区域的大小。例如，可以在距离该内存区域最近的内存页中寻找空闲内存页分配给第一线程，以确保第一内存区域的连续性。若距离该内存区域最近的内存页无法满足第一线程的内存需求，则可以在飞地的内存中重新为第一线程寻找多个连续的内存页作为第一内存区域。
S302、在第一内存区域中创建并执行第一飞地入口函数的静态依赖类的对象。
计算设备在通过上述方式为第一线程分配第一内存区域后，可以在第一内存区域中创建并执行第一飞地入口函数的静态依赖类的对象。关于如何创建类的对象可以参见现有技术的描述，在此不再赘述。
应理解，在一些实施例中，第一飞地入口函数可能还存在无需创建对象即可执行的静态依赖类，针对此类型的静态依赖类，在执行第一飞地入口函数时，直接执行即可，对此不再赘述。另外，除了静态依赖类之外，可能还包括动态依赖类和/或具有调用关系的第一飞地出口函数。下面对在执行第一飞地入口函数的过程中，如何执行动态依赖类以及飞地出口函数进行说明：
针对动态依赖类：
图8为本申请实施例提供的又一种应用程序的处理方法的流程示意图。以第一动态依赖类为例，即，第一飞地入口函数还包括第一动态依赖类。如图8所示，计算设备可以执行如下操作：
S401、获取第一动态依赖类与静态依赖类的依赖关系。
例如，计算设备可以基于第一线程调用第一飞地入口函数时所请求执行的操作，确定 第一飞地入口函数待执行的动态类，从而获取此动态依赖类与静态依赖类的依赖关系。应理解，此处所说的依赖关系包括该动态依赖类与其所有静态依赖类的依赖关系。
以Java语言为例，则此处所说的动态依赖类例如可以为第一飞地入口函数反射动态调用的类文件。
关于如何获取此动态依赖类与静态依赖类的依赖关系，可以参见前述关于在线获取静态依赖类的描述，对此不再赘述。
S402、根据第一动态依赖类与静态依赖类的依赖关系，动态加载第一动态依赖类。
作为一种可能的实现方式，应用程序的代码可以存储在云环境中，例如，云环境的存储数据库等。计算设备在获取到第第一动态依赖类与静态依赖类的依赖关系后，可以基于该第一动态依赖类与静态依赖类的依赖关系，将第一动态依赖类加载在飞地中。
示例性的，可以提供一个加载动态依赖类的接口，该接口例如可以为loadClass(classname)。其中，classname为待加载的动态依赖类的名字。这样，计算设备可以通过这个接口将该classname加载进入飞地中。
S403、验证第一动态依赖类的完整性。
例如，计算设备可以在飞地中验证所加载的第一动态依赖类的静态依赖类的内容，与该静态依赖类的哈希值的合法性，以判断该第一动态依赖类的完整性。当该第一动态依赖类的静态依赖类的内容，以及，第一动态依赖类的静态依赖类的哈希值均合法时，确定该第一动态依赖类的完整性验证通过。在第一动态依赖类的完整性验证通过后，可以执行步骤S404。当该第一动态依赖类的静态依赖类的内容非法，或，第一动态依赖类的静态依赖类的哈希值非法时，确定该第一动态依赖类的完整性验证失败。在第一动态依赖类的完整性验证失败后，例如可以向第一客户端返回第一动态依赖类加载失败的消息。
可选地，在该第一动态依赖类的完整性验证通过后，可以根据该第一动态依赖类所依赖的静态依赖类的哈希值，生成该第一动态依赖类的哈希值Hc，并将该哈希值Hc发送给通过第一线程调用第一飞地入口函数的客户端，以使该客户端验证飞地中加载的该第一动态依赖类的完整性。关于如何验证可以参见前述客户端验证飞地入口函数的静态依赖类的方式，其实现方式类似，对此不再赘述。
S404、在第一内存区域中创建并执行第一动态依赖类的对象。
关于如何创建动态依赖类的对象可以参见现有技术的描述，在此不再赘述。
针对第一飞地入口函数调用的飞地出口函数：
以第一飞地入口函数调用的第一飞地出口函数为例，则在飞地中执行第一飞地入口函数的过程中，计算设备还可以执行如下操作：
计算设备可以先从飞地的高级语言运行环境切换至非飞地环境，即不可信环境。然后，计算设备可以在非飞地环境执行第一飞地出口函数。最后，返回飞地的高级语言运行环境中继续执行第一飞地入口函数。关于如何切换至非飞地环境执行飞地出口函数，其实现方式与现有技术中切换至非飞地环境执行飞地出口函数的方式类似，对此不再赘述。
上述内容描述了计算设备如何在应用程序的运行过程中，通过第一线程调用应用程序的第一飞地入口函数。下面对在完成第一飞地入口函数的调用后，即执行完第一飞地入口 函数后，如何进行垃圾回收(即清理为第一线程分配的第一内存区域)进行解释和说明：
图9为本申请实施例提供的又一种应用程序的处理方法的流程示意图。如图9所示，在第一飞地入口函数退出执行后，计算设备可以执行如下操作：
S501、判断第一飞地入口函数的对象是否被其他线程访问。若否，则执行S505，若是，则执行S503。
此处所说的对象可以是创建的第一飞地入口函数的静态依赖类的对象，或者是，第一飞地入口函数的动态依赖类的对象。此处所说的其他线程是指飞地中正在调用该应用程序的飞地入口函数的线程。该其他线程与第一线程调用的可以是应用程序相同的飞地入口函数，也可以是不同的飞地入口函数。
在本实施例中，若第一飞地入口函数的对象未被任何线程访问，说明第一飞地入口函数的对象未共享给其他线程，此时，第一内存区域为第一线程独立的内存区域，直接清理第一内存区域对其他线程不会造成影响。若第一飞地入口函数的对象被至少一个其他线程访问，说明第一飞地入口函数的对象共享给其他线程。此时，第一内存区域非第一线程独立的内存区域，即，直接清理第一内存区域对其他线程会造成影响。在一些实施例中，此处所说的被其他线程访问也可以描述为被其他线程调用的该应用程序的飞地入口函数访问，本申请实施例对此不进行限定。
继续参照图4，例如，线程1的对象被线程2访问，说明该对象共享给了线程2。此时，线程1的内存区域非线程1独立的内存区域，即，直接清理线程1的内存区域对线程2会造成影响。
S502、同步停止执行飞地中的所有线程调用的飞地入口函数。
应理解，此处所说的停止执行的所有线程是指飞地中所有调用该应用程序的飞地入口函数的线程(即前述所说的其他线程)。这些线程可以是调用的相同的飞地入口函数，也可以是调用的不同的飞地入口函数，也可以是部分线程调用的是相同的飞地入口函数，部分是调用的不同的飞地入口函数。
S503、确定访问第一对象的至少一个第二线程。
S504、根据至少一个第二线程的数量，对第一对象进行拷贝处理。
继续参照图4，在本申请实施例中，该飞地中的内存区域还可以包括全局内存区域，该全局内存区域可以用于存储静态变量和生存期长于一个线程的对象。
例如，若第二线程的数量为1，则将第一对象拷贝至第二线程对应的第二内存区域中。若第二线程的数量大于1，则将第一对象拷贝至飞地的全局内存区域中，以使多个第二线程通过访问全局内存区域即可访问第一对象，节省了飞地的内存空间。
在执行该步骤S504之后，可以执行步骤S505，以清理为第一线程分配的第一内存区域。
S505、清除第一线程与第一内存区域的映射关系。
在完成第一线程与第一内存区域的映射关系的清除之后，第一内存区域所包括的内存页可以分配给飞地中的其他线程使用，从而可以及时的释放飞地的内存，提高了垃圾收集的效率。
通过上述方式，在执行完第一飞地入口函数后，可以及时清理为第一线程分配的第一内存区域，以将第一内存区域所包括的内存页可以分配给其他线程使用，从而可以及时的 释放飞地的内存，提高了飞地内存中的垃圾收集的效率。
由于大数据处理的应用程序在大数据计算的过程中，多个线程共享的对象少而大部分飞地对象的生存期通常在一个飞地入口函数中，因此，采用该方式可以提高大数据处理的应用程序的垃圾收集的效率。
作为一种可能的实现方式，本申请实施例提出一种无操作系统参与的多线程垃圾收集同步方式，该方式通过记录不同线程是否存在跨区域的写入操作来捕捉一个飞地入口函数的对象是否逃脱(escape)原来的内存区域，即，是否被其他线程访问。
当该飞地入口函数存在逃脱对象时(即当存在被其他线程访问的对象)，需要同步停止所有线程的执行，并把逃脱对象回收并清理其他无用的对象(即未被其他线程访问的对象)。这样，在该飞地入口函数退出执行后，为调用该飞地入口函数的线程分配的内存区域被自动清理。
具体地，本申请实施例为捕捉飞地入口函数是否存在逃脱对象，计算设备在应用程序的可信部分的代码中插入一个对全局变量的检查，通过该全局变量捕捉飞地入口函数是否存在逃脱对象。
以计算设备通过一个采用多线程同步机制将逃脱对象回收的垃圾收集(garbage collect，GC)的线程实现该方法为例，示例性的，这里所涉及的全局变量例如可以如下述表2所示：
表2
变量名称 变量的含意
needGC GC正在被调用
nThd 在飞地中执行的线程总数
nGCThd 在可飞地中停止执行的线程总数
这样，当一个对象(假定为目标对象)写入到另外一个对象的成员变量时，计算设备可以检查目标对象所属的内存区域。假如，目标对象所属的内存区域的标识(例如内存区域的ID或索引等)与被写入的内存区域的标识不同时，则将包含目标对象的内存区域和被写入该目标对象的内存区域的记录写入到目标对象所属的线程的逃脱对象列表中，以及，被写入该目标对象的内存区域对应的线程的逃脱对象列表中。
当目标对象所属的线程退出时，计算设备可以基于该逃脱对象列表判断是否存在逃脱对象。当不存在逃脱对象时，即列表为空时，清除该线程与分配的内存区域的映射关系即可。当存在逃脱对象时，即列表不为空时，调用多线程同步机制，将逃脱对象回收(即GC线程)。
具体地，首先，同步停止所有线程的执行，以避免其他线程同时访问这些逃脱的对象。当所有线程停止后，扫描所有线程的执行栈和逃脱对象列表，发现所有属于当前线程的内存区域的对象。对每一个逃脱对象，假如其逃脱到一个其他线程的内存区域，则将其被拷贝到该线程的内存区域。若该逃脱对象逃脱到多个线程的内存区域，则将其拷贝到飞地的的全局内存区域中。
示例性的，以表2所示的全局变量为例，假定计算设备调用GC针对第一线程进行多线程同步时，可以先尝试把全局变量needGC从0设置为1。
1)假如needGC设置成功，则说明成功调用多线程同步。然后，计算设备对全局变量nGCThd进行原子加一操作。相应地，nThd在第一线程开始执行第一飞地函数时，执行原 子加一操作。当变量nGCThd与nThd相等时，则说明飞地中的所有线程均已停止执行，则可以开始回收逃脱对象。在完成逃脱对象的回收后，减少nGCThd和nThd并设置needGC为0，表示除第一线程之外的其他线程可以恢复执行。
2)假如needGC设置失败时，说明有其他线程调用多线程同步机制，则增加nGCThd的值，在needGC变为0后，再减少nGCThd的值，并返回执行尝试把全局变量needGC从0设置为1的步骤。
针对飞地中运行的线程，计算设备在生成的应用程序的可信代码中的循环检查和函数入口中插入了对needGC的检查(非原子)。当needGC为1时，该线程停止执行直到needGC变为0。同时，该线程增加nGCThd的值，以通知GC该线程已停止执行。当needGC为0时，该线程恢复执行。
通过上述方式，在执行完第一飞地入口函数后，可以及时清理为第一线程分配的第一内存区域，以将第一内存区域所包括的内存页可以分配给其他线程使用，从而可以及时的释放飞地的内存，提高了飞地内存中的垃圾收集的效率。
另外，由于上述垃圾收集的方式无需操作系统参与，即，解除了垃圾收集操作与操作系统的调用依赖，这样，在进行垃圾收集时无需与操作系统进行交互，从而可以在进行垃圾收集免于特权攻击中的侧信道(side-channel)攻击和埃古(iago)攻击。
应理解，此处所说的侧信道攻击是指：攻击者通过观察侧信道(例如执行时间，飞地出口函数等)，猜测飞地中运行的应用程序的隐私数据的攻击方式。例如，当一个敏感数据为1时，两个飞地出口函数被执行，当该敏感数据为0时，一个飞地出口函数被执行。攻击者可以观察飞地出口函数的执行次数来猜测该敏感数据的值。
此处所说的埃古攻击是指：攻击者操纵不可信操作系统给飞地中运行的应用程序提供输入，使得飞地中运行的应用程序的控制流发生改变的攻击方式。例如，假如飞地中运行的应用程序依赖一个文件输入，而这个文件包含一个整型数。当该整型数为1时，飞地中运行的应用程序执行do_one函数，当该整型数为0时，飞地中运行的应用程序执行do_zero。因此，当攻击者操纵不可信操作系统更改提供给飞地中运行的应用程序的输入，则飞地程序的完整性将被破坏。
下面通过一个具体的示例来对第一线程调用第一飞地入口函数的过程中的内存管理以及垃圾收集的流程进行简要说明：
图10为本申请实施例提供的又一种应用程序的处理方法的流程示意图。如图10所示，该方法包括：
S601、从非飞地环境中切换至飞地中。
S602、为第一线程分配第一内存区域。
例如，计算设备可以初始为第一内存区域分配一个内存页。该内存页例如可以为32KB的内存。
S603、执行第一飞地入口函数。
在执行第一飞地入口函数的过程中，执行如下操作：
S6031、在创建对象时，判断第一内存区域的空闲内存是否充足。若否，则执行S6032，若是，则执行S6033。
此处所说的对象可以是静态依赖类的对象或者是动态依赖类的对象。
S6032、扩展第一内存区域的大小。
S6033、在第一内存区域中创建并执行该对象。
返回继续执行第一飞地入口函数。
S604、在第一线程退出飞地环境后，确定第一飞地入口函数是否存在逃脱对象。若是，执行S605，若否，则执行S606。
即在第一飞地入口函数执行完毕后，执行该步骤。
S605、调用多线程同步机制，将逃脱对象回收。
S606、清除第一线程与第一内存区域的映射关系。
至此，完成了在第一线程调用第一飞地入口函数的过程中的内存管理以及垃圾收集。
应理解，上述图10仅是为了说明内存管理以及垃圾收集的流程逻辑，省略了实际执行过程中与内存管理无关的内容，比如，第一飞地入口函数执行过程中调用飞地出口函数的内容等，具体可以参见前述实施例中关于每个部分的详细介绍，在此不再赘述。
需要说明的是，虽然本申请实施例以可信运行环境飞地为例，对如何在可信运行环境中运行采用高级语言编写的应用程序进行了说明和介绍。但是本领域技术人员可以理解的是，本申请实施例的方法也可以应用于其他可信运行环境，对此不加以限定。
图11为本申请实施例提供的一种应用程序的处理装置的结构示意图。如图11所示，该应用程序的处理装置可以为前述所说的计算设备，也可以为该计算设备的芯片。该应用程序的处理装置包括：接收模块11和处理模块12。可选地，在一些实施例中，该应用程序的处理装置还可以包括：发送模块13。
接收模块11，用于接收第一客户端发送的启动请求，启动请求用于启动应用程序。
处理模块12，用于根据启动请求，在飞地的高级语言运行环境中，加载应用程序的舱单文件和应用程序的飞地入口函数与静态依赖类的依赖关系；根据舱单文件和飞地入口函数与静态依赖类的依赖关系，加载应用程序的飞地入口函数的静态依赖类。其中，舱单文件包括：应用程序的飞地入口函数的描述信息，和/或，应用程序的飞地出口函数的描述信息。
作为一种可能的实现方式，处理模块12，还用于在加载应用程序的飞地入口函数与静态依赖类的依赖关系之前，根据应用程序的代码，获取应用程序中含有第一注释标注的类的描述文件；根据应用程序中含有第一注释标注的类的描述文件，获取应用程序的飞地入口函数与静态依赖类的依赖关系；其中，第一注释标注用于表征该第一注释标注的类为飞地入口函数。
作为一种可能的实现方式，处理模块12，还用于在加载应用程序的飞地入口函数与静态依赖类的依赖关系之前，通过接收模块11接收第一客户端发送的应用程序的飞地入口函数与静态依赖类的依赖关系；或者，处理模块12，还用于在加载应用程序的飞地入口函数与静态依赖类的依赖关系之前，从存储数据库获取应用程序的飞地入口函数与静态依赖类的依赖关系。
作为一种可能的实现方式，处理模块12，还用于在加载应用程序的舱单文件之前，通过接收模块11接收第一客户端发送的应用程序的舱单文件；或者，处理模块12，还用于在加载应用程序的舱单文件之前，从存储数据库获取应用程序的舱单文件。
作为一种可能的实现方式，处理模块12，还用于在加载应用程序的舱单文件和应用程序的飞地入口函数与静态依赖类的依赖关系之前，在飞地中加载高级语言运行环境，验证高级语言运行环境的完整性。
作为一种可能的实现方式，处理模块12，还用于在加载应用程序的飞地入口函数的静态依赖类之后，验证加载的飞地入口函数的静态依赖类的完整性；在飞地入口函数的静态依赖类的完整性验证通过后，根据飞地入口函数的静态依赖类的哈希值和舱单文件，生成应用程序的哈希值。发送模块13，用于向第一客户端发送应用程序的哈希值；该应用程序的哈希值用于第一客户端验证飞地中加载的所述飞地入口函数的静态依赖类的完整性。
作为一种可能的实现方式，处理模块12，还用于在飞地入口函数的静态依赖类的完整性验证通过后，在通过第一线程调用应用程序的第一飞地入口函数时，切换至飞地中为第一线程分配第一内存区域，并在第一内存区域中创建并执行第一飞地入口函数的静态依赖类的对象。
作为一种可能的实现方式，第一飞地入口函数还包括第一动态依赖类。处理模块12，还用于获取所述第一动态依赖类与静态依赖类的依赖关系；根据所述第一动态依赖类与静态依赖类的依赖关系，动态加载所述第一动态依赖类；验证所述第一动态依赖类的完整性，并在所述第一动态依赖类的完整性验证通过后，在所述第一内存区域中创建并执行所述第一动态依赖类的对象。
作为一种可能的实现方式，第一飞地入口函数与第一飞地出口函数具有调用关系。处理模块12，还用于从飞地的高级语言运行环境切换至非飞地环境；在非飞地环境执行第一飞地出口函数；返回飞地的高级语言运行环境。
作为一种可能的实现方式，处理模块12，还用于在第一飞地入口函数退出执行后，若第一飞地入口函数的对象均未被其他线程访问，则清除第一线程与第一内存区域的映射关系。
作为一种可能的实现方式，处理模块12，还用于在第一飞地入口函数退出执行后，若第一飞地入口函数的第一对象被其他线程访问，则同步停止执行飞地中的所有线程调用的飞地入口函数；确定访问第一对象的至少一个第二线程；根据至少一个第二线程的数量，对第一对象进行拷贝处理；清除第一线程与第一内存区域的映射关系。例如，处理模块12，具体用于在第二线程的数量为1时，将第一对象拷贝至第二线程对应的第二内存区域；或者，在第二线程的数量大于1时，将第一对象拷贝至飞地的全局内存区域中。
应理解，上述接收模块11和发送模块13可以集成在收发模块，也可以分离。
本申请实施例提供的应用程序的处理装置，可以执行上述方法实施例中图5至图10所示的计算设备的动作，其实现原理和技术效果类似，在此不再赘述。
可选地，上述应用程序的处理装置中还可以包括至少一个存储模块，该存储模块可以包括数据和/或指令，处理模块和/或收发模块(或者接收模块和发送模块)可以读取存储模块中的数据和/或指令，实现对应的方法。
本申请实施例还提供了一种应用程序的处理装置的结构示意图。该应用程序的处理装置可以为前述所说的能够获取到应用程序的代码的设备，也可以为该设备的芯片。该应用程序的处理装置包括：处理模块21。
处理模块21，用于根据应用程序的代码，获取应用程序中含有第一注释标注的类，和/或，含有第二注释标注的类；根据含有第一注释标注的类，和/或，含有第二注释标注的类，生成应用程序的舱单文件；其中，第一注释标注用于表征该第一注释标注的类为飞地入口函数，第二注释标注用于表征第二注释标注的类为飞地出口函数，舱单文件包括：应用程序的飞地入口函数的描述信息，和/或，应用程序的飞地出口函数的描述信息。
作为一种可能的实现方式，处理模块21，还用于根据含有第一注释标注的类的描述文件，获取应用程序的飞地入口函数的静态依赖类；根据飞地入口函数的静态依赖类的哈希值和舱单文件，生成应用程序的哈希值，该应用程序的哈希值用于验证静态依赖类的完整性。
作为一种可能的实现方式，处理模块21，还用于根据含有第一注释标注的类的描述文件，获取应用程序的飞地入口函数与静态依赖类的依赖关系。
作为一种可能的实现方式，上述应用程序的处理装置中还可以包括收发模块(或者接收模块和发送模块)，处理模块可以通过收发模块(或者接收模块和发送模块)与其他外设之间进行通信，本申请实施例对此不进行限定。
本申请实施例提供的应用程序的处理装置，可以执行上述方法实施例中图3所示的能够获取到应用程序的代码的设备的动作，其实现原理和技术效果类似，在此不再赘述。
可选的，上述应用程序的处理装置中还可以包括至少一个存储模块，该存储模块可以包括数据和/或指令，处理模块21可以读取存储模块中的数据和/或指令，实现对应的方法。
需要说明的是，应理解以上接收模块实际实现时可以为接收器或通信接口、发送模块实际实现时可以为发送器或通信接口。而处理模块可以以软件通过处理元件调用的形式实现；也可以以硬件的形式实现。例如，处理模块可以为单独设立的处理元件，也可以集成在上述装置的某一个芯片中实现，此外，也可以以程序代码的形式存储于上述装置的存储器中，由上述装置的某一个处理元件调用并执行以上处理模块的功能。此外这些模块全部或部分可以集成在一起，也可以独立实现。这里所述的处理元件可以是一种集成电路，具有信号的处理能力。在实现过程中，上述方法的各步骤或以上各个模块可以通过处理器元件中的硬件的集成逻辑电路或者软件形式的指令完成。
例如，以上这些模块可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个专用集成电路(application specific integrated circuit，ASIC)，或，一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)等。再如，当以上某个模块通过处理元件调度程序代码的形式实现时，该处理元件可以是通用处理器，例如中央处理器(central processing unit，CPU)或其它可以调用程序代码的处理器。再如，这些模块可以集成在一起，以片上系统(system-on-a-chip，SOC)的形式实现。
图12为本申请实施例提供的另一种应用程序的处理装置的结构示意图。如图12所示，该应用程序的处理装置可以包括：处理器31(例如CPU)、存储器32；存储器32可能包含高速随机存取存储器(random-access memory，RAM)，也可能还包括非易失性存储器(non-volatile memory，NVM)，例如至少一个磁盘存储器，存储器32中可以存储各种指令，以用于完成各种处理功能以及实现本申请的方法步骤。可选的，本申请涉及的应用程 序的处理装置还可以包括：电源33、通信总线34以及通信端口35。通信总线34用于实现元件之间的通信连接。上述通信端口35用于实现应用程序的处理装置与其他外设之间进行连接通信。
在本申请实施例中，上述存储器32用于存储计算机可执行程序代码，程序代码包括指令。当处理器31执行指令时，指令使应用程序的处理装置执行上述方法实施例中计算设备的动作；或者，当处理器31执行指令时，指令使应用程序的处理装置执行上述方法实施例中能够获取到应用程序的代码的设备的动作，其实现原理和技术效果类似，在此不再赘述。
本申请实施例还提供一种计算机可读存储介质，其上存储有用于实现上述方法实施例中由计算设备执行的方法，或由能够获取到应用程序的代码的设备执行的方法的计算机指令。
例如，该计算机指令被执行时，使得应用程序的处理装置可以实现上述方法实施例中计算设备执行的方法、或者、能够获取到应用程序的代码的设备执行的方法。
本申请实施例还提供一种包含指令的计算机程序产品，该指令被执行时使得该计算机实现上述方法实施例中由计算设备执行的方法，或由能够获取到应用程序的代码的设备执行的方法。
本申请实施例还提供一种云环境，该云环境包括上文实施例中的包括前述所描述的计算设备和客户端。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例的流程或功能。计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Drive(SSD))等。
本文中的术语“多个”是指两个或两个以上。本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系；在公式中，字符“/”，表示前后关联对象是一种“相除”的关系。
可以理解的是，在本申请的实施例中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的实施例的范围。
可以理解的是，在本申请的实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请的实施例的实施过程构成任何限定。

Claims (36)

  1. 一种应用程序的处理方法，其特征在于，所述方法包括：
    接收第一客户端发送的启动请求，所述启动请求用于启动应用程序；
    根据所述启动请求，在飞地的高级语言运行环境中，加载所述应用程序的舱单文件和所述应用程序的飞地入口函数与静态依赖类的依赖关系；其中，所述舱单文件包括：所述应用程序的飞地入口函数的描述信息，和/或，所述应用程序的飞地出口函数的描述信息；
    根据所述舱单文件和所述飞地入口函数与静态依赖类的依赖关系，加载所述应用程序的飞地入口函数的静态依赖类。
  2. 根据权利要求1所述的方法，其特征在于，所述加载所述应用程序的飞地入口函数与静态依赖类的依赖关系之前，所述方法还包括：
    根据所述应用程序的代码，获取所述应用程序中含有第一注释标注的类的描述文件，所述第一注释标注用于表征所述第一注释标注的类为飞地入口函数；
    根据所述应用程序中含有第一注释标注的类的描述文件，获取所述应用程序的飞地入口函数与静态依赖类的依赖关系。
  3. 根据权利要求1所述的方法，其特征在于，所述加载所述应用程序的飞地入口函数与静态依赖类的依赖关系之前，所述方法还包括：
    接收所述第一客户端发送的所述应用程序的飞地入口函数与静态依赖类的依赖关系；或者，
    从存储数据库获取所述应用程序的飞地入口函数与静态依赖类的依赖关系。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述加载所述应用程序的舱单文件之前，所述方法还包括：
    接收所述第一客户端发送的所述舱单文件；或者，
    从存储数据库获取所述舱单文件。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述加载所述应用程序的舱单文件和所述应用程序的飞地入口函数与静态依赖类的依赖关系之前，所述方法还包括：
    在所述飞地中加载高级语言运行环境；
    验证所述高级语言运行环境的完整性。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，所述加载所述应用程序的飞地入口函数的静态依赖类之后，所述方法还包括：
    验证加载的所述飞地入口函数的静态依赖类的完整性；
    在所述飞地入口函数的静态依赖类的完整性验证通过后，根据所述飞地入口函数的静态依赖类的哈希值和所述舱单文件，生成所述应用程序的哈希值；
    向所述第一客户端发送所述应用程序的哈希值；所述应用程序的哈希值用于所述第一客户端验证所述飞地中加载的所述飞地入口函数的静态依赖类的完整性。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    在所述飞地入口函数的静态依赖类的完整性验证通过后，在通过第一线程调用所述应用程序的第一飞地入口函数时，切换至所述飞地中为所述第一线程分配第一内存区域；
    在所述第一内存区域中创建并执行所述第一飞地入口函数的静态依赖类的对象。
  8. 根据权利要求7所述的方法，其特征在于，所述第一飞地入口函数还包括第一动态依赖类，所述方法还包括：
    获取所述第一动态依赖类与静态依赖类的依赖关系；
    根据所述第一动态依赖类与静态依赖类的依赖关系，动态加载所述第一动态依赖类；
    验证所述第一动态依赖类的完整性；
    在所述第一动态依赖类的完整性验证通过后，在所述第一内存区域中创建并执行所述第一动态依赖类的对象。
  9. 根据权利要求7或8所述的方法，其特征在于，所述第一飞地入口函数与第一飞地出口函数具有调用关系，所述方法还包括：
    从所述飞地的高级语言运行环境切换至非飞地环境；
    在所述非飞地环境执行所述第一飞地出口函数；
    返回所述飞地的高级语言运行环境。
  10. 根据权利要求7-9任一项所述的方法，其特征在于，所述方法还包括：
    在所述第一飞地入口函数退出执行后，若所述第一飞地入口函数的对象均未被其他线程访问，则清除所述第一线程与所述第一内存区域的映射关系。
  11. 根据权利要求7-10任一项所述的方法，其特征在于，所述方法还包括：
    在所述第一飞地入口函数退出执行后，若所述第一飞地入口函数的第一对象被其他线程访问，则同步停止执行所述飞地中的所有线程调用的飞地入口函数；
    确定访问所述第一对象的至少一个第二线程；
    根据所述至少一个第二线程的数量，对所述第一对象进行拷贝处理；
    清除所述第一线程与所述第一内存区域的映射关系。
  12. 根据权利要求11所述的方法，其特征在于，所述根据所述至少一个第二线程的数量，对所述第一对象进行拷贝处理，包括：
    若所述第二线程的数量为1，则将所述第一对象拷贝至所述第二线程对应的第二内存区域；或者，
    若所述第二线程的数量大于1，则将所述第一对象拷贝至所述飞地的全局内存区域中。
  13. 一种应用程序的处理方法，其特征在于，所述方法包括：
    根据应用程序的代码，获取所述应用程序中含有第一注释标注的类，和/或，含有第二注释标注的类，所述第一注释标注用于表征所述第一注释标注的类为飞地入口函数，所述第二注释标注用于表征所述第二注释标注的类为飞地出口函数；
    根据所述含有第一注释标注的类，和/或，所述含有第二注释标注的类，生成所述应用程序的舱单文件，其中，所述舱单文件包括：所述应用程序的飞地入口函数的描述信息，和/或，所述应用程序的飞地出口函数的描述信息。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    根据所述含有第一注释标注的类的描述文件，获取所述应用程序的飞地入口函数的静态依赖类；
    根据所述飞地入口函数的静态依赖类的哈希值和所述舱单文件，生成所述应用程序的哈希值，所述应用程序的哈希值用于验证所述静态依赖类的完整性。
  15. 根据权利要求13或14所述的方法，其特征在于，所述方法还包括：
    根据所述含有第一注释标注的类的描述文件，获取所述应用程序的飞地入口函数与静态依赖类的依赖关系。
  16. 一种应用程序的处理装置，其特征在于，所述装置包括：
    接收模块，用于接收第一客户端发送的启动请求，所述启动请求用于启动应用程序；
    处理模块，用于根据所述启动请求，在飞地的高级语言运行环境中，加载所述应用程序的舱单文件和所述应用程序的飞地入口函数与静态依赖类的依赖关系；根据所述舱单文件和所述飞地入口函数与静态依赖类的依赖关系，加载所述应用程序的飞地入口函数的静态依赖类；其中，所述舱单文件包括：所述应用程序的飞地入口函数的描述信息，和/或，所述应用程序的飞地出口函数的描述信息。
  17. 根据权利要求16所述的装置，其特征在于，所述处理模块，还用于在加载所述应用程序的飞地入口函数与静态依赖类的依赖关系之前，根据所述应用程序的代码，获取所述应用程序中含有第一注释标注的类的描述文件；根据所述应用程序中含有第一注释标注的类的描述文件，获取所述应用程序的飞地入口函数与静态依赖类的依赖关系；其中，所述第一注释标注用于表征所述第一注释标注的类为飞地入口函数。
  18. 根据权利要求16所述的装置，其特征在于，
    所述处理模块，还用于在加载所述应用程序的飞地入口函数与静态依赖类的依赖关系之前，通过所述接收模块接收所述第一客户端发送的所述应用程序的飞地入口函数与静态依赖类的依赖关系；或者，
    所述处理模块，还用于在加载所述应用程序的飞地入口函数与静态依赖类的依赖关系之前，从存储数据库获取所述应用程序的飞地入口函数与静态依赖类的依赖关系。
  19. 根据权利要求16-18任一项所述的装置，其特征在于，
    所述处理模块，还用于在加载所述应用程序的舱单文件之前，通过所述接收模块接收所述第一客户端发送的所述舱单文件；或者，
    所述处理模块，还用于在加载所述应用程序的舱单文件之前，从存储数据库获取所述舱单文件。
  20. 根据权利要求16-19任一项所述的装置，其特征在于，所述处理模块，还用于在加载所述应用程序的舱单文件和所述应用程序的飞地入口函数与静态依赖类的依赖关系之前，在所述飞地中加载高级语言运行环境，验证所述高级语言运行环境的完整性。
  21. 根据权利要求16-20任一项所述的装置，其特征在于，所述装置还包括：发送模块；
    所述处理模块，还用于在加载所述应用程序的飞地入口函数的静态依赖类之后，验证加载的所述飞地入口函数的静态依赖类的完整性；在所述飞地入口函数的静态依赖类的完整性验证通过后，根据所述飞地入口函数的静态依赖类的哈希值和所述舱单文件，生成所述应用程序的哈希值；
    所述发送模块，用于向所述第一客户端发送所述应用程序的哈希值；所述应用程序的哈希值用于所述第一客户端验证所述飞地中加载的所述飞地入口函数的静态依赖类的完整性。
  22. 根据权利要求21所述的装置，其特征在于，所述处理模块，还用于在所述飞地入口函数的静态依赖类的完整性验证通过后，在通过第一线程调用所述应用程序的第一飞 地入口函数时，切换至所述飞地中为所述第一线程分配第一内存区域，并在所述第一内存区域中创建并执行所述第一飞地入口函数的静态依赖类的对象。
  23. 根据权利要求22所述的装置，其特征在于，所述第一飞地入口函数还包括第一动态依赖类；
    所述处理模块，还用于获取所述第一动态依赖类与静态依赖类的依赖关系；根据所述第一动态依赖类与静态依赖类的依赖关系，动态加载所述第一动态依赖类；验证所述第一动态依赖类的完整性，并在所述第一动态依赖类的完整性验证通过后，在所述第一内存区域中创建并执行所述第一动态依赖类的对象。
  24. 根据权利要求22或23所述的装置，其特征在于，所述第一飞地入口函数与第一飞地出口函数具有调用关系；
    所述处理模块，还用于从所述飞地的高级语言运行环境切换至非飞地环境；在所述非飞地环境执行所述第一飞地出口函数；返回所述飞地的高级语言运行环境。
  25. 根据权利要求22-24任一项所述的装置，其特征在于，所述处理模块，还用于在所述第一飞地入口函数退出执行后，若所述第一飞地入口函数的对象均未被其他线程访问，则清除所述第一线程与所述第一内存区域的映射关系。
  26. 根据权利要求22-25任一项所述的装置，其特征在于，所述处理模块，还用于在所述第一飞地入口函数退出执行后，若所述第一飞地入口函数的第一对象被其他线程访问，则同步停止执行所述飞地中的所有线程调用的飞地入口函数；确定访问所述第一对象的至少一个第二线程；根据所述至少一个第二线程的数量，对所述第一对象进行拷贝处理；清除所述第一线程与所述第一内存区域的映射关系。
  27. 根据权利要求26所述的装置，其特征在于，所述处理模块，具体用于在所述第二线程的数量为1时，将所述第一对象拷贝至所述第二线程对应的第二内存区域；或者，在所述第二线程的数量大于1时，将所述第一对象拷贝至所述飞地的全局内存区域中。
  28. 一种应用程序的处理装置，其特征在于，所述装置包括：
    处理模块，用于根据应用程序的代码，获取所述应用程序中含有第一注释标注的类，和/或，含有第二注释标注的类；根据所述含有第一注释标注的类，和/或，所述含有第二注释标注的类，生成所述应用程序的舱单文件；其中，所述第一注释标注用于表征所述第一注释标注的类为飞地入口函数，所述第二注释标注用于表征所述第二注释标注的类为飞地出口函数，所述舱单文件包括：所述应用程序的飞地入口函数的描述信息，和/或，所述应用程序的飞地出口函数的描述信息。
  29. 根据权利要求28所述的装置，其特征在于，所述处理模块，还用于根据所述含有第一注释标注的类的描述文件，获取所述应用程序的飞地入口函数的静态依赖类；根据所述飞地入口函数的静态依赖类的哈希值和所述舱单文件，生成所述应用程序的哈希值，所述应用程序的哈希值用于验证所述静态依赖类的完整性。
  30. 根据权利要求28或29所述的装置，其特征在于，所述处理模块，还用于根据所述含有第一注释标注的类的描述文件，获取所述应用程序的飞地入口函数与静态依赖类的依赖关系。
  31. 一种云环境，其特征在于，所述云环境包括如权利要求16-27任一项所述的装置，以及，如权利要求28-30任一项所述的装置。
  32. 一种网络装置，其特征在于，包括处理器和接口电路；
    所述接口电路，用于接收计算机执行指令并传输至所述处理器；所述处理器运行所述计算机执行指令以执行如权利要求1-15任一项所述的方法。
  33. 一种网络装置，其特征在于，包括处理器和存储器；
    所述存储器用于存储计算机执行指令；
    所述处理器用于执行所述存储器所存储的计算机执行指令，以使所述网络装置执行如权利要求1-15中任一项所述的方法。
  34. 一种网络装置，其特征在于，包括处理器、存储器和收发器；
    所述收发器，用于接收信号或者发送信号；
    所述存储器，用于存储计算机程序；
    所述处理器，用于从所述存储器调用所述计算机程序执行如权利要求1-15任一项所述的方法。
  35. 一种计算机可读存储介质，其特征在于，用于存储计算机程序或计算机执行指令，当所述计算机程序或计算机执行指令在计算机上运行时，使得所述计算机执行权利要求1至15任一项所述的方法。
  36. 一种计算机程序产品，包括计算机程序，其特征在于，所述计算机程序被处理器执行时实现权利要求1-15任一项所述的方法。
PCT/CN2021/090317 2020-04-30 2021-04-27 应用程序的处理方法、装置、云环境、介质及程序产品 WO2021218976A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21796229.9A EP4141717A4 (en) 2020-04-30 2021-04-27 APPLICATION PROCESSING METHOD AND APPARATUS, CLOUD ENVIRONMENT, MEDIUM AND PROGRAM PRODUCT
US17/975,163 US20230106435A1 (en) 2020-04-30 2022-10-27 Application processing method and apparatus, cloud environment, medium, and program product

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010366539.4A CN113591091A (zh) 2020-04-30 2020-04-30 应用程序的处理方法、装置、云环境及存储介质
CN202010366539.4 2020-04-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/975,163 Continuation US20230106435A1 (en) 2020-04-30 2022-10-27 Application processing method and apparatus, cloud environment, medium, and program product

Publications (1)

Publication Number Publication Date
WO2021218976A1 true WO2021218976A1 (zh) 2021-11-04

Family

ID=78237504

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/090317 WO2021218976A1 (zh) 2020-04-30 2021-04-27 应用程序的处理方法、装置、云环境、介质及程序产品

Country Status (4)

Country Link
US (1) US20230106435A1 (zh)
EP (1) EP4141717A4 (zh)
CN (1) CN113591091A (zh)
WO (1) WO2021218976A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113961427A (zh) * 2021-12-20 2022-01-21 荣耀终端有限公司 系统内存分析的方法及电子设备

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116302218A (zh) * 2023-03-15 2023-06-23 北京百度网讯科技有限公司 函数信息的添加方法、装置、设备以及存储介质
CN116541105A (zh) * 2023-07-06 2023-08-04 智慧眼科技股份有限公司 一种基于注解的组件加载方法、系统、终端及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107431621A (zh) * 2014-12-27 2017-12-01 迈克菲有限责任公司 采用输入标记的可信二进制的二进制转换
CN107466464A (zh) * 2014-12-23 2017-12-12 迈克菲有限责任公司 输入验证
US20180241572A1 (en) * 2017-02-22 2018-08-23 Intel Corporation Techniques for remote sgx enclave authentication
CN109032663A (zh) * 2018-07-09 2018-12-18 深圳市小牛在线互联网信息咨询有限公司 接口文档的生成方法、装置、计算机设备及存储介质
CN110874468A (zh) * 2018-08-31 2020-03-10 华为技术有限公司 应用程序安全保护方法以及相关设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107466464A (zh) * 2014-12-23 2017-12-12 迈克菲有限责任公司 输入验证
CN107431621A (zh) * 2014-12-27 2017-12-01 迈克菲有限责任公司 采用输入标记的可信二进制的二进制转换
US20180241572A1 (en) * 2017-02-22 2018-08-23 Intel Corporation Techniques for remote sgx enclave authentication
CN109032663A (zh) * 2018-07-09 2018-12-18 深圳市小牛在线互联网信息咨询有限公司 接口文档的生成方法、装置、计算机设备及存储介质
CN110874468A (zh) * 2018-08-31 2020-03-10 华为技术有限公司 应用程序安全保护方法以及相关设备

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113961427A (zh) * 2021-12-20 2022-01-21 荣耀终端有限公司 系统内存分析的方法及电子设备

Also Published As

Publication number Publication date
CN113591091A (zh) 2021-11-02
EP4141717A4 (en) 2023-10-18
US20230106435A1 (en) 2023-04-06
EP4141717A1 (en) 2023-03-01

Similar Documents

Publication Publication Date Title
US11392506B2 (en) Apparatus and method for secure memory access using trust domains
WO2021218976A1 (zh) 应用程序的处理方法、装置、云环境、介质及程序产品
US9846787B2 (en) System and method for implementing a trusted dynamic launch and trusted platform module (TPM) using secure enclaves
KR102355213B1 (ko) 운영 체제 공격으로부터 애플리케이션 기밀사항을 보호하는 기법
US11842217B1 (en) Isolating tenants executing in multi-tenant software containers
US11748146B2 (en) Scalable virtual machine operation inside trust domains within the trust domain architecture
JP2019503539A (ja) 仮想マシンを監査するためのシステムおよび方法
WO2018153027A1 (zh) 一种数据迁移方法及装置
US8880757B1 (en) RDMA resource leakage detection and reporting
Thalheim et al. Rkt-io: A direct i/o stack for shielded execution
US9477538B2 (en) Method and system for the support of application specific policies for conventional operating systems
US20240037218A1 (en) Techniques for improved virtual instance inspection utilizing disk cloning
Liang et al. Toward migration of SGX-enabled containers
US11604669B2 (en) Single use execution environment for on-demand code execution
WO2018153113A1 (zh) 信息保护方法及装置
US20240061938A1 (en) Patching enclaves with shared resources
Stavrakakis et al. Anchor: A Library for Building Secure Persistent Memory Systems
Sartakov Systems Support for Emerging Memory Technologies
Singh Fundamental of Windows

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21796229

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021796229

Country of ref document: EP

Effective date: 20221122

NENP Non-entry into the national phase

Ref country code: DE