WO2022001842A1 - 处理数据的方法、主机及装置 - Google Patents

处理数据的方法、主机及装置 Download PDF

Info

Publication number
WO2022001842A1
WO2022001842A1 PCT/CN2021/102236 CN2021102236W WO2022001842A1 WO 2022001842 A1 WO2022001842 A1 WO 2022001842A1 CN 2021102236 W CN2021102236 W CN 2021102236W WO 2022001842 A1 WO2022001842 A1 WO 2022001842A1
Authority
WO
WIPO (PCT)
Prior art keywords
environment
isolation
data
program
host
Prior art date
Application number
PCT/CN2021/102236
Other languages
English (en)
French (fr)
Inventor
尹文
李宏
邱颖鑫
林晓伟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21834542.9A priority Critical patent/EP4160403A4/en
Publication of WO2022001842A1 publication Critical patent/WO2022001842A1/zh
Priority to US18/067,797 priority patent/US20230185901A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/10—Payment architectures specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
    • G06Q20/102—Bill distribution or payments
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/4557—Distribution of virtual machine instances; Migration and load balancing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2105—Dual mode as a secondary aspect

Definitions

  • the present application relates to the field of internet technology (IT), and in particular, to a method, host and device for processing data.
  • IT internet technology
  • a virtual machine refers to a complete computer system with complete hardware system functions simulated by software modules and running in an environment.
  • a virtual machine can be regarded as a complete computer system that can be used to run a program and process the data to be processed by running the program.
  • the data to be processed includes the account numbers of both parties to be transferred and the transfer amount.
  • the virtual machine can run the transfer program and complete the transfer based on the pending data. Running the transfer program in a virtual machine to process the data to be processed is prone to information leakage and high security risks.
  • the present application provides a method, host and device for processing data to improve the security of processing data.
  • the technical solution is as follows:
  • the present application provides a host for data processing, including a program running environment and a first isolation environment, where the program running environment is an environment where the host works in a non-secure mode, and the first isolation environment is where the host works in a secure mode. environment of.
  • the program execution environment includes at least one virtualized instance working in a non-secure mode, wherein the first isolation environment corresponds to the virtualized instance in the program execution environment.
  • the first isolation environment includes an operating system in a secure mode and resources allocated to the first isolation environment, the resources including a first isolation space and processor resources, the first isolation space for running the operating system and the security handler, and
  • the data to be processed is stored, the security processing program corresponds to the program in the virtualized instance, and is used to process the data to be processed to realize the security processing function of the program in the virtualized instance.
  • the first isolation space is isolated from the program running environment.
  • the first isolation environment corresponding to the virtualized instance includes the operating system and resources in the safe mode, and the resources include the first isolation environment.
  • Isolation space and processor resources the first isolation space is used to run the operating system and the security processing program, and process the data to be processed
  • the security processing program is the program called by the virtualized instance
  • the data to be processed is required to run the security processing program data
  • the first isolated space is the space protected by this host in safe mode.
  • the first isolation environment is an environment with high security.
  • the security processing program is run, and the security processing program is used to process the data to be processed, thereby improving the security of the processed data.
  • the program running environment is used to provide hardware resources and/or software resources required for running the virtualized instance
  • the first isolation environment is used to provide hardware resources and/or software resources required to run the security processing program software resources.
  • the host further includes: a second isolation environment, the second isolation environment includes a first management module and a first isolation environment, and the first management module is configured to manage the first isolation environment.
  • the isolation environment can be divided into a first isolation environment and a second isolation environment.
  • a first isolation environment corresponding to different virtualization instances can be created, and the first management module can be used to manage the The first isolation environment, to achieve granular management of virtualized instances, to achieve fine management.
  • the first isolation space is an isolated running environment that only communicates with the virtualization instance corresponding to the first isolation space, and cannot be accessed by other virtualization instances.
  • the first management module when the host switches to the safe mode, is configured to receive task information, where the task information includes an identifier of the virtualization instance.
  • the first management module is further configured to create or allocate a first isolation environment corresponding to the virtualized instance according to the task information. In this way, the first management module can be triggered to create or allocate the first isolation environment through the task information.
  • the first management module is configured to receive the task information sent by the security monitor, where the task information is information obtained by the security monitor in a non-secure mode.
  • the security level of the security monitor is relatively high, and the security of the task information transmission can be improved by transmitting the task information in the program running environment in the non-secure mode to the first management module in the secure mode through the security monitor.
  • the task information is generated when a second management module in the program running environment receives a call request sent by the virtualized instance, and the task information acquired by the security monitor is the second management module module input, so that the task information can be safely transmitted to the first management module through the security monitor.
  • the task information further includes a shared memory address
  • the first management module is further configured to acquire first data according to the shared memory address
  • the first data includes the safe running program and the data to be processed.
  • the shared memory is the memory shared by the program running environment and the first isolation environment, so that the first data in the program running environment in the non-secure mode can be transferred to the first management module through the shared memory, so as to ensure that the first management module can be based on the first management module.
  • a data creates a first isolation environment.
  • the first management module is further configured to adjust the amount of resources included in the first isolation environment corresponding to the virtualized instance running in the program running environment, so that the amount of resources included in the first isolation environment can be guaranteed Meet the needs of runner handlers to process pending data.
  • the first management module releases the first isolation environment corresponding to the virtualized instance running in the program running environment, so that idle resources can be released for use by other virtualized instances.
  • the first management module is configured to run the operating system in the security mode in the first isolation space, and run the security processing program through the operating system to process the data to be processed to obtain a processing result.
  • the operating system in the first isolation environment can run the security processing program and process the data to be processed, so as to ensure that the security processing program can be run by using the first isolation environment, so that the virtualized instance and the first isolation environment can be implemented one by one. correspond.
  • the first management module is further configured to transmit the processing result to the program running environment, and trigger to switch the working mode of the host to the non-safe mode. This ensures that the virtualized instance located in the program running environment can obtain the processing result.
  • the first management module inputs task completion information to the security monitor, and the security monitor receives the task completion information and triggers the host to switch the working mode to the non-secure mode.
  • the first management module is further configured to acquire second data, where the second data includes state information and data stored in the first isolation space, where the state information is used to describe the first isolation environment The running state of the operating system and the running state of the security processing program, and the second data is used to restore the first isolation environment corresponding to the virtualized instance on other hosts.
  • the first management module is further configured to send the second data to the second management module in the program running environment.
  • the virtualized instance can be migrated to other hosts, the virtualized instance can be continued to run on other hosts, and the security processing program can continue to process the data to be processed in the first isolation environment, thereby realizing the connection between the first isolation environment and the host. Hardware decoupling.
  • the second management module is configured to send second data to other hosts, so as to restore the first isolation environment corresponding to the virtualization instance on the other hosts.
  • the virtualized instance can be migrated to other hosts, the virtualized instance can be continued to run on other hosts, and the security processing program can continue to process the data to be processed in the first isolation environment, thereby realizing the connection between the first isolation environment and the host.
  • Hardware decoupling is configured to send second data to other hosts, so as to restore the first isolation environment corresponding to the virtualization instance on the other hosts.
  • the number of first isolation environments included in the host is multiple, and each first isolation environment in the multiple first isolation environments corresponds to a virtualized instance in the program running environment one-to-one .
  • different virtualized instances correspond to different first isolation environments, so as to achieve granular management based on the virtualized instances, and realize fine management.
  • the first management module is a hypervisor, a hypervisor.
  • the present application provides a method for processing data.
  • task information is received, where the task information includes an identifier of a virtualized instance, where the virtualized instance is a program running
  • the virtualized instance in the environment works in the non-secure mode
  • the program running environment is the environment in which the host works in the non-secure mode.
  • the first isolation environment is an environment in which the host works in a safe mode.
  • the first isolation environment includes the operating system in the safe mode and the The resources of the isolation environment, the resources include a first isolation space and processor resources, the first isolation space is used to run the operating system and the security processing program, and store the data to be processed, and the security processing program corresponds to the program in the virtualized instance , which is used to process the data to be processed to realize the security processing function of the program in the virtualized instance, and the first isolation space is isolated from the program running environment.
  • the first isolation environment corresponding to the virtualized instance is created or allocated according to the task information, and the first isolation environment includes the operating system in the safe mode and the first isolation environment assigned to the first isolation environment.
  • the resources of the environment, the resources include a first isolation space and processor resources, the first isolation space is used to run the operating system and the security processing program, and store the data to be processed, and the first isolation space is isolated from the program running environment, so that the first isolation space is
  • the isolation environment is an environment with high security. In this way, in the first isolation environment corresponding to the virtualized instance, the security processing program is run, and the security processing program is used to process the data to be processed, thereby improving the security of processing data.
  • the receiving security monitor sends task information, where the task information is information obtained by the security monitor in a non-secure mode.
  • the security level of the security monitor is relatively high, and the security of the transmission of the task information can be improved by transmitting the task information in the program running environment in the non-secure mode to the secure mode through the security monitor.
  • the first isolation space is an isolated running environment that only communicates with the virtualization instance corresponding to the first isolation space, and cannot be accessed by other virtualization instances.
  • the task information further includes a shared memory address
  • first data is obtained according to the shared memory address
  • the first data includes the safe running program and data to be processed
  • the shared memory is the program running environment and the first data to be processed.
  • An isolated environment shared memory Since the shared memory is the memory shared by the program running environment and the first isolation environment, the first data in the program running environment in the non-safe mode can be transferred to the safe mode through the shared memory, so as to ensure that the first data can be created based on the first data.
  • An isolated environment is possible implementation manner, first data is obtained according to the shared memory address, the first data includes the safe running program and data to be processed, and the shared memory is the program running environment and the first data to be processed.
  • the host further includes a second isolation environment, and the second isolation environment includes the first isolation environment.
  • the isolation environment can be divided into a first isolation environment and a second isolation environment.
  • first isolation environments corresponding to different virtualization instances can be created, and first isolation environments corresponding to different virtualization instances can be managed. To achieve granular management of virtualized instances, to achieve fine management.
  • the amount of resources included in the first isolation environment corresponding to the virtualized instance running in the program running environment is adjusted, so as to ensure that the amount of resources included in the first isolation environment satisfies the running program processing program to process pending processing data needs.
  • the first isolation environment corresponding to the virtualized instance running in the program running environment is released, so that idle resources can be released for use by other virtualized instances.
  • the operating system in the safe mode is run in the first isolation space, and the data to be processed is processed by running the safe processing program through the operating system to obtain a processing result.
  • the operating system in the first isolation environment can run the security processing program and process the data to be processed, so as to ensure that the security processing program can be run by using the first isolation environment, so that the virtualized instance and the first isolation environment can be implemented one by one. correspond.
  • the processing result is transmitted to the program running environment, and the switching of the working mode of the host to the non-safety mode is triggered. This ensures that the virtualized instance located in the program running environment can obtain the processing result.
  • second data is acquired, where the second data includes state information and data stored in the first isolation space, where the state information is used to describe the running state and security processing of the operating system in the first isolation environment
  • the running state of the program, and the second data is used to restore the first isolation environment corresponding to the virtualized instance on another host.
  • the virtualized instance can be migrated to other hosts, the virtualized instance can be continued to run on other hosts, and the security processing program can continue to process the data to be processed in the first isolation environment, thereby realizing the connection between the first isolation environment and the host.
  • the second data is sent to the other host, so as to restore the first isolation environment corresponding to the virtualization instance on the other host.
  • the virtualized instance can be migrated to other hosts, the virtualized instance can be continued to run on other hosts, and the security processing program can continue to process the data to be processed in the first isolation environment, thereby realizing the connection between the first isolation environment and the host.
  • Hardware decoupling
  • the number of first isolation environments included in the host is multiple, and each first isolation environment in the multiple first isolation environments corresponds to a virtualized instance in the program running environment one-to-one .
  • different virtualized instances correspond to different first isolation environments, so as to achieve granular management based on the virtualized instances, and realize fine management.
  • the present application provides a data processing apparatus for executing the method in the second aspect or any possible implementation manner of the second aspect.
  • the apparatus includes a unit for performing the method in the second aspect or any one possible implementation manner of the second aspect.
  • the present application provides an apparatus for data processing, the apparatus including a transceiver, a processor and a memory.
  • the transceiver, the processor and the memory may be connected through an internal connection.
  • the memory is used to store programs, instructions or codes
  • the processor is used to execute the programs, instructions or codes in the memory and cooperate with the transceiver, so that the apparatus accomplishes the second aspect or any possible implementation of the second aspect A directive for a method in a method.
  • the present application provides a computer program product, the computer program product includes a computer program stored in a computer-readable storage medium, and the computer program is loaded by a processor to implement the second aspect or the first aspect.
  • the computer program product includes a computer program stored in a computer-readable storage medium, and the computer program is loaded by a processor to implement the second aspect or the first aspect.
  • the present application provides a computer-readable storage medium for storing a computer program, the computer program being loaded by a processor to execute instructions of the method of the second aspect or any possible implementation manner of the second aspect.
  • FIG. 1 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of a host provided by an embodiment of the present application.
  • FIG. 3 is a flowchart of a method for processing data provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of information transfer between modules of a host provided by an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of an apparatus for processing data provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of another apparatus for processing data provided by an embodiment of the present application.
  • an embodiment of the present application provides a system architecture, where the system architecture includes at least one host, and for any two hosts in the at least one host, a network connection may be established between the two hosts.
  • the system architecture can be applied to scenarios such as cloud scenarios or data centers.
  • the host in the system architecture may be a server included in a cloud scenario or a server included in a data center.
  • the host may include at least one virtualized instance, and the host may provide an operating environment for the at least one virtualized instance in which each virtualized instance may run.
  • the at least one virtualization instance includes virtual machines and/or containers, and the like.
  • the virtualized instance For each virtualized instance, the virtualized instance includes an operating system and a program that can provide services.
  • An operating system can be run in the virtualized instance, and the program is run through the operating system, so that the virtualized instance provides the service.
  • the virtualized instance may call some security processing programs to process data at runtime, so as to realize the security processing function of the program.
  • the security processing program needs to run in a high security environment to ensure the security of data processing, so as to realize the security processing function.
  • the security processing function is a sub-function of the function that the program needs to implement.
  • the operation implemented by the security handler is one or more steps included in the function that the program needs to implement.
  • the programs in this virtualized instance are used to implement user login.
  • the virtualized instance may need to verify the password entered by the user during the running process.
  • the virtualized instance calls the security handler for password verification to verify the password entered by the user. test.
  • the program in the virtualized instance is a financial program, and transfer may be required during the running of the virtualized instance.
  • the virtualized instance invokes a security handler for transferring transfer to perform transfer.
  • the data that the security processing program needs to process includes the amount of the transfer, the input account information and the output account information.
  • an embodiment of the present application provides a host as shown in FIG. 2 , where the host includes:
  • the program running environment 1 is an environment in which the host works in a non-secure mode
  • the first isolation environment 2 is an environment in which the host works in a secure mode.
  • the program operating environment 1 includes at least one virtualized instance working in a non-secure mode, wherein the first isolation environment 2 corresponds to the virtualized instance 11 in the program operating environment 1;
  • the first isolation environment 2 includes an operating system in a safe mode and resources allocated to the first isolation environment 2, the resources include a first isolation space and processor resources, and the first isolation space is used to run the operating system and the security processing program , and store the data to be processed, the security processing program corresponds to the program in the virtualized instance 11, and is used to process the data to be processed to realize the security processing function of the program in the virtualized instance 11.
  • the program running environment 1 is used to provide hardware resources and/or software resources required for running the virtualized instance, and the first isolation environment 1 is used to provide hardware resources and/or software resources required to run the security processing program.
  • a security handler is a program called by a program in the virtualized instance 11.
  • the function implemented by the security handler is a sub-function of the function implemented by the program in the virtualization instance 11
  • the function implemented by the security handler is one or more steps of the function implemented by the program in the virtualization instance 11 .
  • the operating system in the safe mode included in the first isolation environment 2 corresponds to the safe processing program.
  • the operating system is the operating system corresponding to the program class of the security handler.
  • the operating system can be used to process a class of programs, and the program class of the security processing program corresponds to the operating system, so that the operating system can run the security processing program.
  • the operating system can be used to process programs of the window (windows) category, that is to say, the program category of the security handler is windows.
  • the processor resource includes a time slice occupying the processor of the host, and/or an input/output (input/output, I/O) interface, and the like.
  • the time slice is a period of time, indicating that the processor of the host is used to run the operating system and the security processing program in the first isolation space and process the data to be processed during the period of time.
  • the first isolated space is the space protected by the host in safe mode.
  • the first isolation space is isolated from the program execution environment 1, so that other virtualization instances in the program execution environment 1 other than the virtualization instance 11 cannot communicate with the first isolation space.
  • the operating system included in the virtualization instance 11 is different from the operating system in the safe mode.
  • the operating system included in the virtualization instance 11 runs in the program running environment 1, while the operating system in the safe mode can only run in the It runs in the first isolation environment 2 corresponding to the virtualization instance 11 .
  • the host may include multiple first isolation environments 2 , and each first isolation environment in the multiple first isolation environments 2 corresponds to a virtualized instance in the program running environment 1 one-to-one.
  • the non-secure mode and the secure mode are two different modes in which the host works, that is to say, the host can work in the non-secure mode or in the secure mode.
  • the first isolation environment 2 corresponding to the virtualization instance 11 is isolated from the program running environment 1 .
  • the other virtualized instances except the virtualized instance 11 running in the program running environment 1 in the non-secure mode cannot communicate with the first isolation environment 2 corresponding to the virtualized instance 11 in the secure mode.
  • the first isolation environment 2 corresponding to the virtualized instance 11 includes a security processing program for running the data to be processed required by the security processing program and the operating system in the security mode
  • the virtualized instance 11 corresponding to the In the first isolation environment 2 a security processing program is run through the operating system, and the security processing program is used to process the data to be processed. In this way, in an isolated and protected environment, the security processing program is run and the data to be processed is processed, thereby improving the security of processing the data to be processed.
  • the host further includes: a second isolation environment 3, which is also an environment in which the host works in a safe mode; the second isolation environment 3 includes a first management module 4 and one or more
  • the first management module 4 is used to manage each of the second isolation environments 2 .
  • the first management module 4 may be used to create each of the first isolation environments 2 .
  • each first isolation environment 2 is a subset of the second isolation environment 3 .
  • the second isolation environment 3 further includes a second isolation space, which is also a space protected by the host in the safe mode, and the first isolation spaces included in each of the first isolation environments 2 are located in the second isolation spaces.
  • the storage space of the host is divided into two parts, one part is called the user storage space, and the other part is called the second isolation space.
  • the user storage space belongs to the program operating environment 1, and each virtualized instance located in the program operating environment 1 can access the user storage space, but cannot access the second isolated space protected by the host.
  • the program execution environment 1 further includes a second management module 12, and the second management module 12 is used to manage the program execution environment 1.
  • the second management module 12 can be used to manage each virtualized instance working in the program execution environment 1 .
  • the first management module 4 and the second management module 12 are located in different environments and work in different modes, that is, the first management module 4 is located in the second isolation environment 3 and works in the safe mode, the second The management module 12 is located in the program running environment 1 and works in a non-secure mode, so the first management module 4 and the second management module 12 cannot communicate directly, that is, information cannot be directly transmitted between the two.
  • the host further includes a security monitor 5, and the security level of the security monitor 5 in the host is higher than a specified level. Information is communicated between the first management module 4 and the second management module 12 through the security monitor 5 .
  • the process of communicating information using Security Monitor 5 can be:
  • the first management module 4 inputs the information that needs to be transmitted to the second management module 12 to the safety monitor 5, and the safety monitor 5 triggers the host to switch to the non-safe mode, and sends the information to the second management module. 12 Send the message.
  • the second management module 12 receives the information. or,
  • the second management module 12 inputs the information to be transmitted to the first management module 4 to the security monitor 5, and the security monitor 5 triggers the host to switch to the secure mode, and sends the information to the first management module 4Send the message.
  • the first management module 4 receives the information.
  • the security level of the security monitor 5 Since the security level of the security monitor 5 is relatively high, usually the security level of the security monitor 5 in the host may be the highest, thus ensuring the security of the information transmitted between the first management module 4 and the second management module 12. higher.
  • the following two methods may be used to create the first isolation environment 2 corresponding to the virtualization instance 11 in the second isolation environment 3 .
  • the two methods are:
  • the first isolated environment 2 corresponding to the virtualized instance 11 is created in the second isolated environment 2 .
  • the host first works in a non-secure mode, and the virtualized instance 11 located in the program running environment 1 sends a call request to the second management module 12 when the security handler needs to be called.
  • the second management module 12 is configured to receive the call request, generate task information, where the task information includes the identifier of the virtualization instance 11 , and input the task information to the security monitor 5 of the host.
  • the security monitor 5 is configured to receive the task information, trigger the host to switch to the security mode, and send the task information to the first management module 4 .
  • the first management module 4 is configured to receive the task information when the host switches to the safe mode, and create a first isolation environment 2 corresponding to the virtualization instance 11 according to the task information.
  • the invocation request may include a program identifier of the security handler and data to be processed, and the data to be processed is data required to run the security handler.
  • the security processing program is a program that implements the transfer function
  • the data to be processed includes the transferred amount, the account information of the transferred amount, and the account information of the transferred amount.
  • the second management module 12 is further configured to obtain the security processing program according to the program identifier of the security processing program after receiving the calling request, and save the first data in the shared memory, where the first data includes the security processing program and the data to be processed.
  • the task information input by the second management module 12 to the security monitor 5 also includes the shared memory address and the amount of resources.
  • the resource amount is the capacity of the first isolation space.
  • the task information may also include a data amount of the first data.
  • the first data is a data packet
  • the packet header of the data packet may include the data amount of the first data
  • the first management module 4 is further configured to acquire first data from the shared memory according to the task information, and create a first isolation environment 2 corresponding to the virtualized instance according to the first data.
  • the first management module 4 acquires the first data from the shared memory according to the shared memory address included in the task information. Wherein, when the first data includes the data amount of the first data, the first management module 4 obtains the data amount of the first data from the packet header of the first data in the shared memory according to the shared memory address, and according to the data amount Get the first data from shared memory. Alternatively, when the task information includes the data amount of the first data, the first management module 4 acquires the first data from the shared memory according to the shared memory address and the data amount.
  • the complete process includes the following (1-1) to (1-5) operations, which can be:
  • the second management module 12 receives the invocation request, where the invocation request includes the program identifier of the security processing program and the data to be processed.
  • the second management module 12 obtains the security processing program according to the program identifier of the security processing program, verifies the security processing program and the data to be processed to obtain the verification information, and uses the first corresponding to the virtualization instance 11.
  • the private key information encrypts the to-be-encrypted data to obtain the first data, and the to-be-encrypted data includes a security processing program, the to-be-processed data and the verification information.
  • the second management module 12 further acquires the operating system in the safe mode according to the program category of the security processing program called by the virtualization instance 11 , and the data to be encrypted also includes the operating system.
  • an implementation method for obtaining the operating system is listed, and the implementation method is:
  • a corresponding relationship between program categories and operating systems is stored in the program running environment 1, and each record in the corresponding relationship includes a program category and an operating system in a safe mode. Therefore, the second management module 12 obtains the operating system in the safe mode from the corresponding relationship between the program category and the operating system according to the program category of the security processing program called by the virtualization instance 11 .
  • the verification information may be a hash value obtained by performing a hash operation on the security processing program and the data to be processed.
  • the corresponding relationship between the identifier of the virtualized instance and the first private key information can be stored in the program operating environment 1, and each record in the corresponding relationship includes the identifier of a virtualized instance and the first corresponding to the virtualized instance. a private key information. Therefore, the operation for the second management module 12 to obtain the first private key information corresponding to the virtualized instance 11 may be:
  • the second management module 12 acquires the first private key information corresponding to the virtualization instance 11 from the correspondence between the identifier of the virtualization instance and the first private key information according to the identification of the virtualization instance 11 .
  • the second management module 12 allocates a shared memory in the user storage space included in the program running environment 1, the capacity of the shared memory is greater than the data amount of the first data, saves the first data in the shared memory, and generates Task information, the task information includes information such as the identifier of the virtualized instance 11 and the shared memory address, and the task information is input to the security monitor 5 of the host.
  • the security monitor 5 receives the task information, triggers the host to switch to the security mode, and sends the task information to the first management module 4 .
  • the first management module 4 when the host is switched to the safe mode, the first management module 4 receives the task information, and obtains, according to the task information, the operating system in the safe mode, the security processing program called by the virtualization instance 11, and the waiting list. Process data, allocate resources, the resources include first isolation space and processor resources, save the operating system, security processing program and data to be processed in the first isolation space, and obtain the first isolation environment 2 corresponding to the virtualization instance 11 .
  • the first management module 4 obtains the first public key information corresponding to the virtualization instance 11 according to the task information including the identifier of the virtualization instance 11; and obtains the first data from the shared memory according to the shared memory address included in the task information , use the first public key information corresponding to the virtualization instance 11 to decrypt the first data to obtain the security processing program, the data to be processed and the verification information; use the verification information to verify the security processing program and the data to be processed. If the verification is passed, the security processing program and the data to be processed called by the virtualized instance 11 are obtained. If the verification fails, the operation is terminated, or the second management module 12 is notified through the security monitor 5, so that the second management module 12 stores the first data in the shared memory again.
  • the verification process of the first management module 4 may be:
  • the first management module 4 calculates a hash value according to the decrypted security processing program and the data to be processed. If the calculated hash value is the same as the verification information, the verification is passed, and if the calculated hash value is different from the verification information , the verification fails.
  • the first private key information corresponding to the virtualization instance 11 and the first public key information corresponding to the virtualization instance 11 are a pair of public and private keys.
  • the operation of the first management module 4 to obtain the first public key information may be:
  • the correspondence between the identifier of the virtualization instance and the first public key information can be stored in the second isolation environment 3, and each record in the correspondence includes the identifier of a virtualization instance and the first public key corresponding to the virtualization instance. information.
  • the first management module 4 acquires the first public key information corresponding to the virtualization instance 11 from the correspondence between the identifier of the virtualization instance and the first public key information according to the identification of the virtualization instance 11 .
  • the first management module 4 can obtain the operating system in the following two ways, and the two ways are:
  • the first data includes the operating system, so the first management module 4 decrypts the first data to obtain the operating system.
  • Manner 2 The second isolation environment 3 saves the correspondence between the program category and the operating system, and each record in the correspondence includes a program category and the operating system in the safe mode. Therefore, the first management module 4 obtains the corresponding operating system from the corresponding relationship between the program type and the operating system according to the program type of the security processing program called by the virtualized instance.
  • At least one first isolation environment 2 is created in the second isolation environment 3 in advance.
  • the virtualized instance 11 when the virtualized instance 11 invokes the security processing program, the virtualized instance 11 can be allocated the first isolation environment 2 in the second isolation environment 2.
  • the first isolation environment includes an operating system in safe mode and resources allocated to the first isolation environment, the The resource includes a first isolation space for storing the operating system.
  • the number of the first isolation environments 2 including the operating system may be one or more, and in the case of multiple first isolation environments 2, each of the multiple first isolation environments 2
  • the first isolation spaces included in an isolation environment 2 have different capacities.
  • three first isolation environments 2 including the operating system may be created in advance, and the capacities of the first isolation spaces included in the three first isolation environments 2 are 10G, 8G, and 6G, respectively.
  • the second isolation environment 3 includes operating systems corresponding to different program categories, and for each operating system, one or more first isolation environments 2 including the operating system can be established.
  • the second isolation environment 2 is allocated to the virtualized instance 11 in the environment 3, and the allocation process includes the operations (2-1) to (2-5), which may be:
  • the virtualized instance 11 when the virtualized instance 11 needs to invoke the security processing program, it sends an invocation request to the second management module 12, where the invocation request includes the program identifier of the security processing program and the data to be processed.
  • the second management module 12 receives the call request, creates a shared memory in the program execution space included in the program execution environment 1, and saves first data in the shared memory, where the first data includes a security processing program and data to be processed , generate task information, the task information includes the identifier of the virtualized instance, the shared memory address and the capacity of the first isolation space, and input the task information to the security monitor 5 of the host.
  • the operation of the second management module 12 to obtain the first data may be:
  • the second management module 12 can verify the security processing program and the data to be processed to obtain the verification information, obtain the first private key information corresponding to the virtualization instance 11, and use the first private key information to encrypt the data to be encrypted to obtain the first private key information.
  • a data, the data to be encrypted includes the program identifier of the security processing program, the data to be processed and the verification information.
  • the security monitor 5 receives the task information, triggers the host to switch to the security mode, and sends the task information to the first management module 4 .
  • the first management module 4 when the host switches to the security mode, the first management module 4 reads the task information from the security monitor 5, and obtains the security processing from the shared memory according to the shared memory address included in the task information programs and data to be processed.
  • the first management module 12 acquires the first public key information corresponding to the virtualization instance 11 according to the identifier of the virtualization instance 11, and uses the first public key information. Decrypt the first data to obtain the security processing program, the data to be processed and the verification information, and verify the data to be processed and the security processing program according to the verification information. If the verification passes, perform the following operations (2-5). .
  • the first management module 4 allocates the first isolation environment 2 created in advance according to the capacity of the first isolation space included in the task information and the program category of the security processing program, and assigns the security processing program and the to-be-processed program to the first isolation environment 2 created in advance. Data is stored in the first isolation space included in the first isolation environment 2 , and processor resources are allocated to the first isolation environment 2 .
  • the allocated capacity of the first isolation space included in the first isolation environment 2 is greater than or equal to the capacity of the first isolation space included in the task information.
  • the first isolation environment 2 includes a first isolation space and processor resources, and the first isolation space saves the operating system in the safe mode, the safe processing program and the data to be processed .
  • the first management module 4 can establish the first isolation environment 2 corresponding to different virtualization instances, so as to realize the establishment of different first isolation environments for different virtualization instances, and realize fine-grained updating. management.
  • the first management module 4 is further configured to run the operating system in the first isolation environment 2 corresponding to the virtualization instance 11 , and run the security processing program through the operating system to process the data to be processed.
  • the first management module 4 may process the data to be processed through the following operations (3-1) to (3-3).
  • the operations of (3-1) to (3-3) are:
  • the first management module 4 runs the operating system in the first isolation space 2 corresponding to the virtualization instance 11 .
  • the operating system is started, and after the operating system is started, the processor of the host may start to run the operating system.
  • the first management module 4 starts the process for running the security processing program through the operating system.
  • the operating system may create a process for running the security handler.
  • the processor of the host can call the process and run the process, and when running the process, process the data to be processed to obtain the processing result.
  • the first management module 4 is further configured to adjust the amount of resources included in the first isolation environment 2 corresponding to the virtualization instance 11 .
  • the amount of resources may include the capacity of the first isolation space. That is, in the process of processing the data to be processed, the first management module 4 increases or decreases the capacity of the first isolation capacity as required.
  • the first management module 4 is further configured to release the first isolation environment 2 corresponding to the virtualization instance 11 .
  • the first management module 4 is further configured to transmit the processing result to the program running environment 2, and trigger the switching of the working mode of the host to the non-secure mode.
  • the second management module 12 is further configured to acquire the processing result, and input the processing result to the virtualization instance 11 .
  • the complete process includes the following operations (4-1)-(4-3), which may be:
  • the first management module 4 obtains the second private key information corresponding to the virtualization instance 11, encrypts the processing result using the second private key information, and saves the encrypted processing result in the shared memory, And input task completion information to the security monitor 5, where the task completion information includes the identifier of the virtualized instance 11, the shared memory address and the task completion indication.
  • the operation of obtaining the second private key information by the first management module 4 may be:
  • the correspondence between the identifier of the virtualized instance and the information of the second private key can be stored in the second isolation environment 3, and each record in the correspondence includes the identifier of a virtualized instance and the second private key corresponding to the virtualized instance. information.
  • the first management module 4 acquires the second private key information corresponding to the virtualization instance 11 from the correspondence between the identifier of the virtualization instance and the second private key information according to the identification of the virtualization instance 11 .
  • the security monitor 5 receives the task completion information, triggers the host to switch the working mode to the non-secure mode, and sends the task completion information to the second management module 12 .
  • the second management module 12 when the host is switched to the non-secure mode, the second management module 12 receives the task completion information, and the task completion information includes the identifier of the virtualized instance 11, the shared memory address and the task completion instruction, in Triggered by the task completion instruction, the second public key information corresponding to the virtualization instance 11 is obtained according to the identifier of the virtualization instance, the encrypted processing result is obtained according to the shared memory address, and the second public key information is used to decrypt the The encrypted processing result is decrypted, the processing result is obtained, and the processing result is input to the virtualization instance 11 .
  • the second private key information corresponding to the virtualization instance 11 and the second public key information corresponding to the virtualization instance 11 are a pair of public and private keys.
  • the operation of obtaining the second public key information by the second management module 12 may be:
  • the corresponding relationship between the identifier of the virtualization instance and the second public key information can be stored in the program running environment 1, and each record in the corresponding relationship includes the identifier of a virtualized instance and the second public key information corresponding to the virtualized instance.
  • the second management module 12 acquires the second public key information corresponding to the virtualization instance 11 from the correspondence between the identifier of the virtualization instance and the second public key information according to the identifier of the virtualization instance.
  • the virtualization instance 11 in the process of using the security processing program to process the data to be processed, the virtualization instance 11 may be migrated from the host to another host.
  • the first isolation environment 2 corresponding to the virtualization instance 11 also needs to be migrated to other hosts.
  • the first management module 4 is also used to obtain second data, and input the second data to the second management module 12, the second data includes state information and data saved in the first isolation space 2, and the state information is used to describe the operating system 's running state and the running state of this security handler.
  • the second management module 12 is further configured to send second data to other hosts. In this way, other hosts receive the second data, and restore the first isolation environment 2 corresponding to the virtualization instance 11 based on the second data.
  • the status information includes the current running status of the operating system and the current running status of the security processing program.
  • the data stored in the first isolation space includes the operating system, the security processing program, the intermediate result of processing the data to be processed by the security processing program, and the like.
  • the first management module 4 After acquiring the second data, the first management module 4 stores the second data in the shared memory, and inputs migration information to the security monitor 5, where the migration information includes the identifier of the virtualized instance 11, the shared memory address and the migration instruction.
  • the security monitor 5 receives the migration information, triggers the host to switch the working mode to the non-secure mode, and sends the migration information to the second management module 12 .
  • the second management module 12 receives the migration information, and under the trigger of the migration instruction, acquires the second data according to the shared memory address.
  • the other hosts are the same as the hosts provided in the embodiments of the present application, and also include a program running environment and a second isolation environment.
  • the second management module located in the program execution environment receives the second data, allocates a shared memory in the user storage space of the program execution environment, saves the second data in the shared memory, and inputs recovery to the security monitor of the other host information, the recovery information includes the shared memory address and a recovery indication.
  • the security monitor receives the recovery information, triggers the other host to switch the working mode to the security mode, and sends the recovery information to the first management module in the second isolation environment.
  • the first management module located in the second isolation environment receives the recovery information, and under the trigger of the recovery instruction, reads the second data from the shared memory according to the shared memory address , and restore the first isolation environment corresponding to the virtualization instance 11 according to the second data.
  • the first management module 4 is a hypervisor
  • the second management module 12 is also a hypervisor.
  • the host since the host includes a program running environment and a first isolation environment, for a virtualized instance that is included in the program running environment and works in a non-secure mode, the first isolation environment corresponding to the virtualized instance is included in a secure mode
  • the resources include the first isolation space and processor resources
  • the first isolation space is used to run the operating system and the security processing program, and process the data to be processed
  • the security processing program is called by the virtualized instance.
  • the data to be processed is the data required to run the security processing program
  • the first isolation space is the space protected by the host in the security mode.
  • the present application provides a method for processing data, the method can be applied to the host shown in Fig. 2, and the method includes:
  • Step 301 when the host works in a non-secure mode, a call request sent by the virtualization instance 11 is received, where the call request includes the program identifier of the security handler invoked by the virtualization instance 11 and the data to be processed.
  • the host includes a program execution environment and a second isolation environment, the program execution environment includes at least one virtualization instance, and the virtualization instance 11 is any one of the at least one virtualization instance.
  • the second management module receives the call request sent by the virtualization instance 11 .
  • Step 302 Save the first data in the shared memory, and input task information to the security monitor of the host, where the task information includes the identifier of the virtualization instance 11 to trigger switching the working mode of the host to the security mode.
  • the second management module saves the first data in the shared memory, and inputs task information to the security monitor of the host.
  • the security processing program is obtained according to the program identifier of the security processing program
  • the verification information is obtained by verifying the security processing program and the data to be processed
  • the first private key information corresponding to the virtualization instance 11 is used to perform the encryption process on the data to be encrypted.
  • Encryption to obtain the first data includes the security processing program, the data to be processed and the verification information; according to the data amount of the first data, a shared memory is allocated in the user storage space included in the program running environment, and the capacity of the shared memory is greater than The data amount of the first data, save the first data in the shared memory, generate task information, the task information includes the identifier of the virtualized instance 11 and the shared memory address, and input the task information to the security monitor of the host.
  • the task information further includes information such as the capacity of the first isolation space.
  • the data to be encrypted further includes the operating system in the safe mode. That is to say, before encrypting the data to be encrypted, the operating system in the safe mode is also obtained according to the program category of the security processing program.
  • the operation to obtain the operating system can be:
  • a corresponding relationship between program categories and operating systems is stored in the program running environment of the host, and each record in the corresponding relationship includes a program category and the operating system of the program category in the safe mode. Therefore, according to the program category of the security processing program, the operating system in the safe mode is obtained from the corresponding relationship between the program category and the operating system.
  • the verification information may be a hash value obtained by performing a hash operation on the security processing program and the data to be processed.
  • the corresponding relationship between the identifier of the virtualized instance 11 and the first private key information can be saved in the program running environment, and each record in the corresponding relationship includes the identifier of a virtualized instance and the first corresponding to the virtualized instance. a private key information. Therefore, the operation of obtaining the first private key information corresponding to the virtualization instance 11 can be as follows:
  • the first private key information corresponding to the virtualization instance 11 is obtained from the correspondence between the identifier of the virtualization instance and the first private key information.
  • the security monitor of the host receives the task information, triggers the host to switch to the security mode, and the security monitor sends the task information.
  • Step 303 When the host switches to the security mode, receive the task information sent by the security monitor, and create or assign a first isolation environment corresponding to the virtualization instance 11 according to the task information.
  • the first management module receives the task information, obtains first data from the shared memory according to the task information, and creates or allocates a first isolation environment corresponding to the virtualization instance 11 according to the first data.
  • step 303 may be:
  • the task information is received, and according to the task information including the identifier of the virtualization instance 11, the first public key information corresponding to the virtualization instance 11 is obtained; according to the shared memory address included in the task information, Obtain the first data from the shared memory, use the first public key information corresponding to the virtualization instance 11 to decrypt the first data to obtain the security processing program, the data to be processed, and the verification information; The processing data is verified, and if the verification passes, the security processing program called by the virtualized instance 11 and the data to be processed are obtained; the operating system corresponding to the program category of the security processing program in the security mode is acquired; the first isolation is allocated space and processor resources.
  • the first isolation space includes security processing programs, data to be processed, and the operating system, thereby creating a first isolation environment corresponding to the virtualization instance 11 .
  • the verification process can be as follows:
  • the first private key information corresponding to the virtualization instance 11 and the first public key information corresponding to the virtualization instance 11 are a pair of public and private keys.
  • the operation of obtaining the first public key information may be:
  • the correspondence between the identifier of the virtualization instance and the first public key information can be stored in the second isolation environment, and each record in the correspondence includes the identifier of a virtualization instance and the first public key information corresponding to the virtualization instance . Therefore, according to the identifier of the virtualization instance 11, the first public key information corresponding to the virtualization instance 11 can be obtained from the correspondence between the identifier of the virtualization instance and the first public key information.
  • the operating system can be obtained in the following two ways:
  • the first data includes the operating system, so the operating system is obtained by decrypting the first data.
  • the correspondence between the program category and the operating system is stored in the second isolation environment, and each record in the correspondence includes a program category and the operating system of the program category in the safe mode. Therefore, according to the program category of the security processing program, the corresponding operating system is obtained from the corresponding relationship between the program category and the operating system.
  • step 303 may be:
  • the task information is received, and according to the shared memory address included in the task information, first data is obtained from the shared memory, and the first data includes the security processing program, the data to be processed, and the first isolation space.
  • Capacity according to the capacity of the first isolation space included in the task information and the program category of the security processing program, allocate the first isolation environment created in advance, and save the security processing program and the data to be processed in the first isolation environment. in the first isolation space, and allocating processor resources for the first isolation environment.
  • the first public key information corresponding to the virtualization instance 11 After obtaining the first data from the shared memory, according to the identifier of the virtualization instance 11, obtain the first public key information corresponding to the virtualization instance 11, and use the first public key information to perform an analysis on the first data. Decrypt to obtain the security processing program, the data to be processed and the verification information, verify the data to be processed and the security processing program according to the verification information, and the verification passes, and save the data to be processed and the security processing program to the virtualized instance 11 corresponds to the first isolation space included in the first isolation environment.
  • Step 304 Run the operating system in the first isolation environment corresponding to the virtualization instance 11, and run the security processing program through the operating system to process the data to be processed.
  • the data to be processed can be processed through the following operations 3041-3043.
  • the operations of the 3041-3043 are:
  • the operating system is started, and after the operating system is started, the processor of the host can start to run the operating system.
  • the processor of the host can call the process and run the process, and when running the process, process the data to be processed and obtain the processing result.
  • the amount of resources included in the first isolation environment corresponding to the virtualization instance 11 may be adjusted.
  • the amount of resources may include the capacity of the first isolation space. That is, in the process of processing the data to be processed, the capacity of the first isolation capacity is increased or decreased as required.
  • the first isolation environment corresponding to the virtualization instance 11 may also be released.
  • Step 305 After the data to be processed is processed and the processing result is obtained, the processing result is transmitted to the program running environment, and the working mode of the host is triggered to be switched to the non-secure mode.
  • step 305 the second private key information corresponding to the virtualization instance 11 is obtained, the processing result is encrypted by using the second private key information, the encrypted processing result is saved in the shared memory, and input to the security monitor Task completion information, where the task completion information includes the identifier of the virtualized instance 11, the shared memory address and the task completion indication.
  • the operation of obtaining the second private key information may be:
  • the correspondence between the identifier of the virtualized instance and the information of the second private key can be stored, and each record in the correspondence includes the identifier of a virtualized instance and the information of the second private key corresponding to the virtualized instance. .
  • the second private key information corresponding to the virtualization instance 11 is obtained from the correspondence between the identification of the virtualization instance and the second private key information.
  • the safety monitor receives the task completion information, triggers the host to switch the working mode to the non-safety mode, and sends the task completion information.
  • Step 306 When the host switches to the non-secure mode, the task completion information is received, the processing result is acquired according to the task completion information, and the processing result is input to the virtualization instance 11 .
  • the second management module receives the task completion information, obtains the processing result from the shared memory according to the task completion information, and inputs the processing result into the virtualization instance 11 .
  • step 306 when the host switches to the non-secure mode, the task completion information is received, and the task completion information includes the identifier of the virtualized instance 11, the shared memory address and the task completion indication, under the trigger of the task completion indication , obtain the second public key information corresponding to the virtualization instance 11 according to the identifier of the virtualization instance 11, obtain the encrypted processing result according to the shared memory address, use the second public key information to decrypt the encrypted processing result, according to the The identification of the virtualization instance 11 inputs the processing result to the virtualization instance 11 .
  • the second private key information corresponding to the virtualization instance 11 and the second public key information corresponding to the virtualization instance are a pair of public and private keys.
  • the corresponding relationship between the identifier of the virtualization instance and the second public key information can be stored in the program running environment 1, and each record in the corresponding relationship includes the identifier of a virtualized instance and the second public key information corresponding to the virtualized instance. . Therefore, according to the identifier of the virtualization instance 11, the second public key information corresponding to the virtualization instance 11 can be obtained from the corresponding relationship between the identifier of the virtualization instance and the second public key information.
  • the virtualized instance 11 in the first isolation environment corresponding to the virtualized instance 11, in the process of using the security processing program to process the data to be processed, the virtualized instance 11 may be migrated from the host to another host.
  • the first isolation environment corresponding to the virtualization instance 11 also needs to be migrated to other hosts. This can be achieved through the operations of steps 307 to 308 as follows.
  • Step 307 Acquire second data, where the second data includes state information and data stored in the first isolation space, where the state information is used to describe the running state of the operating system and the running state of the security processing program.
  • the first management module obtains the second data, stores the second data in the shared memory, and inputs migration information to the security monitor, where the migration information includes the identifier of the virtualized instance 11, the shared memory address and the migration instruction.
  • the security monitor receives the migration information, triggers to switch the working mode of the host to the non-secure mode, and sends the migration information to the second management module.
  • the second management module receives the migration information, and under the trigger of the migration instruction, acquires the second data according to the shared memory address.
  • Step 308 Send the second data to other hosts, so that the other hosts can restore the first isolation environment corresponding to the virtualization instance 11 based on the second data.
  • the second management module sends second data to other hosts.
  • the other host receives the second data, and restores the first isolation environment corresponding to the virtualization instance 11 based on the second data.
  • the operations for restoring the first isolation environment by other hosts may be:
  • Other hosts include a program execution environment and a second isolation environment.
  • the second management module in the program running environment of the other host receives the second data, allocates a shared memory in the user storage space of the program running environment, saves the second data in the shared memory, and inputs the second data to the security monitor of the other host Recovery information, the recovery information includes the shared memory address and a recovery indication.
  • the security monitor receives the recovery information, triggers the other host to switch the working mode to the security mode, and sends the recovery information to the first management module in the second isolation environment.
  • the first management module in the second isolation environment of the other host receives the recovery information, and under the trigger of the recovery instruction, reads the second management module from the shared memory according to the shared memory address. data, and restore the first isolation environment corresponding to the virtualization instance 11 according to the second data.
  • the task information is received and the first isolation environment corresponding to the virtualization instance 11 is created, so that the host includes the program running environment and the first isolation environment, and the program running environment includes The virtualized instance 11 working in the non-safe mode, the first isolation environment corresponding to the virtualized instance 11 includes the operating system in the safe mode and the resources allocated to the first isolation environment, and the resources include the first isolation space and processor resources, the first isolation space is used to run the operating system and the security processing program, and process the data to be processed, so that the data to be processed is processed in the first isolation environment, thereby improving the security of processing the data to be processed.
  • an embodiment of the present application provides an apparatus 500 for processing data.
  • the apparatus 500 may be deployed on the host provided by the embodiment shown in FIG. 1 , FIG. 2 or FIG. 3 , including:
  • the receiving unit 501 is configured to receive task information when the host switches to the safe mode, where the task information includes an identifier of a virtualized instance, and the virtualized instance is a virtualized instance in a program running environment where the host works in environment in non-secure mode;
  • a processing unit 502 configured to create or allocate a first isolation environment corresponding to the virtualized instance according to the task information, the first isolation environment is an environment in which the host works in a safe mode, and the first isolation environment includes an operating system in the safe mode and resources allocated to the first isolation environment, the resources include a first isolation space and processor resources, the first isolation space is used for running the operating system and the security processing program, storing data to be processed, the security processing program and the virtualization
  • the program in the instance corresponds to the data to be processed, so as to realize the security processing function of the program in the virtualized instance, and the first isolation space is isolated from the program running environment.
  • step 303 for the detailed process of creating or allocating the first isolation environment by the processing unit 502, refer to the related content in step 303 in the embodiment shown in FIG. 3, which will not be described in detail here.
  • the receiving unit 501 is configured to receive the task information sent by the security monitor, where the task information is information obtained by the security monitor in a non-secure mode.
  • step 301 for the detailed process of receiving the task information by the receiving unit 501, refer to the relevant content in step 301 in the embodiment shown in FIG. 3, and will not be described in detail here.
  • the task information further includes a shared memory address
  • the processing unit 502 is further configured to:
  • the first data is acquired according to the shared memory address, the first data includes the safe running program and the data to be processed, and the shared memory is the memory shared by the program running environment and the first isolation environment.
  • step 303 for the detailed process of acquiring the first data by the processing unit 502, please refer to the related content in step 303 in the embodiment shown in FIG. 3, which will not be described in detail here.
  • the host further includes a second isolation environment, and the second isolation environment includes the first isolation environment.
  • processing unit 502 is further configured to:
  • the amount of resources included in the first isolation environment corresponding to the virtualized instance running in the program running environment is adjusted, or the first isolation environment corresponding to the virtualized instance running in the program running environment is released.
  • processing unit 502 is further configured to:
  • the operating system in the security mode is run in the first isolation space, and the data to be processed is processed by running the security processing program in the operating system to obtain a processing result.
  • step 304 in the embodiment shown in FIG. 3 , which is not described in detail here.
  • the processing unit 502 is further configured to transmit the processing result to the program running environment, and trigger to switch the working mode of the host to the non-secure mode.
  • step 305 for the detailed process of transmitting the processing result by the processing unit 502, please refer to the related content in step 305 in the embodiment shown in FIG. 3, which will not be described in detail here.
  • the processing unit 502 is further configured to acquire second data, where the second data includes state information and data saved in the first isolation space, where the state information is used to describe the running state of the operating system in the first isolation environment and the The running state of the security processing program, and the second data is used to restore the first isolation environment corresponding to the virtualized instance on other hosts.
  • step 307 for the detailed process of acquiring the second data by the processing unit 502, please refer to the relevant content in step 307 in the embodiment shown in FIG. 3, which will not be described in detail here.
  • the apparatus 500 further includes:
  • the sending unit 503 is configured to send the second data to other hosts, so as to restore the first isolation environment corresponding to the virtualization instance on the other hosts.
  • the number of first isolation environments included in the host is multiple, and each first isolation environment in the multiple first isolation environments corresponds to a virtualized instance in the program running environment one-to-one.
  • the processing unit since the receiving unit receives task information when the host switches to the safe mode, the processing unit creates the first isolation environment corresponding to the virtualized instance, so that the host includes the program running environment and the first isolation environment, and for the program
  • the running environment includes a virtualized instance working in a non-secure mode
  • the first isolation environment corresponding to the virtualized instance includes an operating system in a secure mode and resources allocated to the first isolation environment, the resources including the first isolation environment Space and processor resources, the first isolation space is used to run the operating system and the security processing program, and process the data to be processed, so that the processing unit processes the data to be processed in the first isolation environment, thereby improving the processing efficiency of the data to be processed. safety.
  • an embodiment of the present application provides a schematic diagram of an apparatus 600 for data processing.
  • the apparatus 600 may be the host in any of the above embodiments.
  • the apparatus 600 includes at least one processor 601 , internal connections 602 , memory 603 and at least one transceiver 604 .
  • the apparatus 600 is an apparatus with a hardware structure, and can be used to implement the functional modules in the apparatus 500 described in FIG. 5 .
  • the processing unit 502 in the apparatus 500 shown in FIG. 5 can be implemented by calling the code in the memory 603 by the at least one processor 601, and the receiving unit 501 and the receiving unit 501 in the apparatus 500 shown in FIG.
  • the sending unit 502 can be implemented by the transceiver 604 .
  • the apparatus 600 may also be used to implement the functions of the host, the first management module and/or the second management module in the host in any of the foregoing embodiments.
  • processor 601 may be a general-purpose central processing unit (central processing unit, CPU), network processor (network processor, NP), microprocessor, application-specific integrated circuit (application-specific integrated circuit, ASIC) , or one or more integrated circuits used to control the execution of the program of this application.
  • CPU central processing unit
  • NP network processor
  • ASIC application-specific integrated circuit
  • the internal connection 602 described above may include a path to transfer information between the above described components.
  • the internal connection 602 is a single board or a bus or the like.
  • the above transceiver 604 is used to communicate with other devices or communication networks.
  • the above-mentioned memory 603 can be a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, a random access memory (random access memory, RAM) or other types of storage devices that can store information and instructions.
  • types of dynamic storage devices which can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), or other optical disk storage, optical disks storage (including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by Any other medium accessed by the computer without limitation.
  • the memory can exist independently and be connected to the processor through a bus.
  • the memory can also be integrated with the processor.
  • the memory 603 is used for storing the application code for executing the solution of the present application, and the execution is controlled by the processor 601 .
  • the processor 601 is used to execute the application program code stored in the memory 603 and cooperate with at least one transceiver 604, so that the device 600 can realize the functions in the method of the present patent.
  • the processor 601 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 6 .
  • the apparatus 600 may include multiple processors, such as the processor 601 and the processor 607 in FIG. 6 .
  • processors can be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • General Engineering & Computer Science (AREA)
  • Finance (AREA)
  • Computer Hardware Design (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Storage Device Security (AREA)
  • Stored Programmes (AREA)

Abstract

一种处理数据的方法、主机及装置，属于IT领域。所述主机包括程序运行环境（1）和第一隔离环境（2），程序运行环境（1）是主机工作在非安全模式下的环境，第一隔离环境（2）是主机工作在安全模式下的环境；程序运行环境（1）包括工作在非安全模式下的至少一个虚拟化实例（11），第一隔离环境（2）与程序运行环境（1）中的虚拟化实例（11）相对应；第一隔离环境（2）包括在安全模式下的操作系统和分配给第一隔离环境（2）的资源，资源包括第一隔离空间和处理器资源，第一隔离空间用于运行操作系统和安全处理程序，存储待处理数据，安全处理程序与虚拟化实例（11）中的程序对应，用于处理待处理数据，第一隔离空间与程序运行环境（1）隔离，能够提高处理数据的安全性。

Description

处理数据的方法、主机及装置
本申请要求于2020年6月28日提交的申请号为202010598730.1、发明名称为“一种安全硬件平台系统”的中国专利申请的优先权，以及于2020年9月29日提交中国专利局、申请号为202011051770.0、申请名称为“处理数据的方法、主机及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及互联网技术(internet technology，IT)领域，特别涉及一种处理数据的方法、主机及装置。
背景技术
虚拟机是指通过软件模块模拟的具有完整硬件系统功能且运行在一个环境中的完整计算机系统。也就说，虚拟机可以被看作为一个完整的计算机系统，可用来运行程序，通过运行该程序来处理待处理数据。
目前，对于某些程序和待处理数据，需要在一个安全性较高的运行环境中运行。然而，目前使用虚拟机来运行程序以及处理待数据，而虚拟机无法提供安全性较高的运行环境，可能降低数据处理的安全性。
例如，假设程序为转账程序，待处理数据包括需要转账的双方账号和转账额度等数据。虚拟机可以运行该转账程序，并根据待处理数据完成转账。在虚拟机中运行该转账程序来处理待处理数据，很容易发生信息泄漏，安全风险高。
发明内容
本申请提供了一种处理数据的方法、主机及装置，提高处理数据的安全性。所述技术方案如下：
第一方面，本申请提供了一种数据处理的主机，包括程序运行环境和第一隔离环境，程序运行环境是主机工作在非安全模式下的环境，第一隔离环境是主机工作在安全模式下的环境。程序运行环境包括工作在非安全模式下的至少一个虚拟化实例，其中，第一隔离环境与程序运行环境中的虚拟化实例相对应。第一隔离环境包括在安全模式下的操作系统和分配给第一隔离环境的资源，该资源包括第一隔离空间和处理器资源，第一隔离空间用于运行该操作系统和安全处理程序，以及存储待处理数据，安全处理程序与该虚拟化实例中的程序对应，用于处理待处理数据，以实现该虚拟化实例中的程序的安全处理功能，第一隔离空间与程序运行环境隔离。
其中，由于主机包括程序运行环境和第一隔离环境，对于程序运行环境包括的虚拟化实例，该虚拟化实例对应的第一隔离环境包括在安全模式下的操作系统和资源，该资源包括第一隔离空间和处理器资源，第一隔离空间用于运行该操作系统和安全处理程序，以及处理待处理数据，安全处理程序是该虚拟化实例调用的程序，待处理数据是运行安全处理程序所需 要的数据，第一隔离空间是在安全模式下被该主机保护的空间。这样第一隔离环境是一个安全性较高的环境，在该第一隔离环境中，运行安全处理程序，使用安全处理程序处理待处理数据，提高了处理数据的安全性。
在一种可能的实现方式中，程序运行环境用于提供运行虚拟化实例所需要的硬件资源和/或软件资源，第一隔离环境用于提供运行该安全处理程序所需要的硬件资源和/或软件资源。
在另一种可能的实现方式中，该主机还包括：第二隔离环境，第二隔离环境包括第一管理模块和第一隔离环境，第一管理模块用于管理第一隔离环境。这样可以将隔离环境分成第一隔离环境和第二隔离环境两层，在第二隔离环境中可以创建不同虚拟化实例对应的第一隔离环境，可以通过第一管理模块管理不同虚拟化实例对应的第一隔离环境，做到以虚拟化实例为粒度的管理，实现精细管理。
在另一种可能的实现方式中，第一隔离空间是仅供与该第一隔离空间对应的虚拟化实例通信的隔离运行环境，不能被其他的虚拟化实例访问。
在另一种可能的实现方式中，在主机切换到安全模式下，第一管理模块，用于接收任务信息，该任务信息包括该虚拟化实例的标识。第一管理模块，还用于根据该任务信息创建或分配虚拟化实例对应的第一隔离环境。这样可以通过任务信息触发第一管理模块创建或分配第一隔离环境。
在另一种可能的实现方式中，第一管理模块，用于接收安全监视器发送该任务信息，该任务信息是安全监视器在非安全模式下获取的信息。其中，安全监视器的安全等级较高，通过安全监视器将非安全模式下程序运行环境中的任务信息传递给安全模式下的第一管理模块，可以提高任务信息传递的安全性。
在另一种可能的实现方式中，该任务信息是程序运行环境中的第二管理模块在接收该虚拟化实例发送的调用请求时生成的，而安全监视器获取的该任务信息是第二管理模块输入的，这样可以通过安全监视器将任务信息安全地传递到第一管理模块。
在另一种可能的实现方式中，该任务信息还包括共享内存地址，第一管理模块，还用于根据该共享内存地址获取第一数据，第一数据包括安全运行程序和待处理数据，由于该共享内存为程序运行环境和第一隔离环境共享的内存，从而可以通过共享内存将非安全模式下程序运行环境中的第一数据传递到第一管理模块，以保证第一管理模块能够基于第一数据创建第一隔离环境。
在另一种可能的实现方式中，第一管理模块，还用于调整程序运行环境中运行的虚拟化实例对应的第一隔离环境包括的资源量，这样可以保证第一隔离环境包括的资源量满足运行程序处理程序处理待处理数据的需求。
在另一种可能的实现方式中，第一管理模块释放程序运行环境中运行的虚拟化实例对应的第一隔离环境，这样可以释放出空闲的资源，以供其他虚拟化实例使用。
在另一种可能的实现方式中，第一管理模块，用于在第一隔离空间中运行该安全模式下的操作系统，通过操作系统运行该安全处理程序处理待处理数据，得到处理结果。这样可以通过第一隔离环境中的操作系统来运行安全处理程序并处理待处理数据，从而确保可以使用该第一隔离环境来运行安全处理程序，从而能够实现虚拟化实例与第一隔离环境一一对应。
在另一种可能的实现方式中，第一管理模块，还用于向程序运行环境传递处理结果，以及触发将主机的工作模式切换到非安全模式。这样保证位于程序运行环境中的该虚拟化实例能够得到处理结果。
在另一种可能的实现方式中，第一管理模块向安全监视器输入任务完成信息，安全监视器接收该任务完成信息，触发主机将工作模式切换到非安全模式。
在另一种可能的实现方式中，第一管理模块，还用于获取第二数据，第二数据包括状态信息和第一隔离空间中保存的数据，该状态信息用于描述第一隔离环境中操作系统的运行状态和安全处理程序的运行状态，第二数据用于在其他主机上恢复该虚拟化实例对应的第一隔离环境。第一管理模块，还用于向程序运行环境中的第二管理模块发送第二数据。如此可以在将该虚拟化实例迁移到其他主机，能够在其他主机继续运行该虚拟化实例，继续在第一隔离环境中使该安全处理程序处理待处理数据，实现了第一隔离环境与主机的硬件解耦。
在另一种可能的实现方式中，第二管理模块，用于向其他主机发送第二数据，以在其他主机上恢复虚拟化实例对应的第一隔离环境。如此可以在将该虚拟化实例迁移到其他主机，能够在其他主机继续运行该虚拟化实例，继续在第一隔离环境中使该安全处理程序处理待处理数据，实现了第一隔离环境与主机的硬件解耦。
在另一种可能的实现方式中，主机包括的第一隔离环境的数目为多个，该多个第一隔离环境中的每个第一隔离环境与程序运行环境中的虚拟化实例一一对应。如此使得不同虚拟化实例对应不同第一隔离环境，做到以虚拟化实例为粒度的管理，实现精细管理。
在另一种可能的实现方式中，第一管理模块为虚拟化管理程序Hypervisor。
第二方面，本申请提供了一种处理数据的方法，在所述方法中：在主机切换到安全模式下，接收任务信息，该任务信息包括虚拟化实例的标识，该虚拟化实例是程序运行环境中的工作在非安全模式下的虚拟化实例，程序运行环境是主机工作在非安全模式下的环境。根据该任务信息创建或分配该虚拟化实例对应的第一隔离环境，第一隔离环境是主机工作在安全模式下的环境，第一隔离环境包括在该安全模式下的操作系统和分配给第一隔离环境的资源，该资源包括第一隔离空间和处理器资源，第一隔离空间用于运行该操作系统和安全处理 程序，存储待处理数据，该安全处理程序与该虚拟化实例中的程序对应，用于处理待处理数据，以实现虚拟化实例中的该程序的安全处理功能，第一隔离空间与该程序运行环境隔离。
其中，由于在主机切换到安全模式下，根据该任务信息创建或分配该虚拟化实例对应的第一隔离环境，又由于第一隔离环境包括在该安全模式下的操作系统和分配给第一隔离环境的资源，该资源包括第一隔离空间和处理器资源，第一隔离空间用于运行该操作系统和安全处理程序，存储待处理数据，第一隔离空间与该程序运行环境隔离，使得第一隔离环境是一个安全性较高的环境，这样在该虚拟化实例对应的第一隔离环境中，运行安全处理程序，使用安全处理程序处理待处理数据，提高了处理数据的安全性。
在一种可能的实现方式中，接收安全监视器发送任务信息，该任务信息是安全监视器在非安全模式下获取的信息。其中，安全监视器的安全等级较高，通过安全监视器将非安全模式下程序运行环境中的任务信息传递到安全模式下，可以提高任务信息传递的安全性。
在另一种可能的实现方式中，第一隔离空间是仅供与该第一隔离空间对应的虚拟化实例通信的隔离运行环境，不能被其他的虚拟化实例访问。
在另一种可能的实现方式中，该任务信息还包括共享内存地址，根据该共享内存地址获取第一数据，第一数据包括安全运行程序和待处理数据，该共享内存为程序运行环境和第一隔离环境共享的内存。由于该共享内存为程序运行环境和第一隔离环境共享的内存，从而可以通过共享内存将非安全模式下程序运行环境中的第一数据传递到安全模式下，以保证能够基于第一数据创建第一隔离环境。
在另一种可能的实现方式中，主机还包括第二隔离环境，第二隔离环境包括第一隔离环境。这样可以将隔离环境分成第一隔离环境和第二隔离环境两层，在第二隔离环境中可以创建不同虚拟化实例对应的第一隔离环境，可以管理不同虚拟化实例对应的第一隔离环境，做到以虚拟化实例为粒度的管理，实现精细管理。
在另一种可能的实现方式中，调整程序运行环境中运行的虚拟化实例对应的第一隔离环境包括的资源量，这样可以保证第一隔离环境包括的资源量满足运行程序处理程序处理待处理数据的需求。
在另一种可能的实现方式中，释放程序运行环境中运行的虚拟化实例对应的第一隔离环境，这样可以释放出空闲的资源，以供其他虚拟化实例使用。
在另一种可能的实现方式中，在第一隔离空间中运行该安全模式下的操作系统，通过该操作系统运行该安全处理程序处理待处理数据，得到处理结果。这样可以通过第一隔离环境中的操作系统来运行安全处理程序并处理待处理数据，从而确保可以使用该第一隔离环境来运行安全处理程序，从而能够实现虚拟化实例与第一隔离环境一一对应。
在另一种可能的实现方式中，向程序运行环境传递该处理结果，以及触发将主机的工作 模式切换到非安全模式。这样保证位于程序运行环境中的该虚拟化实例能够得到处理结果。
在另一种可能的实现方式中，获取第二数据，第二数据包括状态信息和第一隔离空间中保存的数据，该状态信息用于描述第一隔离环境中操作系统的运行状态和安全处理程序的运行状态，第二数据用于在其他主机上恢复该虚拟化实例对应的第一隔离环境。如此可以在将该虚拟化实例迁移到其他主机，能够在其他主机继续运行该虚拟化实例，继续在第一隔离环境中使该安全处理程序处理待处理数据，实现了第一隔离环境与主机的硬件解耦。
在另一种可能的实现方式中，向其他主机发送第二数据，以在其他主机上恢复该虚拟化实例对应的第一隔离环境。如此可以在将该虚拟化实例迁移到其他主机，能够在其他主机继续运行该虚拟化实例，继续在第一隔离环境中使该安全处理程序处理待处理数据，实现了第一隔离环境与主机的硬件解耦。
在另一种可能的实现方式中，主机包括的第一隔离环境的数目为多个，该多个第一隔离环境中的每个第一隔离环境与程序运行环境中的虚拟化实例一一对应。如此使得不同虚拟化实例对应不同第一隔离环境，做到以虚拟化实例为粒度的管理，实现精细管理。
第三方面，本申请提供了一种数据处理的装置，用于执行第二方面或第二方面的任意一种可能的实现方式中的方法。具体地，所述装置包括用于执行第二方面或第二方面的任意一种可能的实现方式中的方法的单元。
第四方面，本申请提供了一种数据处理的装置，所述装置包括收发器、处理器和存储器。其中，所述收发器、所述处理器以及所述存储器之间可以通过内部连接相连。所述存储器用于存储程序、指令或代码，所述处理器用于执行所述存储器中的程序、指令或代码以及配合收发器，使得所述装置完成第二方面或第二方面的任意可能的实现方式中的方法的指令。
第五方面，本申请提供了一种计算机程序产品，所述计算机程序产品包括在计算机可读存储介质中存储的计算机程序，并且所述计算程序通过处理器进行加载来实现上述第二方面或第二方面任意可能的实现方式的方法的指令。
第六方面，本申请提供了一种计算机可读存储介质，用于存储计算机程序，所述计算机程序通过处理器进行加载来执行第二方面或第二方面任意可能的实现方式的方法的指令。
附图说明
图1是本申请实施例提供的一种系统架构示意图；
图2是本申请实施例提供的一种主机的结构示意图；
图3是本申请实施例提供的一种处理数据的方法流程图；
图4是本申请实施例提供的一种信息在主机的各模块之间的传递示意图；
图5是本申请实施例提供的一种处理数据的装置结构示意图；
图6是本申请实施例提供的另一种处理数据的装置结构示意图。
具体实施方式
下面将结合附图对本申请实施方式作进一步地详细描述。
参见图1，本申请实施例提供了一种系统架构，该系统架构包括至少一个主机，对于该至少一个主机中的任意两个主机，该两个主机之间可以建立有网络连接。
该系统架构可以应用于云场景或数据中心等场景下。例如，该系统架构中的主机可以为云场景包括的服务器或数据中心包括的服务器。
对于该至少一个主机中的每个主机，该主机中可以包括至少一个虚拟化实例，该主机可以为该至少一个虚拟化实例提供运行环境，以让每个虚拟化实例可以在该环境中运行。
该至少一个虚拟化实例包括虚拟机和/或容器等。
对于每个虚拟化实例，该虚拟化实例包括操作系统和程序，该程序可以提供服务。在该虚拟化实例中可运行操作系统，通过该操作系统运行该程序，从而使得该虚拟化实例提供该服务。
对于该至少一个虚拟化实例中的每个虚拟化实例，该虚拟化实例在运行时可能会调用某些安全处理程序来处理数据，以实现该程序的安全处理功能。
其中，该安全处理程序需要在安全性较高的环境中运行，以确保对数据处理的安全性，从而实现安全处理功能。安全处理功能是该程序需要实现的功能的子功能。或者，安全处理程序实现的操作是该程序需要实现的功能包括的一个或多个步骤。
例如，该虚拟化实例中的程序用于实现用户登录。在用户登录的过程中，该虚拟化实例在运行的过程中可能需要校验用户输入的密码，此时该虚拟化实例调用用于实现密码校验的安全处理程序来对用户输入的密码进行校验。或者，该虚拟化实例中的程序是一种金融类程序，在该虚拟化实例运行的过程中可能需要进行转账，此时该虚拟化实例调用用于实现转账的安全处理程序来进行转账，该安全处理程序所需要处理的数据包括转账的金额、输入的账户信息和输出的账户信息等。
在上述两个例子中，为了保证对密码校验的安全性或对转账的安全性，需要在一个安全性较高的环境下运行安全处理程序，以及使用安全处理程序来处理数据。
为了满足该需求，本申请实施例提供了如图2所示的主机，该主机包括：
程序运行环境1和第一隔离环境2，程序运行环境1是主机工作在非安全模式下的环境，第一隔离环境2是主机工作在安全模式下的环境。
其中，程序运行环境1包括工作在非安全模式下至少一个虚拟化实例，其中，第一隔离环境2与程序运行环境1中的虚拟化实例11相对应；
第一隔离环境2包括在安全模式下的操作系统和分配给第一隔离环境2的资源，该资源包括第一隔离空间和处理器资源，第一隔离空间用于运行该操作系统和安全处理程序，以及存储待处理数据，安全处理程序与该虚拟化实例11中的程序对应，用于处理待处理数据，以实现该虚拟化实例11中的该程序的安全处理功能，第一隔离空间与程序运行环境1隔离。
其中，程序运行环境1用于提供运行虚拟化实例所需要的硬件资源和/或软件资源，第一隔离环境1用于提供运行该安全处理程序所需要的硬件资源和/或软件资源。
该安全处理程序与该虚拟化实例11中的程序之间存在关联关系。例如，安全处理程序 是该虚拟化实例11中的程序调用的程序。安全处理程序实现的功能是该虚拟化实例11中的程序实现的功能的子功能，或者，安全处理程序实现的功能是该虚拟化实例11中的程序实现功能的一个或多个步骤。
第一隔离环境2包括的在安全模式下的操作系统与该安全处理程序相对应。例如，该操作系统是与该安全处理程序的程序类别相对应的操作系统。其中，该操作系统可以用于处理一类程序，而安全处理程序的程序类别与该操作系统相对应，使得该操作系统可以运行该安全处理程序。例如，该操作系统可用于处理窗口(windows)类别的程序，也就是说该安全处理程序的程序类别为windows。
该处理器资源包括占用该主机的处理器的时间片，和/或，输入/输出(input/output，I/O)接口等。时间片是一段时间，表示在该段时间内该主机的处理器用于运行第一隔离空间中的该操作系统和安全处理程序，以及处理待处理数据。
第一隔离空间是在安全模式下被该主机保护的空间。第一隔离空间与程序运行环境1隔离，使得程序运行环境1中除该虚拟化实例11之外的其他虚拟化实例无法与第一隔离空间通信。
该虚拟化实例11包括的操作系统和在安全模式下的该操作系统不同，该虚拟化实例11包括的操作系统在程序运行环境1中运行，而在安全模式下的该操作系统只能在该虚拟化实例11对应的第一隔离环境2中运行。
可选的，该主机可以包括多个第一隔离环境2，该多个第一隔离环境2中的每个第一隔离环境与程序运行环境1中的虚拟化实例一一对应。
其中，非安全模式和安全模式是主机工作的两种不同模式，也就是说主机可以工作在非安全模式或者工作在安全模式。
在安全模式下，该虚拟化实例11对应的第一隔离环境2与程序运行环境1是隔离的。在非安全模式下的程序运行环境1中运行的除该虚拟化实例11之外的其他各虚拟化实例是无法与安全模式下的该虚拟化实例11对应的第一隔离环境2通信。由于该虚拟化实例11对应的第一隔离环境2包括安全处理程序，用于运行该安全处理程序所需要的待处理数据以及在安全模式下的操作系统，这样可以在该虚拟化实例11对应的第一隔离环境2中，通过该操作系统运行安全处理程序，并使用安全处理程序处理待处理数据。这样实现在一个隔离且受保护的环境下，运行安全处理程序和处理待处理数据，从而提高对处理待处理数据的安全性。
可选的，参见图2，该主机还包括：第二隔离环境3，第二隔离环境3也是主机工作在安全模式下的环境；第二隔离环境3包括第一管理模块4和一个或多个第一隔离环境2，第一管理模块4用于管理每个第二隔离环境2。例如，第一管理模块4可用于创建每个第一隔离环境2。
其中，每个第一隔离环境2均是第二隔离环境3的子集。第二隔离环境3还包括第二隔离空间，第二隔离空间也是在安全模式下被该主机保护的空间，每个第一隔离环境2包括的第一隔离空间均位于第二隔离空间中。
其中，主机的存储空间被分为两部分，一部分称为称用户存储空间，另一部分称为第二隔离空间。用户存储空间属于程序运行环境1，位于程序运行环境1中的各虚拟化实例可以访问用户存储空间，但无法访问被主机保护的第二隔离空间。
可选的，参见图2，程序运行环境1还包括第二管理模块12，第二管理模块12用于管 理程序运行环境1。例如，第二管理模块12可用于管理工作在程序运行环境1中的各虚拟化实例。
由于第一管理模块4和第二管理模块12分别位于不同的环境下，以及分别工作在不同的模式下，即第一管理模块4位于第二隔离环境3下且工作在安全模式下，第二管理模块12位于程序运行环境1下且工作在非安全模式下，所以第一管理模块4和第二管理模块12不可直接进行通信，即两者之间不可直接进行信息传递。
为了能够使第一管理模块4和第二管理模块12之间可以传递信息，该主机还包括安全监视器5，安全监视器5在该主机中的安全等级较高，高于指定等级。第一管理模块4和第二管理模块12之间通过安全监视器5来传递信息。
使用安全监视器5来传递信息的过程可以为：
在主机工作在安全模式下，第一管理模块4将需要传递给第二管理模块12的信息输入到安全监视器5，安全监视器5触发主机切换到非安全模式下，并向第二管理模块12发送该信息。在该主机切换到非安全模式下，第二管理模块12接收该信息。或者，
在主机工作在非安全模式下，第二管理模块12将需要传递给第一管理模块4的信息输入到安全监视器5，安全监视器5触发主机切换到安全模式下，并向第一管理模块4发送该信息。在该主机切换到安全模式下，第一管理模块4接收该信息。
由于安全监视器5的安全等级较高，通常情况下安全监视器5在该主机中的安全等级可能最高，从而保证了第一管理模块4和第二管理模块12之间传递信息的安全性也较高。
对于该虚拟化实例11对应的第一隔离环境2，在本申请实施例中，可以采用如下两种方式在第二隔离环境3中创建该虚拟化实例11对应的第一隔离环境2。该两种方式分别为：
第一种方式，在该虚拟化实例11调用安全处理程序的情况下，在第二隔离环境2中创建该虚拟化实例11对应的第一隔离环境2。
在第一种方式中，主机先工作在非安全模式下，位于程序运行环境1中的该虚拟化实例11在需要调用安全处理程序时，向第二管理模块12发送调用请求。
第二管理模块12，用于接收该调用请求，生成任务信息，该任务信息包括该虚拟化实例11的标识，向主机的安全监视器5输入该任务信息。
安全监视器5，用于接收该任务信息，触发该主机切换到安全模式，并向第一管理模块4发送该任务信息。
第一管理模块4，用于在该主机切换到安全模式下，接收该任务信息，根据该任务信息创建该虚拟化实例11对应的第一隔离环境2。
在第一种方式中，该调用请求可以包括安全处理程序的程序标识和待处理数据，待处理数据是运行安全处理程序所需要的数据。例如，假设安全处理程序是一个实现转账功能的程序，待处理数据包括转账的金额、转出金额的账户信息和转入金额的账户信息等。
第二管理模块12，还用于在接收该调用请求后，根据安全处理程序的程序标识，获取安全处理程序，向共享内存中保存第一数据，第一数据包括安全处理程序和待处理数据。
其中，第二管理模块12向安全监视器5输入的任务信息还包括共享内存地址和资源量。
可选的，该资源量为第一隔离空间的容量。该任务信息还可以包括第一数据的数据量。
可选的，第一数据是一个数据包，该数据包的包头可以包括第一数据的数据量。
第一管理模块4，还用于根据该任务信息，从共享内存中获取第一数据，根据第一数据创建该虚拟化实例对应的第一隔离环境2。
第一管理模块4根据该任务信息包括的共享内存地址，从共享内存中获取第一数据。其中，在第一数据包括第一数据的数据量的情况下，第一管理模块4根据共享内存地址，在共享内存中的第一数据的包头中获取第一数据的数据量，根据该数据量从共享内存中获取第一数据。或者，在该任务信息包括第一数据的数据量的情况下，第一管理模块4根据共享内存地址和该数据量，从共享内存中获取第一数据。
对于第一种方式，接下来详细介绍了创建第一隔离环境2的完整过程。该完整过程包括如下(1-1)至(1-5)操作，可以为：
(1-1)，第二管理模块12接收该调用请求，该调用请求包括安全处理程序的程序标识和待处理数据。
(1-2)，第二管理模块12根据该安全处理程序的程序标识获取安全处理程序，对安全处理程序和待处理数据进行校验得到校验信息，采用该虚拟化实例11对应的第一私钥信息对待加密数据进行加密得到第一数据，待加密数据包括安全处理程序、待处理数据和该校验信息。
可选的，第二管理模块12还根据该虚拟化实例11调用的安全处理程序的程序类别，获取在安全模式下的操作系统，待加密数据还包括该操作系统。接下来，列举一种获取该操作系统的实现方式，该实现方式为：
在程序运行环境1中保存程序类别与操作系统的对应关系，该对应关系中的每条记录包括一个程序类别和在安全模式下的操作系统。所以第二管理模块12根据该虚拟化实例11调用的安全处理程序的程序类别，从该程序类别与操作系统的对应关系中获取在安全模式下的操作系统。
可选的，校验信息可以是对安全处理程序和待处理数据进行哈希运算，得到的哈希值。
可选的，在程序运行环境1中可以保存虚拟化实例的标识与第一私钥信息的对应关系，该对应关系中的每条记录包括一个虚拟化实例的标识和该虚拟化实例对应的第一私钥信息。所以第二管理模块12获取该虚拟化实例11对应的第一私钥信息的操作，可以为：
第二管理模块12根据该虚拟化实例11的标识，从该虚拟化实例的标识与第一私钥信息的对应关系中获取该虚拟化实例11对应的第一私钥信息。
(1-3)，第二管理模块12在程序运行环境1包括的用户存储空间中分配共享内存，该共享内存的容量大于第一数据的数据量，向该共享内存中保存第一数据，生成任务信息，该任务信息包括该虚拟化实例11的标识和共享内存地址等信息，向主机的安全监视器5输入该任务信息。
(1-4)，安全监视器5接收到该任务信息，触发该主机切换到安全模式下，并向第一管理模块4发送该任务信息。
(1-5)，在该主机切换到安全模式下，第一管理模块4接收该任务信息，根据该任务信息获取在安全模式下的操作系统、该虚拟化实例11调用的安全处理程序和待处理数据，分配资源，该资源包括第一隔离空间和处理器资源，向第一隔离空间中保存该操作系统、安全处理程序和待处理数据，得到该虚拟化实例11对应的第一隔离环境2。
对于安全处理程序和待处理数据，接下来列举了一种第一管理模块4获取安全处理程序和待处理数据的实现实例。该实现实例可以为：
第一管理模块4根据该任务信息包括该虚拟化实例11的标识，获取该虚拟化实例11对应的第一公钥信息；根据该任务信息包括的共享内存地址，从共享内存中获取第一数据，使 用该虚拟化实例11对应的第一公钥信息，解密第一数据得到安全处理程序、待处理数据和校验信息；使用该检验信息对安全处理程序和待处理数据进行校验，如果校验通过，得到该虚拟化实例11调用的安全处理程序和待处理数据。如果校验不通过，则结束运行，或者，通过安全监视器5通知第二管理模块12，以使第二管理模块12重新向共享内存中保存第一数据。
对于该校验信息，在该校验信息为哈希值的情况下，第一管理模块4校验的过程，可以为：
第一管理模块4根据解密得到的安全处理程序和待处理数据计算哈希值，如果计算的哈希值与该校验信息相同，则检验通过，如果计算的哈希值与该校验信息不同，则校验未通过。
该虚拟化实例11对应的第一私钥信息和该虚拟化实例11对应的第一公钥信息是一对公私密钥对。第一管理模块4获取第一公钥信息的操作，可以为：
在第二隔离环境3中可以保存虚拟化实例的标识与第一公钥信息的对应关系，该对应关系中的每条记录包括一个虚拟化实例的标识和该虚拟化实例对应的第一公钥信息。第一管理模块4根据该虚拟化实例11的标识，从该虚拟化实例的标识与第一公钥信息的对应关系中获取该虚拟化实例11对应的第一公钥信息。
对于在安全模式下的操作系统，第一管理模块4可以通过如下两种方式获取该操作系统，该两种方式分别为：
方式一，第一数据包括该操作系统，所以第一管理模块4对第一数据进行解密得到该操作系统。
方式二，第二隔离环境3中保存程序类别与操作系统的对应关系，该对应关系中的每条记录包括一个程序类别和在安全模式下的操作系统。所以第一管理模块4根据该虚拟化实例调用的安全处理程序的程序类别，从该程序类型与操作系统的对应关系中获取对应的操作系统。
第二种方式，事先在第二隔离环境3中创建至少一个第一隔离环境2。这样对于程序运行环境1中的该虚拟化实例11，在该虚拟化实例11调用安全处理程序时，可以在第二隔离环境2中为该虚拟化实例11分配第一隔离环境2。
在第二种方式中，对于该至少一个第一隔离环境2中的每个第一隔离环境，该第一隔离环境包括在安全模式下的操作系统和分配给该第一隔离环境的资源，该资源包括第一隔离空间，该第一隔离空间用于保存该操作系统。
其中，对于安全模式下的操作系统，包括该操作系统的第一隔离环境2的数目可以为一个或多个，在为多个的情况下，该多个第一隔离环境2中的每个第一隔离环境2包括的第一隔离空间的容量不同。例如，对于某个操作系统，可以事先创建三个包括该操作系统的第一隔离环境2，该三个第一隔离环境2中包括的第一隔离空间的容量分别为10G、8G和6G。
第二隔离环境3中包括不种程序类别对应的操作系统，对于每个操作系统，可以建立包括该操作系统的一个或多个第一隔离环境2。
在第二种方式中，在主机工作在非安全模式下，对于程序运行环境1中的虚拟化实例11，在该虚拟化实例11调用安全处理程序来处理待处理数据时，需要在第二隔离环境3中为该虚拟化实例11分配第一隔离环境2，该分配的过程包括(2-1)至(2-5)的操作，可以为：
(2-1)，该虚拟化实例11在需要调用安全处理程序时，向第二管理模块12发送调用请求，该调用请求包括安全处理程序的程序标识和待处理数据。
(2-2)，第二管理模块12接收该调用请求，在程序运行环境1包括的程序运行空间中创建共享内存，向共享内存保存第一数据，第一数据包括安全处理程序和待处理数据，生成任务信息，该任务信息包括该虚拟化实例的标识、共享内存地址和第一隔离空间的容量，向主机的安全监视器5输入该任务信息。
对于上述第一数据，第二管理模块12得到第一数据的操作，可以为：
第二管理模块12可以对安全处理程序和待处理数据进行校验得到校验信息，获取该虚拟化实例11对应的第一私钥信息，使用该第一私钥信息对待加密数据进行加密得到第一数据，待加密数据包括安全处理程序的程序标识、待处理数据和该校验信息。
(2-3)，安全监视器5接收该任务信息，触发该主机切换到安全模式，并向第一管理模块4发送该任务信息。
(2-4)，在该主机切换到安全模式下，第一管理模块4从安全监视器5中读取该任务信息，根据该任务信息包括的共享内存地址，从共享内存中获取该安全处理程序和待处理数据。
可选的，第一管理模块12从共享内存中获取到第一数据后，根据该虚拟化实例11的标识，获取该虚拟化实例11对应的第一公钥信息，使用该第一公钥信息对第一数据进行解密，得到安全处理程序、待处理数据和该校验信息，根据该校验信息对待处理数据和安全处理程序进行校验，如果检验通过，执行如下(2-5)的操作。
(2-5)，第一管理模块4根据该任务信息包括的第一隔离空间的容量和该安全处理程序的程序类别，分配事先创建的第一隔离环境2，将该安全处理程序和待处理数据保存到该第一隔离环境2包括的第一隔离空间中，以及为该第一隔离环境2分配处理器资源。
其中，分配的该第一隔离环境2包括的第一隔离空间的容量大于或等于该任务信息包括的第一隔离空间的容量。在执行操作(2-5)后，该第一隔离环境2中包括第一隔离空间和处理器资源，第一隔离空间中保存有在安全模式下的操作系统、该安全处理程序和待处理数据。
在上述第一种方式和第二种方式中，第一管理模块4可以建立不同虚拟化实例对应的第一隔离环境2，从而实现为不同虚拟化实例建立不同的第一隔离环境，实现更新精细化的管理。
其中，第一管理模块4还用于在该虚拟化实例11对应的第一隔离环境2中运行该操作系统，通过该操作系统运行安全处理程序处理待处理数据。
可选的，第一管理模块4可以通过如下(3-1)至(3-3)的操作，来处理待处理数据。该(3-1)至(3-3)的操作，分别为：
(3-1)：第一管理模块4在该虚拟化实例11对应的第一隔离空间2中运行该操作系统。
可选的，在第一隔离空间2中，启动该操作系统，在操作系统启动后，该主机的处理器可以开始运行该操作系统。
(3-2)：第一管理模块4通过该操作系统中启动用于运行安全处理程序的进程。
其中，在该操作系统被运行后，该操作系统可创建用于运行安全处理程序的进程。
(3-3)：通过该进程处理待处理数据，得到处理结果。
其中，该主机的处理器可以调用该进程，并运行该进程，在运行该进程时，处理待处理数据，得到处理结果。
可选的，在上述处理待处理数据过程中，第一管理模块4还用于调整该虚拟化实例11对应的第一隔离环境2包括的资源量。
该资源量可以包括第一隔离空间的容量。即在处理待处理数据的过程，第一管理模块4根据需要增加或减小第一隔离容量的容量。
可选的，在处理完待处理数据后，第一管理模块4，还用于释放该虚拟化实例11对应的第一隔离环境2。
在处理完待处理数据并得到处理结果后，第一管理模块4，还用于向程序运行环境2传递该处理结果，以及触发将该主机的工作模式切换到非安全模式。
这样在该主机切换到非安全模式下，第二管理模块12，还用于获取该处理结果，将该处理结果输入到该虚拟化实例11。
接下来，详细说明将该处理结果输入给该虚拟化实例11的完整过程，该完整过程包括如下(4-1)-(4-3)的操作，可以为：
(4-1)，第一管理模块4获取该虚拟化实例11对应的第二私钥信息，使用第二私钥信息对该处理结果进行加密，将该加密的处理结果保存到共享内存中，以及向安全监视器5输入任务完成信息，该任务完成信息包括该虚拟化实例11的标识、该共享内存地址和任务完成指示。
第一管理模块4获取第二私钥信息的操作，可以为：
在第二隔离环境3中可以保存虚拟化实例的标识与第二私钥信息的对应关系，该对应关系中的每条记录包括一个虚拟化实例的标识和该虚拟化实例对应的第二私钥信息。第一管理模块4根据该虚拟化实例11的标识，从该虚拟化实例的标识与第二私钥信息的对应关系中获取该虚拟化实例11对应的第二私钥信息。
(4-2)，该安全监视器5接收该任务完成信息，触发该主机将工作模式切换到非安全模式，向第二管理模块12发送该任务完成信息。
(4-3)，在该主机切换到非安全模式下，第二管理模块12接收该任务完成信息，该任务完成信息包括该虚拟化实例11的标识、该共享内存地址和任务完成指示，在该任务完成指示的触发下，根据该虚拟化实例的标识获取该虚拟化实例11对应的第二公钥信息，根据该共享内存地址获取该加密的处理结果，使用第二公钥信息解密对该加密的处理结果进行解密，得到处理结果，向该虚拟化实例11输入该处理结果。
该虚拟化实例11对应的第二私钥信息和该虚拟化实例11对应的第二公钥信息是一对公私密钥对。第二管理模块12获取第二公钥信息的操作，可以为：
在程序运行环境1中可以保存虚拟化实例的标识与第二公钥信息的对应关系，该对应关系中的每条记录包括一个虚拟化实例的标识和该虚拟化实例对应的第二公钥信息。第二管理模块12根据该虚拟化实例的标识，从该虚拟化实例的标识与第二公钥信息的对应关系中获取该虚拟化实例11对应的第二公钥信息。
可选的，在该虚拟化实例11对应的第一隔离环境2中，在使用安全处理程序处理待处理数据的过程中，可以将该虚拟化实例11从该主机上迁移到其他主机上。在将该虚拟化实例11迁移到其他主机时，也需要将该虚拟化实例11对应的第一隔离环境2迁移到其他主机上。在实现时：
第一管理模块4还用于获取第二数据，向第二管理模块12输入第二数据，第二数据包括状态信息和第一隔离空间2中保存的数据，该状态信息用于描述该操作系统的运行状态和该安全处理程序的运行状态。
第二管理模块12还用于向其他主机发送第二数据。这样其他主机接收第二数据，基于 第二数据恢复该虚拟化实例11对应的第一隔离环境2。
可选的，该状态信息包括该操作系统的当前运行状态和安全处理程序的当前运行状态。第一隔离空间中保存的数据包括该操作系统、安全处理程序和安全处理程序处理待处理数据的中间结果等内容。
接下来，列举了一种将第二数据输入给第二管理模块12的实现实例，该实现实例可以为：
第一管理模块4获取到第二数据后，向该共享内存保存第二数据，向安全监视器5输入迁移信息，该迁移信息包括该虚拟化实例11的标识、共享内存地址和迁移指示。
该安全监视器5接收该迁移信息，触发该主机将工作模式切换到非安全模式，向第二管理模块12发送该迁移信息。
在该主机切换到非安全模式，第二管理模块12接收迁移信息，在该迁移指示的触发下，根据该共享内存地址获取第二数据。
其中，其他主机同本申请实施例提供的主机一样，也包括程序运行环境和第二隔离环境。位于该程序运行环境中的第二管理模块接收第二数据，在该程序运行环境的用户存储空间中分配共享内存，向该共享内存中保存第二数据，向该其他主机的安全监视器输入恢复信息，该恢复信息包括该共享内存地址和恢复指示。
该安全监视器接收该恢复信息，触发该其他主机将工作模式切换到安全模式，向该第二隔离环境中的第一管理模块发送该恢复信息。
在该其他主机切换到安全模式后，位于该第二隔离环境中的第一管理模块接收该恢复信息，在该恢复指示的触发下，根据该共享内存地址从该共享内存中读取第二数据，根据第二数据恢复该虚拟化实例11对应的第一隔离环境。
可选的，上述第一管理模块4为虚拟化管理程序(Hypervisor)，第二管理模块12也一个Hypervisor。
在本申请实施例中，由于主机包括程序运行环境和第一隔离环境，对于程序运行环境包括的工作在非安全模式下的虚拟化实例，该虚拟化实例对应的第一隔离环境包括在安全模式下的操作系统和资源，该资源包括第一隔离空间和处理器资源，第一隔离空间用于运行该操作系统和安全处理程序，以及处理待处理数据，安全处理程序是该虚拟化实例调用的程序，待处理数据是运行安全处理程序所需要的数据，第一隔离空间是在安全模式下被该主机保护的空间。这样在该虚拟化实例11对应的第一隔离环境中，运行安全处理程序，使用安全处理程序处理待处理数据，从而提高了处理数据的安全性。
参见图3，本申请提供了一种处理数据的方法，该方法可以应用于如图2所示的主机中，该方法包括：
步骤301：在该主机工作在非安全模式下，接收虚拟化实例11发送的调用请求，该调用请求包括该虚拟化实例11调用的安全处理程序的程序标识和待处理数据。
其中，该主机包括程序运行环境和第二隔离环境，程序运行环境包括至少一个虚拟化实例，该虚拟化实例11是该至少一个虚拟化实例中的任一个虚拟化实例。
参见图4，第二管理模块接收该虚拟化实例11发送的调用请求。
步骤302：向共享内存保存第一数据，向主机的安全监视器输入任务信息，该任务信息包括该虚拟化实例11的标识，以触发将该主机的工作模式切换到安全模式。
参见图4，第二管理模块向共享内存保存第一数据，向主机的安全监视器输入任务信息。
在本步骤中，根据安全处理程序的程序标识获取安全处理程序，对安全处理程序和待处理数据进行校验得到校验信息，采用该虚拟化实例11对应的第一私钥信息对待加密数据进行加密得到第一数据，待加密数据包括安全处理程序、待处理数据和该校验信息；根据第一数据的数据量在程序运行环境包括的用户存储空间中分配共享内存，该共享内存的容量大于第一数据的数据量，向该共享内存中保存第一数据，生成任务信息，该任务信息包括该虚拟化实例11的标识和共享内存地址，向主机的安全监视器输入该任务信息。
可选的，该任务信息还包括第一隔离空间的容量等信息。
可选的，待加密数据还包括在安全模式下的操作系统。也就是说，在加密待加密数据前，还根据该安全处理程序的程序类别，获取在安全模式下的操作系统。
获取该操作系统的操作，可以为：
该主机的程序运行环境中保存程序类别与操作系统的对应关系，该对应关系中的每条记录包括一个程序类别和该程序类别在安全模式下的操作系统。所以根据该安全处理程序的程序类别，从该程序类别与操作系统的对应关系中获取在安全模式下的操作系统。
可选的，校验信息可以是对安全处理程序和待处理数据进行哈希运算，得到的哈希值。
可选的，在程序运行环境中可以保存虚拟化实例11的标识与第一私钥信息的对应关系，该对应关系中的每条记录包括一个虚拟化实例的标识和该虚拟化实例对应的第一私钥信息。所以获取该虚拟化实例11对应的第一私钥信息的操作，可以为：
根据该虚拟化实例11的标识，从该虚拟化实例的标识与第一私钥信息的对应关系中获取该虚拟化实例11对应的第一私钥信息。
其中，该主机的安全监视器接收该任务信息，触发该主机切换到安全模式，该安全监视器发送该任务信息。
步骤303：在主机切换到安全模式下，接收该安全监视器发送的任务信息，根据该任务信息创建或分配该虚拟化实例11对应的第一隔离环境。
参见图4，第一管理模块接收该任务信息，根据该任务信息从共享内存中获取第一数据，根据第一数据创建或分配该虚拟化实例11对应的第一隔离环境。
在第二隔离环境中未事先建立程序运行环境中的该虚拟化实例11对应的第一隔离环境的情况下，步骤303的操作可以为：
在主机切换到安全模式下，接收该任务信息，根据该任务信息包括该虚拟化实例11的标识，获取该虚拟化实例11对应的第一公钥信息；根据该任务信息包括的共享内存地址，从共享内存中获取第一数据，使用该虚拟化实例11对应的第一公钥信息，解密第一数据得到安全处理程序、待处理数据和校验信息；使用该检验信息对安全处理程序和待处理数据进行校验，如果校验通过，得到该虚拟化实例11调用的安全处理程序和待处理数据；获取在安全模式下与该安全处理程序的程序类别相对应的操作系统；分配第一隔离空间和处理器资源，第一隔离空间包括安全处理程序、待处理数据和该操作系统，从而创建该虚拟化实例11对应的第一隔离环境。
对于该校验信息，在该校验信息为哈希值的情况下，校验的过程，可以为：
根据解密得到的安全处理程序和待处理数据计算哈希值，如果计算的哈希值与该校验信息相同，则检验通过，如果计算的哈希值与该校验信息不同，则校验未通过。
该虚拟化实例11对应的第一私钥信息和该虚拟化实例11对应的第一公钥信息是一对公 私密钥对。获取第一公钥信息的操作，可以为：
在第二隔离环境中可以保存虚拟化实例的标识与第一公钥信息的对应关系，该对应关系中的每条记录包括一个虚拟化实例的标识和该虚拟化实例对应的第一公钥信息。所以可以根据该虚拟化实例11的标识，从该虚拟化实例的标识与第一公钥信息的对应关系中获取该虚拟化实例11对应的第一公钥信息。
对于该操作系统，可以通过如下两种方式获取该操作系统，该两种方式分别为：
方式一，第一数据包括该操作系统，所以对第一数据进行解密得到该操作系统。
方式二，第二隔离环境中保存程序类别与操作系统的对应关系，该对应关系中的每条记录包括一个程序类别和该程序类别在安全模式下的操作系统。所以根据该安全处理程序的程序类别，从该程序类别与操作系统的对应关系中获取对应的操作系统。
在第二隔离环境中事先建立该虚拟化实例11对应的第一隔离环境的情况下，步骤303的操作可以为：
在主机切换到安全模式下，接收该任务信息，根据该任务信息包括的共享内存地址，从共享内存中获取第一数据，第一数据包括该安全处理程序、待处理数据和第一隔离空间的容量，根据该任务信息包括的第一隔离空间的容量和该安全处理程序的程序类别，分配事先创建的第一隔离环境，将该安全处理程序和待处理数据保存到该第一隔离环境包括的第一隔离空间中，以及为该第一隔离环境分配处理器资源。
可选的，从共享内存中获取到第一数据后，根据该虚拟化实例11的标识，获取该虚拟化实例11对应的第一公钥信息，使用该第一公钥信息对第一数据进行解密，得到安全处理程序、待处理数据和该校验信息，根据该校验信息对待处理数据和安全处理程序进行校验，检验通过，将该待处理数据和安全处理程序保存到该虚拟化实例11对应的第一隔离环境包括的第一隔离空间中。
步骤304：在该虚拟化实例11对应的第一隔离环境中运行该操作系统，通过该操作系统运行安全处理程序处理待处理数据。
可选的通过如下3041-3043的操作，来处理待处理数据。该3041-3043的操作，分别为：
3041：在第一隔离空间中运行该安全模式下的操作系统。
可选的，在第一隔离空间中，启动该操作系统，在操作系统启动后，该主机的处理器可以开始运行该操作系统。
3042：通过该操作系统中启动用于运行安全处理程序的进程。
该操作系统被运行后，创建用于运行安全处理程序的进程。
3043：通过该进程处理待处理数据，得到处理结果。
主机的处理器可以调用该进程，并运行该进程，在运行该进程时，处理待处理数据，得到处理结果。
可选的，在上述处理待处理数据过程中，可以调整该虚拟化实例11对应的第一隔离环境包括的资源量。
该资源量可以包括第一隔离空间的容量。即在处理待处理数据的过程，根据需要增加或减小第一隔离容量的容量。
可选的，在处理完待处理数据后，还可以释放该虚拟化实例11对应的第一隔离环境。
步骤305：在处理完待处理数据并得到处理结果后，向程序运行环境传递处理结果，以及触发将主机的工作模式切换到非安全模式。
在步骤305中，获取该虚拟化实例11对应的第二私钥信息，使用第二私钥信息对该处理结果进行加密，将该加密的处理结果保存到共享内存中，以及向安全监视器输入任务完成信息，该任务完成信息包括该虚拟化实例11的标识、该共享内存地址和任务完成指示。
可选的，获取第二私钥信息的操作，可以为：
在第二隔离环境中可以保存虚拟化实例的标识与第二私钥信息的对应关系，该对应关系中的每条记录包括一个虚拟化实例的标识和该虚拟化实例对应的第二私钥信息。这样根据该虚拟化实例11的标识，从该虚拟化实例的标识与第二私钥信息的对应关系中获取该虚拟化实例11对应的第二私钥信息。
其中，该安全监视器接收该任务完成信息，触发该主机将工作模式切换到非安全模式，发送该任务完成信息。
步骤306：在主机切换到非安全模式下，接收该任务完成信息，根据该任务完成信息获取该处理结果，将该处理结果输入到该虚拟化实例11。
参见图4，第二管理模块接收该任务完成信息，根据任务完成信息从共享内存中获取该处理结果，将该处理结果输入到该虚拟化实例11。
在步骤306中，在主机切换到非安全模式下，接收该任务完成信息，该任务完成信息包括该虚拟化实例11的标识、该共享内存地址和任务完成指示，在该任务完成指示的触发下，根据该虚拟化实例11的标识获取该虚拟化实例11对应的第二公钥信息，根据该共享内存地址获取该加密的处理结果，使用第二公钥信息解密该加密的处理结果，根据该虚拟化实例11的标识向该虚拟化实例11输入该处理结果。
该虚拟化实例11对应的第二私钥信息和该虚拟化实例对应的第二公钥信息是一对公私密钥对。
在程序运行环境1中可以保存虚拟化实例的标识与第二公钥信息的对应关系，该对应关系中的每条记录包括一个虚拟化实例的标识和该虚拟化实例对应的第二公钥信息。所以可以根据该虚拟化实例11的标识，从该虚拟化实例的标识与第二公钥信息的对应关系中获取该虚拟化实例11对应的第二公钥信息。
可选的，在该虚拟化实例11对应的第一隔离环境中，在使用安全处理程序处理待处理数据的过程中，可以将该虚拟化实例11从该主机上迁移到其他主机上。在将该虚拟化实例11迁移到其他主机时，也需要将该虚拟化实例11对应的第一隔离环境迁移到其他主机上。可以通过如下步骤307至308的操作来实现。
步骤307：获取第二数据，第二数据包括状态信息和第一隔离空间中保存的数据，该状态信息用于描述该操作系统的运行状态和该安全处理程序的运行状态。
参见图4，第一管理模块获取第二数据，向该共享内存保存第二数据，向安全监视器输入迁移信息，该迁移信息包括该虚拟化实例11的标识、共享内存地址和迁移指示。该安全监视器接收该迁移信息，触发将该主机的工作模式切换到非安全模式，向第二管理模块发送该迁移信息。在该主机切换到非安全模式，第二管理模块接收迁移信息，在该迁移指示的触发下，根据该共享内存地址获取第二数据。
步骤308：向其他主机发送第二数据，以使其他主机基于第二数据恢复该虚拟化实例11对应的第一隔离环境。
参见图4，第二管理模块向其他主机发送第二数据。这样其他主机接收第二数据，基于第二数据恢复该虚拟化实例11对应的第一隔离环境。
其中，其他主机恢复第一隔离环境的操作可以为：
其他主机包括程序运行环境和第二隔离环境。其他主机的程序运行环境中的第二管理模块接收第二数据，在该程序运行环境的用户存储空间中分配共享内存，向该共享内存中保存第二数据，向该其他主机的安全监视器输入恢复信息，该恢复信息包括该共享内存地址和恢复指示。该安全监视器接收该恢复信息，触发该其他主机将工作模式切换到安全模式，向该第二隔离环境中的第一管理模块发送该恢复信息。在该其他主机切换到安全模式后，其他主机的第二隔离环境中的第一管理模块接收该恢复信息，在该恢复指示的触发下，根据该共享内存地址从该共享内存中读取第二数据，根据第二数据恢复该虚拟化实例11对应的第一隔离环境。
在本申请实施例中，由于在主机切换到安全模式下，接收任务信息并创建虚拟化实例11对应的第一隔离环境，这样使得主机包括程序运行环境和第一隔离环境，对于程序运行环境包括的工作在非安全模式下的虚拟化实例11，该虚拟化实例11对应的第一隔离环境包括在安全模式下的操作系统和分配给该第一隔离环境的资源，该资源包括第一隔离空间和处理器资源，第一隔离空间用于运行该操作系统和安全处理程序，以及处理待处理数据，这样在第一隔离环境中，处理待处理数据，从而提高了处理待处理数据的安全性。
参见图5，本申请实施例提供了一种处理数据的装置500，所述装置500可以部署在图1、图2或图3所示实施例提供的主机上，包括：
接收单元501，用于在主机切换到安全模式下，接收任务信息，该任务信息包括虚拟化实例的标识，该虚拟化实例是程序运行环境中的虚拟化实例，该程序运行环境是主机工作在非安全模式下的环境；
处理单元502，用于根据该任务信息创建或分配该虚拟化实例对应的第一隔离环境，第一隔离环境是主机工作在安全模式下的环境，第一隔离环境包括在安全模式下的操作系统和分配给第一隔离环境的资源，该资源包括第一隔离空间和处理器资源，第一隔离空间用于运行该操作系统和安全处理程序，存储待处理数据，该安全处理程序与该虚拟化实例中的程序对应，用于处理待处理数据，以实现该虚拟化实例中的所述程序的安全处理功能，第一隔离空间与该程序运行环境隔离。
可选的，处理单元502创建或分配第一隔离环境的详细过程，参见图3所示实施例中的步骤303中的相关内容，在此不再详细说明。
可选的，接收单元501，用于接收安全监视器发送该任务信息，该任务信息是安全监视器在非安全模式下获取的信息。
可选的，接收单元501接收任务信息的详细过程，参见图3所示实施例中的步骤301中的相关内容，在此不再详细说明。
可选的，该任务信息还包括共享内存地址，处理单元502，还用于：
根据共享内存地址获取第一数据，第一数据包括该安全运行程序和待处理数据，该共享内存为程序运行环境和第一隔离环境共享的内存。
可选的，处理单元502获取第一数据的详细过程，参见图3所示实施例中的步骤303中的相关内容，在此不再详细说明。
可选的，主机还包括第二隔离环境，第二隔离环境包括第一隔离环境。
可选的，处理单元502，还用于：
调整程序运行环境中运行的虚拟化实例对应的第一隔离环境包括的资源量，或者，释放程序运行环境中运行的虚拟化实例对应的第一隔离环境。
可选的，处理单元502，还用于：
在第一隔离空间中运行该安全模式下的操作系统，通过该操作系统运行安全处理程序处理待处理数据，得到处理结果。
可选的，处理单元502得到的详细过程，参见图3所示实施例中的步骤304中的相关内容，在此不再详细说明。
可选的，处理单元502，还用于向程序运行环境传递处理结果，以及触发将主机的工作模式切换到非安全模式。
可选的，处理单元502传递处理结果的详细过程，参见图3所示实施例中的步骤305中的相关内容，在此不再详细说明。
可选的，处理单元502，还用于获取第二数据，第二数据包括状态信息和第一隔离空间中保存的数据，该状态信息用于描述第一隔离环境中操作系统的运行状态和该安全处理程序的运行状态，第二数据用于在其他主机上恢复该虚拟化实例对应的第一隔离环境。
可选的，处理单元502获取第二数据的详细过程，参见图3所示实施例中的步骤307中的相关内容，在此不再详细说明。
可选的，所述装置500还包括：
发送单元503，用于向其他主机发送所述第二数据，以在其他主机上恢复该虚拟化实例对应的第一隔离环境。
可选的，主机包括的第一隔离环境的数目为多个，该多个第一隔离环境中的每个第一隔离环境与程序运行环境中的虚拟化实例一一对应。
在本申请实施例中，由于接收单元在主机切换到安全模式下，接收任务信息，处理单元创建虚拟化实例对应的第一隔离环境，这样使得主机包括程序运行环境和第一隔离环境，对于程序运行环境包括的工作在非安全模式下的虚拟化实例，该虚拟化实例对应的第一隔离环境包括在安全模式下的操作系统和分配给该第一隔离环境的资源，该资源包括第一隔离空间和处理器资源，第一隔离空间用于运行该操作系统和安全处理程序，以及处理待处理数据，这样处理单元在第一隔离环境中，处理待处理数据，从而提高了处理待处理数据的安全性。
参见图6，本申请实施例提供了一种数据处理的装置600示意图。该装置600可以是上述任一实施例中的主机。该装置600包括至少一个处理器601，内部连接602，存储器603以及至少一个收发器604。
该装置600是一种硬件结构的装置，可以用于实现图5所述的装置500中的功能模块。例如，本领域技术人员可以想到图5所示的装置500中的处理单元502可以通过该至少一个处理器601调用存储器603中的代码来实现，图5所示的装置500中的接收单元501和发送单元502可以通过该收发器604来实现。
可选的，该装置600还可用于实现上述任一实施例中主机、主机中的第一管理模块和/或第二管理模块的功能。
可选的，上述处理器601可以是一个通用中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
上述内部连接602可包括一通路，在上述组件之间传送信息。可选的，内部连接602为单板或总线等。
上述收发器604，用于与其他设备或通信网络通信。
上述存储器603可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过总线与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器603用于存储执行本申请方案的应用程序代码，并由处理器601来控制执行。处理器601用于执行存储器603中存储的应用程序代码，以及配合至少一个收发器604，从而使得该装置600实现本专利方法中的功能。
在具体实现中，作为一种实施例，处理器601可以包括一个或多个CPU，例如图6中的CPU0和CPU1。
在具体实现中，作为一种实施例，该装置600可以包括多个处理器，例如图6中的处理器601和处理器607。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (31)

  1. 一种数据处理的主机，其特征在于，包括程序运行环境和第一隔离环境，所述程序运行环境是所述主机工作在非安全模式下的环境，所述第一隔离环境是所述主机工作在安全模式下的环境；
    所述程序运行环境包括工作在所述非安全模式下的至少一个虚拟化实例，其中，所述第一隔离环境与所述程序运行环境中的虚拟化实例相对应；
    所述第一隔离环境包括在所述安全模式下的操作系统和分配给所述第一隔离环境的资源，所述资源包括第一隔离空间和处理器资源，所述第一隔离空间用于运行所述操作系统和安全处理程序，以及存储待处理数据，所述安全处理程序与所述虚拟化实例中的程序对应，用于处理所述待处理数据，以实现所述虚拟化实例中的所述程序的安全处理功能，所述第一隔离空间与所述程序运行环境隔离。
  2. 如权利要求1所述的主机，其特征在于，还包括：第二隔离环境，所述第二隔离环境包括第一管理模块和所述第一隔离环境，所述第一管理模块用于管理所述第一隔离环境。
  3. 如权利要求2所述的主机，其特征在于，
    在主机切换到所述安全模式下，所述第一管理模块，用于接收任务信息，所述任务信息包括所述虚拟化实例的标识；
    所述第一管理模块，还用于根据所述任务信息创建或分配所述虚拟化实例对应的第一隔离环境。
  4. 如权利要求3所述的主机，其特征在于，
    所述第一管理模块，用于接收安全监视器发送所述任务信息，所述任务信息是所述安全监视器在所述非安全模式下获取的信息。
  5. 如权利要求3所述的主机，其特征在于，所述任务信息还包括共享内存地址，
    所述第一管理模块，还用于根据所述共享内存地址获取第一数据，所述第一数据包括所述安全运行程序和所述待处理数据，所述共享内存为所述程序运行环境和所述第一隔离环境共享的内存。
  6. 如权利要求2至5任一项所述的主机，其特征在于，所述第一管理模块，还用于调整所述程序运行环境中运行的虚拟化实例对应的第一隔离环境包括的资源量，或者，释放所述程序运行环境中运行的虚拟化实例对应的第一隔离环境。
  7. 如权利要求2至6任一项所述的主机，其特征在于，
    所述第一管理模块，用于在所述第一隔离空间中运行所述安全模式下的操作系统，通过所述操作系统运行所述安全处理程序处理所述待处理数据，得到处理结果。
  8. 如权利要求7所述的主机，其特征在于，
    所述第一管理模块，还用于向所述程序运行环境传递所述处理结果，以及触发将所述主机的工作模式切换到所述非安全模式。
  9. 如权利要求2至8任一项所述的主机，其特征在于，
    所述第一管理模块，还用于获取第二数据，所述第二数据包括状态信息和所述第一隔离空间中保存的数据，所述状态信息用于描述所述第一隔离环境中操作系统的运行状态和所述安全处理程序的运行状态，所述第二数据用于在所述其他主机上恢复所述虚拟化实例对应的第一隔离环境；
    所述第一管理模块，还用于向所述程序运行环境中的第二管理模块发送所述第二数据。
  10. 如权利要求9所述的主机，其特征在于，
    所述第二管理模块，用于向所述其他主机发送所述第二数据，以在所述其他主机上恢复所述虚拟化实例对应的第一隔离环境。
  11. 如权利要求1至10任一项所述的主机，其特征在于，所述主机包括的第一隔离环境的数目为多个，所述多个第一隔离环境中的每个第一隔离环境与所述程序运行环境中的虚拟化实例一一对应。
  12. 一种处理数据的方法，其特征在于，所述方法包括：
    在主机切换到安全模式下，接收任务信息，所述任务信息包括虚拟化实例的标识，所述虚拟化实例是程序运行环境中的虚拟化实例，所述程序运行环境是所述主机工作在非安全模式下的环境；
    根据所述任务信息创建或分配所述虚拟化实例对应的第一隔离环境，所述第一隔离环境是所述主机工作在所述安全模式下的环境，所述第一隔离环境包括在所述安全模式下的操作系统和分配给所述第一隔离环境的资源，所述资源包括第一隔离空间和处理器资源，所述第一隔离空间用于运行所述操作系统和安全处理程序，存储待处理数据，所述安全处理程序与所述虚拟化实例中的程序对应，用于处理所述待处理数据，以实现所述虚拟化实例中的所述程序的安全处理功能，所述第一隔离空间与所述程序运行环境隔离。
  13. 如权利要求12所述的方法，其特征在于，所述接收任务信息，包括：
    接收安全监视器发送所述任务信息，所述任务信息是所述安全监视器在所述非安全模式下获取的信息。
  14. 如权利要求12或13所述的方法，其特征在于，所述任务信息还包括共享内存地址，所述方法还包括：
    根据所述共享内存地址获取第一数据，所述第一数据包括所述安全运行程序和所述待处理数据，所述共享内存为所述程序运行环境和所述第一隔离环境共享的内存。
  15. 如权利要求12至14任一项所述的方法，其特征在于，所述主机还包括第二隔离环 境，所述第二隔离环境包括所述第一隔离环境。
  16. 如权利要求12至15任一项所述的方法，其特征在于，所述方法还包括：
    调整所述程序运行环境中运行的虚拟化实例对应的第一隔离环境包括的资源量，或者，释放所述程序运行环境中运行的虚拟化实例对应的第一隔离环境。
  17. 如权利要求12至16任一项所述的方法，其特征在于，所述方法还包括：
    在所述第一隔离空间中运行所述安全模式下的操作系统，通过所述操作系统运行所述安全处理程序处理所述待处理数据，得到处理结果。
  18. 如权利要求17所述的方法，其特征在于，所述方法还包括：
    向所述程序运行环境传递所述处理结果，以及触发将所述主机的工作模式切换到所述非安全模式。
  19. 如权利要求12至18任一项所述的方法，其特征在于，所述方法还包括：
    获取第二数据，所述第二数据包括状态信息和所述第一隔离空间中保存的数据，所述状态信息用于描述所述第一隔离环境中操作系统的运行状态和所述安全处理程序的运行状态，所述第二数据用于在所述其他主机上恢复所述虚拟化实例对应的第一隔离环境。
  20. 如权利要求19所述的方法，其特征在于，所述方法还包括：
    向所述其他主机发送所述第二数据，以在所述其他主机上恢复所述虚拟化实例对应的第一隔离环境。
  21. 如权利要求12至20任一项所述的方法，其特征在于，所述主机包括的第一隔离环境的数目为多个，所述多个第一隔离环境中的每个第一隔离环境与所述程序运行环境中的虚拟化实例一一对应。
  22. 一种处理数据的装置，其特征在于，所述装置包括：
    接收单元，用于在主机切换到安全模式下，接收任务信息，所述任务信息包括虚拟化实例的标识，所述虚拟化实例是程序运行环境中的虚拟化实例，所述程序运行环境是所述主机工作在非安全模式下的环境；
    处理单元，用于根据所述任务信息创建或分配所述虚拟化实例对应的第一隔离环境，所述第一隔离环境是所述主机工作在所述安全模式下的环境，所述第一隔离环境包括在所述安全模式下的操作系统和分配给所述第一隔离环境的资源，所述资源包括第一隔离空间和处理器资源，所述第一隔离空间用于运行所述操作系统和安全处理程序，存储待处理数据，所述安全处理程序与所述虚拟化实例中的程序对应，用于处理所述待处理数据，以实现所述虚拟化实例中的所述程序的安全处理功能，所述第一隔离空间与所述程序运行环境隔离。
  23. 如权利要求22所述的装置，其特征在于，所述接收单元，用于：
    接收安全监视器发送所述任务信息，所述任务信息是所述安全监视器在所述非安全模式 下获取的信息。
  24. 如权利要求22或23所述的装置，其特征在于，所述任务信息还包括共享内存地址，所述处理单元，还用于：
    根据所述共享内存地址获取第一数据，所述第一数据包括所述安全运行程序和所述待处理数据，所述共享内存为所述程序运行环境和所述第一隔离环境共享的内存。
  25. 如权利要求22至24任一项所述的装置，其特征在于，所述主机还包括第二隔离环境，所述第二隔离环境包括所述第一隔离环境。
  26. 如权利要求22至25任一项所述的装置，其特征在于，所述处理单元，还用于：
    调整所述程序运行环境中运行的虚拟化实例对应的第一隔离环境包括的资源量，或者，释放所述程序运行环境中运行的虚拟化实例对应的第一隔离环境。
  27. 如权利要求22至26任一项所述的装置，其特征在于，所述处理单元，还用于：
    在所述第一隔离空间中运行所述安全模式下的操作系统，通过所述操作系统运行所述安全处理程序处理所述待处理数据，得到处理结果。
  28. 如权利要求27所述的装置，其特征在于，
    所述处理单元，还用于向所述程序运行环境传递所述处理结果，以及触发将所述主机的工作模式切换到所述非安全模式。
  29. 如权利要求22至28任一项所述的装置，其特征在于，
    所述处理单元，还用于获取第二数据，所述第二数据包括状态信息和所述第一隔离空间中保存的数据，所述状态信息用于描述所述第一隔离环境中操作系统的运行状态和所述安全处理程序的运行状态，所述第二数据用于在所述其他主机上恢复所述虚拟化实例对应的第一隔离环境。
  30. 如权利要求29所述的装置，其特征在于，所述装置还包括：
    发送单元，用于向所述其他主机发送所述第二数据，以在所述其他主机上恢复所述虚拟化实例对应的第一隔离环境。
  31. 如权利要求22至30任一项所述的装置，其特征在于，所述主机包括的第一隔离环境的数目为多个，所述多个第一隔离环境中的每个第一隔离环境与所述程序运行环境中的虚拟化实例一一对应。
PCT/CN2021/102236 2020-06-28 2021-06-25 处理数据的方法、主机及装置 WO2022001842A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21834542.9A EP4160403A4 (en) 2020-06-28 2021-06-25 METHOD, HOST AND DEVICE FOR DATA PROCESSING
US18/067,797 US20230185901A1 (en) 2020-06-28 2022-12-19 Data processing method, host, and apparatus

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202010598730 2020-06-28
CN202010598730.1 2020-06-28
CN202011051770.0 2020-09-29
CN202011051770.0A CN113849261A (zh) 2020-06-28 2020-09-29 处理数据的方法、主机及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/067,797 Continuation US20230185901A1 (en) 2020-06-28 2022-12-19 Data processing method, host, and apparatus

Publications (1)

Publication Number Publication Date
WO2022001842A1 true WO2022001842A1 (zh) 2022-01-06

Family

ID=78972805

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/102236 WO2022001842A1 (zh) 2020-06-28 2021-06-25 处理数据的方法、主机及装置

Country Status (4)

Country Link
US (1) US20230185901A1 (zh)
EP (1) EP4160403A4 (zh)
CN (1) CN113849261A (zh)
WO (1) WO2022001842A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115904761A (zh) * 2023-01-03 2023-04-04 南京芯驰半导体科技有限公司 片上系统、车辆及视频处理单元虚拟化方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140115623A1 (en) * 2012-10-18 2014-04-24 Broadcom Corporation Integration of Untrusted Framework Components With a Secure Operating System Environment
CN103870336A (zh) * 2012-12-07 2014-06-18 三星电子株式会社 数据处理设备的基于优先级的应用运行方法及装置
CN107633394A (zh) * 2017-09-19 2018-01-26 山东大学 一种基于TrustZone技术的移动支付系统及其应用
US20180239896A1 (en) * 2015-08-25 2018-08-23 Seltech Corporation System including a hypervisor
CN108959916A (zh) * 2017-05-22 2018-12-07 华为技术有限公司 用于访问安全世界的方法、装置和系统
CN110955493A (zh) * 2019-11-13 2020-04-03 东软集团股份有限公司 一种实现安全运行环境切换的方法、系统及相关设备

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9729517B2 (en) * 2013-01-22 2017-08-08 Amazon Technologies, Inc. Secure virtual machine migration

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140115623A1 (en) * 2012-10-18 2014-04-24 Broadcom Corporation Integration of Untrusted Framework Components With a Secure Operating System Environment
CN103870336A (zh) * 2012-12-07 2014-06-18 三星电子株式会社 数据处理设备的基于优先级的应用运行方法及装置
US20180239896A1 (en) * 2015-08-25 2018-08-23 Seltech Corporation System including a hypervisor
CN108959916A (zh) * 2017-05-22 2018-12-07 华为技术有限公司 用于访问安全世界的方法、装置和系统
CN107633394A (zh) * 2017-09-19 2018-01-26 山东大学 一种基于TrustZone技术的移动支付系统及其应用
CN110955493A (zh) * 2019-11-13 2020-04-03 东软集团股份有限公司 一种实现安全运行环境切换的方法、系统及相关设备

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115904761A (zh) * 2023-01-03 2023-04-04 南京芯驰半导体科技有限公司 片上系统、车辆及视频处理单元虚拟化方法

Also Published As

Publication number Publication date
EP4160403A1 (en) 2023-04-05
CN113849261A (zh) 2021-12-28
EP4160403A4 (en) 2023-10-25
US20230185901A1 (en) 2023-06-15

Similar Documents

Publication Publication Date Title
EP3937424B1 (en) Blockchain data processing methods and apparatuses based on cloud computing
US9471355B2 (en) Secure operations for virtual machines
KR102295960B1 (ko) 가상화 기반의 보안 서비스 제공 장치 및 제공 방법
EP2862119B1 (en) Network based management of protected data sets
CN113632081B (zh) 用于计算实例内的增强安全计算的经验证孤立运行时环境
US20230259462A1 (en) Data Management Method, Apparatus, and System, and Storage Medium
CN111414640B (zh) 秘钥访问控制方法和装置
US20210132975A1 (en) Automated host attestation for secure run-time environments
WO2022001842A1 (zh) 处理数据的方法、主机及装置
US10686596B2 (en) Mutually authenticated adaptive management interfaces for interaction with sensitive infrastructure
JP2022501733A (ja) データ管理の方法および装置並びにサーバ
US11436318B2 (en) System and method for remote attestation in trusted execution environment creation using virtualization technology
US11360824B2 (en) Customized partitioning of compute instances
WO2023041025A1 (zh) 基于云技术的计算节点及基于云技术的实例管理方法
US11922211B2 (en) System and method for cross-architecture trusted execution environment migration
WO2023027814A1 (en) Distributed trusted platform module key management protection for roaming data
US20230291558A1 (en) Trusted computing-based local key escrow method, apparatus, device and medium
CN114584398B (zh) 一种计费管理方法及系统
WO2023041037A1 (zh) 基于云技术的计算节点及基于云技术的实例管理方法
US20240095338A1 (en) Isolated runtime environments for securing secrets used to access remote resources from compute instances
CN115048679B (zh) 一种融合片内安全防护功能的多业务分区隔离芯片
US11805109B1 (en) Data transfer encryption offloading using session pairs
CN110990120B (zh) 虚拟机监视器分区间通信方法及装置、存储介质和终端
CN118260027A (zh) 一种安全虚拟机管理方法和相关设备
Will et al. Enclave Management Models for Safe Execution of Software Components.

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21834542

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021834542

Country of ref document: EP

Effective date: 20221230

NENP Non-entry into the national phase

Ref country code: DE