WO2025026327A1 - Data processing method and apparatus, and device and storage medium - Google Patents

Abstract

Provided in the embodiments of the present disclosure are a data processing method and apparatus, and a device and a storage medium. The method comprises: in a trusted execution environment, initializing a first program and a second program that is different from the first program; respectively allocating a first memory space and a second memory space for the first program and the second program, wherein the first memory space is a linear memory address space and comprises at least a first memory page, the second memory space is a linear memory address space and comprises at least a second memory page, and the second memory page is different from the first memory page; mapping the first memory page of the first memory space to a first virtual memory page in a virtual address space of the trusted execution environment; and mapping the second memory page of the second memory space to the first virtual memory page in the virtual address space.

Description

Data processing method, device, equipment and storage medium

This application claims priority to the Chinese invention patent application entitled “Data processing method, device, equipment and storage medium” and application number 202310967247.X filed on August 2, 2023. The entire contents of this application are incorporated by reference into this application.

Technical Field

Example embodiments of the present disclosure generally relate to the field of computers, and more particularly, to a data processing method, apparatus, device, and computer-readable storage medium based on a trusted execution environment.

Background Art

Trusted execution environment (TEE) builds a secure area in the central processing unit through software and hardware methods, which can provide an independent execution environment with confidentiality and integrity protection for the programs running in it. In a trusted execution environment, program running code and confidential data can be maintained in an encrypted isolated memory, and calculations are completed in the encrypted memory. The entire calculation process is invisible to the outside, thus achieving data protection. In other words, different programs can be run in a trusted execution environment in an isolated manner. While this isolation ensures data security, it also increases the complexity of sharing data between programs. Therefore, how to quickly and efficiently realize memory sharing in a trusted execution environment to achieve data sharing between programs is a technical problem that needs to be solved urgently.

Summary of the invention

In a first aspect of the present disclosure, a data processing method is provided, comprising: in a trusted execution environment, initializing a first program and a second program different from the first program; allocating a first memory space and a second memory space to the first program and the second program respectively; wherein the first memory space is visible to the first program and invisible to the second program, and the second memory space is visible to the second program and invisible to the first program; wherein the first memory space is linear A memory address space, and includes at least a first memory page; and wherein the second memory space is a linear memory address space, and includes at least a second memory page, and the second memory page is different from the first memory page; mapping the first memory page of the first memory space to the first virtual memory page in the virtual address space of the trusted execution environment; and mapping the second memory page of the second memory space to the first virtual memory page in the virtual address space.

In a second aspect of the present disclosure, a data processing device is provided, comprising: a program initialization module, configured to: initialize a first program and a second program different from the first program in a trusted execution environment; a memory allocation module, configured to allocate a first memory space and a second memory space to the first program and the second program, respectively; wherein the first memory space is visible to the first program and invisible to the second program, and the second memory space is visible to the second program and invisible to the first program; wherein the first memory space is a linear memory address space and includes at least a first memory page; and wherein the second memory space is a linear memory address space and includes at least a second memory page, the second memory page being different from the first memory page; a first mapping module, configured to map a first memory page of the first memory space to a first virtual memory page in a virtual address space of the trusted execution environment; and a second mapping module, configured to map a second memory page of the second memory space to a first virtual memory page in the virtual address space.

In a third aspect of the present disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit. When the instructions are executed by the at least one processing unit, the electronic device executes the method of the first aspect.

In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the computer-readable storage medium, and the computer program can be executed by a processor to implement the method of the first aspect.

It should be understood that the contents described in this content section are not intended to limit the key features or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

FIG1 is a schematic diagram showing an example environment in which embodiments of the present disclosure can be implemented;

FIG2 shows a flow chart of a data processing method according to some embodiments of the present disclosure;

FIG3 illustrates a block diagram of a memory map according to some embodiments of the present disclosure;

FIG4 illustrates a block diagram of a program address according to some embodiments of the present disclosure;

FIG5 shows a flow chart of a shared memory mapping method according to some embodiments of the present disclosure;

FIG6 illustrates another memory mapping block diagram according to some embodiments of the present disclosure;

FIG7 shows a schematic structural block diagram of a data processing device according to some embodiments of the present disclosure; and

FIG8 illustrates a block diagram of an electronic device in which one or more embodiments of the present disclosure may be implemented.

DETAILED DESCRIPTION

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

Herein, unless explicitly stated, executing a step “in response to A” does not mean executing the step immediately after “A” but may include one or more intermediate steps.

It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

As an optional but non-limiting embodiment, in response to receiving an active request from the user, the prompt information is sent to the user in a manner such as a pop-up window, in which the prompt information can be presented in text form. In addition, the pop-up window can also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation to the embodiments of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the embodiments of the present disclosure.

In recent years, virtual machine technology has been widely used. In order to optimize the processing of virtual machines, a binary instruction set suitable for virtual machine scenarios is proposed, namely, WebAssembly (abbreviated as Wasm in this disclosure).

Wasm technology has good isolation. Specifically, multiple Wasm programs can be executed simultaneously in a virtual machine based on Wasm technology. Each Wasm program has an independent linear memory address space. In this case, each Wasm program can only access the data in its own linear memory address space, and cannot observe or interfere with the execution flow and data flow of other Wasm programs.

In addition, Wasm technology is a lightweight instruction set. Specifically, Wasm programs are small in size, fast in cold start, and consume low system resources. Furthermore, Wasm technology has good portability and can be used as a compilation target for other high-level languages. Specifically, Wasm instructions are a binary format and are not limited to development languages. In this case, programs written in high-level languages can be compiled into Wasm bytecodes to be run in the Wasm virtual machine. Currently, languages that support Wasm instructions include C, C++, Rust, etc.

Since Wasm technology is a lightweight instruction set and has good portability and isolation, in addition to browser scenarios, Wasm technology is increasingly used in application scenarios that need to support multi-language and multi-tenant programs.

However, while the good isolation of Wasm technology enhances data security, it also makes data exchange between Wasm programs more complicated. As discussed above. When a Wasm program is running, each Wasm program can only access its own linear memory address space and cannot access any area outside its own linear memory address space. Under this limitation, if two Wasm programs want to exchange data, they can usually only copy the data from the linear memory address space of one Wasm program to the linear memory address space of another Wasm program through memory copying, which results in low efficiency in exchanging data between Wasm programs.

In some embodiments, shared memory can be implemented through memory remapping technology to improve the efficiency of exchanging data. Specifically, memory remapping technology refers to remapping the physical memory space pointed to by a virtual address to another physical memory space by changing the address translation process of the operating system. For example, the virtual address VA ₁ originally points to the physical address PA ₁ , and the virtual address VA ₁ can be remapped to point to the physical address PA _2. In this way, the program can access the physical address PA ₂ by accessing VA ₁ .

In some embodiments, memory sharing can be achieved by remapping a set of continuous virtual addresses in the linear memory address space of different Wasm programs to a shared data area. For example, the first Wasm program expects to share a memory area Region _A in its linear memory address space with the second Wasm program and the third Wasm program. The second Wasm program and the third Wasm program can map an unused virtual address space in their respective linear memory address spaces that meets the shared memory length to the physical memory area corresponding to Region _A. Therefore, memory sharing can be achieved between Wasm programs through memory remapping technology, thereby avoiding the additional system development required to achieve data sharing through memory copying. pin.

In recent years, in order to improve data security, trusted execution environment technology has also been widely used in virtual machine management and maintenance scenarios. Trusted execution environment technology builds a secure area in the central processor through software and hardware methods, which can provide an independent execution environment with confidentiality and integrity protection for the programs running in it.

In some embodiments, the trusted execution environment can implement process-level protection. Specifically, in a trusted execution environment, program running code and confidential data can be maintained in an encrypted isolated memory, and calculations are completed in the encrypted isolated memory. The entire calculation process is invisible to the outside world, and even an operating system with a higher privilege level cannot see the execution flow and confidential data in the encrypted isolated memory.

In some embodiments, since Wasm technology can achieve safer memory isolation and can well support multi-language architecture, Wasm technology can be applied to a trusted execution environment to more conveniently and quickly build a lightweight trusted data sandbox through Wasm technology. When Wasm technology is applied to a trusted execution environment, the memory security feature of Wasm technology restricts Wasm programs from accessing address spaces outside the sandbox, and must call system-supervised application programming interfaces to access system resources, which enables Wasm programs running in a trusted execution environment to have two-way sandbox isolation protection. In this way, privacy computing and cloud proxy computing scenarios based on a trusted execution environment can be effectively supported, and public cloud confidential computing services such as Function as a Service (FaaS) can be created.

In some embodiments, the technology based on software fault isolation (SFI) can make multiple Wasm programs running in the same system non-interfering with each other and invisible to each other. In this solution, the system is required to set a continuous and independent linear memory address space for each Wasm program, and limit each Wasm program to access only its own linear memory address space. However, this linear memory management mechanism leads to obvious lack of support for shared memory. Specifically, when using the linear memory model, the memory sharing of multiple Wasm programs mainly depends on memory remapping technology. However, the shared memory based on memory remapping is not very versatile. For example, it cannot support user-mode trusted execution environment. This is because the user-mode trusted execution environment does not trust the page table managed by the operating system, so it does not support the shared memory. The operating system is allowed to remap the memory pages of the trusted execution environment. In addition, the above memory management mechanism cannot achieve fine-grained memory access control. In this case, shared memory is usually set to read and write, and it is impossible to limit a shared memory block to read-only for some Wasm programs and read and write for other Wasm programs.

More importantly, the security of the above memory management mechanism is not strong enough. Specifically, all areas of the shared memory of the Wasm program are readable and writable, and read-only permissions cannot be configured separately, resulting in the existing page table being able to modify the constant variables of the Wasm program through buffer overflow attacks, thereby changing the program execution flow.

In order to solve at least part of the above problems, the present disclosure proposes a data processing scheme based on a trusted execution environment. The scheme includes: in a trusted execution environment, initializing a first program and a second program different from the first program; allocating a first memory space and a second memory space to the first program and the second program respectively, wherein the first memory space is a linear memory address space and includes at least a first memory page; and wherein the second memory space is a linear memory address space and includes at least a second memory page, and the second memory page is different from the first memory page; mapping the first memory page of the first memory space to the first virtual memory page in the virtual address space of the trusted execution environment; and mapping the second memory page of the second memory space to the first virtual memory page in the virtual address space. In this way, shared memory can be realized between linear memory address spaces isolated from each other.

Example Environment

Fig. 1 shows a schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented. As shown in Fig. 1, the example environment 100 may include a computing device 110. As shown in Fig. 1, the computing device 110 may be deployed with a trusted execution environment 150. In the trusted execution environment 150, one or more virtual machines 160 may be run.

Multiple programs may be run on the virtual machine 160, such as the first program 170-1 and the second program 170-2 shown in FIG1. For ease of discussion, the first program 170-1 and the second program 170-2 may be collectively referred to as programs 170.

An example of program 170 is a Wasm program. An example of trusted execution environment 150 is a trusted execution environment based on user mode, such as a trusted execution environment based on Software Guard Extensions (SGE). Guard Extensions (SGX) trusted execution environment.

Wasm programs have three operating modes: interpreter (Interpreter), ahead of time (Ahead Of Time, AOT) and just in time (Just In Time, JIT). When Wasm runs in interpreter mode, it is necessary to interpret Wasm instructions one by one and perform corresponding operations on the virtual machine 160. When Wasm runs in ahead of time (Ahead-Of-Time, AOT) mode, the Wasm bytecode can be converted into machine code in advance in a compilation step similar to that of a C++ program. The pre-compiled Wasm program is not an executable file that can be run directly and needs to be loaded at runtime. When Wasm runs in just-in-time compilation mode, it is still interpreted and executed as a whole, but frequently run code will be compiled to generate machine code to speed up the operation.

Furthermore, when the program 170 is running, it may be allocated with mutually isolated linear memory address spaces, each of which may include multiple memory pages, and at least some of the multiple memory pages may be mapped to virtual memory pages of the virtual address space 190. As shown in FIG1 , the first program 170-1 is allocated with a first memory space 180-1, and the second program 170-2 is allocated with a second memory space 180-2.

Next, we will take the pre-compilation mode as an example to describe the address mapping mechanism of the Wasm program. When the Wasm program is executed, a 32-bit address can be used to access a 64-bit virtual memory address. Furthermore, the Wasm program can only see a 32-bit address, which is called a Wasm address/program address, and its value range is [0, 4294967296], where 4294967296 is the maximum value of a 32-bit unsigned integer. When the Wasm program is running, the Wasm address needs to be converted to a virtual memory address. The address translation process from Wasm address to virtual address is described as follows.

In some embodiments, when the Wasm program is running, a linear virtual memory of size SIZE _Mem is allocated. This continuous linear virtual memory is represented as [ADDR _Mem , ADDR _Mem + SIZE _Mem ], where ADDR _Mem is the starting virtual memory address of the linear virtual memory. When the Wasm program accesses the linear memory, the mapping of the Wasm address ADDR _Wasm to the virtual address ADDR _Virt is ADDR _Virt = ADDR _Wasm + ADDR _Mem .

Since Wasm programs use continuous virtual addresses as Wasm programs at runtime The linear memory of the Wasm address is simply the sum of the starting address of the linear memory, making the address translation process very simple.

In some embodiments, the computing device 110 can be any type of mobile terminal, fixed terminal or portable terminal, including a mobile phone, a desktop computer, a laptop computer, a notebook computer, a netbook computer, a tablet computer, a media computer, a multimedia tablet, a personal communication system (PCS) device, a personal navigation device, a personal digital assistant (PDA), an audio/video player, a digital camera/camcorder, a positioning device, a television receiver, a radio broadcast receiver, an e-book device, a gaming device, or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. In some embodiments, the client device 120 can also support any type of interface for the user (such as a "wearable" circuit, etc.).

Alternatively, in some embodiments, the computing device 110 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks, and big data and artificial intelligence platforms. The computing device 110 may include, for example, a computing system/server, such as a mainframe, an edge computing node, a computing device in a cloud environment, and the like.

It should be understood that the structure and function of each element in the environment 100 are described only for exemplary purposes, and do not imply any limitation on the scope of the present disclosure. In other words, the structure, function, quantity and link relationship of the elements in the environment 100 can be changed according to actual needs. The present disclosure is not limited in this respect.

Example Method

FIG2 shows a flow chart of a data processing process 200 according to some embodiments of the present disclosure. For ease of discussion, the discussion is made with reference to the environment 100 of FIG1 . The data processing process 200 may be implemented at a computing device 110. Further, when the program 170 is a Wasm program, the process 200 may be executed by a “Wasm runtime”.

In some example embodiments as follows, the Wasm program will be used as the first program In the example of 170-1/second program 170-2, a trusted execution environment based on Software Guard Extension (SGX) will be used as an example of trusted execution environment 150. It should be understood that the above example cannot be understood as a limitation on the scope of protection of the present disclosure. In other embodiments, the first program 170-1/second program 170-2 can be other instruction programs with good isolation, and the trusted execution environment 150 can be other user-mode trusted execution environments. The scope of protection of the present disclosure is not limited in this respect.

In some embodiments, the second memory space 180-2 is isolated from the first memory space 180-1. In addition, the first memory space 180-1 is invisible to the second program 170-2, and the second memory space 180-2 is invisible to the first program 170-1.

At block 210 , in the trusted execution environment 150 , the computing device 110 initializes the first program 170 - 1 and the second program 170 - 2 .

At block 220 , the computing device 110 allocates a first memory space 180 - 1 and a second memory space 180 - 2 to the first program 170 - 1 and the second program 170 - 2 , respectively.

In some embodiments, the first memory space 180 - 1 is a linear memory address space and includes at least a first memory page.

In some embodiments, the second memory space 180 - 2 is a linear memory address space and includes at least a second memory page, which is different from the first memory page.

At block 230 , the computing device 110 maps a first memory page of the first memory space 180 - 1 to a first virtual memory page in the virtual address space 190 of the trusted execution environment.

In box 240, the computing device 110 maps the second memory page of the second memory space 180-2 to the first virtual memory page in the virtual address space 190.

It can be seen that by dividing the linear memory address space allocated to the program 170 into memory pages and mapping the memory pages into virtual memory pages, a paging-based memory management and maintenance mechanism can be established in a trusted execution environment. In this way, shared memory can be implemented between isolated linear memory address spaces.

In some embodiments, the first memory space 180-1 further includes a third memory page and a fourth memory page, wherein the third memory page and the fourth memory page are two consecutive memory pages in the first memory space 180-1. The computing device 110 maps the third memory page of the first memory space 180-1 to the second virtual memory page in the virtual address space 190, and maps the first memory space 180-1 to the second virtual memory page in the virtual address space 190. The fourth memory page of 180 - 1 is mapped to the third virtual memory page in the virtual address space 190 , wherein the second virtual memory page and the third virtual memory page are not continuous in the virtual address space 190 .

The above process is better understood with reference to FIG3 , which shows a block diagram of a memory map 300 according to some embodiments of the present disclosure. For ease of discussion, reference is made to the environment 100 of FIG1 .

3, the first memory space 180-1 is allocated to the first program 170-1, which includes the first memory page 310, the third memory page 311, and the fourth memory page 312, etc. The second memory space 180-2 is allocated to the first program 170-2, which includes the second memory page 320, etc.

The computing device 110 is responsible for maintaining the virtual address space 190, which includes the first virtual memory page 330, the second virtual memory page 331, the third virtual memory page 332, etc. When the first program 170-1 (or the second program 170-2) needs to use the first memory space 180-1/the second memory space 180-2, the computing device 110 is responsible for establishing/maintaining/interpreting the mapping of the first memory space 180-1/the second memory space 180-2 to the virtual address space 190.

3 , the first memory page 310 of the first program 170 - 1 and the second memory page 320 of the second program 170 - 2 are both mapped to the first virtual memory page 330. In other words, according to some embodiments of the present disclosure, shared memory can be implemented by modifying the address mapping/translation process.

Further, in the specific embodiment of Figure 3, the first memory page 310 and the second memory page 320 can be called shared memory pages; since the third memory page 311 and the fourth memory page 312 are not shared with other programs, the third memory page 311 and the fourth memory page 312 can also be called private memory pages of the first program 170-1.

3 , the third memory page 311 and the fourth memory page are continuous in the first memory space 180 - 1 . In operation, the third memory page 311 and the fourth memory page are mapped to the second virtual memory page 331 and the third virtual memory page 332 , respectively.

In this way, continuous memory pages in the linear memory address space can be mapped in a non-linear manner to non-contiguous virtual memory pages in the virtual address space 190. In this way, the memory mapping method will be more flexible.

According to some embodiments of the present disclosure, the internal memory in the system can be accessed through a page table. Next, how to design and maintain the page table will be described in conjunction with an exemplary embodiment.

In some embodiments, the memory size of the linear memory address space can be set to an integer multiple of a predetermined memory block. For example, when the program 170 is a Wasm program, the size of the linear memory address space allocated to the program 170 can be an integer multiple of 65536 bytes (ie, 64KB).

Referring to Fig. 4, a block diagram of a program address 400 according to some embodiments of the present disclosure is shown. In the specific embodiment of Fig. 4, the size of each memory page is 64KB, then for a 32-bit program address, the high/low 16 bits can be used as a memory page index, and the low/high 16 bits can be used as an offset within the page.

In some embodiments, the computing device 110 may generate a first mapping table for the first program 170-1, wherein the first mapping table includes at least one page table entry. Further, each page table entry corresponds to a corresponding memory page in the first memory space 180-1 and indicates at least one of the following: whether the corresponding memory page has been mapped to a virtual memory page in the virtual address space 190, or virtual address information of the virtual memory page corresponding to the corresponding memory page in the virtual address space 190.

Continue to refer to Figure 3. In Figure 3, the first mapping table may include a first page table entry corresponding to the first memory page 310, wherein the first page table entry includes at least one of the following: first information indicating that the first memory page 310 has been mapped to the first virtual memory page 330, and second information indicating a first virtual address identifying the first virtual memory page 330.

In an example embodiment where program 170 is a Wasm program, the mapping relationship between the Wasm address and the virtual address of the Wasm program may be stored in the page table, that is, the mapping relationship between the memory page information of the Wasm program and the virtual memory page is stored.

Furthermore, when the maximum memory allocated to the Wasm program is 4G and each memory page is 64KB, each Wasm program can be allocated a maximum of 65536 memory pages (because 64KB*65536=4GB). In this case, each page table can include a maximum of 65536 page table entries, each of which stores information corresponding to a memory page. In some embodiments, each page table entry may include first information, which The parameter can be a Boolean value, which is used to indicate whether the Wasm memory page has been bound to a virtual memory page, or whether the starting address of the Wasm memory page has been bound to the starting address of a virtual memory page. If a Wasm memory page has been bound to a virtual memory page, the first information value is true, and the corresponding page table entry can be called a mapped page table entry. Correspondingly, if a Wasm memory page has not yet been bound to a virtual memory page, the first information value is false, and the corresponding page table entry can be called an unmapped page table entry. Alternatively, each page table entry may also include second information, and when the first information is true/a Wasm memory page has been bound to a virtual memory page, the second information indicates the starting address of the virtual memory page to which the Wasm memory page is bound.

In this way, the mapping relationship of memory pages can be maintained separately through the page table, which reduces the cost of memory page maintenance and improves the efficiency of memory page maintenance.

Furthermore, dynamic allocation of memory can be achieved by dynamically modifying the page table. Specifically, when the computing device 110 loads a program 170, a page table is created for the program. During execution, at least one page table entry in the page table can be dynamically modified, that is, an unmapped memory page is mapped to a corresponding virtual memory page.

In some embodiments, in response to the first program 170 - 1 being executed, the computing device 110 generates a first mapping table for the first program 170 - 1 , wherein the first mapping table has a preset number of page table entries, for example, equal to (or less than) 65536 page table entries.

Further, in response to detecting an increase memory instruction for the first program 170-1, the computing device 110 modifies at least one page table entry in the first mapping table to indicate a mapping relationship between at least one newly allocated memory page in the first memory space 180-1 and at least one virtual memory page in the virtual address space 190.

Additionally, before the program 170 is released, the program 170 may be allowed to release the previously established mapping. For example, the program 170 may call a mapping release interface provided by the system to release a portion of the memory page mapping according to the program 170's requirements.

The Wasm program is used as an example for further description. The Wasm program bytecode specifies its initial memory size and maximum memory size. Therefore, when creating a page table, the computing device 110 may first map part of the Wasm page to a virtual memory page to meet the program's initial memory size requirement. For example, a page table with 65536 page table entries is created, and 4096 of the entries are modified. Change to mapped entry.

If the Wasm program has a memory growth requirement later, more mappings are created through the Wasm memory growth instruction to achieve memory expansion, that is, by modifying the unmapped page table entries to mapped page table entries. Correspondingly, before the Wasm program is released, the Wasm program can also call the system instruction to release the mapped page table entries.

In this way, the system's memory can be allocated on demand as needed and released promptly when not needed, thereby improving the utilization of system resources.

According to some embodiments of the present disclosure, different read and write permissions can be configured for different memory pages. When the memory page is a shared memory page, the security of data management can be effectively improved.

In some embodiments, the first mapping table includes a first sub-mapping table and/or a second sub-mapping table. The first sub-mapping table includes at least one first page table entry, and the at least one first page table entry corresponds to at least one memory page for which the first program 170-1 has read-only permission. Accordingly, the second sub-mapping table includes at least one second page table entry, and the at least one second page table entry corresponds to at least one memory page for which the first program 170-1 has write permission.

In other embodiments of implementing memory page read and write permission control, each page table entry may include third information in addition to the first information and the second information, and the third information indicates the read and write permission information of the corresponding program for the memory page corresponding to the page table entry.

Still taking the Wasm program as an example to describe the embodiment of the read-write control right item. In some embodiments, when multiple Wasm programs share memory with each other, it is necessary to restrict the write permission of the shared memory to prevent irrelevant programs from modifying the shared memory.

However, the traditional solution cannot achieve read and write control of shared memory. Specifically, in the traditional solution, permission control is effective for all Wasm programs. Therefore, in the traditional solution, when a Wasm program obtains access to a piece of shared memory, it has both read and write permissions. Under this restriction, a Wasm program cannot limit another Wasm program to only read shared memory, because in the traditional solution, if the shared memory page is set to read-only, all Wasm programs in the system cannot obtain write permissions.

According to the paging-based memory management and maintenance mechanism disclosed in the present invention, memory access control can be optimized by setting up a read page table (i.e., the first sub-mapping table) and a write page table (i.e., the second sub-mapping table). Specifically, the computing device 110 maintains two single pages for each Wasm program. The Wasm program uses the read page table to translate the address, and the write page table to translate the address. In this way, a Wasm program can implement read/write access control for different memory pages.

According to the paging-based memory management and maintenance mechanism disclosed herein, the mapping relationship between program addresses and virtual addresses can also be modified at the memory page granularity, thereby conveniently realizing cross-program shared memory. Next, the creation of cross-program shared memory will be further described with reference to FIG5. FIG5 shows a flow chart of a shared memory mapping method 500 according to some embodiments of the present disclosure. In the embodiment of FIG5, the computing device 110 has mapped a first memory page to a first virtual memory page.

In box 510, during the execution of the first program, the computing device 110 detects a request for creating a shared memory initiated by the first program 170-1, and the shared memory creation request indicates the first memory address information of the first memory page, the read and write permission information set by the first program for the first memory page, and the first identification information of the first memory page.

In block 520 , in response to detecting a request initiated by the second program 170 - 2 to query the shared memory, the computing device 110 returns an identification information list of the shared memory to the second program 170 - 2 , the identification information list including the first identification information of the first memory page.

In block 530 , the computing device 110 detects a shared memory mapping request initiated by the second program 170 - 2 , the shared memory mapping request indicating second memory address information of the second memory page and first identification information of the first memory page.

At block 540 , in response to detecting the shared memory mapping request, the computing device 110 maps the second memory page to the first virtual memory page.

Still taking the Wasm program as an example for description. In some embodiments, the first Wasm program can call a preset function to create a shared memory page. The input parameters of the preset function may include: 1) information indicating a section of shared memory that the first Wasm program expects to share; 2) information indicating the access control policy of this shared area, that is, the read and write permissions of other Wasm programs to this area; 3) an identifier for identifying this section of shared memory. As an example, the first Wasm program expects to share the first memory page and restrict other Wasm programs from modifying it. Change the content of the first memory page and set the flag of the first memory page to "1".

The second Wasm program may send a shared memory query request. The computing device 110 returns a list to the second Wasm program, in which the identifiers of the currently existing shared memory areas are stored, for example, the identifier "1" of the first memory page.

The second Wasm program can remap a memory area in its own linear memory address space to the corresponding shared memory by sending a shared memory mapping request. For example, if the second Wasm program expects to map its second memory page to the first memory page of the first Wasm program, the second Wasm program sends a shared memory mapping request indicating the second memory page address and the first memory page identifier "1". The computing device 110 can map the second memory page to the first virtual memory page, that is, the virtual memory page corresponding to the first memory page.

In this way, memory sharing can be achieved quickly and easily without introducing too much overhead, and different Wasm programs can have different read and write permission controls.

In addition, to further improve data security, computing device 110 may set boundary checking rules to prevent out-of-bounds access by program 170. Specifically, computing device 110 performs boundary checking on each access initiated to the linear memory address space to ensure that a program can only access its own linear memory address space.

In the paging memory management mode, an exception memory page may be used to assist in implementing boundary checking. Referring to FIG. 6 , it shows a block diagram of another memory map 600 according to some embodiments of the present disclosure.

In some embodiments, the computing device 110 detects a data access request initiated by the first program 170-1. In response to detecting the data access request initiated by the first program 170-1, the computing device 110 determines whether the memory address corresponding to the data is within the first memory space 180-1, and if the memory address is not within the first memory space 180-1, maps the memory address to an abnormal virtual memory page 610 of the virtual address space 190.

Taking the Wasm program as an example, the computing device 110 can maintain a 64KB memory area for each Wasm program, which is called an abnormal memory page. In some embodiments, the computing device 110 pre-modifies the address of the virtual memory page in the unmapped page table entry to point to the virtual memory address of the abnormal memory page. Therefore, when the Wasm program accesses the unmapped memory page, it actually accesses its own abnormal memory page.

In this way, when the memory access is legal, the abnormal memory page will never be accessed. Only when the memory is out of bounds, the abnormal memory page will be accessed. Since the abnormal memory page does not store any meaningful information, the out-of-bounds access can only touch the abnormal memory page and will not affect the original sandbox design of Wasm.

According to some embodiments of the present disclosure, a paging memory management method is proposed, which is particularly suitable for the Wasm-based SGX environment. The paging memory management disclosed in the present disclosure can effectively solve the shortcomings of insufficient support for shared memory in the linear memory model and the inability to flexibly set read-only permissions.

In addition, according to the paging-based memory management and maintenance mechanism disclosed in the present invention, the virtual address corresponding to the linear memory of the Wasm program can be non-contiguous, and it supports dynamically increasing or decreasing the linear memory by establishing or canceling the corresponding mapping on the page table.

More importantly, the shared memory solution implemented according to the paging-based memory management and maintenance mechanism disclosed in the present invention is more versatile (applicable to various types of trusted execution environments including SGX), and can implement flexible read and write permission control on shared memory areas between multiple programs.

Example devices and equipment

7 shows a schematic structural block diagram of a data processing apparatus 700 according to some embodiments of the present disclosure. The apparatus 700 may be implemented as or included in a computing device 110. Each module/component in the apparatus 700 may be implemented by hardware, software, firmware, or any combination thereof.

As shown in FIG. 7 , the apparatus 700 includes: a program initialization module 710, configured to: in a trusted execution environment, initialize a first program and a second program different from the first program; a memory allocation module 720, configured to allocate a first memory space and a second memory space to the first program and the second program, respectively; wherein the first memory space is visible to the first program and invisible to the second program, and the second memory space is visible to the second program and invisible to the first program; wherein the first memory space is a linear memory address space and includes at least a first memory page; and wherein the second memory space is a linear memory address space and includes at least a second memory page, the second memory page being different from the first memory page; a first mapping module 730, configured to map a first memory page of the first memory space to the trusted execution environment; and a second mapping module 740, configured to map a second memory page of the second memory space to the first virtual memory page in the virtual address space.

In some embodiments, the device 700 also includes an out-of-bounds check module, which is configured to determine whether the memory address corresponding to the data is within the first memory space in response to detecting an access request for data initiated by the first program; and based on determining that the memory address is not within the first memory space, map the memory address to an abnormal virtual memory page of the virtual address space.

In some embodiments, the device 700 also includes: a page table generation module, configured to: generate a first mapping table for the first program, the first mapping table including at least one page table entry, each page table entry corresponding to a corresponding memory page in the first memory space and indicating at least one of the following: whether the corresponding memory page has been mapped to a virtual memory page in the virtual address space, or virtual address information of the virtual memory page corresponding to the corresponding memory page in the virtual address space.

In some embodiments, the page table generation module is further configured to: in response to detecting that the first program is initialized, generate a first mapping table for the first program, the first mapping table having a preset number of page table entries. The device 700 also includes: a memory modification module, configured to, in response to detecting an increase memory instruction for the first program, modify at least one page table entry in the first mapping table to indicate a mapping relationship between at least one newly allocated memory page in the first memory space and at least one virtual memory page in the virtual address space.

In some embodiments, the first mapping table includes a first page table entry corresponding to the first memory page, the first mapping table entry including at least one of the following: first information indicating that the first memory page has been mapped to a first virtual memory page, second information indicating a first virtual address identifying the first virtual memory page, and third information indicating read and write permission information of the first program for the first memory page.

In some embodiments, the first mapping table includes at least one of the following: a first sub-mapping table, the first sub-mapping table includes at least one first page table entry, and the at least one first page table entry corresponds to at least one memory page for which the first program has read-only permission; a second sub-mapping table, the second sub-mapping table includes at least one second page table entry, and the at least one second page table entry corresponds to at least one memory page for which the first program has write permission.

In some embodiments, the first memory space also includes a third memory page and a fourth memory page, and the third memory page and the fourth memory page are two consecutive memory pages in the first memory space. The device 700 also includes: a second mapping module, configured to map the third memory page to a second virtual memory page in the virtual address space; and a third mapping module, configured to map the fourth memory page to a third virtual memory page in the virtual address space, and the second virtual memory page and the third virtual memory page are not consecutive in the virtual address space.

In some embodiments, the device 700 also includes: a shared request detection module, configured to: during the execution of the first program, detect a request for creating a shared memory initiated by the first program, the request for creating a shared memory indicates the following information: first memory address information of the first memory page, read and write permission information set by the first program for the first memory page, and first identification information of the first memory page; a shared memory query request processing module, configured to: in response to detecting a request for querying shared memory initiated by the second program, return a list of identification information of the shared memory in the trusted execution environment to the second program, the list of identification information including the first identification information of the first memory page; a shared memory mapping request processing module, configured to: detect a shared memory mapping request initiated by the second program, the shared memory mapping request indicates the second memory address information of the second memory page and the first identification information of the first memory page; and a shared memory mapping module, configured to: in response to detecting a shared memory mapping request, map the second memory page to the first virtual memory page.

FIG8 shows a block diagram of an electronic device 800 in which one or more embodiments of the present disclosure may be implemented. It should be understood that the electronic device 800 shown in FIG8 is merely exemplary and should not constitute any limitation on the functionality and scope of the embodiments described herein. The electronic device 800 shown in FIG8 may be used to implement the computing device 110 of FIG1 .

As shown in FIG8 , the electronic device 800 is in the form of a general electronic device or computing device. The components of the electronic device 800 may include, but are not limited to, one or more processors or processing units 810, a memory 820, a storage device 830, one or more communication units 840, one or more input devices 850, and one or more output devices 860. The processing unit 810 may be an actual or virtual processor and is capable of performing various processes according to a program stored in the memory 820. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to improve the parallel processing capability of the electronic device 800.

The electronic device 800 typically includes a plurality of computer storage media. Such media may be any accessible media that is accessible to the electronic device 800, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 820 may be a volatile memory (e.g., a register, a cache, a random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 830 may be a removable or non-removable medium, and may include a machine-readable medium, such as a flash drive, a disk, or any other medium, which may be capable of being used to store information and/or data (e.g., training data for training) and may be accessed within the electronic device 800.

The electronic device 800 may further include additional removable/non-removable, volatile/non-volatile storage media. Although not shown in FIG. 8 , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a “floppy disk”) and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to a bus (not shown) by one or more data media interfaces. The memory 820 may include a computer program product 825 having one or more program modules configured to perform various methods or actions of various embodiments of the present disclosure.

The communication unit 840 implements communication with other electronic devices through a communication medium. Additionally, the functions of the components of the electronic device 800 can be implemented with a single computing cluster or multiple computing machines that can communicate through a communication connection. Therefore, the electronic device 800 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

The input device 850 may be one or more input devices, such as a mouse, a keyboard, a tracking ball, etc. The output device 860 may be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 800 may also communicate with one or more external devices (not shown) through the communication unit 840 as needed, such as a storage device, a display device, etc., communicate with one or more devices that allow a user to interact with the electronic device 800, or communicate with any device that allows the electronic device 800 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via This is performed by an input/output (I/O) interface (not shown).

According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein the computer-executable instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above.

Various aspects of the present disclosure are described herein with reference to the flowcharts and/or block diagrams of the methods, devices, equipment, and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and/or block diagram and the combination of each box in the flowchart and/or block diagram can be implemented by computer-readable program instructions.

These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions/actions specified in one or more boxes in the flowchart and/or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and/or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions/actions specified in one or more boxes in the flowchart and/or block diagram.

Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable data processing apparatus, or other device implement the functions/actions specified in one or more boxes in the flowchart and/or block diagram.

The flowcharts and block diagrams in the accompanying drawings show possible architectures, functions, and operations of systems, methods, and computer program products according to various implementations of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a portion of an instruction, which includes one or more functions for implementing a specified logic. The blocks may be executable instructions for performing a specific function or action. In some alternative implementations, the functions noted in the blocks may occur in a different order than that noted in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and/or flow chart, and combinations of blocks in the block diagram and/or flow chart, may be implemented using a dedicated hardware-based system that performs the specified functions or actions, or may be implemented using a combination of dedicated hardware and computer instructions.

The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the various implementations disclosed herein.

Claims (18)

A data processing method, comprising: In a trusted execution environment, initializing a first program and a second program different from the first program; Allocate a first memory space and a second memory space to the first program and the second program respectively; wherein the first memory space is visible to the first program and invisible to the second program, and the second memory space is visible to the second program and invisible to the first program; Wherein, the first memory space is a linear memory address space and includes at least a first memory page; and The second memory space is a linear memory address space and includes at least a second memory page, and the second memory page is different from the first memory page; Mapping the first memory page of the first memory space to a first virtual memory page in the virtual address space of the trusted execution environment; and A second memory page of the second memory space is mapped to the first virtual memory page in the virtual address space. The method according to claim 1, further comprising: In response to detecting a data access request initiated by the first program, determining whether a memory address corresponding to the data is within the first memory space; and Based on determining that the memory address is not in the first memory space, the memory address is mapped to an abnormal virtual memory page of the virtual address space. The method according to claim 1, further comprising: A first mapping table is generated for the first program, the first mapping table comprising at least one page table entry, each page table entry corresponding to a corresponding memory page in the first memory space and indicating at least one of the following: Whether the corresponding memory page has been mapped to a virtual memory page in the virtual address space, or Virtual address information of a virtual memory page corresponding to the corresponding memory page in the virtual address space. The method according to claim 3, wherein generating the first mapping table for the first program comprises: In response to detecting that the first program is initialized, generating the first mapping table for the first program, the first mapping table having a preset number of page table entries; And the method further comprises: In response to detecting an increase memory instruction for the first program, at least one page table entry is modified in the first mapping table to indicate a mapping relationship between at least one newly allocated memory page in the first memory space and at least one virtual memory page in the virtual address space. The method according to claim 3, wherein the first mapping table includes a first page table entry corresponding to the first memory page, and the first page table entry includes at least one of the following: first information, the first information indicating that the first memory page has been mapped to a first virtual memory page, second information indicating a first virtual address identifying the first virtual memory page, and The third information indicates the read and write permission information of the first program with respect to the first memory page. The method according to claim 3, wherein the first mapping table includes at least one of the following: a first sub-mapping table, the first sub-mapping table comprising at least one first page table entry, the at least one first page table entry corresponding to at least one memory page for which the first program has read-only permission; and A second sub-mapping table, wherein the second sub-mapping table includes at least one second page table entry, and the at least one second page table entry corresponds to at least one memory page for which the first program has write permission. The method according to claim 1, wherein the first memory space also includes a A third memory page and a fourth memory page, wherein the third memory page and the fourth memory page are two consecutive memory pages in the first memory space, and the method further includes: Mapping the third memory page of the first memory space to a second virtual memory page in the virtual address space; and The fourth memory page is mapped to a third virtual memory page in the virtual address space, and the second virtual memory page and the third virtual memory page are not continuous in the virtual address space. The method according to claim 1, further comprising: During the execution of the first program, detecting a request for creating a shared memory initiated by the first program, the request for creating a shared memory indicating the following information: first memory address information of the first memory page, read and write permission information set by the first program for the first memory page, and first identification information of the first memory page; In response to detecting a request for querying the shared memory initiated by the second program, returning to the second program a list of identification information of the shared memory in the trusted execution environment, the list of identification information including the first identification information of the first memory page; detecting a shared memory mapping request initiated by the second program, the shared memory mapping request indicating second memory address information of the second memory page and the first identification information of the first memory page; and In response to detecting the shared memory mapping request, mapping the second memory page to the first virtual memory page. A data processing device, comprising: A program initialization module is configured to: initialize a first program and a second program different from the first program in a trusted execution environment; A memory allocation module, configured to allocate a first memory space and a second memory space to the first program and the second program respectively; wherein the first memory space is visible to the first program and invisible to the second program, and the second memory space is visible to the second program and invisible to the first program; wherein the first memory space is a linear memory address space and includes at least a first memory page; and wherein the second memory space is a linear memory address space and includes at least a second memory page. page, the second memory page is different from the first memory page; A first mapping module is configured to map the first memory page of the first memory space to a first virtual memory page in the virtual address space of the trusted execution environment; and The second mapping module is configured to map the second memory page of the second memory space to the first virtual memory page in the virtual address space. The apparatus according to claim 9, further comprising an out-of-bounds checking module configured to: In response to detecting a data access request initiated by the first program, determining whether a memory address corresponding to the data is within the first memory space; and Based on determining that the memory address is not in the first memory space, the memory address is mapped to an abnormal virtual memory page of the virtual address space. The apparatus according to claim 9, further comprising a page table generation module configured to: A first mapping table is generated for the first program, the first mapping table comprising at least one page table entry, each page table entry corresponding to a corresponding memory page in the first memory space and indicating at least one of the following: Whether the corresponding memory page has been mapped to a virtual memory page in the virtual address space, or Virtual address information of a virtual memory page corresponding to the corresponding memory page in the virtual address space. The apparatus according to claim 11, wherein the page table generation module is further configured to: In response to detecting that the first program is initialized, generating the first mapping table for the first program, the first mapping table having a preset number of page table entries; And the device also includes: A memory modification module is configured to modify at least one page table entry in the first mapping table in response to detecting an increase memory instruction for the first program to indicate a mapping relationship between at least one newly allocated memory page in the first memory space and at least one virtual memory page in the virtual address space. The apparatus according to claim 11, wherein the first mapping table comprises a first page table entry corresponding to the first memory page, the first page table entry comprising at least one of the following: first information, the first information indicating that the first memory page has been mapped to a first virtual memory page, second information indicating a first virtual address identifying the first virtual memory page, and The third information indicates the read and write permission information of the first program for the first memory page. The apparatus according to claim 11, wherein the first mapping table comprises at least one of the following: a first sub-mapping table, the first sub-mapping table comprising at least one first page table entry, the at least one first page table entry corresponding to at least one memory page for which the first program has read-only permission; and A second sub-mapping table, wherein the second sub-mapping table includes at least one second page table entry, and the at least one second page table entry corresponds to at least one memory page for which the first program has write permission. The device according to claim 9, wherein the first memory space further includes a third memory page and a fourth memory page, the third memory page and the fourth memory page are two consecutive memory pages in the first memory space, and the device further includes: A second mapping module is configured to map the third memory page to a second virtual memory page in the virtual address space; and The third mapping module is configured to map the fourth memory page to a third virtual memory page in the virtual address space, and the second virtual memory page and the third virtual memory page are not continuous in the virtual address space. The apparatus according to claim 9, further comprising: The sharing request detection module is configured to: during the running of the first program, detect a request initiated by the first program to create a shared memory, wherein the request to create a shared memory indicates the following information: first memory address information of the first memory page, information of the first program, the read and write permission information set for the first memory page and the first identification information of the first memory page; a shared memory query request processing module, configured to: in response to detecting a request for querying the shared memory initiated by the second program, return to the second program a list of identification information of the shared memory in the trusted execution environment, the list of identification information including the first identification information of the first memory page; a shared memory mapping request processing module, configured to: detect a shared memory mapping request initiated by the second program, the shared memory mapping request indicating second memory address information of the second memory page and the first identification information of the first memory page; and The shared memory mapping module is configured to: in response to detecting the shared memory mapping request, map the second memory page to the first virtual memory page. An electronic device, comprising: at least one processing unit; and At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the electronic device to perform the method according to any one of claims 1 to 8 when executed by the at least one processing unit. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 8.