WO2018153027A1 - 一种数据迁移方法及装置 - Google Patents

一种数据迁移方法及装置 Download PDF

Info

Publication number
WO2018153027A1
WO2018153027A1 PCT/CN2017/095829 CN2017095829W WO2018153027A1 WO 2018153027 A1 WO2018153027 A1 WO 2018153027A1 CN 2017095829 W CN2017095829 W CN 2017095829W WO 2018153027 A1 WO2018153027 A1 WO 2018153027A1
Authority
WO
WIPO (PCT)
Prior art keywords
enclave
source host
host
migration
target application
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/095829
Other languages
English (en)
French (fr)
Inventor
夏虞斌
申宇
陈海波
翟征德
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP17897879.7A priority Critical patent/EP3572938B1/en
Priority to CN201780087318.XA priority patent/CN110622138B/zh
Publication of WO2018153027A1 publication Critical patent/WO2018153027A1/zh
Priority to US16/549,861 priority patent/US11347542B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4843—Task transfer initiation or dispatching by program, e.g. task dispatcher, supervisor, operating system
    • G06F9/485—Task life-cycle, e.g. stopping, restarting, resuming execution
    • G06F9/4856—Task life-cycle, e.g. stopping, restarting, resuming execution resumption being on a different machine, e.g. task migration, virtual machine migration
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/4557—Distribution of virtual machine instances; Migration and load balancing
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149—Restricted operating environment
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to a data migration method and apparatus.
  • Enclave In the CPU (Central Processing Unit) Isolated Execution technology, a secure execution area (Enclave) can be created by the CPU to execute security-sensitive applications.
  • the privileged code includes a virtual machine monitor (VMM).
  • OS Output System
  • BIOS Basic Input Output System
  • EPC Enclave Page Cache, Enclave, Enclave memory
  • Enclave of application A refers to a CPU-protected execution environment created in the address space of application A, and some or all codes of application A can be run in the Enclave.
  • the code running in Enclave is called Enclave code.
  • the Enclave code of Application A is running state data generated during the running process, such as data segment, heap, stack, SSA (State Save Area), etc., and the data is stored in application A.
  • the Enclave is in the EPC.
  • VMs virtual machines
  • containers such as Dockers
  • applications etc.
  • the code and status data of the computing entity in memory are generally accessed by the operating system or VMM on the source host and sent to the target physical host to reconstruct the computing entity.
  • an application creates or uses a CPU Enclave
  • the code and data in the Enclave are only accessible to the application's Enclave code and cannot be accessed by the operating system or virtual machine monitor on the source host.
  • Enclave's EPC cannot be migrated to the target physical host, causing inconsistent application state data before and after migration.
  • Embodiments of the present invention provide a data migration method and apparatus, which can implement migration of Enclave between different hosts.
  • an embodiment of the present invention provides a data migration method, including: a source host acquires a migration instruction for instructing a target application that creates an Enclave to be migrated to a destination host; and a source host invokes an Enclave preset in the target application.
  • the migration control thread because the migration control thread is located in the Enclave of the target application, the migration control thread can access the running state data of the target application in the EPC, so that the migration control thread uses the running state data of the target application in the EPC.
  • the target memory is the area of the source host's memory that can be directly accessed by the operating system or the virtual machine monitor, because the data in the target memory is allowed.
  • Source host operating system or virtual machine monitor access source The host can send the protected running state data of the target application in the target memory to the destination host, thereby implementing data migration in the EPC, so that the data of the target application before and after the migration is consistent.
  • the source host invokes a migration control thread preset in the Enclave of the target application to write the running state data of the target application in the EPC to the source host in an encrypted and integrity-protected manner.
  • the target memory includes: the source host calls the migration control thread to obtain running state data of the target application from the EPC; the source host calls the migration control thread to write the running state data to the target memory.
  • the target application Enclave further includes N working threads, N ⁇ 1; wherein the source host invokes a migration control thread to obtain running state data of the target application from the EPC, including
  • the source host calls the migration control thread to set the global state of the Enclave to the migration state; when the global state is the migration state, the source host forces the worker thread to exit by waiting for the end of each worker thread execution or by interrupt.
  • Enclave and prevent it from re-entering Enclave set the local state of each worker thread in N worker threads to the stop state; when the local state of each worker thread in N worker threads is stopped, the source host calls The migration control thread acquires operational state data of the target application within the EPC. At the same time, the source host records the CSSA value of each worker thread that was forcibly interrupted.
  • the worker thread may modify the running state data of the target application in the EPC during the running process, if the local state of any of the N worker threads is busy, the worker thread may be modifying the operation of the Enclave. State data, at this time, the migration control thread needs to wait for the local state of the worker thread to change to the stop state, until the migration control thread determines that the local state of the N worker threads is the stop state, and starts the data migration process in the Enclave, It can be avoided that during the migration process, any worker threads in the Enclave modify the running state data of the Enclave, which causes the target application to be inconsistent before and after the migration.
  • the method further includes: the source host invoking the migration migration control thread to perform encryption on the running state data. And integrity protection operations; wherein the source host invokes the migration control thread to write the protected operational state data to the target memory, including: the source host invokes the migration control thread to write the encrypted operational state data with integrity protection Into the target memory.
  • an embodiment of the present invention provides a data migration method, including: a destination host acquires running state data of a target application from a source host; and a destination host restores an Enclave of the target application in an EPC of a memory of the destination host; A migration control thread of the target application is created in the Enclave of the target application; the destination host invokes the migration control thread to copy the operational status data into the EPC.
  • the destination host recovers the Enclave of the target application in the EPC of the memory, including: the destination host acquires an Enclave creation record of the target application from the source host, and the Enclave creation record records the target application. Enclave's memory address; the destination host restores the Enclave of the target application in the EPC of the memory based on the memory address.
  • the destination host invokes the migration control thread to copy the running state data into the EPC, including: the destination host invokes the migration control thread to protect the protected running state It is written into the EPC; the destination host calls the migration control thread to perform integrity verification and decryption operations on the operational state data written in the EPC, and restore the operational status data.
  • the destination host obtains the CSSA value of each thread that is forcibly interrupted by the source host, and adjusts the CSSA value of each worker thread in the target Enclave by manufacturing a page fault interrupt method. the same.
  • an embodiment of the present invention provides a source host, including: an obtaining unit, configured to acquire a migration instruction, where the migration instruction is used to instruct a target application that creates an Enclave to be migrated to a destination host; and an execution unit is used to invoke The target application's preset migration control thread in the Enclave is used to write the running state data of the target application in the EPC to the target host's target memory in an encrypted and integrity-protected manner, and the target memory is the source host's memory.
  • the execution unit is specifically configured to: invoke the migration control thread to obtain running state data of the target application from the EPC; invoke the migration control thread to perform the operation in the EPC Status data is written to the target memory in a protected manner.
  • the Enclave of the target application further includes N working threads, N ⁇ 1; the execution unit is specifically configured to: the source host invokes the migration control thread to globalize the Enclave
  • the state is set to the migration state; when the global state is the migration state, the source host will each N work threads by waiting for each worker thread to finish executing or by forcing the worker thread to exit the Enclave and prevent it from re-entering the Enclave.
  • the local state of the worker thread is set to the stop state; when the local state of each worker thread in the N worker threads is the stop state, the migration control thread can acquire the running state data of the Enclave.
  • the source host records the CSSA value of each worker thread that was forcibly interrupted.
  • the physical host further includes: an encryption unit, configured to invoke the migration control thread to perform an encryption and integrity protection operation on the running state data; and an execution unit, specifically configured to: invoke the migration control Thread to write encryption and run-time data with integrity protection to the target memory.
  • an embodiment of the present invention provides a destination host, including: an obtaining unit, configured to acquire running state data of a target Enclave from a source host, and a recovery unit, configured to recover the target in an EPC of a memory of the destination host Enclave; a unit for creating a migration control thread in the target Enclave; and a copy unit for invoking the migration control thread to copy the running state data into the EPC.
  • the recovery unit is specifically configured to: obtain an Enclave creation record of the target application from the source host, where the Enclave creates a memory address of the Enclave of the target application recorded; according to the memory address The Enclave of the target application is restored in the EPC of memory.
  • the copying unit is specifically configured to: invoke the migration control thread to write the running state data into the EPC; invoke the migration control thread to perform integrity on the running state data Verify and decrypt the operation and restore the enclave run status data.
  • the destination host obtains the CSSA value of each thread that is forcibly interrupted from the source host, and adjusts the CSSA value of each worker thread in the target Enclave to be the same by manufacturing a page fault interrupt.
  • an embodiment of the present invention provides a source host, including: a processor, a memory, a bus, and a communication interface; the memory is configured to store a computer execution instruction, and the processor is connected to the memory through the bus.
  • the processor executes the computer-executed instructions stored by the memory to cause the source host to perform any of the data migration methods of the first aspect described above.
  • an embodiment of the present invention provides a destination host, including: a processor, a memory, a bus, and a communication interface; the memory is configured to store a computer execution instruction, and the processor is connected to the memory through the bus, and the destination host In operation, the processor executes the computer-executed instructions stored by the memory to cause the destination host to perform any of the data migration methods of the second aspect above.
  • the embodiment of the present invention provides a data migration system, including the source host of any of the third aspects, and the destination host of any of the fourth aspects.
  • an embodiment of the present invention provides a computer readable storage medium, where the computer readable storage medium stores instructions, when the source host and/or the destination host are running, causing the source host and/or Or the destination host performs the data migration method of the above aspects.
  • an embodiment of the present invention provides a computer program product, including instructions, when the source host and/or the destination host are run on the source host and/or the destination host, so that the source host and/or the destination host perform data migration in the foregoing aspects. method.
  • the names of the source host and the destination host are not limited to the device itself. In actual implementation, the devices may appear under other names. As long as the functions of the respective devices are similar to the embodiments of the present invention, they are within the scope of the claims and the equivalents thereof.
  • FIG. 1 is a schematic structural diagram of an operating environment of a virtual machine in an implementation of the present invention
  • FIG. 2 is a schematic structural diagram of a data migration system according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of interaction of a data migration method according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of an application scenario of a data migration method according to an embodiment of the present disclosure
  • FIG. 5 is a schematic flowchart of a data migration method according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of a source host according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a destination host according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of hardware of a source host (or a destination host) according to an embodiment of the present invention.
  • first and second are used for descriptive purposes only, and are not to be construed as indicating or implying a relative importance or implicitly indicating the number of technical features indicated.
  • features defining “first” and “second” may include one or more of the features either explicitly or implicitly.
  • the meaning of "a plurality" is two or more unless otherwise specified.
  • Virtual Machine Virtual machine software can simulate one or more virtual computers on a physical host. These virtual machines work like real computers. Operating systems and applications can be installed on virtual machines. The virtual machine can also access network resources. For an application running in a virtual machine, the virtual machine is like working on a real computer.
  • Container A lightweight application runtime environment for isolating applications from multiple tenants on the same physical host. Generally, multiple containers share the operating system kernel. Typical containers are Docker, LXC, etc.
  • Hardware layer The hardware platform on which the virtualized environment runs. As shown in FIG. 1 , the hardware layer may include various hardware.
  • the hardware layer of a physical host may include a CPU, a memory, a network card, a memory, and a high speed/low speed input/output (I/O, Input/Output) device. And other devices with specific processing capabilities.
  • Host As a management layer, it is used to manage and allocate hardware resources; to present a virtual hardware platform for virtual machines; to realize scheduling and isolation of virtual machines.
  • a virtual machine monitor VMM
  • the virtual hardware platform provides various hardware resources for each virtual machine running on it, such as providing a virtual processor (VCPU, virtual CPU), virtual memory, a virtual disk, a virtual network card, and the like.
  • the embodiment of the present invention can be applied to a virtual computing platform such as a Xen, a KVM (Kernel-based Virtual Machine), a Docker, or the like, which is not limited by the embodiment of the present invention.
  • a virtual computing platform such as a Xen, a KVM (Kernel-based Virtual Machine), a Docker, or the like, which is not limited by the embodiment of the present invention.
  • the embodiment of the present invention provides a data migration method, which can be applied to the data migration system shown in FIG. 2, and includes a source host 21 and a destination host 22.
  • the source host 21 runs the application A, and the application A is any application that creates an Enclave (memory protection area), that is, the Enclave code in the application A is run in the EPC of the source host 21, and the operation process The operational status data generated in is stored in the EPC.
  • Enclave memory protection area
  • the memory of the source host 21 is usually accessed by the operating system of the source host 21, and the code of the application A stored in the memory and the running status data and the like are sent to the destination host 22.
  • the above operating state data stored in the EPC in the memory only allows the Enclave code of the application A to be accessed by calling the CPU of the source host 21. Therefore, the data in the EPC cannot be sent to the destination host 22, then the destination host 22 is based on the source host.
  • the running state of the application A recovered by the data sent by 21 may be different from the running state of the application A running in the source host 21.
  • a migration control thread is created in advance, because the migration control thread is located.
  • the code of the migration control thread in the application A's Enclave is also the Enclave code of the application A. Therefore, the migration control thread can access the running state data of the application A in the EPC, and write the running state data to the target other than the EPC.
  • the migration control thread may also be used to restore the migrated running state data to the EPC where the Enclave of the application A in the destination host is located.
  • the source host 21 when the source host 21 obtains the migration instruction (instructed to indicate that the target application to be created with the Enclave, for example, the application A, is migrated to the destination host 22), the migration control thread within the Enclave of the application A has access.
  • the access authority of the EPC therefore, the source host 21 can call the migration control thread to write the running state data of the application A in the EPC to the target memory of the source host 21; since the data in the target memory allows the operating system access of the source host 21 Therefore, the subsequent source host 21 can use the existing data migration method to send the above-mentioned running state data written in the target memory and the related data of the application A originally stored in the target memory to the destination. Host 22.
  • the destination host 22 may first restore the Enclave of the application A in the EPC of the destination host 22 for the application A, and then create the migration control thread of the application A in the Enclave.
  • the migration control thread has access to the EPC, so it can be created by the migration.
  • the shift control thread copies the above operational state data to the EPC where the application A's Enclave is located, decrypts and restores the running state of the Enclave in the application A.
  • data migration in the EPC can be implemented in the process of application migration, so that the data of the application before and after the migration is consistent.
  • the above migration control thread can also perform encryption and integrity protection operations on the running state data of the EPC target application, thereby ensuring the confidentiality and integrity of the running state data during the migration process, which will be elaborated in the following embodiments. I won't go into details here.
  • the data migration method provided by the embodiment of the present invention is applicable not only to the migration process of the virtual machine in the cloud virtualization environment, but also to the migration process of the application and the container containing the Enclave between any two physical hosts.
  • the data migration method provided by the embodiment of the present invention is illustrated by taking the migration process of the virtual machine as an example.
  • FIG. 3 is a schematic diagram of interaction of a data migration method according to an embodiment of the present invention, where the method includes:
  • the source host obtains a migration instruction, where the migration instruction is used to instruct the source host to migrate the target application created with the Enclave to the destination host.
  • Hosts are running on the source host. At least one virtual machine runs on the host, and at least one application can run in each virtual machine. Then, when the target virtual machine (the target virtual machine is one of the at least one virtual machine) is migrated to the destination host, the application in the target virtual machine needs to be migrated to the destination host, and the application in the target virtual machine may include creation. There are target applications for Enclave.
  • the VMM in the Host may send a migration instruction to the target virtual machine to indicate the target virtual machine: the source host prepares to migrate the target application, such as application A, to the destination host.
  • the target virtual machine may also query the VMM to periodically generate a migration instruction from the VMM by means of a polling monitoring. If the migration instruction is generated, the migration instruction is obtained from the VMM, which is not limited in this embodiment of the present invention. .
  • the source host invokes the Enclave driver to send a preset migration signal to the migration control thread in the target application's Enclave.
  • the target virtual machine After the target virtual machine obtains the above migration instruction, it checks whether an application containing Enclave is created in the target virtual machine. For an application including Enclave, such as application A in FIG. 4, the application A generally needs to run N (N) in its Enclave. ⁇ 1) worker threads, and in the embodiment of the present invention, a migration control thread is preset in the Enclave of the application A, and the migration control thread is specifically used to perform data migration on the data in the EPC area in which the Enclave is located.
  • the specific code executed by the migration control thread is that the part of the code pre-written in the Enclave of the application A is specifically used to migrate the running state data generated in the Enclave in the EPC. Then, after the source host obtains the migration instruction, A new thread can be created to execute the above-mentioned pre-written code. The new thread is the migration control thread. The migration control thread executes the corresponding signal and executes the corresponding code to complete the following steps 303-304. The data migration process continues until the end of the data migration process.
  • an application including Enclave is created in the target virtual machine, for example, application A, as shown in FIG. 4, the target virtual machine can invoke the Enclave driver in the target virtual machine operating system to apply to the above application A.
  • the migration control thread in the Enclave sends a preset migration signal to trigger the migration control thread to perform the above data migration process.
  • the migration signal may be a signal that is predefined by a person skilled in the art according to actual experience, and is not limited in this embodiment of the present invention.
  • the source host invokes the migration control thread to obtain running state data of the target application from the EPC.
  • the operating state data may specifically be the stack data, the heap data, the SSA data, and the like generated when the Enclave code of the target application runs in the Enclave, and the embodiment of the present invention does not impose any limitation.
  • the following steps 501-506 can be performed to access the running state data of the application A in the EPC where the Enclave is located.
  • the source host invokes a migration control thread to set the global state of the target Enclave to a migration state.
  • a global identifier may be set in the Enclave of the application A, where the global identifier is used to indicate a global state, and the global identifier is queried by the N working threads. Then, after the migration control thread in the Enclave receives the migration signal, the migration control thread can set the global state of the enclave to the migration state. For example, setting the global identifier to 1, indicating that the operation status data of the Enclave is currently required to be executed. data migration.
  • the source host waits for the local state of each worker thread in the N working threads to be stopped according to the global state.
  • the source host For each of the N worker threads, the source host is pre-configured with a local identifier that indicates the local state of the worker thread.
  • the worker thread sets its own local state to busy, indicating that the worker thread is running, and the worker thread may modify the running state of the application A in the EPC during the running process. data.
  • the working thread when the working thread starts, the working thread sets the local state to a busy state, and then the working thread queries the current state.
  • the global identifier if the global identifier is 1 (that is, the global state is the migration state), the worker thread can set the local state corresponding to the stop state (free) after the execution is completed or forced to exit the Enclave to inform the migration. Control the thread.
  • the source host determines that the local state of each worker thread in the N working threads is a stop state.
  • the source host may determine that the local state of each of the N working threads is a stop state by calling the migration control thread, or each of the N working threads may set its own local state.
  • the embodiment of the present invention does not impose any limitation on the stop state.
  • the migration control thread in the Enclave after the migration control thread sets the global state of the Enclave to the migration state, the local state of the N worker threads is monitored. If the local state of any of the N worker threads is busy, it indicates that the worker thread may be modifying the running state data of the application A in the EPC. At this time, the migration control thread needs to wait for the local state transition of the worker thread. To stop the state, until the migration control thread determines that the local state of the N working threads is the stop state, the following steps 504-506 may continue.
  • the migration control thread in the Enclave detects that any one or more of the N working threads (for example, worker thread 1) is busy, if the source host wants to start immediately Data migration, you can force all busy lines through interrupts (such as clock interrupts) Exit the Enclave. After each worker thread exits Enclave, it can check whether the above global state is 1. If the global state is 1, the worker thread gives up re-entering Enclave and sets its local state to stop state (free).
  • the running state data of each worker thread in the Enclave such as the value of the CPU general-purpose register, will be automatically saved to the SSA by the CPU, and the stack pointer of the SSA.
  • the CSSA Current State Save Area
  • the source host When the source host forces all busy worker threads to exit Enclave by interrupt, the running state data of the worker thread is automatically saved to the SSA, and the CSSA of each forced interrupted thread is incremented by 1.
  • the source host can record each job. The value of the thread's CSSA. After the source host subsequently migrates the value of the CSSA to the destination host, the destination host can restore the current execution state of the working thread 1 according to the value of the CSSA, and ensure that the target application runs in the same state before and after the migration.
  • the source host does not need to wait for all the worker threads in the Enclave of the target application to execute and then migrate, thereby improving the migration efficiency of the target application.
  • the source host if the source host is willing to accept a certain wait time, it can wait for all worker threads to complete execution, and each worker thread sets the local state to a stop state after exiting the enclave. When the local state of all worker threads is stopped, the running state data of the enclave is read.
  • the source host invokes the migration control thread to access the running state data of the target application in the EPC through the CPU of the source host.
  • the migration control thread Since the migration control thread is located in the Enclave of the application A, the migration control thread has the right to access the EPC where the Enclave is located. Then, the migration control thread can access the operation of the application A in the EPC where the Enclave is located through the CPU of the source host. Status data, which in turn replicates the operational status data of the application A.
  • the migration control thread in the source host performs an encryption operation on the foregoing running state data.
  • the migration control thread in the source host adds integrity protection to the encrypted running state data.
  • the source host may use the message authentication code MAC (Message Authentication Code) or digital signature method to add integrity protection to the encrypted running state data.
  • MAC Message Authentication Code
  • digital signature method may be used to add integrity protection to the encrypted running state data.
  • the source host can obtain the encryption key and the MAC key through Enclave's remote attestation technology.
  • the entity without the encryption key such as the operating system, virtual monitor, and administrator, cannot read the running status data.
  • the entity of the MAC key cannot tamper with the data, thereby improving the confidentiality and integrity of the operational status data generated within the Enclave during data migration.
  • the migration control thread accesses the running state data of the target application in the EPC by calling the CPU of the source host.
  • the source host invokes a migration control thread to write the foregoing running state data into the target memory.
  • the target memory involved in the embodiment of the present invention refers to an area other than the EPC in the memory of the source host, and the area may be accessed by an operating system of the source host or a virtual machine monitor.
  • the migration control thread writes the encrypted and integrity-protected running state data to the target memory, so that the running state data is written in the target memory accessible by the operating system, but due to the running state data It has been encrypted and added integrity protection, thus improving the security of the operational status data located in the target memory.
  • the source host sends the running state data of the target application to the destination host.
  • the code of the application A and the Enclave creation record of the application A (the Enclave creation record records the memory address of the Enclave created in the application A) and the related data of the CSSA of each worker thread are also stored.
  • the source host may send the data, the running state data of the target application, and the related data of the target virtual machine to the destination host, and the destination host restores the target virtual machine, and restores the application A in the target virtual machine. To achieve the migration process of application A.
  • a data migration method includes:
  • the destination host acquires running state data of the target application from the source host.
  • the destination host obtains an Enclave creation record of the target application from the source host and a CSSA of each worker thread, and the Enclave creates a memory address of the Enclave in which the target application is recorded.
  • the source host can store the target application code (including the Enclave code running in the Enclave and the code running outside the Enclave), the running status data, the Enclave creation record, and the CSSA of each worker thread in the target virtual machine. Send to the destination host.
  • the target application code including the Enclave code running in the Enclave and the code running outside the Enclave
  • the running status data including the Enclave code running in the Enclave and the code running outside the Enclave
  • the Enclave creation record including the CSSA of each worker thread in the target virtual machine.
  • the foregoing operational status data is encrypted operational status data with integrity protection.
  • the destination host restores the Enclave of the target application in the EPC of the memory of the destination host according to the foregoing memory address.
  • the destination host creates a migration control thread of the target application in the Enclave of the target application.
  • the destination host invokes a migration control thread to write the foregoing operational status data into the EPC.
  • the destination host may first create a target virtual machine on the host of the destination host, and then create an initial target application in the newly created target virtual machine according to the code of the received target application.
  • the running state of the target application at this time may be a preset initial value.
  • the operating system of the destination host since some of the target applications may not be running in the Enclave of the target application, the operating system of the destination host has access to the running state data generated by the running of the part of the code, then the destination host The operating system can be called to restore this part of the operational status data in the initial target application.
  • the destination host can first target the application in its own memory EPC. Create its Enclave, the Enclave of the target application.
  • the destination host may create a new Enclave in the EPC of the destination host according to the memory address recorded in the Enclave creation record of the target application, and load the Enclave code of the target application into the new Enclave. , as the Enclave for the target application after recovery.
  • step 604 the destination host creates a migration control thread for the target application in the Enclave of the target application. Furthermore, in the steps In 605, the migration control thread writes the running state data generated by the Enclave code acquired in step 601 into the EPC where the Enclave is located, thereby restoring the running state of the entire target application.
  • the destination host needs to resume the execution progress of the worker thread 1 on the source host, so that the running state of the target application is consistent before and after the migration.
  • the default initial value of the CSSA set in the destination host is different from the value of the CSSA recorded in the above running state data.
  • the default initial value of CSSA is 0, and the value of CSSA recorded in the above running status data is not 0 (that is, it is in the interrupt when it is migrated).
  • the destination host can adjust the CSSA of worker thread 1 by actively triggering the page fault interrupt until it is the same as the value of the CSSA recorded by the source host.
  • the destination host can restore the execution progress of the worker thread 1 according to the value of the CSSA and the data segment, the stack data, the heap data, and the SSA data recorded in the Enclave in the foregoing running state data, so that the execution of the thread 1 is not performed on the source host. Worker thread 1 can continue to execute on the destination host.
  • the destination host invokes a migration control thread to perform an integrity verification operation and a decryption operation on the foregoing running state data.
  • the destination host needs to obtain encryption and encryption in order to restore the running state of the target application.
  • the key used at the time and the integrity key used for integrity protection (for example, a MAC key or a signing key).
  • steps 505, 506 that is, if the encryption is performed first in steps 505, 506 and the integrity protection is performed, then integrity verification and decryption are performed first. If the integrity protection is performed first in steps 505, 506 and then the encryption is performed, then the integrity verification needs to be performed before decryption.
  • the source host, the destination host, and the like include hardware structures and/or software modules corresponding to each function.
  • the embodiments of the present invention can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the embodiments of the invention.
  • the embodiment of the present invention may perform the division of the function modules on the source host, the destination host, and the like according to the foregoing method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present invention is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 6 is a schematic diagram of a possible configuration of a source host involved in the foregoing embodiment, where the source host includes: an obtaining unit 71, an executing unit 72, and a sending unit. 73 and encryption unit 74.
  • the obtaining unit 71 is configured to support the source host to execute the process 301 in FIG. 3; the executing unit 72 is configured to support the source host The process 303-304 in FIG. 3 and the processes 501-504 in FIG. 5 are performed; the sending unit 73 is configured to support the source host to execute the processes 302 and 305 in FIG. 3; the encrypting unit 74 is configured to support the source host to execute FIG. 5. Processes 505-506. All the related content of the steps involved in the foregoing method embodiments may be referred to the functional descriptions of the corresponding functional modules, and details are not described herein again.
  • FIG. 7 is a schematic diagram of a possible structure of the destination host involved in the foregoing embodiment, where the target host includes: an obtaining unit 81, a restoring unit 82, and a creating unit. 83 and copy unit 84.
  • the obtaining unit 81 is configured to support the destination host to perform the process 601 in FIG. 6; the recovery unit 82 is configured to support the destination host to perform the processes 602-603 in FIG. 6; the creating unit 83 is configured to support the destination host to execute the process 604 in FIG. 6; The copy unit 84 is configured to support the destination host to perform the processes 605-606 of FIG. All the related content of the steps involved in the foregoing method embodiments may be referred to the functional descriptions of the corresponding functional modules, and details are not described herein again.
  • FIG. 8 shows a possible structural diagram of the source host (or destination host) involved in the above embodiment.
  • the source host (or destination host) includes a processing module 1302 and a communication module 1303.
  • the processing module 1302 is configured to control and manage the actions of the source host (or the destination host).
  • the communication module 1303 is configured to support communication between the source host (or destination host) and other network entities.
  • the source host (or destination host) may further include a storage module 1301 for storing program code and data of the source host (or destination host).
  • the processing module 1302 may be a processor or a controller, for example, may be a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application specific integrated circuit (Application-Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out various exemplary logical blocks, modules and circuits described in connection with the disclosure of the embodiments of the invention.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication module 1303 may be a transceiver, a transceiver circuit, a communication interface, or the like.
  • the storage module 1301 may be a memory.
  • the embodiment of the present invention further provides a data migration system, which includes a source host 21 and a destination host 22 as shown in FIG. 2.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or contain one or more available media. Integrated data storage devices such as servers and data centers.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

一种数据迁移方法及装置，涉及通信技术领域，可实现EPC内的数据迁移，以提高应用程序迁移前后的数据一致性。该方法包括：源主机获取迁移指令，所述迁移指令用于指示将创建有Enclave的目标应用迁移至目的主机；所述源主机调用所述目标应用的Enclave内预置的迁移控制线程，以将EPC内所述目标应用的运行状态数据写入所述源主机的目标内存，所述目标内存为所述源主机的内存中除所述EPC之外的区域；所述源主机向目的主机发送所述目标应用在所述目标内存中的运行状态数据。

Description

一种数据迁移方法及装置
本申请要求于2017年02月23日提交中国专利局、申请号为201710100246.X、发明名称为“一种数据迁移方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及通信技术领域，尤其涉及一种数据迁移方法及装置。
背景技术
在中央处理器(CPU，Central Processing Unit)隔离执行(Isolated execution)技术中，可通过CPU创建一个安全的执行区域(Enclave)来执行安全敏感的应用，特权代码包括虚拟机监控器(VMM)、OS(Output System，输出系统)和基本输入输出系统(Basic Input Output System，BIOS)等不能访问Enclave中的内容，从而保护敏感应用代码和数据免受恶意或者含有bug的底层代码的攻击。CPU Enclave使用的内存称为EPC(Enclave Page Cache，Enclave，Enclave内存)。以应用A为例，应用A的Enclave是指在应用A的地址空间(address space)中创建的一个受CPU直接保护的执行环境，该Enclave内可运行应用A的部分或全部代码，而在该Enclave内运行的代码称为Enclave代码应用A的Enclave代码在运行过程中产生的运行状态数据，例如数据段、堆、栈、SSA(State Save Area，状态保存区域)等，这些数据存储在应用A的Enclave所在的EPC中。
在云计算应用场景下，可能需要将某些计算实体，如虚拟机(VM)、容器(如Docker)、应用等，在两台不同的物理主机之间迁移。在迁移过程中，一般由源主机上的操作系统或VMM访问内存中的计算实体的代码和状态数据，发送到目标物理主机内以重建计算实体。但是，如果某个应用创建或者使用了CPU Enclave，由于Enclave中的代码和数据只允许应用的Enclave代码访问，而无法被源主机上的操作系统或虚拟机监控器访问。因此，Enclave的EPC中存储的数据无法迁移至目标物理主机，会导致迁移前后应用程序的运行状态数据不一致。
发明内容
本发明的实施例提供一种数据迁移方法及装置，可实现Enclave在不同主机之间的迁移。
为达到上述目的，本发明的实施例采用如下技术方案：
第一方面，本发明的实施例提供一种数据迁移方法，包括：源主机获取用于指示将创建有Enclave的目标应用迁移至目的主机的迁移指令；源主机调用该目标应用的Enclave内预置的迁移控制线程，由于该迁移控制线程位于目标应用的Enclave内，因此，该迁移控制线程可访问EPC内目标应用的运行状态数据，从而由该迁移控制线程将EPC内该目标应用的运行状态数据以加密并带有完整性保护的方式写入源主机的目标内存，该目标内存为源主机的内存中可以被操作系统或者虚拟机监控器所直接访问的区域，由于目标内存中的数据是允许源主机的操作系统或虚拟机监控器访问的，源 主机可以向目的主机发送该目标应用在目标内存中的受保护的运行状态数据，从而实现EPC内的数据迁移，使得目标应用在迁移前后的运行状态等数据保持一致。
在一种可能的设计方法中，源主机调用该目标应用的Enclave内预置的迁移控制线程，以将EPC内该目标应用的运行状态数据以加密并带有完整性保护的方式写入源主机的目标内存，包括：源主机调用该迁移控制线程，以从该EPC内获取该目标应用的运行状态数据；源主机调用该迁移控制线程，以将该运行状态数据写入该目标内存。
在一种可能的设计方法中，该目标应用的Enclave内还包括N个工作线程，N≥1；其中，源主机调用迁移控制线程，以从该EPC内获取该目标应用的运行状态数据，包括：开始迁移时，源主机调用该迁移控制线程，以将该Enclave的全局状态设置为迁移状态；当全局状态为迁移状态时，源主机通过等待每个工作线程执行结束或者通过中断强迫工作线程退出Enclave并阻止其重新进入Enclave的方法，将N个工作线程中每个工作线程的本地状态设置为停止状态；当N个工作线程中每个工作线程的本地状态均为停止状态时，源主机调用该迁移控制线程，以获取EPC内所述目标应用的运行状态数据。同时源主机记录每个被强行中断的工作线程的CSSA数值。
由于工作线程在运行过程中可能会修改EPC内目标应用的运行状态数据，那么，如果N个工作线程中的任意工作线程的本地状态为忙碌状态，则说明该工作线程有可能正在修改Enclave的运行状态数据，此时，迁移控制线程需要等待该工作线程的本地状态转变为停止状态，直到迁移控制线程确定上述N个工作线程的本地状态都为停止状态后，开始Enclave内的数据迁移过程，这样可以避免目标应用在迁移的过程中，Enclave内的任意工作线程执行时修改了Enclave的运行状态数据，从而导致目标应用在迁移前后的运行状态不一致的问题。
在一种可能的设计方法中，在源主机调用该迁移控制线程，从EPC内获取该Enclave的运行状态数据之后，还包括：源主机调用该迁移迁移控制线程，以对该运行状态数据执行加密和完整性保护操作；其中，源主机调用迁移控制线程，将受保护的运行状态数据写入目标内存，包括：源主机调用迁移控制线程，以将加密并带有完整性保护的运行状态数据写入目标内存。
这样，将受保护的运行状态数据写入目标内存后，VMM、OS和云管理员无法读取和修改该运行状态数据，从而提高了数据迁移过程中Enclave内产生的运行状态数据的保密性和完整性。
第二方面，本发明的实施例提供一种数据迁移方法，包括：目的主机从源主机获取目标应用的运行状态数据；目的主机在目的主机的内存的EPC中恢复该目标应用的Enclave；目的主机在该目标应用的Enclave中创建该目标应用的迁移控制线程；目的主机调用该迁移控制线程，以将该运行状态数据复制到该EPC中。
在一种可能的设计方法中，目的主机在内存的EPC中恢复该目标应用的Enclave，包括：目的主机从源主机获取该目标应用的Enclave创建记录，该Enclave创建记录中记录有该目标应用的Enclave的内存地址；目的主机根据该内存地址在内存的EPC中恢复该目标应用的Enclave。
在一种可能的设计方法中，目的主机调用该迁移控制线程，以将该运行状态数据复制到该EPC中，包括：目的主机调用该迁移控制线程，以将该受保护的运行状态数 据写入该EPC中；目的主机调用该迁移控制线程，以对写入EPC中的运行状态数据进行完整性验证和解密操作，并恢复运行状态数据。
在一种可能的设计方法中，目的主机从源主机获取其记录的每个被强行中断的线程的CSSA数值，通过制造缺页中断的方法，调整目标Enclave中每个工作线程的CSSA数值与之相同。
第三方面，本发明的实施例提供一种源主机，包括：获取单元，用于获取迁移指令，该迁移指令用于指示将创建有Enclave的目标应用迁移至目的主机；执行单元，用于调用该目标应用的Enclave内预置的迁移控制线程，以将EPC内该目标应用的运行状态数据以加密并带有完整性保护的方式写入源主机的目标内存，该目标内存为源主机的内存中可以为OS或者VMM直接访问的区域；发送单元，用于向目的主机发送目标应用在该目标内存中的受保护的运行状态数据。
在一种可能的设计方法中，该执行单元，具体用于：调用该迁移控制线程，以从该EPC内获取该目标应用的运行状态数据；调用该迁移控制线程，以将EPC内的该运行状态数据以受保护的方式写入该目标内存。
在一种可能的设计方法中，该目标应用的Enclave内还包括N个工作线程，N≥1；该执行单元，具体用于：源主机调用所述迁移控制线程，以将所述Enclave的全局状态设置为迁移状态；当所述全局状态为迁移状态时，源主机通过等待每个工作线程执行结束或者通过中断强迫工作线程退出Enclave并阻止其重新进入Enclave的方法，将N个工作线程中每个工作线程的本地状态设置为停止状态；当N个工作线程中每个工作线程的本地状态均为停止状态时，迁移控制线程可以获取Enclave的运行状态数据。同时源主机记录每个被强行中断的工作线程的CSSA数值。
在一种可能的设计方法中，该物理主机还包括：加密单元，用于调用该迁移控制线程，以对该运行状态数据执行加密和完整性保护操作；执行单元，具体用于：调用迁移控制线程，以将加密和带有完整性保护的运行状态数据写入目标内存。
第四方面，本发明的实施例提供一种目的主机，包括：获取单元，用于从源主机获取目标Enclave的运行状态数据；恢复单元，用于在目的主机的内存的EPC中恢复该目标的Enclave；创建单元，用于在该目标Enclave中创建迁移控制线程；复制单元，用于调用该迁移控制线程，以将该运行状态数据复制到该EPC中。
在一种可能的设计方法中，该恢复单元，具体用于：从源主机获取该目标应用的Enclave创建记录，该Enclave创建记录中记录有该目标应用的Enclave的内存地址；根据该内存地址在内存的EPC中恢复该目标应用的Enclave。
在一种可能的设计方法中，该复制单元，具体用于：调用该迁移控制线程，以将该运行状态数据写入该EPC中；调用该迁移控制线程，以对该运行状态数据执行完整性验证和解密操作，并恢复enclave运行状态数据。
在一种可能的设计方法中，目的主机从源主机获取每个被强行中断的线程的CSSA数值，通过制造缺页中断的方法，调整目标Enclave中每个工作线程的CSSA数值与之相同。
第五方面，本发明的实施例提供一种源主机，包括：处理器、存储器、总线和通信接口；该存储器用于存储计算机执行指令，该处理器与该存储器通过该总线连接， 当源主机运行时，该处理器执行该存储器存储的该计算机执行指令，以使源主机执行上述第一方面中的任一项数据迁移方法。
第六方面，本发明的实施例提供一种目的主机，包括：处理器、存储器、总线和通信接口；该存储器用于存储计算机执行指令，该处理器与该存储器通过该总线连接，当目的主机运行时，该处理器执行该存储器存储的该计算机执行指令，以使目的主机执行上述第二方面中的任一项数据迁移方法。
第七方面，本发明的实施例提供一种数据迁移系统，包括第三方面中中任一项的源主机，以及第四方面中任一项的目的主机。
第八方面，本发明实施例提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在上述源主机和/或目的主机上运行时，使得上述源主机和/或目的主机执行上述各方面的数据迁移方法。
第九方面，本发明实施例提供了一种包含指令的计算机程序产品，当其在上述源主机和/或目的主机上运行时，使得上述源主机和/或目的主机执行上述各方面的数据迁移方法。
本发明的实施例中，上述源主机和目的主机的名字对设备本身不构成限定，在实际实现中，这些设备可以以其他名称出现。只要各个设备的功能和本发明的实施例类似，即属于本发明权利要求及其等同技术的范围之内。
另外，第二方面至第九方面中任一种设计方式所带来的技术效果可参见上述第一方面中不同设计方法所带来的技术效果，此处不再赘述。
附图说明
图1为本发明实施中虚拟机的运行环境的架构示意图；
图2为本发明实施例提供的一种数据迁移系统的架构示意图；
图3为本发明实施例提供的一种数据迁移方法的交互示意图；
图4为本发明实施例提供的一种数据迁移方法的应用场景示意图；
图5为本发明实施例提供的一种数据迁移方法的流程示意图；
图6为本发明实施例提供的一种源主机的结构示意图；
图7为本发明实施例提供的一种目的主机的结构示意图；
图8为本发明实施例提供的一种源主机(或目的主机)的硬件结构示意图。
具体实施方式
以下，术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括一个或者更多个该特征。在本发明实施例的描述中，除非另有说明，“多个”的含义是两个或两个以上。
为了方便理解本发明实施例，首先在此介绍本发明实施例描述中会引入的几个术语；
虚拟机(VM)：通过虚拟机软件可以在一台物理主机上模拟出一台或者多台虚拟的计算机，而这些虚拟机就像真正的计算机那样工作，虚拟机上可以安装操作系统和应用程序，虚拟机还可访问网络资源。对于在虚拟机中运行的应用程序而言，虚拟机就像是在真正的计算机中工作。
容器：一种轻量级的应用运行环境，用于隔离同一个物理主机上的多个租户的应用，一般多个容器是共享操作系统内核的。典型的容器有Docker,LXC等。
硬件层：虚拟化环境运行的硬件平台。其中，如图1所示，硬件层可包括多种硬件，例如，某物理主机的硬件层可包括CPU、内存、网卡、存储器、高速/低速输入/输出(I/O，Input/Output)设备，及具有特定处理功能的其它设备。
宿主机(Host)：作为管理层，用以完成硬件资源的管理、分配；为虚拟机呈现虚拟硬件平台；实现虚拟机的调度和隔离。例如，如图1所示，Host内可设置虚拟机监控器(VMM)。其中，虚拟硬件平台对其上运行的各个虚拟机提供各种硬件资源，如提供虚拟处理器(VCPU，virtual CPU)、虚拟内存、虚拟磁盘、虚拟网卡等等。
可以理解的是，本发明实施例可以应用于Xen、KVM(Kernel-based Virtual Machine，基于内核的虚拟机)、Docker等虚拟计算平台中，本发明实施例对此不作限制。
本发明的实施例提供一种数据迁移方法，可应用于图2所示的数据迁移系统，该系统中包括源主机21和目的主机22。
其中，源主机21内运行有应用A，该应用A为创建有Enclave(内存保护区域)的任意应用，也就是说，应用A中的Enclave代码是在源主机21的EPC中运行的，运行过程中产生的运行状态数据存储在EPC中。
那么，当需要将应用A迁移至目的主机22时，通常是由源主机21的操作系统访问源主机21的内存，将内存中存储的应用A的代码以及运行状态数据等数据发送至目的主机22。而内存中EPC内存储的上述运行状态数据只允许应用A的Enclave代码通过调用源主机21的CPU才能访问，因此，该EPC内的数据无法发送至目的主机22，那么，目的主机22根据源主机21发送的数据恢复出的应用A的运行状态，与源主机21内运行的应用A的运行状态可能不同。
对此，在本发明实施例提供的数据迁移方法中，在每一个创建有Enclave的目标应用的Enclave内，例如，图2中的应用A，预先创建一个迁移控制线程，由于该迁移控制线程位于应用A的Enclave内，即迁移控制线程的代码也是应用A的Enclave代码，因此，该迁移控制线程可访问EPC内应用A的运行状态数据，并将该运行状态数据写入除EPC之外的目标内存中，即可以由源主机21的操作系统访问的内存中。并且，当上述运行状态数据迁移至目的主机后，该迁移控制线程还可以用于将迁移来的运行状态数据恢复至目的主机内应用A的Enclave所在的EPC中。
这样，当源主机21获取到迁移指令(该迁移指令用于指示将创建有Enclave的目标应用，例如，应用A，迁移至目的主机22)后，由于应用A的Enclave内的迁移控制线程具有访问EPC的访问权限，因此，源主机21可以调用该迁移控制线程，将EPC内应用A的运行状态数据写入源主机21的目标内存；由于目标内存中的数据是允许源主机21的操作系统访问的，因此，后续源主机21便可以沿用现有的数据迁移方法，将已写入目标内存中的上述运行状态数据，以及原本就存储在目标内存中的应用A的代码等相关数据发送给目的主机22。
目的主机22接收到上述源主机21发送的应用A的相关数据后，可以先为应用A在目的主机22的EPC中恢复应用A的Enclave，进而在该Enclave内创建应用A的迁移控制线程，由于该迁移控制线程具有访问EPC的访问权限，因此，可由创建出的迁 移控制线程将上述运行状态数据复制到应用A的Enclave所在的EPC中，解密并恢复应用A中Enclave的运行状态。
这样，通过上述方法可以在应用迁移的过程中实现EPC内的数据迁移，使得应用在迁移前后的运行状态等数据保持一致。
当然，上述迁移控制线程还可以对EPC目标应用的运行状态数据执行加密和完整性保护操作，从而保证迁移过程中运行状态数据的机密性和完整性，后续实施例中将对此详细阐述，故此处不再赘述。
另外，本发明实施例提供的数据迁移方法不仅适用于云虚拟化环境下虚拟机的迁移过程中，还适用于任意两台物理主机之间对含有Enclave的应用和容器的迁移过程，本发明实施例对此不作任何限制，后续实施例中以虚拟机的迁移过程为例，举例说明本发明实施例提供的数据迁移方法。
如图3所示，为本发明实施例提供的一种数据迁移方法的交互示意图，该方法包括：
301、源主机获取迁移指令，该迁移指令用于指示源主机将创建有Enclave的目标应用迁移至目的主机。
以虚拟机迁移为例，源主机上运行有Host，Host上运行有至少一个虚拟机，而每个虚拟机内可运行至少一个应用。那么，将目标虚拟机(目标虚拟机为上述至少一个虚拟机中的一个)迁移至目的主机时，需要将目标虚拟机内的应用也迁移至目的主机，目标虚拟机内的应用中可能包括创建有Enclave的目标应用。
此时，如图4所示，Host内的VMM可以向目标虚拟机发送迁移指令，以指示目标虚拟机：源主机准备将目标应用，例如应用A，迁移至目的主机。
或者，目标虚拟机也可以通过轮询监测的方式，定时的从VMM中查询VMM是否生成迁移指令，如果生成上述迁移指令，则从VMM中获取该迁移指令，本发明实施例对此不作任何限定。
302、源主机调用Enclave驱动，向目标应用的Enclave内的迁移控制线程发送预置的迁移信号。
目标虚拟机获取到上述迁移指令后，检查目标虚拟机内是否创建了包含Enclave的应用，对于包含Enclave的应用，例如图4中的应用A，该应用A一般在其Enclave内需要运行N(N≥1)个工作线程，而在本发明实施例中，在应用A的Enclave内预先设置了一个迁移控制线程，该迁移控制线程专门用于对该Enclave所在的EPC区域内的数据执行数据迁移。
其中，上述迁移控制线程执行的具体代码是预先编写在应用A的Enclave中的这部分代码专门用于迁移EPC内在该Enclave中产生的运行状态数据，那么，当源主机获取到上述迁移指令后，可创建一个新的线程专门执行上述预先编写的代码，此时该新的线程即为上述迁移控制线程，该迁移控制线程接收到上述迁移信号后执行对应的代码，以完成下述步骤303-304的数据迁移过程，直至该数据迁移过程结束时，上述工作线程结束运行。
那么，如果目标虚拟机内创建了包含Enclave的应用，例如，应用A，则如图4所示，目标虚拟机可调用目标虚拟机操作系统内的Enclave驱动，向上述应用A的 Enclave内的迁移控制线程发送预置的迁移信号，以触发上述迁移控制线程执行上述数据迁移过程。
示例性的，该迁移信号可以为本领域技术人员根据实际经验预先定义的信号，本发明实施例对此不作任何限定。
303、源主机调用该迁移控制线程，以从EPC内获取目标应用的运行状态数据。
其中，运行状态数据具体可以为目标应用的Enclave代码在其Enclave内运行时产生的栈数据、堆数据和SSA数据等，本发明实施例对此不作任何限制。
具体的，上述应用A的Enclave内的迁移控制线程接收到迁移信号后，如图5所示，可执行下述步骤501-506，访问该Enclave所在的EPC内应用A的运行状态数据。
501、源主机调用迁移控制线程，以将目标Enclave的全局状态设置为迁移状态。
具体的，应用A的Enclave内可以设置一个全局标识，该全局标识用于指示全局状态，这个全局标识是上述N个工作线程都可以查询到的。那么，上述Enclave内的迁移控制线程接收到迁移信号后，迁移控制线程可将enclave的全局状态设置为迁移状态，例如，将全局标识设置为1，即指示当前需要对上述Enclave的运行状态数据执行数据迁移。
502、源主机根据全局状态，等待N个工作线程中每个工作线程的本地状态都变为停止状态。
对于N个工作线程中的每个工作线程，源主机都预先设置有一个本地标识，该本地标识用于指示该工作线程的本地状态。当该工作线程启动时，该工作线程会将自身的本地状态置为忙碌状态(busy)，即指示该工作线程正在运行，而工作线程在运行的过程中可能会修改EPC内应用A的运行状态数据。
因此，为了保证应用A在迁移前后的运行状态一致，在本发明实施例中，当该工作线程启动时，该工作线程会将自身的本地状态置为忙碌状态，进而，该工作线程会查询当前的全局标识，若全局标识为1(即全局状态为迁移状态)，则该工作线程可以在执行完毕后或者被强迫退出Enclave后将与其对应的本地状态设置为停止状态(free)，以告知迁移控制线程。
503、源主机确定N个工作线程中每个工作线程的本地状态均为停止状态。
例如，源主机可以通过调用上述迁移控制线程来确定上述N个工作线程中每个工作线程的本地状态均为停止状态，也可以由这N个工作线程中每个工作线程将自身的本地状态设置为停止状态，本发明实施例对此不作任何限制。
在一种可能的实现方式中，对于Enclave内的迁移控制线程，当迁移控制线程将Enclave的全局状态设置为迁移状态后，监测上述N个工作线程的本地状态。如果N个工作线程中的任意工作线程的本地状态为忙碌状态，则说明该工作线程有可能正在修改EPC内应用A的运行状态数据，此时，迁移控制线程需要等待该工作线程的本地状态转变为停止状态，直到迁移控制线程确定上述N个工作线程的本地状态都为停止状态时，可继续执行下述步骤504-506。
在另一种可能的实现方式中，当Enclave内的迁移控制线程检测到上述N个工作线程中任意一个或多个工作线程(例如，工作线程1)为忙碌状态时，如果源主机希望立即开始数据迁移，则可以通过中断(例如时钟中断)强迫所有忙碌状态的工作线 程退出Enclave。每个工作线程退出Enclave后可检查上述全局状态是否为1，如果全局状态为1，则该工作线程放弃重新进入Enclave，并把自己的本地状态设置为停止状态(free)。
通常，如果Enclave中的工作线程在执行时发生了中断，则该Enclave内每个工作线程的运行状态数据，例如CPU通用寄存器的值等，会被CPU自动保存到SSA中，而SSA的栈指针CSSA(Current State Save Area，当前线程运行状态信息)加1，CPU退出Enclave后去执行中断处理程序。
源主机通过中断强迫所有忙碌状态的工作线程退出Enclave时，该工作线程的运行状态数据将自动保存到SSA中，每个被强迫中断的线程的CSSA加1，此时源主机可记录每个工作线程的CSSA的取值。这样，源主机后续将CSSA的取值迁移至目的主机后，目的主机可以根据该CSSA的取值恢复工作线程1的当前执行状态，保证目标应用在迁移前后的运行状态一致。同时，在源主机和迁移目的主机之间迁移创建有Enclave的目标应用时，源主机无需等待目标应用的Enclave中所有工作线程都执行完毕再进行迁移，从而提高了目标应用的迁移效率。
在另外一种实现方法中，如果源主机愿意接受一定的等待时间，则可以等待所有工作线程执行完毕，每个工作线程退出enclave后将本地状态置为停止状态。当所有工作线程的本地状态为停止状态时，再读取enclave的运行状态数据。
当上述N个工作线程的本地状态都为停止状态时，可继续执行下述步骤504-506。
504、源主机调用迁移控制线程，以通过源主机的CPU访问EPC内目标应用的运行状态数据。
由于迁移控制线程位于应用A的Enclave内，因此，该迁移控制线程具有访问该Enclave所在的EPC的权限，那么，迁移控制线程可以通过源主机的CPU，访问该Enclave所在的EPC内应用A的运行状态数据，进而复制该应用A的运行状态数据。
505、源主机内的迁移控制线程对上述运行状态数据执行加密操作。
506、源主机内的迁移控制线程对加密后的运行状态数据添加完整性保护。
例如，源主机可以采用消息认证码MAC(Message Authentication Code)或数字签名的方法对加密后的运行状态数据添加完整性保护。
这里也可以采用先加密后再添加完整性保护的方法，也可以采用先添加完整性保护再加密的方法。也即，本发明实施例不限制步骤505和506之间的执行顺序。
在步骤505和506中，源主机可以通过Enclave的remote attestation(远程认证)技术，获取加密密钥和MAC密钥。
后续，源主机可将加密并带有完整性保护的运行状态数据写入目标内存后，没有加密密钥的实体，如操作系统、虚拟监控机和管理员，无法读取该运行状态数据，没有MAC密钥的实体无法篡改该数据，从而提高了数据迁移过程中Enclave内产生的运行状态数据的保密性和完整性。
至此，通过执行步骤501-506，迁移控制线程通过调用源主机的CPU，访问EPC内目标应用的运行状态数据。
304、源主机调用迁移控制线程，以将上述运行状态数据写入目标内存。
其中，本发明实施例中涉及的目标内存，是指源主机的内存中除上述EPC之外的区域，该区域可由源主机的操作系统或者虚拟机监控器访问。
具体的，迁移控制线程将经过加密和带有完整性保护的运行状态数据写入目标内存，这样，运行状态数据虽在被写入可以由操作系统访问的目标内存中，但是由于该运行状态数据已经被加密和添加完整性保护，因此，可提高位于目标内存中的运行状态数据的安全性。
305、源主机将目标应用的运行状态数据发送至目的主机。
在源主机的目标内存中，还存储有应用A的代码以及应用A的Enclave创建记录(该Enclave创建记录中记录有应用A内创建的Enclave的内存地址)以及每个工作线程的CSSA等相关数据。在步骤305中，源主机可以将这些数据、目标应用的运行状态数据以及目标虚拟机的相关数据一同发送至目的主机，由目的主机恢复上述目标虚拟机，并在目标虚拟机内恢复应用A，以实现应用A的迁移过程。
仍如图3所示，为本发明实施例提供的一种数据迁移方法，该方法包括：
601、目的主机从源主机获取目标应用的运行状态数据。
602、目的主机从源主机获取目标应用的Enclave创建记录和每个工作线程的CSSA，该Enclave创建记录中记录有目标应用的Enclave的内存地址。
具体的，源主机可以将目标虚拟机内目标应用的代码(包括在Enclave内运行的Enclave代码以及在Enclave外运行的代码)、运行状态数据、Enclave创建记录和每个工作线程的CSSA等相关信息发给目的主机。
可选的，上述运行状态数据为加密并带有完整性保护的运行状态数据。
603、目的主机根据上述内存地址在目的主机的内存的EPC中恢复目标应用的Enclave。
604、目的主机在目标应用的Enclave中创建目标应用的迁移控制线程。
605、目的主机调用迁移控制线程，以将上述运行状态数据写入EPC中。
目的主机接收到上述目标虚拟机的相关信息后，可以先在目的主机的host上创建目标虚拟机，进而，根据接收到的目标应用的代码在新创建的目标虚拟机中创建一个初始目标应用，此时的目标应用的运行状态可以为一个预设的初始值。
另外，由于目标应用中可能有一部分代码是并不是运行在目标应用的Enclave内的，因此，目的主机的操作系统对这部分代码运行时产生的运行状态数据是具有访问权限的，那么，目的主机可以调用其操作系统在初始目标应用中先恢复这部分运行状态数据。
而对于运行在目标应用的Enclave内的Enclave代码产生的运行状态数据，由于只有位于目标应用的Enclave内的Enclave代码对其具有访问权限，因此，目的主机可以先在自身内存的EPC中为目标应用创建其Enclave，即目标应用的Enclave。
具体的，在步骤603中，目的主机可以根据目标应用的Enclave创建记录中记载的内存地址，在目的主机的EPC中创建一个新的Enclave，并将目标应用的Enclave代码加载到这个新的Enclave中，作为恢复后该目标应用的Enclave。
但是，该目标应用的Enclave的运行状态还未恢复，因此，在步骤604中，目的主机在上述目标应用的Enclave中为目标应用创建一个迁移控制线程。进而，在步骤 605中，由该迁移控制线程将步骤601中获取到的Enclave代码产生的运行状态数据写入该Enclave所在的EPC中，进而恢复整个目标应用的运行状态。
进一步地，如果从源主机迁移来的数据中包含某个工作线程(例如，工作线程1)的CSSA，则说明工作线程1是通过中断方式被强迫退出Enclave的，也就是说，工作线程1在源主机上还未执行完，因此，目的主机需要恢复工作线程1在源主机上的执行进度，使得目标应用的运行状态在迁移前后保持一致。
一般，目的主机内设置的CSSA的默认初始值与上述运行状态数据中记录的CSSA的取值不相同。例如，CSSA的默认初始值为0，而上述运行状态数据中记录的CSSA的取值不为0(即迁移时正处于中断中)。此时，目的主机可通过主动触发缺页中断的方式调整工作线程1的CSSA，直至其与源主机记录的CSSA的取值相同。
这样，目的主机可以根据CSSA的取值，以及上述运行状态数据中记录的Enclave内的数据段、栈数据、堆数据和SSA数据，恢复工作线程1的执行进度，使得在源主机上未执行完的工作线程1可以在目的主机上继续执行。
606、目的主机调用迁移控制线程，以对上述运行状态数据执行完整性验证操作和解密操作。
可选的，如果源主机在发送上述Enclave代码产生的运行状态数据时已经对该运行状态数据执行了加密和完整性保护操作，那么，目的主机为了恢复目标应用的运行状态，还需要获取加加密时使用的密钥和进行完整性保护时使用的完整性密钥(例如，MAC密钥或者签名密钥)。
这里，上述完整性验证和解密操作的执行次序与步骤505、506相反，即如果步骤505、506中先执行加密再执行完整性保护，则这里需要先执行完整性验证，再解密。如果步骤505、506中先执行完整性保护再执行加密，则这里需要先解密再执行完整性验证。
可以理解的是，上述源主机、目的主机等为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本发明实施例能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明实施例的范围。
本发明实施例可以根据上述方法示例对上述源主机、目的主机等进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本发明实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，图6示出了上述实施例中所涉及的源主机的一种可能的结构示意图，该源主机包括：获取单元71，执行单元72，发送单元73和加密单元74。
获取单元71用于支持源主机执行图3中的过程301；执行单元72用于支持源主 机执行图3中的过程303-304，以及图5中的过程501-504；发送单元73用于支持源主机执行图3中的过程302和305；加密单元74用于支持源主机执行图5中的过程505-506。其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在采用对应各个功能划分各个功能模块的情况下，图7示出了上述实施例中所涉及的目的主机的一种可能的结构示意图，该目的主机包括：获取单元81，恢复单元82，创建单元83和复制单元84。
获取单元81用于支持目的主机执行图6中的过程601；恢复单元82用于支持目的主机执行图6中的过程602-603；创建单元83用于支持目的主机执行图6中的过程604；复制单元84用于支持目的主机执行图6中的过程605-606。其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在采用集成的单元的情况下，图8示出了上述实施例中所涉及的源主机(或目的主机)的一种可能的结构示意图。源主机(或目的主机)包括：处理模块1302和通信模块1303。处理模块1302用于对源主机(或目的主机)的动作进行控制管理。通信模块1303用于支持源主机(或目的主机)与其他网络实体的通信。源主机(或目的主机)还可以包括存储模块1301，用于存储源主机(或目的主机)的程序代码和数据。
其中，处理模块1302可以是处理器或控制器，例如可以是中央处理器(Central Processing Unit，CPU)，通用处理器，数字信号处理器(Digital Signal Processor，DSP)，专用集成电路(Application-Specific Integrated Circuit，ASIC)，现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明实施例公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信模块1303可以是收发器、收发电路或通信接口等。存储模块1301可以是存储器。
当源主机(或目的主机)内运行有虚拟机时，源主机(或目的主机)的架构示意图如图1所示。
进一步地，本发明实施例还提供一种数据迁移系统，该系统包括如图2所示的源主机21和目的主机22。
在上述实施例中，可以全部或部分的通过软件，硬件，固件或者其任意组合来实现。当使用软件程序实现时，可以全部或部分地以计算机程序产品的形式出现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质 集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质，(例如，软盘，硬盘、磁带)、光介质(例如，DVD)或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (18)

  1. 一种数据迁移方法，其特征在于，包括：
    源主机获取迁移指令，所述迁移指令用于指示将创建有Enclave的目标应用迁移至目的主机；
    所述源主机调用所述目标应用的Enclave内预置的迁移控制线程，以将Enclave内存EPC内所述目标应用的运行状态数据写入所述源主机的目标内存，所述目标内存为所述源主机的内存中除所述EPC之外的区域；
    所述源主机向所述目的主机发送所述目标应用在所述目标内存中的运行状态数据。
  2. 根据权利要求1所述的方法，其特征在于，所述源主机调用所述目标应用的Enclave内预置的迁移控制线程，以将所述Enclave的EPC内存内所述目标应用的运行状态数据写入所述源主机的目标内存，包括：
    所述源主机调用所述迁移控制线程，以从所述EPC内获取所述Enclave的运行状态数据；
    所述源主机调用所述迁移控制线程，以将所述EPC内所述Enclave的运行状态数据写入所述目标内存。
  3. 根据权利要求2所述的方法，其特征在于，所述目标应用的Enclave内还包括N个工作线程，N≥1；
    其中，所述源主机调用所述迁移控制线程，以从所述EPC内获取所述目标应用的运行状态数据，包括：
    当所述迁移控制线程接收到预置的迁移信号时，所述源主机调用所述迁移控制线程，以将所述目标Enclave的全局状态设置为迁移状态；
    当所述全局状态为迁移状态时，所述源主机将所述N个工作线程中每个工作线程的本地状态都设置为停止状态；
    当所述N个工作线程中每个工作线程的本地状态均为停止状态时，所述源主机调用所述迁移控制线程，以通过所述源主机的CPU访问所述EPC内所述目标应用的运行状态数据。
  4. 根据权利要求3所述的方法，其特征在于，当所述全局状态为迁移状态时，所述源主机将所述N个工作线程中每个工作线程的本地状态设置为停止状态，包括：
    当所述N个工作线程中包含本地状态为忙碌状态的工作线程时，所述源主机通过中断将该工作线程的本地状态修改为停止状态；
    所述源主机记录工作线程的当前线程运行状态信息CSSA；
    或者；
    所述源主机等待所有本地状态为忙碌状态的工作线程执行完毕后，将每个工作线程的本地状态置为停止状态。
  5. 根据权利要求2-4中任一项所述的方法，其特征在于，在所述源主机调用所述迁移控制线程，以从所述EPC内获取所述目标应用的运行状态数据之后，还包括：
    所述源主机调用所述迁移控制线程，以对所述运行状态数据执行加密操作，对加密加的运行状态数据添加完整性保护，所述完整性保护可以是数字签名或者消息认证码MAC执行数字签名操作；
    其中，所述源主机调用所述迁移控制线程，以将所述EPC内所述目标应用的运行状态数据写入所述目标内存，包括：
    所述源主机调用所述迁移控制线程，以将加密且带有完整性保护的运行状态数据写入所述目标内存。
  6. 一种数据迁移方法，其特征在于，包括：
    目的主机从源主机获取目标应用的运行状态数据；
    所述目的主机在所述目标应用的Enclave中创建所述目标应用的迁移控制线程；
    所述目的主机调用所述迁移控制线程，以将所述运行状态数据复制到所述EPC中。
  7. 根据权利要求6所述的方法，其特征在于，所述目的主机在内存的EPC中恢复所述目标应用的Enclave，包括：
    所述目的主机从所述源主机获取所述目标应用的Enclave创建记录，所述Enclave创建记录中记录有所述目标应用的Enclave的内存地址；
    所述目的主机根据所述内存地址在内存的EPC中恢复所述目标应用的Enclave。
  8. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    所述目的主机从所述源主机获取所述目标应用的Enclave中的各个工作线程的CSSA；
    若目标工作线程的CSSA取值不为0，则所述目的主机通过中断将所述目标工作线程的CSSA修改为与所述源主机记录的CSSA相同的取值。
  9. 根据权利要求6-8中任一项所述的方法，其特征在于，所述目的主机调用所述迁移控制线程，以将所述运行状态数据复制到所述EPC中，包括：
    所述目的主机调用所述迁移控制线程，以将所述运行状态数据写入所述EPC中；
    所述目的主机调用所述迁移控制线程，以对写入所述EPC中的运行状态数据执行解密和完整性验证。
  10. 一种主机，所述主机为源主机，其特征在于，包括：
    获取单元，用于获取迁移指令，所述迁移指令用于指示将创建有内存保护区域Enclave的目标应用迁移至目的主机；
    执行单元，用于调用所述目标应用的Enclave内预置的迁移控制线程，以将Enclave内存EPC内所述目标应用的运行状态数据写入所述源主机的目标内存，所述目标内存为所述源主机的内存中除所述EPC之外的区域；
    发送单元，用于向所述目的主机发送所述目标应用在所述目标内存中的运行状态数据。
  11. 根据权利要求10所述的源主机，其特征在于，
    所述执行单元，具体用于：调用所述迁移控制线程，以从所述EPC内获取所述目标应用的运行状态数据；调用所述迁移控制线程，以将所述EPC内所述目标应用的运行状态数据写入所述目标内存。
  12. 根据权利要求11所述的源主机，其特征在于，所述目标应用的Enclave内还包括N个工作线程，N≥1；
    所述执行单元，具体用于：调用所述迁移控制线程，以将所述enclave的全局状态设置为迁移状态；当所述全局状态为迁移状态时，将所述N个工作线程中每个工作线 程的本地状态设置为停止状态；当所述N个工作线程中每个工作线程的本地状态均为停止状态时，调用所述迁移控制线程，以通过所述源主机的CPU访问所述EPC内所述目标应用的运行状态数据。
  13. 根据权利要求12所述的源主机，其特征在于，
    所述执行单元，具体用于：当所述N个工作线程中包含本地状态为忙碌状态的工作线程时，所述源主机通过中断将该工作线程的本地状态修改为停止状态；所述源主机记录工作线程的当前线程运行状态信息CSSA；或者；所述源主机等待所有本地状态为忙碌状态的工作线程执行完毕后，将每个工作线程的本地状态置为停止状态。
  14. 根据权利要求11-13中任一项所述的源主机，其特征在于，所述源主机还包括：
    加密单元，用于调用所述迁移控制线程对所述运行状态数据执行加密和完整性保护操作，其中，所述完整性保护可以通过消息认证码MAC或签名算法实现；
    所述执行单元，具体用于：调用所述迁移控制线程，以将加密并带有完整性保护的运行状态数据写入所述目标内存。
  15. 一种主机，所述主机为目的主机，其特征在于，包括：
    获取单元，用于从源主机获取目标应用的运行状态数据；
    恢复单元，用于在所述目的主机的内存的EPC中恢复所述目标应用的Enclave；
    创建单元，用于在所述目标应用的Enclave中创建所述目标应用的迁移控制线程；
    复制单元，用于调用所述迁移控制线程，以将所述运行状态数据以加密并带有完整性保护的方式复制到所述EPC中。
  16. 根据权利要求15所述的目的主机，其特征在于，
    所述恢复单元，具体用于：从所述源主机获取所述目标应用的Enclave创建记录，所述Enclave创建记录中记录有所述目标应用的Enclave的内存地址；根据所述内存地址在内存的EPC中恢复所述目标应用的Enclave。
  17. 根据权利要求16所述的目的主机，其特征在于，
    所述获取单元，还用于：从所述源主机获取所述目标应用的Enclave中的各个工作线程的CSSA；
    所述恢复单元，还用于：若目标工作线程的CSSA取值不为0，则通过中断将所述目标工作线程的CSSA修改为与所述源主机记录的CSSA相同的取值。
  18. 根据权利要求15-17中任一项所述的目的主机，其特征在于，
    所述复制单元，具体用于：调用所述迁移控制线程，以将所述运行状态数据写入所述EPC中；调用所述迁移控制线程，以对所述运行状态数据执行完整性验证和解密操作。
PCT/CN2017/095829 2017-02-23 2017-08-03 一种数据迁移方法及装置 Ceased WO2018153027A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP17897879.7A EP3572938B1 (en) 2017-02-23 2017-08-03 Method and device for data migration
CN201780087318.XA CN110622138B (zh) 2017-02-23 2017-08-03 一种数据迁移方法及装置
US16/549,861 US11347542B2 (en) 2017-02-23 2019-08-23 Data migration method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710100246.X 2017-02-23
CN201710100246.XA CN108469986B (zh) 2017-02-23 2017-02-23 一种数据迁移方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/549,861 Continuation US11347542B2 (en) 2017-02-23 2019-08-23 Data migration method and apparatus

Publications (1)

Publication Number Publication Date
WO2018153027A1 true WO2018153027A1 (zh) 2018-08-30

Family

ID=63252304

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/095829 Ceased WO2018153027A1 (zh) 2017-02-23 2017-08-03 一种数据迁移方法及装置

Country Status (4)

Country Link
US (1) US11347542B2 (zh)
EP (1) EP3572938B1 (zh)
CN (2) CN108469986B (zh)
WO (1) WO2018153027A1 (zh)

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP7193732B2 (ja) * 2019-04-08 2022-12-21 富士通株式会社 管理装置、情報処理システムおよび管理プログラム
CN112035272B (zh) * 2019-06-03 2024-11-29 华为技术有限公司 进程间通信的方法、装置以及计算机设备
CN112749397A (zh) * 2019-10-29 2021-05-04 阿里巴巴集团控股有限公司 一种系统和方法
WO2022006810A1 (zh) * 2020-07-09 2022-01-13 深圳市汇顶科技股份有限公司 一种数据管理方法、装置、电子元件以及终端设备
CN114417362B (zh) * 2020-10-10 2025-11-21 华为技术有限公司 数据管理方法、装置及系统、存储介质
CN112636916A (zh) * 2020-11-30 2021-04-09 捷德(中国)科技有限公司 数据处理方法、装置、存储介质及电子设备
US11836514B2 (en) * 2021-01-19 2023-12-05 Dell Products L.P. System and method of utilizing memory medium fault resiliency with secure memory medium portions
US11762672B2 (en) * 2021-03-23 2023-09-19 Vmware, Inc. Dynamic linker for loading and running an application over a plurality of nodes
CN115168318A (zh) * 2021-04-06 2022-10-11 腾讯科技（深圳）有限公司 数据迁移的控制方法、装置和存储介质及电子设备
WO2022233394A1 (en) * 2021-05-04 2022-11-10 Huawei Technologies Co., Ltd. Device, method and system for asynchronous messaging
CN113467884B (zh) * 2021-05-25 2024-08-02 阿里巴巴创新公司 资源配置方法和装置、电子设备及计算机可读存储介质
CN113472876B (zh) * 2021-06-29 2024-02-13 招商局金融科技有限公司 应用迁移的控制方法、装置、设备及存储介质
EP4167086A1 (en) * 2021-10-13 2023-04-19 Microsoft Technology Licensing, LLC Enclave cloning
JP7829829B2 (ja) * 2021-10-27 2026-03-16 日本電気株式会社 安全なエンクレーブマイグレーションのための方法およびホストシステム
US11775360B2 (en) * 2021-12-01 2023-10-03 Nec Corporation Cache-based communication for trusted execution environments
CN115237600A (zh) * 2022-07-29 2022-10-25 携程旅游信息技术（上海）有限公司 数据迁移的管理方法、系统、电子设备和存储介质
US20240053983A1 (en) * 2022-08-10 2024-02-15 Google Llc Performance Optimized Task Duplication and Migration
CN117675257A (zh) * 2022-09-06 2024-03-08 中国移动通信有限公司研究院 数据迁移方法、安全模块、迁移平台、设备及介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103399778A (zh) * 2013-07-01 2013-11-20 华为技术有限公司 一种虚拟机在线整体迁移方法和设备
CN104346575A (zh) * 2014-10-24 2015-02-11 重庆邮电大学 一种软件定义安全体系结构
US20150370628A1 (en) * 2014-06-23 2015-12-24 Intel Corporation Employing intermediary structures for facilitating access to secure memory
CN105700945A (zh) * 2016-01-12 2016-06-22 中南大学 一种基于净室环境的虚拟机安全迁移方法
CN105956465A (zh) * 2016-05-04 2016-09-21 浪潮电子信息产业股份有限公司 一种基于vtpm构建虚拟可信平台的方法

Family Cites Families (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9087200B2 (en) * 2009-12-22 2015-07-21 Intel Corporation Method and apparatus to provide secure application execution
GB2481563B (en) * 2009-12-22 2017-07-19 Intel Corp Method and apparatus to provide secure application execution
US8972746B2 (en) * 2010-12-17 2015-03-03 Intel Corporation Technique for supporting multiple secure enclaves
US9009858B2 (en) * 2012-05-16 2015-04-14 Okta, Inc. Systems and methods for providing and managing distributed enclaves
CN103885719B (zh) * 2012-12-21 2017-02-08 中国电信股份有限公司 虚拟机系统在线存储迁移的方法、系统与装置
US9430384B2 (en) * 2013-03-31 2016-08-30 Intel Corporation Instructions and logic to provide advanced paging capabilities for secure enclave page caches
CN103249114B (zh) * 2013-04-03 2016-03-23 大唐移动通信设备有限公司 集团内网异地接入方法和系统
CN104283853B (zh) * 2013-07-08 2018-04-10 华为技术有限公司 一种提高信息安全性的方法、终端设备及网络设备
EP3028210B1 (en) * 2013-08-02 2020-01-08 OLogN Technologies AG Secure server in a system with virtual machines
US20150205542A1 (en) * 2014-01-22 2015-07-23 Vmware, Inc. Virtual machine migration in shared storage environment
CN105022658B (zh) * 2014-04-30 2019-03-05 中国移动通信集团公司 一种虚拟机迁移方法、系统及相关装置
US9652631B2 (en) 2014-05-05 2017-05-16 Microsoft Technology Licensing, Llc Secure transport of encrypted virtual machines with continuous owner access
US9461994B2 (en) * 2014-11-26 2016-10-04 Intel Corporation Trusted computing base evidence binding for a migratable virtual machine
US9852301B2 (en) * 2014-12-24 2017-12-26 Intel Corporation Creating secure channels between a protected execution environment and fixed-function endpoints
CN105791175B (zh) * 2014-12-26 2019-04-12 电信科学技术研究院 软件定义网络中控制传输资源的方法及设备
CN106161076B (zh) * 2015-04-22 2019-06-11 华为技术有限公司 虚拟网络功能扩展方法和装置
US9710401B2 (en) * 2015-06-26 2017-07-18 Intel Corporation Processors, methods, systems, and instructions to support live migration of protected containers
US9942035B2 (en) * 2015-08-18 2018-04-10 Intel Corporation Platform migration of secure enclaves
US10048977B2 (en) * 2015-12-22 2018-08-14 Intel Corporation Methods and apparatus for multi-stage VM virtual network function and virtual service function chain acceleration for NFV and needs-based hardware acceleration
CN105678191B (zh) * 2016-03-02 2018-11-13 上海瓶钵信息科技有限公司 利用SoC内部存储提高系统安全性的方法、终端与系统
CN105955809B (zh) * 2016-04-25 2020-06-26 深圳市万普拉斯科技有限公司 线程调度方法和系统
CN106095576A (zh) * 2016-06-14 2016-11-09 上海交通大学 虚拟化多核环境下非一致性i/o访问虚拟机资源迁移方法
CN106169994B (zh) * 2016-06-29 2019-02-26 中国联合网络通信集团有限公司 容器间通信的安全控制方法及装置
US10338957B2 (en) * 2016-12-27 2019-07-02 Intel Corporation Provisioning keys for virtual machine secure enclaves

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103399778A (zh) * 2013-07-01 2013-11-20 华为技术有限公司 一种虚拟机在线整体迁移方法和设备
US20150370628A1 (en) * 2014-06-23 2015-12-24 Intel Corporation Employing intermediary structures for facilitating access to secure memory
CN104346575A (zh) * 2014-10-24 2015-02-11 重庆邮电大学 一种软件定义安全体系结构
CN105700945A (zh) * 2016-01-12 2016-06-22 中南大学 一种基于净室环境的虚拟机安全迁移方法
CN105956465A (zh) * 2016-05-04 2016-09-21 浪潮电子信息产业股份有限公司 一种基于vtpm构建虚拟可信平台的方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3572938A4

Also Published As

Publication number Publication date
CN108469986B (zh) 2021-04-09
EP3572938B1 (en) 2025-06-25
EP3572938A4 (en) 2020-01-15
US11347542B2 (en) 2022-05-31
CN108469986A (zh) 2018-08-31
US20190377598A1 (en) 2019-12-12
CN110622138A (zh) 2019-12-27
CN110622138B (zh) 2022-12-30
EP3572938A1 (en) 2019-11-27

Similar Documents

Publication Publication Date Title
CN110622138B (zh) 一种数据迁移方法及装置
US11442770B2 (en) Formally verified trusted computing base with active security and policy enforcement
KR102355213B1 (ko) 운영 체제 공격으로부터 애플리케이션 기밀사항을 보호하는 기법
US11693952B2 (en) System and method for providing secure execution environments using virtualization technology
US8495750B2 (en) Filesystem management and security system
US10990690B2 (en) Disk encryption
KR101823888B1 (ko) 신뢰 컴퓨팅을 위한 다중노드 허브
US10719346B2 (en) Disk encryption
US10754680B2 (en) Disk encription
CN108959916B (zh) 用于访问安全世界的方法、装置和系统
US20250021369A1 (en) Securely persisting information across system reboots
CN111353162B (zh) 基于TrustZone分核异步执行的主动可信计算方法及系统
US10528736B1 (en) Systems and methods for detecting preparatory-stages of rowhammer attacks
JP2015500543A (ja) ハードウェア保護アプリケーションのシステム・サービス要求相互作用を容易化する方法
CN112818327A (zh) 基于TrustZone的用户级代码和数据安全可信保护方法及装置
EP3079057B1 (en) Method and device for realizing virtual machine introspection
US11513825B2 (en) System and method for implementing trusted execution environment on PCI device
EP4492229B1 (en) Securely persisting information across system reboots
CN102799480B (zh) 虚拟化系统中关闭中断的方法和装置
EP3408780B1 (en) Disk encryption
Nakatsuka et al. CTR: Checkpoint, Transfer, and Restore for Secure Enclaves
EP3408779B1 (en) Disk encryption

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17897879

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017897879

Country of ref document: EP

Effective date: 20190823

WWG Wipo information: grant in national office

Ref document number: 2017897879

Country of ref document: EP