US 2026/0147894 A1 · DATA CONFIDENTIALITY METHOD, RELATED APPARATUS, AND SYSTEM

Abstract

This application provides a data confidentiality method, a related apparatus, and a system. The method relates to the virtualization field, and is applied to a heterogeneous device. Some or all hardware resources in the heterogeneous device are divided into a trusted execution environment TEE side. Confidential data is preset on the TEE side of the heterogeneous device. The method includes: A processor of the heterogeneous device verifies, on the TEE side, whether a virtual machine running on a TEE side of a host can obtain the confidential data in the heterogeneous device; and when the virtual machine running on the TEE side of the host cannot obtain the confidential data, the TEE side of the heterogeneous device receives an access request that is of the virtual machine running on the TEE side of the host and that is for the TEE side of the heterogeneous device.

Claims15

Dependent claims

A data confidentiality method, wherein the method is applied to a heterogeneous device, some or all hardware resources in the heterogeneous device are divided into a trusted execution environment (TEE) side of the heterogeneous device, confidential data is preset on the TEE side of the heterogeneous device, and the data confidentiality method comprises:

verifying, by a processor of the heterogeneous device on the TEE side of the heterogeneous device, integrity of a TEE side of a host, wherein the integrity of the TEE side of the host comprises that a virtual machine running on the TEE side of the host does not have a read operation capability and a write operation capability on the confidential data in the heterogeneous device, and the heterogeneous device and the host form a heterogeneous system;
and
in response to verification on the integrity of the TEE side of the host succeeding, receiving, by the TEE side of the heterogeneous device, an access request that is of the virtual machine running on the TEE side of the host and that is for the TEE side of the heterogeneous device.

A heterogeneous device, wherein some or all hardware resources in the heterogeneous device are divided into a trusted execution environment (TEE) side of the heterogeneous device, confidential data is preset on the TEE side of the heterogeneous device, and the heterogeneous device comprises:

a processor;
and
a memory having instructions stored thereon that, when executed by the processor, cause the heterogeneous device to:
verify, on the TEE side of the heterogeneous device, integrity of a TEE side of a host, wherein the integrity of the TEE side of the host comprises that a virtual machine running on the TEE side of the host does not have a read operation capability and a write operation capability on the confidential data in the heterogeneous device, and the heterogeneous device and the host form a heterogeneous system;
and
in response to verification on the integrity of the TEE side of the host succeeding, receive, by the TEE side of the heterogeneous device, an access request that is of the virtual machine running on the TEE side of the host and that is for the TEE side of the heterogeneous device.

3 more elements

A non-transitory computer-readable storage medium having instructions stored thereon that, when executed by a processor, cause a heterogeneous device wherein some or all hardware resources in the heterogeneous device are divided into a trusted execution environment (TEE) side of the heterogeneous device, and confidential data is preset on the TEE side of the heterogeneous device, to:

verify, on the TEE side of the heterogeneous device, integrity of a TEE side of a host, wherein the integrity of the TEE side of the host comprises that a virtual machine running on the TEE side of the host does not have a read operation capability and a write operation capability on the confidential data in the heterogeneous device, and the heterogeneous device and the host form a heterogeneous system;
and
in response to verification on the integrity of the TEE side of the host succeeding, receive, by the TEE side of the heterogeneous device, an access request that is of the virtual machine running on the TEE side of the host and that is for the TEE side of the heterogeneous device.

Dependencies are inferred from the claim text.

Data confidentiality method, related apparatus, and system

Life of this patent

Data confidentiality method, related apparatus, and system

Life of this patent

Abstract

Claims15