CN116401671B - Centralized computing method and device based on trusted execution environment - Google Patents
Centralized computing method and device based on trusted execution environment Download PDFInfo
- Publication number
- CN116401671B CN116401671B CN202310298255.XA CN202310298255A CN116401671B CN 116401671 B CN116401671 B CN 116401671B CN 202310298255 A CN202310298255 A CN 202310298255A CN 116401671 B CN116401671 B CN 116401671B
- Authority
- CN
- China
- Prior art keywords
- task
- execution environment
- instance
- trusted
- computing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000004364 calculation method Methods 0.000 title claims abstract description 83
- 238000000034 method Methods 0.000 claims abstract description 50
- 238000010276 construction Methods 0.000 claims abstract description 31
- 230000006870 function Effects 0.000 claims abstract description 31
- 230000008569 process Effects 0.000 claims abstract description 26
- 238000012544 monitoring process Methods 0.000 claims abstract description 11
- 238000004422 calculation algorithm Methods 0.000 claims description 74
- 238000002955 isolation Methods 0.000 claims description 25
- 230000000694 effects Effects 0.000 abstract description 7
- 238000007726 management method Methods 0.000 description 25
- 230000002688 persistence Effects 0.000 description 9
- 230000005540 biological transmission Effects 0.000 description 8
- 238000012545 processing Methods 0.000 description 8
- 238000010586 diagram Methods 0.000 description 7
- 230000003287 optical effect Effects 0.000 description 6
- 238000010801 machine learning Methods 0.000 description 5
- 238000004891 communication Methods 0.000 description 4
- 238000013523 data management Methods 0.000 description 4
- 238000004590 computer program Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000009434 installation Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 2
- 230000000737 periodic effect Effects 0.000 description 2
- 238000006467 substitution reaction Methods 0.000 description 2
- 241000512668 Eunectes Species 0.000 description 1
- 208000025174 PANDAS Diseases 0.000 description 1
- 208000021155 Paediatric autoimmune neuropsychiatric disorders associated with streptococcal infection Diseases 0.000 description 1
- 240000000220 Panda oleosa Species 0.000 description 1
- 235000016496 Panda oleosa Nutrition 0.000 description 1
- 238000012550 audit Methods 0.000 description 1
- 230000000903 blocking effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 238000007477 logistic regression Methods 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000004806 packaging method and process Methods 0.000 description 1
- 238000012163 sequencing technique Methods 0.000 description 1
- 238000000638 solvent extraction Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/445—Program loading or initiating
- G06F9/44505—Configuring for program initiating, e.g. using registry, configuration files
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Storage Device Security (AREA)
Abstract
The invention discloses a centralized computing method and device based on a trusted execution environment, comprising the following steps: in an untrusted execution environment, acquiring a target computing task from a task queue; determining task configuration information matched with a target computing task; performing calculation task instance construction based on task configuration information through a preset trusted construction function, and performing stack memory use permission configuration to obtain a target calculation task instance; starting a target computing task instance, and monitoring the process information of the target computing task instance; in a trusted execution environment, executing a target computing task instance to obtain a computing result; encrypting the calculation result by using the encryption and decryption keys of each data node to obtain an encryption result; and outputting the encryption result to each data node respectively. Therefore, the method and the device can reasonably arrange the resource use of the non-trusted execution environment and the trusted execution environment, and improve the centralized safe and trusted computing effect on the privacy computing program and the privacy data.
Description
Technical Field
The invention relates to the technical field of computers, in particular to a centralized computing method and device based on a trusted execution environment.
Background
At present, in a centralized computing scenario, in order to avoid information leakage, centralized computing is often implemented based on a trusted execution environment, so as to improve information security.
In practice, it is found that, although performing centralized computation in a trusted execution environment can improve the security of computation, there is a limit to the stack memory and the like due to the trusted execution environment, so that there is a portion of program code that cannot be executed in the trusted execution environment, and thus the program function is limited. It can be seen that the centralized computing method in the trusted execution environment currently has the problem of limited program functions.
In view of the above problems, no effective solution has been proposed at present.
Disclosure of Invention
The embodiment of the invention provides a centralized computing method and device based on a trusted execution environment, which can realize the task flexible configuration of computing tasks, thereby meeting the execution requirements of more program codes and further improving the centralized computing effect.
According to an aspect of an embodiment of the present invention, there is provided a centralized computing method based on a trusted execution environment, including:
in an untrusted execution environment, acquiring a target computing task from a task queue through an algorithm manager;
Determining task configuration information matched with the target computing task; the task configuration information comprises a parameter configuration file and an operation dependency library corresponding to a calculation task algorithm program;
performing calculation task instance construction based on the task configuration information through a preset trusted construction function to obtain an initial calculation task instance;
configuring the use authority of the stack memory for the initial computing task instance to obtain a target computing task instance;
starting the target computing task instance through the algorithm manager, and monitoring the process information of the target computing task instance;
executing the target computing task instance in a trusted execution environment to obtain a computing result;
encrypting the calculation result by using encryption and decryption keys of all the data nodes to obtain an encryption result;
outputting the encryption result to each data node respectively;
the encryption and decryption keys are keys which are generated in advance for each data node by the service layer instance of the isolation environment and are safely stored in the trusted execution environment.
As an alternative embodiment, the method further comprises:
installing an operation dependency library corresponding to the target program in an untrusted execution environment; the target program comprises the computing task algorithm program, an isolated environment service layer program and an algorithm manager program;
Starting the algorithm manager program based on an operation dependency library corresponding to the algorithm manager program in an untrusted execution environment; and constructing the isolation environment service layer instance based on an operation dependency library corresponding to the isolation environment service layer program through the preset trusted construction function; the isolated environment service layer instance is configured with the use permission of the stack memory;
and starting the isolation environment service layer instance in the trusted execution environment.
As an alternative embodiment, the method further comprises:
in the trusted execution environment, generating the encryption and decryption keys for each data node through the isolated environment service layer instance;
encrypting the data in each data node by using the encryption and decryption key to obtain ciphertext data;
and storing the ciphertext data into a local storage of each data node so that each data node registers the ciphertext data to a trusted execution environment based on an SSL certificate.
As an alternative embodiment, the method further comprises:
in an untrusted execution environment, responding to a trusted task execution request through the algorithm manager, and carrying out life cycle management of each trusted task;
The target computing task is a task in the trusted tasks.
As an alternative embodiment, the method further comprises:
in an untrusted execution environment, SSL certificates are generated.
According to another aspect of the embodiments of the present invention, there is also provided a centralized computing device based on a trusted execution environment, including:
the task acquisition unit is used for acquiring a target calculation task from the task queue through the algorithm manager in the non-trusted execution environment;
the configuration determining unit is used for determining task configuration information matched with the target computing task; the task configuration information comprises a parameter configuration file and an operation dependency library corresponding to a calculation task algorithm program;
the instance construction unit is used for constructing a calculation task instance based on the task configuration information through a preset trusted construction function to obtain an initial calculation task instance; configuring the use authority of the stack memory for the initial computing task instance to obtain a target computing task instance;
the algorithm management unit is used for starting the target computing task instance through the algorithm manager and monitoring the process information of the target computing task instance;
The task computing unit is used for executing the target computing task instance in a trusted execution environment to obtain a computing result;
the encryption unit is used for encrypting the calculation result by using encryption and decryption keys of all the data nodes to obtain an encryption result;
the output unit is used for respectively outputting the encryption results to the data nodes;
the encryption and decryption keys are keys which are generated in advance for each data node by the service layer instance of the isolation environment and are safely stored in the trusted execution environment.
According to yet another aspect of an embodiment of the present invention, there is also provided a computing device including: at least one processor, memory, and input output unit; the memory is used for storing a computer program, and the processor is used for calling the computer program stored in the memory to execute the centralized computing method based on the trusted execution environment.
According to yet another aspect of embodiments of the present invention, there is also provided a computer-readable storage medium comprising instructions that, when executed on a computer, cause the computer to perform the above-described centralized computing method based on a trusted execution environment.
In the embodiment of the application, in an untrusted execution environment, acquiring a target computing task from a task queue through an algorithm manager; determining task configuration information matched with a target computing task; performing calculation task instance construction based on task configuration information through a preset trusted construction function to obtain an initial calculation task instance; configuring the use authority of a stack memory for the initial computing task instance to obtain a target computing task instance; starting a target computing task instance through an algorithm manager, and monitoring the process information of the target computing task instance; in a trusted execution environment, executing a target computing task instance to obtain a computing result; encrypting the calculation result by using the encryption and decryption keys of each data node to obtain an encryption result; respectively outputting the encryption result to each data node; therefore, the application can realize the flexible configuration of the task of the calculation task, thereby meeting the execution requirement of more program codes and further improving the centralized calculation effect.
Drawings
The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the application and do not constitute a limitation on the application. In the drawings:
FIG. 1 is a flow diagram of an alternative trusted execution environment-based centralized computing method according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of an alternative trusted execution environment-based centralized computing device, according to an embodiment of the present invention;
FIG. 3 is a system architecture diagram of an alternative trusted execution environment-based centralized computing method according to an embodiment of the present invention;
FIG. 4 schematically illustrates a schematic structural diagram of a medium according to an embodiment of the present invention;
FIG. 5 schematically illustrates a structural diagram of a computing device in accordance with embodiments of the present invention.
Detailed Description
In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.
It should be noted that the terms "first," "second," and the like in the description and the claims of the present invention and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the invention described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
Referring now to fig. 1, fig. 1 is a flowchart illustrating a centralized computing method based on a trusted execution environment according to an embodiment of the present invention. It should be noted that embodiments of the present invention may be applied to any scenario where applicable.
The process of the centralized computing method based on the trusted execution environment according to the embodiment of the present invention shown in fig. 1 includes:
step S101, in an untrusted execution environment, acquiring a target computing task from a task queue through an algorithm manager;
step S102, determining task configuration information matched with the target computing task; the task configuration information comprises a parameter configuration file and an operation dependency library corresponding to a calculation task algorithm program;
step S103, performing calculation task instance construction based on the task configuration information through a preset trusted construction function to obtain an initial calculation task instance;
step S104, carrying out stack memory use permission configuration on the initial computing task instance to obtain a target computing task instance;
step S105, starting the target computing task instance through the algorithm manager, and monitoring the process information of the target computing task instance;
Step S106, executing the target computing task instance in a trusted execution environment to obtain a computing result;
step S107, encrypting the calculation result by using encryption and decryption keys of all data nodes to obtain an encryption result;
and step S108, outputting the encryption result to each data node.
The encryption and decryption keys are keys which are generated in advance for each data node by the service layer instance of the isolation environment and are safely stored in the trusted execution environment.
In this embodiment, the execution subject may be an electronic device such as a terminal device, a server, or the like for executing the centralized computing method based on the trusted execution environment.
The application can be improved on the basis of the existing Occlum platform (an open source safe computing platform similar to the containerization effect) to realize better centralized computing effect. The Occlum platform realizes trusted execution environment computing based on Intel SGX.
The Intel SGX creates an isolated environment in the memory, which is called enclave (enclave), where data and programs can be safely used, i.e., the trusted execution environment in the present application.
The Occlum platform also comprises an onside region, namely an untrusted execution environment in the application. The outlide region refers to the Outside world region where all computations performed in this region do not provide the secure environment capabilities of a trusted execution environment, and is primarily responsible for SSL generator and algorithm manager functions.
The algorithm manager is used for initializing, installing and configuring all computing algorithms written in advance in the outlide region, and the computing algorithms can include but are not limited to feature engineering, data management and machine learning.
The task queue may include a plurality of computing tasks that need to run in a trusted execution environment, and the target computing task may be a task that needs to be executed currently in the task queue.
The parameter configuration file may be used to indicate parameters such as total memory size, heap memory size, stack memory size, number of threads available, and available stack memory of the number of processes, where the parameters may be a json file obtained by encapsulating values of the parameters.
The operation dependency library corresponding to the computing task algorithm program may be a third party dependency library packaged in an untrusted execution environment in advance, and may include, but is not limited to, pandas, numpy, and various machine learning frameworks. In addition, preferably, each computing task can package the corresponding operation dependency, so that compared with the generation of global operation dependency on all computing tasks, the volume of the computing tasks can be reduced, and the operation efficiency in a trusted execution environment can be improved.
Each computing task can be regarded as an example, and is obtained by uniformly packaging and constructing operation dependence and parameter configuration.
Optionally, the method for constructing the computing task instance based on the task configuration information to obtain the target computing task instance may specifically be: based on the task configuration information, a corresponding hardware environment is allocated for the target computing task in the trusted execution environment, and the running dependency and the computing task corresponding to the target computing task are allocated to the hardware environment so as to generate a target computing task instance corresponding to the target computing task in the hardware environment.
When the target computing task instance is constructed, the target computing task instance can be constructed by using relevant capabilities such as Intel sgx sdk (an sgx sdk program provided by Intel authorities and used for converting a computing program to be executed in a trusted execution environment into a program which can be recognized and executed by an Intel sgx trusted execution environment), so that the target computing task instance becomes a trusted application program, the target computing task instance is enabled, and meanwhile, the application program is required to be subjected to stack memory and other use limiting configurations, so that the target computing task instance is finally obtained. The intesgx sdk is the above-mentioned, preset trusted construction function.
And in the trusted execution environment, the target computing task instance can be executed to obtain a computing result. And encrypting the calculation result by using encryption and decryption keys of all the data nodes in a trusted execution environment to obtain an encrypted ciphertext, namely the encryption result. The encryption result may then be output to each data node and stored in the external environment.
The installation of the running dependency library, the generation of the SSL certificate, the starting algorithm manager and the starting service layer can be sequentially executed before the target calculation task is executed.
As an alternative embodiment, the method further comprises:
installing an operation dependency library corresponding to the target program in an untrusted execution environment; wherein the target program includes at least one of: the computing task algorithm program, the isolation environment service layer program and the algorithm manager program;
starting the algorithm manager program based on an operation dependency library corresponding to the algorithm manager program in an untrusted execution environment; and constructing the isolation environment service layer instance based on an operation dependency library corresponding to the isolation environment service layer program through the preset trusted construction function; the isolated environment service layer instance is configured with the use permission of the stack memory;
And starting the isolation environment service layer instance in the trusted execution environment.
In this embodiment, the computing task algorithm program, the isolation environment service layer program, and the algorithm manager program may be pre-written programs, and the starting operation of these programs needs to rely on various third party software libraries, so that the operation dependency library may be installed before the task is executed. Since the installation of the run-dependent library does not involve private data, the installation may be performed in an untrusted execution environment.
Specifically, an Anaconda technology (an open source package and an environment manager can be used for installing software packages with different versions and dependencies thereof on the same machine and switching between different environments) can be used for preinstallation of running dependencies of a target program to obtain a running dependency library, then mapping relations between the running dependency library and the program are automatically analyzed, and a corresponding folder is created, wherein the folder contains the running dependency library of the target program and the running dependencies of the target program.
And, the computing task algorithm program can include, but is not limited to, machine learning algorithms, data management algorithms and feature engineering algorithms, each algorithm can rely on a corresponding operation dependency library, and a corresponding folder can be established for each algorithm.
And the algorithm manager is only used for responding to the request of the external computing task, and meanwhile, any privacy sensitive data is not involved in the algorithm manager, so that the algorithm manager program can be started based on the operation dependency library corresponding to the algorithm manager program in an untrusted execution environment, and an isolated environment service layer instance can be constructed based on the operation dependency library corresponding to the isolated environment service layer program in the trusted execution environment. Meanwhile, the pre-generated SSL certificate can be provided for data registration in the service layer to form an encrypted transmission channel. And then, in the trusted execution environment, the service layer instance of the isolation environment can be independently started in the isolation environment, so that the service layer is started.
As an alternative embodiment, the method further comprises:
in the trusted execution environment, generating the encryption and decryption keys for each data node through the isolated environment service layer instance;
encrypting the data in each data node by using the encryption and decryption key to obtain ciphertext data;
and storing the ciphertext data into a local storage of each data node so that each data node registers the ciphertext data to a trusted execution environment based on an SSL certificate.
In this embodiment, since the program in the trusted execution environment may access the external providing interface, such as a data registration function, the function may accept privacy-sensitive data registration from an external third party application such as: the data tag, the data key, the data address and the like are directly transmitted in the clear and are exposed to the outside, so that the data registration is carried out in the trusted execution environment and the external transmission channel is not trusted, and therefore the secure transmission is required for the transmission channel received by an external application program, the encrypted transmission of SSL is provided, the encrypted transmission of SSL needs to have SSL certificates, the generation of the SSL certificates cannot be realized in the trusted execution environment, and the generation of the certificates is realized by an SSL generator in the untrusted execution environment.
And, for the calculation result, encryption can be performed by using encryption and decryption keys of each data provider to obtain ciphertext data. After obtaining the ciphertext data, the ciphertext data may be further saved to each data node corresponding to each data provider. And, the calculation result state and the process data may be stored in the data persistence layer.
As an alternative embodiment, the method further comprises:
in an untrusted execution environment, responding to a trusted task execution request through the algorithm manager, and carrying out life cycle management of each trusted task;
The target computing task is a task in the trusted tasks.
In this embodiment, the algorithm manager in the untrusted execution environment may receive a trusted service execution request from an external third party application, where the trusted service execution request is for requesting execution of a corresponding computing task. The algorithm manager may then list these computing tasks in a task queue according to the first-come first-use rules and perform lifecycle management of each trusted task. The target computing tasks are computing tasks being executed in the task queue. Lifecycle management may include, but is not limited to, start, pause, stop, continue, reclaim, among others. In this embodiment, the complete lifecycle management is performed on an untrusted execution environment, and the untrusted execution environment performs periodic management on the computing task, such as task running, and the untrusted execution environment starts the normal function and specifies the corresponding computing task script (such as logistic regression). The computing task creates a piece of trusted execution environment area belonging to the computing task in the trusted execution environment through the Occlum technology. The stopping of the task is to directly use the kill function of the linux system to kill the process of the computing task and recover the resources occupied by the computing task in the trusted execution environment.
As an alternative embodiment, the method further comprises:
in an untrusted execution environment, SSL certificates are generated.
In this embodiment, SSL certificates to be used for data registration in a trusted execution environment may be generated using an SSL generator. The SSL certificate generation herein also does not require that the run be initiated in a trusted execution environment, and so can be performed in an untrusted execution environment.
In the embodiment of the invention, in an untrusted execution environment, acquiring a target computing task from a task queue through an algorithm manager; determining task configuration information matched with the target computing task; performing calculation task instance construction based on the task configuration information to obtain a target calculation task instance; starting the target computing task instance through the algorithm manager, and monitoring the process information of the target computing task instance; executing the target computing task instance in a trusted execution environment to obtain a computing result; encrypting the calculation result by using encryption and decryption keys of all the data nodes to obtain an encryption result; outputting the encryption result to each data node respectively; therefore, the invention can realize the flexible configuration of the task of the calculation task, thereby meeting the execution requirement of more program codes and further improving the centralized calculation effect.
Having described the method of the exemplary embodiment of the present invention, a centralized computing device based on a trusted execution environment according to the exemplary embodiment of the present invention will be described with reference to fig. 2, where the device includes at least a task acquisition unit 201, a configuration determination unit 202, an instance construction unit 203, an algorithm management unit 204, a task calculation unit 205, an encryption unit 206, and an output unit 207.
A task obtaining unit 201, configured to obtain, in an untrusted execution environment, a target computing task from a task queue through an algorithm manager;
a configuration determining unit 202, configured to determine task configuration information that matches the target computing task; the task configuration information comprises a parameter configuration file and an operation dependency library corresponding to a calculation task algorithm program;
an instance construction unit 203, configured to perform calculation task instance construction based on the task configuration information through a preset trusted construction function, so as to obtain an initial calculation task instance; configuring the use authority of the stack memory for the initial computing task instance to obtain a target computing task instance;
the algorithm management unit 204 is configured to start the target computing task instance through the algorithm manager, and monitor process information of the target computing task instance;
A task computing unit 205, configured to execute the target computing task instance in a trusted execution environment to obtain a computing result;
an encryption unit 206, configured to encrypt the calculation result by using an encryption key and a decryption key of each data node, so as to obtain an encryption result;
an output unit 207 for outputting the encryption results to the respective data nodes;
the encryption and decryption keys are keys which are generated in advance for each data node by the service layer instance of the isolation environment and are safely stored in the trusted execution environment.
As an alternative embodiment, the apparatus further comprises:
the configuration unit is used for installing an operation dependency library corresponding to the target program in the non-trusted execution environment; the target program comprises the computing task algorithm program, an isolated environment service layer program and an algorithm manager program;
the configuration unit is further used for starting the algorithm manager program based on an operation dependency library corresponding to the algorithm manager program in an untrusted execution environment; and constructing the isolation environment service layer instance based on an operation dependency library corresponding to the isolation environment service layer program through the preset trusted construction function; the isolated environment service layer instance is configured with the use permission of the stack memory;
The configuration unit is further configured to start the service layer instance of the isolation environment in the trusted execution environment.
As an alternative embodiment, the encryption unit 206 is further configured to:
in the trusted execution environment, generating the encryption and decryption keys for each data node through the isolated environment service layer instance;
encrypting the data in each data node by using the encryption and decryption key to obtain ciphertext data;
and storing the ciphertext data into a local storage of each data node so that each data node registers the ciphertext data to a trusted execution environment based on an SSL certificate.
As an alternative embodiment, the algorithm management unit 204 is further configured to:
in an untrusted execution environment, responding to a trusted task execution request through the algorithm manager, and carrying out life cycle management of each trusted task;
the target computing task is a task in the trusted tasks.
As an alternative embodiment, the configuration unit is further configured to:
in an untrusted execution environment, SSL certificates are generated.
In the embodiment of the invention, in an untrusted execution environment, acquiring a target computing task from a task queue through an algorithm manager; determining task configuration information matched with the target computing task; performing calculation task instance construction based on the task configuration information to obtain a target calculation task instance; starting the target computing task instance through the algorithm manager, and monitoring the process information of the target computing task instance; executing the target computing task instance in a trusted execution environment to obtain a computing result; encrypting the calculation result by using encryption and decryption keys of all the data nodes to obtain an encryption result; outputting the encryption result to each data node respectively; therefore, the invention can realize the flexible configuration of the task of the calculation task, thereby meeting the execution requirement of more program codes and further improving the centralized calculation effect.
Referring to fig. 3, fig. 3 is a schematic system architecture diagram of an alternative trusted execution environment-based centralized computing method according to an embodiment of the present invention, as shown in fig. 3, an onside area (untrusted execution environment area) and an onsum Enclave area (trusted execution environment area) may be included in the occum. And, for the outlide region, it is responsible for SSL generator and algorithm manager functions. Specifically, the SSL generator is configured to generate an SSL certificate file, and synchronously mount the generated SSL certificate into the Occlum Enclave for use by the data registration module. The algorithm manager is used for initializing, installing and configuring all computing algorithms (such as feature engineering, data management and machine learning) written in advance, and comprises a life cycle module, an operation dependency module, a parameter configuration module, an instance construction module, a task queue module and a task anchor module. In order to allow the Occlum Enclave to have more performance resources to provide for the task to run and guarantee single reliability, full lifecycle management will be done on the outlide. The lifecycle module enables periodic management of computing tasks on an outlide, e.g., execution of tasks, stoppage of tasks, etc. The running dependency module is used for installing the packaged third party dependency library on the outlide. The parameter configuration module can determine ideal parameter configuration values according to parameters such as the operable total memory size, the heap memory size, the stack memory size, the usable thread number process number, the usable stack memory of the process number, the logic complexity of each calculation task, the data volume required by the calculation task and the like of the calculation tasks, and package the parameter configuration values into a json file. When the Occlum run is started on the outlide subsequently and used for running the calculation task, the json file with the designated parameter configuration is started at the same time, so that each calculation task running on the Occlum enclaspe can be ensured to obtain a reasonable hardware environment and the waste of hardware resources is avoided. The instance construction module is used for constructing a required trusted execution environment area in enclaspe according to the parameter configuration, and driving the operation dependency and the computing task or the service layer into the area to obtain a computing task instance or a service layer instance. The task queue module is used for sequencing the computing task instances to be operated into a queue according to the starting time, and meanwhile, the task queue module can flexibly specify how many tasks can be operated at the same time by the threshold value, the computing task instance exceeding the threshold value can wait, and the task operation waiting in operation can be ended or stopped, and the operation on the Occlum Enclave can be started. The task queue module can facilitate the execution of the maintenance and management calculation task and avoid the task execution blocking. The task anchor module is used for calculating the pause and continuous functions of the task instance. Specifically, in the running process of the computation task instance in the Occlum Enclave, when the outlide pauses the computation task instance, the computation task instance ends the running of the instance on the Occlum Enclave in a stopped state, which is equivalent to stopping the task, but the computation task instance knows that the instance is paused but not stopped at the moment, meanwhile, the running progress of the current computation task instance is acquired and an anchor point is driven in a corresponding position, meanwhile, the anchor point is returned to the life cycle of the outlide, and when the outlide continues to run the computation task instance, the operation task is equivalent, but at the moment, the previously obtained anchor point is also transmitted to the Occlum Enclave, so that the computation task instance is taken to the position where the anchor point is paused last time, and then the computation task instance continues to run from the position.
For the Occlum Enclave area, the domain is mainly used for functions of a service layer, an algorithm execution layer, a data registration receiving layer and a data persistence layer. The service layer belongs to an upper layer interface service in the Occlum Enclave, and is used for receiving all requests from the outlide and other third party services, such as the full life cycle of the computing task instance, encryption and decryption of data, data registration information, generation of a secret key, and the like, and the service layer is operated on the Occlum Enclave as the computing task instance, so that the instance of the service layer is also required to be obtained through parameter configuration and instance construction. The service layer comprises the following functional modules: key management, data encryption and decryption, data registration and task management. The key management module is used for generating an internal key which needs to encrypt data by utilizing a trusted execution environment provided by the Occlum enclaspe and safely storing the internal key in a data persistence layer. The data encryption and decryption module is used for realizing a high-security data encryption and decryption function by utilizing a trusted execution environment provided by the Occlum enclaspe and utilizing key management in the trusted execution environment. And the encrypted data form a data ciphertext which is stored in an external environment, and the secret key is safely protected in a data persistence layer of the Occlum Enclave by the secret key management, so that the safety of the data can be ensured, and the sustainable sufficiency of resources of the Occlum Enclave can be ensured. The data registration module is configured to provide a portal for receiving data registration information from the data nodes. And, for privacy sensitive data information of the data nodes, such as data tags, encryption and decryption keys, data connection addresses, etc., an encryption transmission channel can be formed by using certificates generated by the SSL generator, and the data registration information of each data node will transmit the privacy sensitive data information to the data registration module of the Occlum Enclave service layer through the encryption transmission channel, and then the module will transmit the obtained information to the data registration receiving layer for unified processing. The task management module is used for interfacing all requests of the algorithm manager of the outlide region, particularly the life cycle management of the task, and simultaneously writing task information into the data persistence layer.
Further, for the algorithm execution layer, which is a core processing layer of the computing task instance, the algorithm execution layer is completely operated based on the Occlum Enclave trusted execution environment, and processes any computing task instance from the initiation of the outlide lifecycle management, such as machine learning, data management, feature engineering, and the like. In the process of executing the computing task instance, privacy sensitive data of each data provider during data registration are used, at the moment, external data resources are required to be acquired according to data connection addresses in the privacy sensitive data, the external data resources are encrypted by the data provider through data encryption and decryption of the service layer and key management to obtain ciphertext data, the obtained ciphertext data are decrypted through encryption and decryption keys during data registration to obtain plaintext data, the computing task instance is executed based on the plaintext data, and some intermediate process data generated in the computing process are put into a data persistence layer for subsequent security audit. And the final algorithm execution layer executes the calculation task instance, encrypts and outputs the calculation result to each data provider by using the encryption and decryption keys registered by the data of each data provider, and each data provider decrypts the data according to the need by using the own key.
Further, for the data registration receiving layer, privacy sensitive data information transmitted by the data registration from the upper service layer can be received, and the privacy sensitive data information is stored in the data persistence layer for safe storage according to a computing task instance to which the privacy sensitive data information belongs.
Further, for the data persistence layer, the data persistence layer is used for mainly performing a secure storage function of various data in the Occlum enclaspe, including key management, task management, data registration information, process data generated by an algorithm execution layer and the like.
Having described the method and apparatus of the exemplary embodiments of the present invention, reference will now be made to FIG. 4 for an illustration of a computer readable storage medium of the exemplary embodiments of the present invention, and reference will now be made to FIG. 4 which shows a computer readable storage medium as an optical disk 40 having a computer program (i.e., program product) stored thereon that, when executed by a processor, performs the steps described in the above method embodiments, e.g., in an untrusted execution environment, by an algorithm manager, to obtain a target computing task from a task queue; determining task configuration information matched with the target computing task; performing calculation task instance construction based on the task configuration information to obtain a target calculation task instance; starting the target computing task instance through the algorithm manager, and monitoring the process information of the target computing task instance; executing the target computing task instance in a trusted execution environment to obtain a computing result; encrypting the calculation result by using encryption and decryption keys of all the data nodes to obtain an encryption result; outputting the encryption result to each data node respectively; the specific implementation of each step is not repeated here.
It should be noted that examples of the computer readable storage medium may also include, but are not limited to, a phase change memory (PRAM), a Static Random Access Memory (SRAM), a Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), a Read Only Memory (ROM), an Electrically Erasable Programmable Read Only Memory (EEPROM), a flash memory, or other optical or magnetic storage medium, which will not be described in detail herein.
Having described the methods, media, and apparatus of exemplary embodiments of the present invention, next, a computing device for centralized computing based on a trusted execution environment of exemplary embodiments of the present invention is described with reference to FIG. 5.
FIG. 5 illustrates a block diagram of an exemplary computing device 50 suitable for use in implementing embodiments of the invention, the computing device 50 may be a computer system or a server. The computing device 50 shown in fig. 5 is merely an example and should not be taken as limiting the functionality and scope of use of embodiments of the present invention.
As shown in fig. 5, components of computing device 50 may include, but are not limited to: one or more processors or processing units 501, a system memory 502, and a bus 503 that connects the various system components (including the system memory 502 and processing units 501).
Computing device 50 typically includes a variety of computer system readable media. Such media can be any available media that is accessible by computing device 50 and includes both volatile and nonvolatile media, removable and non-removable media.
The system memory 502 may include computer system readable media in the form of volatile memory, such as Random Access Memory (RAM) 5021 and/or cache memory 5022. Computing device 50 may further include other removable/non-removable, volatile/nonvolatile computer system storage media. By way of example only, ROM5023 may be used to read from and write to non-removable, nonvolatile magnetic media (not shown in FIG. 5 and commonly referred to as a "hard drive"). Although not shown in fig. 5, a magnetic disk drive for reading from and writing to a removable non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive for reading from or writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media), may be provided. In such cases, each drive may be coupled to bus 503 through one or more data medium interfaces. The system memory 502 may include at least one program product having a set (e.g., at least one) of program modules configured to carry out the functions of embodiments of the invention.
A program/utility 5025 having a set (at least one) of program modules 5024 may be stored in, for example, system memory 502, and such program modules 5024 include, but are not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of which may include an implementation of a network environment. Program modules 5024 generally perform the functions and/or methods of the described embodiments of the present invention.
Computing device 50 may also communicate with one or more external devices 504 (e.g., keyboard, pointing device, display, etc.). Such communication may occur through an input/output (I/O) interface 505. Moreover, computing device 50 may also communicate with one or more networks such as a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network, such as the Internet, through network adapter 506. As shown in fig. 5, network adapter 506 communicates with other modules of computing device 50, such as processing unit 501, etc., via bus 503. It should be appreciated that although not shown in fig. 5, other hardware and/or software modules may be used in connection with computing device 50.
The processing unit 501 executes various functional applications and data processing by running programs stored in the system memory 502, for example, in an untrusted execution environment, acquiring a target calculation task from a task queue through an algorithm manager; determining task configuration information matched with the target computing task; performing calculation task instance construction based on the task configuration information to obtain a target calculation task instance; starting the target computing task instance through the algorithm manager, and monitoring the process information of the target computing task instance; executing the target computing task instance in a trusted execution environment to obtain a computing result; encrypting the calculation result by using encryption and decryption keys of all the data nodes to obtain an encryption result; and outputting the encryption result to each data node respectively. The specific implementation of each step is not repeated here. It should be noted that while in the above detailed description, reference is made to several units/modules or sub-units/sub-modules of a centralized computing device based on a trusted execution environment, such partitioning is merely exemplary and not mandatory. Indeed, the features and functionality of two or more units/modules described above may be embodied in one unit/module in accordance with embodiments of the present invention. Conversely, the features and functions of one unit/module described above may be further divided into ones that are embodied by a plurality of units/modules.
In the description of the present invention, it should be noted that the terms "first," "second," and "third" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance.
It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, and are not repeated herein.
In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. The above-described apparatus embodiments are merely illustrative, for example, the division of the units is merely a logical function division, and there may be other manners of division in actual implementation, and for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be through some communication interface, device or unit indirect coupling or communication connection, which may be in electrical, mechanical or other form.
The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.
The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a non-volatile computer readable storage medium executable by a processor. Based on this understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
Finally, it should be noted that: the above examples are only specific embodiments of the present invention, and are not intended to limit the scope of the present invention, but it should be understood by those skilled in the art that the present invention is not limited thereto, and that the present invention is described in detail with reference to the foregoing examples: any person skilled in the art may modify or easily conceive of the technical solution described in the foregoing embodiments, or perform equivalent substitution of some of the technical features, while remaining within the technical scope of the present disclosure; such modifications, changes or substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention, and are intended to be included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.
Furthermore, although the operations of the methods of the present invention are depicted in the drawings in a particular order, this is not required to either imply that the operations must be performed in that particular order or that all of the illustrated operations be performed to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step to perform, and/or one step decomposed into multiple steps to perform.
Claims (8)
1. A centralized computing method based on a trusted execution environment, comprising:
in an untrusted execution environment, acquiring a target computing task from a task queue through an algorithm manager;
determining task configuration information matched with the target computing task; the task configuration information comprises a parameter configuration file and an operation dependency library corresponding to a calculation task algorithm program;
performing calculation task instance construction based on the task configuration information through a preset trusted construction function to obtain an initial calculation task instance;
configuring the use authority of the stack memory for the initial computing task instance to obtain a target computing task instance;
starting the target computing task instance through the algorithm manager, and monitoring the process information of the target computing task instance;
executing the target computing task instance in a trusted execution environment to obtain a computing result;
encrypting the calculation result by using encryption and decryption keys of each data node to obtain an encryption result;
outputting the encryption result to each data node respectively;
the encryption and decryption keys are keys which are generated in advance for each data node by the service layer instance of the isolation environment and are safely stored in the trusted execution environment;
The method further comprises the steps of:
installing an operation dependency library corresponding to the target program in an untrusted execution environment; the target program comprises the computing task algorithm program, an isolated environment service layer program and an algorithm manager program;
starting the algorithm manager program based on an operation dependency library corresponding to the algorithm manager program in an untrusted execution environment; and constructing the isolation environment service layer instance based on an operation dependency library corresponding to the isolation environment service layer program through the preset trusted construction function; the isolated environment service layer instance is configured with the use permission of the stack memory;
and starting the isolation environment service layer instance in the trusted execution environment.
2. The trusted execution environment-based centralized computing method of claim 1, further comprising:
in the trusted execution environment, generating the encryption and decryption keys for each data node through the isolated environment service layer instance;
encrypting the data in each data node by using the encryption and decryption key to obtain ciphertext data;
and storing the ciphertext data into a local storage of each data node so that each data node registers the ciphertext data to a trusted execution environment based on an SSL certificate.
3. The trusted execution environment-based centralized computing method of claim 1, further comprising:
in an untrusted execution environment, responding to a trusted task execution request through the algorithm manager, and carrying out life cycle management of each trusted task;
the target computing task is a task in the trusted tasks.
4. The trusted execution environment-based centralized computing method of claim 1, further comprising:
in an untrusted execution environment, SSL certificates are generated.
5. A centralized computing device based on a trusted execution environment, comprising:
the task acquisition unit is used for acquiring a target calculation task from the task queue through the algorithm manager in the non-trusted execution environment;
the configuration determining unit is used for determining task configuration information matched with the target computing task; the task configuration information comprises a parameter configuration file and an operation dependency library corresponding to a calculation task algorithm program;
the instance construction unit is used for constructing a calculation task instance based on the task configuration information through a preset trusted construction function to obtain an initial calculation task instance; configuring the use authority of the stack memory for the initial computing task instance to obtain a target computing task instance;
The algorithm management unit is used for starting the target computing task instance through the algorithm manager and monitoring the process information of the target computing task instance;
the task computing unit is used for executing the target computing task instance in a trusted execution environment to obtain a computing result;
the encryption unit is used for encrypting the calculation result by using encryption and decryption keys of all the data nodes to obtain an encryption result;
the output unit is used for respectively outputting the encryption results to the data nodes;
the encryption and decryption keys are keys which are generated in advance for each data node by the service layer instance of the isolation environment and are safely stored in the trusted execution environment;
the apparatus further comprises:
the configuration unit is used for installing an operation dependency library corresponding to the target program in the non-trusted execution environment; the target program comprises the computing task algorithm program, an isolated environment service layer program and an algorithm manager program;
the configuration unit is further used for starting the algorithm manager program based on an operation dependency library corresponding to the algorithm manager program in an untrusted execution environment; and constructing the isolation environment service layer instance based on an operation dependency library corresponding to the isolation environment service layer program through the preset trusted construction function; the isolated environment service layer instance is configured with the use permission of the stack memory;
The configuration unit is further configured to start the service layer instance of the isolation environment in the trusted execution environment.
6. The trusted execution environment-based centralized computing device of claim 5, wherein the encryption unit is further to:
in the trusted execution environment, generating the encryption and decryption keys for each data node through the isolated environment service layer instance;
encrypting the data in each data node by using the encryption and decryption key to obtain ciphertext data;
and storing the ciphertext data into a local storage of each data node so that each data node registers the ciphertext data to a trusted execution environment based on an SSL certificate.
7. The trusted execution environment-based centralized computing device of claim 5, wherein the algorithm management unit is further to:
in an untrusted execution environment, responding to a trusted task execution request through the algorithm manager, and carrying out life cycle management of each trusted task;
the target computing task is a task in the trusted tasks.
8. The trusted execution environment-based centralized computing device of claim 5, further comprising a configuration unit to:
In an untrusted execution environment, SSL certificates are generated.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310298255.XA CN116401671B (en) | 2023-03-23 | 2023-03-23 | Centralized computing method and device based on trusted execution environment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310298255.XA CN116401671B (en) | 2023-03-23 | 2023-03-23 | Centralized computing method and device based on trusted execution environment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116401671A CN116401671A (en) | 2023-07-07 |
| CN116401671B true CN116401671B (en) | 2023-10-03 |
Family
ID=87017065
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310298255.XA Active CN116401671B (en) | 2023-03-23 | 2023-03-23 | Centralized computing method and device based on trusted execution environment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116401671B (en) |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115270134A (en) * | 2022-07-18 | 2022-11-01 | 京信数据科技有限公司 | Computing method and system based on FPGA trusted execution environment |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111460453B (en) * | 2019-01-22 | 2023-12-12 | 百度在线网络技术（北京）有限公司 | Machine learning training method, controller, device, server, terminal and medium |
-
2023
- 2023-03-23 CN CN202310298255.XA patent/CN116401671B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115270134A (en) * | 2022-07-18 | 2022-11-01 | 京信数据科技有限公司 | Computing method and system based on FPGA trusted execution environment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116401671A (en) | 2023-07-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP3937424B1 (en) | Blockchain data processing methods and apparatuses based on cloud computing | |
| US11398899B2 (en) | Data processing device and data processing method | |
| CN112948810B (en) | Trusted computing program calling method and device, electronic equipment and storage medium | |
| Noorman et al. | Sancus: Low-cost trustworthy extensible networked devices with a zero-software trusted computing base | |
| CN110348204B (en) | Code protection system, authentication method, authentication device, chip and electronic equipment | |
| US20200042747A1 (en) | Security processing unit of plc and bus arbitration method thereof | |
| CN112989319B (en) | Method, device, electronic equipment and storage medium for realizing trusted computing | |
| CN109784007B (en) | Byte code encryption method, byte code decryption method and terminal | |
| US9594915B2 (en) | Information processing apparatus | |
| WO2022237123A1 (en) | Method and apparatus for acquiring blockchain data, electronic device, and storage medium | |
| US20110191597A1 (en) | Method and system for securing software | |
| CN109768862B (en) | A kind of key management method, key call method and cipher machine | |
| CN111177749A (en) | Encrypted source code file processing method and device, computer equipment and storage medium | |
| CN115668860B (en) | Method and system for identifying creator of encrypted object | |
| CN110750791A (en) | Method and system for guaranteeing physical attack resistance of trusted execution environment based on memory encryption | |
| Bornträger et al. | Secure your cloud workloads with IBM Secure Execution for Linux on IBM z15 and LinuxONE III | |
| CN111859379B (en) | Processing method and device for protecting data model | |
| Krauß et al. | Using trusted platform modules for location assurance in cloud networking | |
| CN116401671B (en) | Centralized computing method and device based on trusted execution environment | |
| CN116226940B (en) | PCIE-based data security processing method and data security processing system | |
| CN116305005A (en) | Application method, device and system of software encryption service | |
| Vrancken et al. | Securely deploying distributed computation systems on peer-to-peer networks | |
| CN113489723A (en) | Data transmission method, system, computer device and storage medium | |
| Andrade et al. | SRX–Secure Data Backup and Recovery for SGX Applications | |
| CN114329574B (en) | Encrypted partition access control method and system based on domain management platform and computing equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |