WO2023035507A1 - 一种可信执行环境多节点认证方法 - Google Patents

一种可信执行环境多节点认证方法 Download PDF

Info

Publication number
WO2023035507A1
WO2023035507A1 PCT/CN2021/142976 CN2021142976W WO2023035507A1 WO 2023035507 A1 WO2023035507 A1 WO 2023035507A1 CN 2021142976 W CN2021142976 W CN 2021142976W WO 2023035507 A1 WO2023035507 A1 WO 2023035507A1
Authority
WO
WIPO (PCT)
Prior art keywords
computing
user
tee
node
data
Prior art date
Application number
PCT/CN2021/142976
Other languages
English (en)
French (fr)
Inventor
贺伟
史楠迪
汪昌帅
徐潜
马颂华
范磊
Original Assignee
天翼电子商务有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 天翼电子商务有限公司 filed Critical 天翼电子商务有限公司
Priority to JP2023513540A priority Critical patent/JP2023545895A/ja
Publication of WO2023035507A1 publication Critical patent/WO2023035507A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/72—Signcrypting, i.e. digital signing and encrypting simultaneously

Definitions

  • the invention relates to the fields of trusted execution environment, cloud environment, remote authentication and privacy protection, in particular to a multi-node authentication method of trusted execution environment.
  • Trusted Execution Environment is a secure computing framework that implements data security protection by setting a hardware-based security zone in a general-purpose CPU. Native security protection against tampering or theft. Different from traditional simple security chips, TEE can realize the general computing function supported by CPU. In the traditional CPU+security chip architecture, the security chip provides functions such as encryption, signature, and authentication, and the CPU implements general-purpose computing, so the data in the CPU cannot be effectively protected. In TEE, general computing, encryption, authentication and other functions are all completed inside the CPU, and the encryption and access control of memory are protected by TEE, so the data security protection of the entire computing process can be realized. Remote secure computing can be realized through TEE.
  • Typical TEE devices include the SGX environment provided by the Intel CPU and the TRUST ZONE provided by the ARM chip. Through the remote identity authentication protocol, the TEE can realize the user's authentication of the code executed in the TEE and the encryption of the data.
  • the existing certifications are all single equipment (TEE) certifications.
  • Cloud computing integrates computing resources even in the cloud through hardware virtualization, and provides users with dynamically scalable computing, storage and network management services.
  • Cloud-based applications have promoted the growth of many Internet companies.
  • Cloud computing is the current large-scale computing A typical way of resource management and application.
  • cloud computing also faces many security issues. Users need to send data to the cloud for storage and computing processing, and there is a risk of leakage of user sensitive data.
  • user data cannot be uploaded in ciphertext, that is, cloud service providers can obtain all plaintext data of users.
  • cryptographic tools such as fully homomorphic encryption algorithms can be used, but such algorithms have the problem of low efficiency and cannot provide high-performance and practical solutions.
  • TEE-based hardware security solutions can provide a more efficient and practical solution for user data protection in cloud computing environments. Since TEE is a general-purpose computing CPU with security protection functions, using TEE as a CPU in cloud computing can realize the security protection of user data.
  • the remote authentication of a single TEE device by the user can be realized.
  • computing resources include multiple physical nodes, so it is necessary to provide users with a single authentication interface to complete multi-point security authentication.
  • This scheme designs a remote authentication scheme for multi-node trusted execution environment suitable for cloud computing environment.
  • the technical problem to be solved by the present invention is to overcome the defects of the prior art and provide a trusted execution environment multi-node authentication method.
  • the present invention provides the following technical solutions:
  • the present invention provides a trusted execution environment multi-node authentication method, assuming that multiple TEE computing nodes form a computing resource pool, and the computing resource management system uniformly allocates computing resources; the resource pool sets a unified access and authentication node (AuthNode) , the node assists the user in completing the remote authentication process for all allocated TEE computing nodes.
  • the scheme includes two links: user program security deployment and user data security calculation; the main process is described as follows:
  • the user uploads the computing program to the TEE cloud computing environment and applies for the required computing resources.
  • the computing resource pool allocates TEE computing resources for the user and deploys the user program in the secure computing environment TEE;
  • AutNode starts the remote authentication process, and all user programs are deployed
  • the TEE node and AutNode complete the following two functions through a secure communication channel;
  • the TEE node will generate a summary report on the data including basic information such as node information, memory status, and execution program, and upload the report to AutNode; AutNode will check the correctness and completeness of the TEE node report, and add the TEE node to the trusted resource after passing the inspection list;
  • AutNode generates encrypted session keys and authentication session keys shared with all TEEs, and shares these two keys with all TEE nodes and user nodes through a secure channel;
  • AutNode sends the data generation summary report containing basic information such as its own node information, memory status, and execution program to the user; the user verifies the correctness and completeness of the report, and confirms that the computing resource is a trusted environment after passing the inspection;
  • the user uses the trusted environment that has passed the inspection to realize the calculation of data and the acquisition of results, mainly including the following two functions;
  • the user encrypts and signs the data required for calculation and uploads it to the secure computing environment.
  • the secure computing environment assigns computing tasks to the corresponding TEE computing resources according to the resource scheduling policy; the TEE completes the calculation after decrypting the data and verifying the signature. Calculation results;
  • the TEE computing node encrypts the calculation result with the session key, signs it and sends it back to the user, and the user verifies the signature and decrypts it to obtain a credible calculation result.
  • Fig. 1 is a schematic diagram of the framework of the TEE computing resource pool system in the present invention
  • Figure 2 is a flow chart of program security deployment
  • Fig. 3 is a flow chart of data security calculation.
  • the present invention is shown in Figures 1-3.
  • the present invention provides a trusted execution environment multi-node authentication method. It is assumed that multiple TEE computing nodes form a computing resource pool, and the computing resource management system uniformly allocates computing resources; resource pool settings A unified access and authentication node (AuthNode), which assists users to complete the remote authentication process for all allocated TEE computing nodes.
  • AuthNode unified access and authentication node
  • the solution includes two links: user program security deployment and user data security calculation; the main process is described as follows:
  • the user uploads the computing program to the TEE cloud computing environment and applies for the required computing resources.
  • the computing resource pool allocates TEE computing resources for the user and deploys the user program in the secure computing environment TEE;
  • AutNode starts the remote authentication process, and all user programs are deployed
  • the TEE node and AutNode complete the following two functions through a secure communication channel;
  • the TEE node will generate a summary report on the data including basic information such as node information, memory status, and execution program, and upload the report to AutNode; AutNode will check the correctness and completeness of the TEE node report, and add the TEE node to the trusted resource after passing the inspection list;
  • AutNode generates encrypted session keys and authentication session keys shared with all TEEs, and shares these two keys with all TEE nodes and user nodes through a secure channel;
  • AutNode sends the data generation summary report containing basic information such as its own node information, memory status, and execution program to the user; the user verifies the correctness and completeness of the report, and confirms that the computing resource is a trusted environment after passing the inspection;
  • the user uses the trusted environment that has passed the inspection to realize the calculation of data and the acquisition of results, mainly including the following two functions;
  • the user encrypts and signs the data required for calculation and uploads it to the secure computing environment.
  • the secure computing environment assigns computing tasks to the corresponding TEE computing resources according to the resource scheduling policy; the TEE completes the calculation after decrypting the data and verifying the signature. Calculation results;
  • the TEE computing node encrypts the calculation result with the session key, signs it and sends it back to the user, and the user verifies the signature and decrypts it to obtain a credible calculation result.
  • the present invention is applied to a TEE-based secure cloud computing environment, and realizes user data security protection and trusted computing through two stages of program security deployment and data security computing.
  • the implementation flow of the two processes is as follows:
  • Program security deployment is used for users to deploy verifiable code in the cloud computing environment and initialize a secure computing environment.
  • the specific implementation process is shown in Figure 2;
  • the user node applies to the TEE node cluster to deploy the user program, and the node cluster starts the corresponding TEE computing resources to complete the correct deployment of the user program.
  • the TEE cluster correctly deploys the node of the user program to interact with the authentication node AutNode, generates the authentication report of its own execution environment and the corresponding digital signature and sends it to AutNode. After AutNode verifies and passes the remote report, add the node to the user program execution list.
  • AutNode generates a unified authentication key and encryption key K aut , K Enc for all nodes in the user program list. Send Kaut and K Enc to the TEE node.
  • AutNode generates a remote report with its own execution environment, and sends the remote report, Kaut and K Enc to the user node. After the user node is verified and passed the remote report, it is accepted as a safe remote computing environment and saves Kaut and K Enc .
  • Data security computing is used for users to complete data computing safely and credibly in the cloud computing environment.
  • the computing logic is implemented based on the secure computing environment applied for in the security deployment phase.
  • the specific implementation process is shown in Figure 3;
  • the user node uses KEnc to encrypt data and uses Kaut to generate a data signature, and sends the encrypted data and signature to the node in the TEE cluster where the user program is deployed.
  • the TEE node cluster uses KEnc to decrypt data and uses Kaut to verify data integrity.
  • the decrypted data is calculated inside the cluster TEE, and TEE nodes can cooperate to perform calculation functions.
  • the calculation result is encrypted with KEnc and sent to the user node with Kaut signature.
  • the user node decrypts the execution result and verifies the signature, and accepts the calculation result if it passes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了提供一种可信执行环境多节点认证方法，假设多个TEE计算节点组成一个计算资源池，并由计算资源管理系统统一分配计算资源；资源池设置一个统一接入与认证节点（AuthNode），该节点协助用户完成对所有分配TEE计算节点的远程认证过程。本发明的有益效果如下：1.用户可对云计算环境中的代码安全进行认证，并通过TEE对计算过程实现安全保护；2.可实现用户数据的隐私保护，用户数据以加密状态上传至云环境，数据仅在TEE内部解密使用；3.用户可对计算结果正确性进行认证，确保计算结果没有被篡改；4.仅在程序部署阶段进行完整的远程认证，且对TEE的认证过程在云环境内部完成，计算过程用户仅需做简单的本地验证，执行效率高。

Description

一种可信执行环境多节点认证方法 技术领域
本发明涉及可信执行环境、云环境、远程认证、隐私保护领域，特别涉及一种可信执行环境多节点认证方法。
 背景技术
可信执行环境（Trusted Executive Environment，TEE）是通过在通用CPU内设置基于硬件保护的安全区从而实现数据安全保护的一种安全计算框架，其计算过程以及所用到的内存、寄存器等均受到芯片原生的安全保护不被篡改或者窃取。与传统单纯的安全芯片不同，TEE可实现CPU所支持的通用计算功能。在传统的CPU+安全芯片的架构中，安全芯片提供加密、签名、认证等功能，CPU实现通用的计算，因此CPU内的数据无法得到有效的保护。在TEE中，通用计算与加密、认证等功能均在CPU内部完成，并且内存的加密与访问控制均被TEE所保护，因此可以实现整个计算过程的数据安全保护。通过TEE可以实现远程的安全计算。典型的TEE设备包括英特尔CPU提供的SGX环境以及ARM芯片所提供的TRUST ZONE等。TEE通过远程身份认证协议可以实现用户对TEE中执行代码的认证以及数据的加密功能。目前已有的认证均是单个设备（TEE）的认证。
 技术问题
云计算通过硬件虚拟化即使在云端整合了计算资源，为使用者提供了动态可扩展的计算、存储和网络管理服务，基于云的运用推动了许多互联网公司的增长，云计算是当前大规模计算资源管理与应用的典型方式。但是云计算也面临着诸多的安全问题，用户需要将数据发送到云端进行存储与计算处理，用户的敏感数据存在泄露的风险。为了实现云端的计算，用户数据不能以密文方式上传，也就是云服务商可以获得用户的所有明文数据。为了解决这一问题，可以使用全同态加密算法等密码学工具，但此类算法存在效率较低的问题，无法提供高性能实用的解决方案。基于TEE的硬件安全方案可以为云计算环境用户数据保护提供更加高效实用的方案。由于TEE是具有安全防护功能的通用计算CPU，因此使用TEE作为云计算中的CPU可实现用户数据的安全保护。
在原生的TEE认证方案中，可实现用户对单一TEE设备的远程认证。在云计算环境中，计算资源包含多个实体节点，因此需要为用户提供单一的认证接口完成多加点的安全认证。本方案设计了一个适用于云计算环境的多节点可信执行环境的远程认证方案。
 技术解决方案
本发明要解决的技术问题是克服现有技术的缺陷，提供一种可信执行环境多节点认证方法。
为了解决上述技术问题，本发明提供了如下的技术方案：
本发明提供一种可信执行环境多节点认证方法，假设多个TEE计算节点组成一个计算资源池，并由计算资源管理系统统一分配计算资源；资源池设置一个统一接入与认证节点（AuthNode），该节点协助用户完成对所有分配TEE计算节点的远程认证过程，方案包括两个环节：用户程序安全部署和用户数据安全计算；其主要流程描述如下：
（1）.用户程序安全部署
用户将计算程序上传至TEE云计算环境，并申请所需的计算资源，计算资源池为用户分配TEE计算资源，并在安全计算环境TEE中部署用户程序；AutNode启动远程认证流程，所有部署用户程序的TEE节点与AutNode通过安全的通信信道完成如下两项功能；
1）生成远程认证报告
TEE节点将包含节点信息、内存状态、执行程序等基础信息的数据生成摘要报告，并将报告上传至AutNode；AutNode检测TEE节点报告的正确性与完备性，通过检查后将TEE节点加入可信资源列表；
2）获取会话密钥
AutNode生成与所有TEE共享的加密会话密钥与认证会话密钥，并将此两个密钥通过安全信道分享给所有TEE节点以及用户节点；
  AutNode将包含自身节点信息、内存状态、执行程序等基础信息的数据生成摘要报告发送给用户；用户检验报告的正确性与完备性，通过检查后确认该计算资源为可信环境；
（2）.用户数据安全计算
用户利用通过检查的可信环境实现数据的计算与结果的获取，主要包括如下两项功能；
1）数据上传与计算
用户将计算所需数据使用会话密钥加密及签名后上传至安全计算环境，安全计算环境根据资源调度策略将计算任务分配给相应的TEE计算资源；TEE解密数据并校验签名后完成计算，获取计算结果；
2）计算结果确认
TEE计算节点将计算结果使用会话密钥加密并签名后回传给用户，用户校验签名并解密后获得可信的计算结果。
 有益效果
与现有技术相比，本发明的有益效果如下：
1.用户可对云计算环境中的代码安全进行认证，并通过TEE对计算过程实现安全保护。
2.可实现用户数据的隐私保护，用户数据以加密状态上传至云环境，数据仅在TEE内部解密使用。
3.用户可对计算结果正确性进行认证，确保计算结果没有被篡改。
4.仅在程序部署阶段进行完整的远程认证，且对TEE的认证过程在云环境内部完成，计算过程用户仅需做简单的本地验证，执行效率高。
 附图说明
附图用来提供对本发明的进一步理解，并且构成说明书的一部分，与本发明的实施例一起用于解释本发明，并不构成对本发明的限制。在附图中：
图1是本发明中TEE计算资源池系统框架示意图；
图2是程序安全部署流程图；
图3是数据安全计算流程图。
 本发明的实施方式
以下结合附图对本发明的优选实施例进行说明，应当理解，此处所描述的优选实施例仅用于说明和解释本发明，并不用于限定本发明。
实施例 1
本发明如图1-3所示，本发明提供一种可信执行环境多节点认证方法，假设多个TEE计算节点组成一个计算资源池，并由计算资源管理系统统一分配计算资源；资源池设置一个统一接入与认证节点（AuthNode），该节点协助用户完成对所有分配TEE计算节点的远程认证过程，方案包括两个环节：用户程序安全部署和用户数据安全计算；其主要流程描述如下：
（1）.用户程序安全部署
用户将计算程序上传至TEE云计算环境，并申请所需的计算资源，计算资源池为用户分配TEE计算资源，并在安全计算环境TEE中部署用户程序；AutNode启动远程认证流程，所有部署用户程序的TEE节点与AutNode通过安全的通信信道完成如下两项功能；
1）生成远程认证报告
TEE节点将包含节点信息、内存状态、执行程序等基础信息的数据生成摘要报告，并将报告上传至AutNode；AutNode检测TEE节点报告的正确性与完备性，通过检查后将TEE节点加入可信资源列表；
2）获取会话密钥
AutNode生成与所有TEE共享的加密会话密钥与认证会话密钥，并将此两个密钥通过安全信道分享给所有TEE节点以及用户节点；
  AutNode将包含自身节点信息、内存状态、执行程序等基础信息的数据生成摘要报告发送给用户；用户检验报告的正确性与完备性，通过检查后确认该计算资源为可信环境；
（2）.用户数据安全计算
用户利用通过检查的可信环境实现数据的计算与结果的获取，主要包括如下两项功能；
1）数据上传与计算
用户将计算所需数据使用会话密钥加密及签名后上传至安全计算环境，安全计算环境根据资源调度策略将计算任务分配给相应的TEE计算资源；TEE解密数据并校验签名后完成计算，获取计算结果；
2）计算结果确认
TEE计算节点将计算结果使用会话密钥加密并签名后回传给用户，用户校验签名并解密后获得可信的计算结果。
具体的，本发明应用于基于TEE的安全云计算环境，通过程序安全部署与数据安全计算两个阶段实现用户数据的安全保护与可信计算。两个过程的实施流程如下文所示：
1.程序安全部署
程序安全部署用于用户在云计算环境中部署可验证的代码，初始化安全的计算环境，具体实施流程如图2所示；
1）用户节点向TEE节点集群申请部署用户程序，节点集群启动对应的TEE计算资源完成用户程序的正确部署。
2）TEE集群正确部署了用户程序的节点与认证节点AutNode交互，生成自身执行环境的认证报告以及相应的数字签名并发送给AutNode。AutNode验证通过远程报告后将该节点加入用户程序执行名单。
3）AutNode为用户程序名单中的所有节点生成统一的认证密钥与加密密钥K aut、K Enc。将K aut、K Enc发送给TEE节点。
4）AutNode将自身的执行环境生成远程报告，将远程报告以及K aut、K Enc发送给用户节点。用户节点验证通过远程报告后，接受为安全的远程计算环境并保存K aut、K Enc。
2.数据安全计算
数据安全计算用于用户在云计算环境中安全可信的完成数据计算，计算逻辑基于在安全部署阶段所申请的安全计算环境实现，具体实施流程如图3所示；
1）用户节点使用KEnc加密数据并使用Kaut生成数据的签名，将加密后的数据及签名发送给TEE集群中部署了用户程序的节点。
2）TEE节点集群利用KEnc解密数据并使用Kaut校验数据完整性。解密后的数据在集群TEE内部完成计算，TEE节点间可协作执行计算功能。
3）计算完成后，将计算结果使用KEnc加密，并使用Kaut签名发送给用户节点。用户节点解密执行结果并验证签名，如果通过则接受计算结果。
最后应说明的是：以上所述仅为本发明的优选实施例而已，并不用于限制本发明，尽管参照前述实施例对本发明进行了详细的说明，对于本领域的技术人员来说，其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (1)

  1. 一种可信执行环境多节点认证方法，其特征在于，假设多个TEE计算节点组成一个计算资源池，并由计算资源管理系统统一分配计算资源；资源池设置一个统一接入与认证节点（AuthNode），该节点协助用户完成对所有分配TEE计算节点的远程认证过程，方案包括两个环节：用户程序安全部署和用户数据安全计算；其主要流程描述如下：
    （1）.用户程序安全部署
    用户将计算程序上传至TEE云计算环境，并申请所需的计算资源，计算资源池为用户分配TEE计算资源，并在安全计算环境TEE中部署用户程序；AutNode启动远程认证流程，所有部署用户程序的TEE节点与AutNode通过安全的通信信道完成如下两项功能；
    1）生成远程认证报告
    TEE节点将包含节点信息、内存状态、执行程序等基础信息的数据生成摘要报告，并将报告上传至AutNode；AutNode检测TEE节点报告的正确性与完备性，通过检查后将TEE节点加入可信资源列表；
    2）获取会话密钥
    AutNode生成与所有TEE共享的加密会话密钥与认证会话密钥，并将此两个密钥通过安全信道分享给所有TEE节点以及用户节点；
        AutNode将包含自身节点信息、内存状态、执行程序等基础信息的数据生成摘要报告发送给用户；用户检验报告的正确性与完备性，通过检查后确认该计算资源为可信环境；
    （2）.用户数据安全计算
    用户利用通过检查的可信环境实现数据的计算与结果的获取，主要包括如下两项功能；
    1）数据上传与计算
    用户将计算所需数据使用会话密钥加密及签名后上传至安全计算环境，安全计算环境根据资源调度策略将计算任务分配给相应的TEE计算资源；TEE解密数据并校验签名后完成计算，获取计算结果；
    2）计算结果确认
    TEE计算节点将计算结果使用会话密钥加密并签名后回传给用户，用户校验签名并解密后获得可信的计算结果。
PCT/CN2021/142976 2021-09-07 2021-12-30 一种可信执行环境多节点认证方法 WO2023035507A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
JP2023513540A JP2023545895A (ja) 2021-09-07 2021-12-30 信頼できる実行環境マルチノード認証方法

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111042285.1A CN113904806A (zh) 2021-09-07 2021-09-07 一种可信执行环境多节点认证方法
CN202111042285.1 2021-09-07

Publications (1)

Publication Number Publication Date
WO2023035507A1 true WO2023035507A1 (zh) 2023-03-16

Family

ID=79188639

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/142976 WO2023035507A1 (zh) 2021-09-07 2021-12-30 一种可信执行环境多节点认证方法

Country Status (3)

Country Link
JP (1) JP2023545895A (zh)
CN (1) CN113904806A (zh)
WO (1) WO2023035507A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117235693A (zh) * 2023-11-14 2023-12-15 杭州安恒信息技术股份有限公司 一种可信执行环境的可信认证和安全通道建立方法
CN117648998A (zh) * 2024-01-29 2024-03-05 西安电子科技大学 一种基于可信执行环境的大语言模型联邦预训练方法
CN117668887A (zh) * 2024-01-31 2024-03-08 南湖实验室 一种基于机密计算的同态加密安全与性能自定义平衡方法
CN117742898A (zh) * 2024-02-20 2024-03-22 南湖实验室 一种新型机密计算应用层度量方法及其系统
CN117938405A (zh) * 2024-03-21 2024-04-26 北京火山引擎科技有限公司 多云环境下的cdn服务编排方法、装置、设备及存储介质
CN117742898B (zh) * 2024-02-20 2024-05-31 南湖实验室 一种新型机密计算应用层度量方法及其系统

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114189392B (zh) * 2022-02-15 2022-05-20 中电云数智科技有限公司 一种基于可执行环境的数据隐私处理方法及装置
CN114186266B (zh) * 2022-02-16 2022-05-13 国家超级计算天津中心 超级计算与云计算环境下大数据安全隐私计算控制方法
CN114629639A (zh) * 2022-03-10 2022-06-14 阿里云计算有限公司 基于可信执行环境的密钥管理方法、装置和电子设备
CN114697107B (zh) * 2022-03-29 2023-09-19 杭州安恒信息技术股份有限公司 通信方法、装置、计算机设备和可读存储介质
CN117332442B (zh) * 2023-09-28 2024-05-17 浙江大学 一种安全可信的三方设备指纹认证方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107566184A (zh) * 2017-09-22 2018-01-09 天翼电子商务有限公司 一种资源统一管理方法及其系统
CN112288435A (zh) * 2020-11-20 2021-01-29 天翼电子商务有限公司 一种支持可信执行环境的智能合约执行方法
CN112380578A (zh) * 2020-11-20 2021-02-19 天翼电子商务有限公司 一种基于区块链和可信执行环境的边缘计算框架
CN112926051A (zh) * 2021-03-25 2021-06-08 支付宝(杭州)信息技术有限公司 多方安全计算方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107566184A (zh) * 2017-09-22 2018-01-09 天翼电子商务有限公司 一种资源统一管理方法及其系统
CN112288435A (zh) * 2020-11-20 2021-01-29 天翼电子商务有限公司 一种支持可信执行环境的智能合约执行方法
CN112380578A (zh) * 2020-11-20 2021-02-19 天翼电子商务有限公司 一种基于区块链和可信执行环境的边缘计算框架
CN112926051A (zh) * 2021-03-25 2021-06-08 支付宝(杭州)信息技术有限公司 多方安全计算方法和装置

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117235693A (zh) * 2023-11-14 2023-12-15 杭州安恒信息技术股份有限公司 一种可信执行环境的可信认证和安全通道建立方法
CN117235693B (zh) * 2023-11-14 2024-02-02 杭州安恒信息技术股份有限公司 一种可信执行环境的可信认证和安全通道建立方法
CN117648998A (zh) * 2024-01-29 2024-03-05 西安电子科技大学 一种基于可信执行环境的大语言模型联邦预训练方法
CN117648998B (zh) * 2024-01-29 2024-04-26 西安电子科技大学 一种基于可信执行环境的大语言模型联邦预训练方法
CN117668887A (zh) * 2024-01-31 2024-03-08 南湖实验室 一种基于机密计算的同态加密安全与性能自定义平衡方法
CN117668887B (zh) * 2024-01-31 2024-05-31 南湖实验室 一种基于机密计算的同态加密安全与性能自定义平衡方法
CN117742898A (zh) * 2024-02-20 2024-03-22 南湖实验室 一种新型机密计算应用层度量方法及其系统
CN117742898B (zh) * 2024-02-20 2024-05-31 南湖实验室 一种新型机密计算应用层度量方法及其系统
CN117938405A (zh) * 2024-03-21 2024-04-26 北京火山引擎科技有限公司 多云环境下的cdn服务编排方法、装置、设备及存储介质
CN117938405B (zh) * 2024-03-21 2024-05-31 北京火山引擎科技有限公司 多云环境下的cdn服务编排方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN113904806A (zh) 2022-01-07
JP2023545895A (ja) 2023-11-01

Similar Documents

Publication Publication Date Title
WO2023035507A1 (zh) 一种可信执行环境多节点认证方法
CN109361668B (zh) 一种数据可信传输方法
WO2021073170A1 (zh) 数据提供和融合的方法及装置
USRE49673E1 (en) Systems and methods for secure data exchange
WO2017020452A1 (zh) 认证方法和认证系统
US20200177378A9 (en) One-to-many symmetric cryptographic system and method
JP2016512374A5 (zh)
US11595203B2 (en) Systems and methods for encrypted content management
US10454917B2 (en) Enabling single sign-on authentication for accessing protected network services
CN102025503B (zh) 一种集群环境下数据安全实现方法和一种高安全性的集群
CN104735087A (zh) 一种基于公钥算法和SSL协议的多集群Hadoop系统安全优化方法
Abreu et al. Identity and access management for IoT in smart grid
CA3056814A1 (en) Symmetric cryptographic method and system and applications thereof
CN112866197A (zh) 实现物联网终端安全的密码边缘计算方法、系统及终端
CN105119719A (zh) 一种安全存储系统的密钥管理方法
CN113132097B (zh) 适合物联网的轻量级无证书跨域认证方法、系统及应用
CN113722726B (zh) 基于软硬件协同的加解密方法及系统
Maffina et al. An improved and efficient message passing interface for secure communication on distributed clusters
Bojanova et al. Cryptography classes in bugs framework (BF): Encryption bugs (ENC), verification bugs (VRF), and key management bugs (KMN)
US11611541B2 (en) Secure method to replicate on-premise secrets in a cloud environment
US12003634B2 (en) Systems and methods for encrypted content management
Pallavi et al. Study of security algorithms to secure IOT data in middleware
US11979491B2 (en) Transmission of secure information in a content distribution network
US11647013B1 (en) Encryption of data via public key cryptography with certificate verification of target
Wang et al. Source encryption scheme in sdn southbound

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2023513540

Country of ref document: JP

Kind code of ref document: A

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21956676

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE