WO2024001038A1 - 检测隐私数据泄漏的方法 - Google Patents

检测隐私数据泄漏的方法 Download PDF

Info

Publication number
WO2024001038A1
WO2024001038A1 PCT/CN2022/135611 CN2022135611W WO2024001038A1 WO 2024001038 A1 WO2024001038 A1 WO 2024001038A1 CN 2022135611 W CN2022135611 W CN 2022135611W WO 2024001038 A1 WO2024001038 A1 WO 2024001038A1
Authority
WO
WIPO (PCT)
Prior art keywords
statement
privacy
application
output
private data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/135611
Other languages
English (en)
French (fr)
Inventor
王海军
吴行行
傅滢
邱鸿霖
余逸荣
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ant Blockchain Technology Shanghai Co Ltd
Original Assignee
Ant Blockchain Technology Shanghai Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ant Blockchain Technology Shanghai Co Ltd filed Critical Ant Blockchain Technology Shanghai Co Ltd
Publication of WO2024001038A1 publication Critical patent/WO2024001038A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes

Definitions

  • Embodiments of the present disclosure belong to the field of computer technology, and in particular relate to methods for detecting privacy data leakage for applications that can run in a trusted execution environment, and methods for deploying applications to a trusted execution environment.
  • TEE Trusted Execution Environment
  • Cloud access requires remote access, and the end user is invisible to the hardware platform.
  • the first step in using TEE is to confirm that the TEE is authentic and trustworthy. Therefore, current TEE technology has introduced a remote certification mechanism, which is endorsed by hardware manufacturers (mainly CPU manufacturers) and uses digital signature technology to ensure that users can verify the TEE status. At the same time, only secure resource isolation cannot meet the security needs, and further data privacy protection has also been proposed.
  • Commercial TEEs including Intel SGX and AMD SEV also provide memory encryption technology, which limits trusted hardware inside the CPU. The data on the bus and memory are all ciphertext to prevent malicious users from snooping. For example, TEE technologies such as Intel's Software Guard Extensions (SGX) isolate code execution, remote attestation, secure configuration, secure storage of data, and trusted paths for executing code. Applications running in the TEE are securely protected and almost impossible to access by third parties.
  • SGX Software Guard Extensions
  • SGX provides an enclave, also known as an enclave, which is an encrypted trusted execution area in the memory where the CPU protects data from being stolen.
  • enclave also known as an enclave
  • a part of the area EPC Enclave Page Cache, Enclave Page Cache or Enclave Page Cache
  • EPC Enclave Page Cache, Enclave Page Cache or Enclave Page Cache
  • MEE Memory
  • private data can be encrypted and passed to the circle in ciphertext, and the corresponding secret key can also be passed to the circle through remote certification. Then, the data is used to perform calculations under the encryption protection of the CPU, and the results are returned in ciphertext.
  • the purpose of this disclosure is to provide a method of detecting privacy data leakage for an application program capable of running in a trusted execution environment, a method of deploying an application program to a trusted execution environment, a non-transitory computer-readable storage medium, and a computing device.
  • a method for detecting privacy data leakage for an application capable of running in a trusted execution environment including: determining a private data input source; Output outside the environment determines one or more privacy leak detection points; and determining the privacy data based on statements in the application associated with the privacy data input source or the one or more privacy leak detection points Whether the input source is capable of propagating to the one or more privacy leak detection points.
  • a method of deploying an application to a trusted execution environment including: before deploying the application, performing privacy data leakage detection on the application as follows: determining private data Input sources; determining one or more privacy leak detection points based on the output of the application to outside the trusted execution environment; and based on the information in the application that is related to the privacy data input source or the one or more Statements associated with privacy leakage detection points determine whether the privacy data input source can be propagated to the one or more privacy leakage detection points.
  • a non-transitory computer-readable storage medium is provided.
  • a series of computer-executable instructions are stored on the non-transitory computer-readable storage medium.
  • the instructions when executed by one or more computing devices, cause the one or more computing devices to perform the method described above.
  • a computing device including one or more processors and one or more memories configured to store a sequence of computer-executable instructions, wherein The series of computer-executable instructions, when executed by the one or more processors, causes the one or more processors to perform the method as described above.
  • Figure 1 is a schematic flowchart of a method for detecting privacy data leakage for applications capable of running in a trusted execution environment according to an embodiment of the present disclosure
  • Figure 2 is a schematic block diagram of a method for detecting privacy data leakage for applications capable of running in a trusted execution environment according to an embodiment of the present disclosure
  • Figure 3 is a schematic diagram of on-chain nodes in a blockchain network including a trusted execution environment
  • Figure 4 is a schematic diagram of off-chain nodes of a blockchain network including a trusted execution environment
  • Figure 5 is a flowchart of a method of deploying an application to a trusted execution environment according to an embodiment of the present disclosure
  • Figure 6 is a schematic structural diagram of at least part of a node device according to an embodiment of the present disclosure.
  • FIG. 7 is an exemplary block diagram applicable to a general hardware system according to embodiments of the present disclosure.
  • connection is intended to include a physical, electrical, and/or communicative connection of one feature to another feature, with or without intervening features.
  • connection is a communication connection, even if it is mentioned that A and B are "directly connected", it is only intended to emphasize that one or more features emphasized by one or more embodiments of the present disclosure do not exist between the connection of A and B, but it does not It means that A and B are connected without any components.
  • a and B can be connected through cables, routers, gateways, channels, links, networks, etc. It should be noted that in the drawings of one or more embodiments of the present disclosure, whether the direct connection or the indirect connection between A and B is represented by a straight line or other graphic elements connecting A and B.
  • a or B includes “A and B” as well as “A or B” and does not exclusively include only “A” or only “B” unless specifically stated otherwise.
  • the term "exemplary” means “serving as an example, instance, or illustration” rather than as a “model” that will be accurately reproduced. Any implementation illustratively described herein is not necessarily to be construed as preferred or advantageous over other implementations. Furthermore, the disclosure one or more embodiments is not to be bound by any expressed or implied theory presented in the above technical field, background, brief summary, or detailed description.
  • the term “substantially” is meant to include any minor variations resulting from design or manufacturing defects, device or component tolerances, environmental effects, and/or other factors.
  • the term “substantially” also allows for differences from the perfect or ideal situation due to parasitics, noise, and other practical considerations that may be present in actual implementations.
  • first,” “second,” and similar terms may also be used herein for reference purposes only and are therefore not intended to be limiting.
  • the words “first,” “second,” and other such numerical terms referring to structures or elements do not imply a sequence or order unless clearly indicated by the context.
  • the steps of the corresponding methods are not necessarily performed in the order shown and described in this disclosure. In some other embodiments, methods may include more or fewer steps than described in this disclosure. In addition, a single step described in this disclosure may be broken down into multiple steps for description in other embodiments; and multiple steps described in this disclosure may also be combined into a single step in other embodiments. describe.
  • Computing devices that can create a trusted execution environment TEE can ensure that private data is only decrypted, read or executed in the TEE, and is in an encrypted state once it leaves the TEE, thereby ensuring privacy and security during the processing of private data.
  • the application running in the TEE can ensure that the running status is not obtained outside the TEE
  • the application running in the TEE (hereinafter referred to as the privacy application or TAPP) is also written by the developer, and there is no guarantee that the written application There will be no privacy breach. If the developer writes the private input data into the output of the privacy application through a certain method, such as an assignment statement, and returns the result to the caller of the privacy application, there is a possibility of privacy leakage.
  • the private data referred to in this article can be any type of data that the data owner or data provider does not want others to know.
  • it can include: user name, password, account name, checking account number, savings account number, credit card number, ID card Information such as number, transaction content, execution results, device identifier, mobile phone number, geographical location, contact list, and message content.
  • FIG. 1 and 2 are schematic diagrams of a method 100 for detecting privacy data leakage for an application capable of running in a trusted execution environment according to an embodiment of the present disclosure.
  • the method 100 includes determining a private data input source (operation 110); determining one or more privacy leak detection points based on the application's output to outside the trusted execution environment (operation 120); and based on the application's relationship with the private data input source or Statements associated with one or more privacy leak detection points determine whether the private data input source can be propagated to one or more privacy leak detection points (operation 130).
  • a private data input source is determined.
  • the owner or provider of private data can specify a private data input source so that privacy data leakage detection can be performed for the specified private data input source.
  • private data is input from outside the application, such as file contents read, data received from the network, parameters passed in from the command line, etc. Therefore, the private data input source can include at least the private data in the input parameters of the application, the private data in the files that the application reads during operation, or the private data that the application obtains from the network during operation. one.
  • the private data input source may be determined based on designation by a user (eg, owner or provider of private data). Determining the input source of private data based on the user's specification eliminates the need to detect all input data from outside the application, which helps reduce the computational complexity of private data leakage detection.
  • one or more privacy leak detection points are determined based on the application's output outside of the trusted execution environment.
  • Output from an application outside of the trusted execution environment can be application output parameters, data written to files, and data output to the network.
  • the "output parameters of the application” referred to in this article include the return value of the application.
  • the application program may have one or more output parameters, and the output parameters of the application program may also be input parameters at the same time.
  • the form of output parameters can include numeric values, characters, strings or pointers, etc. Therefore, each of the one or more privacy leak detection points may include output parameters of the application, data that the application writes to a file when it is running, or data that the application writes to the network when it is running. At least one of the output data.
  • statement 130 it is determined whether the privacy data input source can be propagated to the one or more privacy leak detection points based on statements in the application associated with the privacy data input source or the one or more privacy leak detection points.
  • Statements in the application program refer to any statement in the program code. They can be statements that process variables, such as statements that perform mathematical operations, assignments, copying or rewriting, etc.; they can also be statements that do not process variables. For example, statements for operations such as returning specific content, printing specific content, etc. Statements can be in the form of command lines, functions, application programming interfaces (APIs), dynamic link library (DLL) interfaces, or system call interfaces.
  • APIs application programming interfaces
  • DLL dynamic link library
  • taint analysis can be performed using the private data input source as a starting point to determine whether there is a propagation chain between the private data input source and the identified one or more privacy leakage detection points.
  • the privacy data input source may be polluted, and an input-output analysis may be performed on each statement in the application associated with the privacy data input source or one or more privacy leak detection points to determine the statement's Whether the output has a data dependency on the input to this statement. If the output of the statement has a data dependency on the input of the statement and the input of the statement is contaminated, the output of the statement is determined to be contaminated. The output of a statement has data dependence on the input of the statement.
  • the input parameters are returned directly, the input parameters are returned after reversible processing, and the input parameters are returned after semi-reversible processing. (In this case, the person with the key can pass the output data Reverse the input data), etc.
  • the input of the statement cannot be deduced based on the output of the statement, even if the input of the statement is a contaminated variable, it should be The output of this statement is determined to be uncontaminated.
  • the statement is an encryption function, such as a hash function
  • the statement includes a function implemented by unknown code, such as a function whose implementation code cannot be obtained
  • whether the output of the statement has a data dependency on the input of the statement is determined based on the abstract implementation of the function.
  • Abstract implementations of functions can be provided by the application developer. Determine whether taint can propagate from the function's input to the function's output based on the relationship between the input and output of the function's abstract implementation.
  • the private data input source can be propagated to a specific privacy leak detection point among one or more privacy leak detection points, it means that the specific privacy leak detection point may leak private data when the application is running. Therefore, alarm information can be output to warn of this situation, or a detection report of privacy data leakage can be output to present the propagation path of each private data input source and whether there is a propagation chain between it and each privacy leakage detection point. .
  • the trusted execution environment may be created in an on-chain node device in the blockchain network, such as in the first blockchain node shown in Figure 3 .
  • the application can be a smart contract that will be deployed in the blockchain network.
  • the first blockchain node can be divided into a regular execution environment and a trusted execution environment. Transactions submitted by the client (taking transactions submitted by the client as an example) first enter the "transaction/query interface" in the regular execution environment for type identification. The identified transactions that can be processed in plain text are left for processing in the regular execution environment, while the identified transactions that require privacy processing (referred to as "private transactions") are passed to the trusted execution environment for processing.
  • the private transaction is passed to the trusted execution environment of the first blockchain node, and the first blockchain node is in the trusted execution environment Decrypt this private transaction.
  • the client can first generate the plain text transaction content, and then encrypt the plain text transaction content with a key.
  • the encryption may be symmetric encryption or asymmetric encryption. Accordingly, the first blockchain node can decrypt the private transaction using the corresponding key to obtain the plaintext transaction content.
  • the transactions in the present disclosure can be used to implement relatively simple processing logic, such as transfer logic similar to that in related technologies.
  • the plain text transaction content for example, in the Ethereum network, can include fields such as to, value, and data to respectively indicate the address of the transaction recipient, the amount of Ether coins transferred by the transaction, and other data that the transaction can carry.
  • the transactions in the present disclosure can also be used to implement relatively complex processing logic, for example, by means of smart contracts.
  • the plain text transaction content can contain the code of the smart contract used to create the smart contract in the blockchain; the clear text transaction content can contain the contract address of a certain smart contract that has been created in the blockchain, used to create the smart contract in the blockchain. Call the smart contract.
  • the application can be deployed to the TEE of each node on the chain in the blockchain network, so that the application can be deployed in the blockchain network.
  • Smart contracts for private transactions After the smart contract is deployed, the smart contract can be called.
  • the first blockchain node can use the new processor instructions in the CPU to allocate a part of the area EPC in the memory, and encrypt the above plaintext code through the encryption engine MEE in the CPU and store it. in EPC.
  • the encrypted content in EPC is decrypted into plain text after entering the CPU.
  • the plaintext code is calculated to complete the execution process of the smart contract.
  • Storing account status or contract status into the blockchain means writing the account status or contract status into a database, such as a local database, from the perspective of a blockchain node.
  • the database is generally stored in a storage medium, more commonly a persistent storage medium.
  • Persistent storage media can be disks, floppy disks, or memory that can restore data after power is turned on so that it can be stored permanently.
  • the first blockchain node can ensure that the ciphertext execution result itself is sufficiently secure by encrypting the plaintext execution result into a ciphertext execution result using a key, and the ciphertext execution result can only be decrypted through a trusted execution environment.
  • the first blockchain node can execute the storage function code outside the trusted execution environment and store the ciphertext execution results in an external storage space outside the trusted execution environment.
  • the first blockchain node can execute the write cache function code in the trusted execution environment to store the plaintext execution results in the write cache in the trusted execution environment.
  • the write cache can correspond to " as shown in Figure 3 cache".
  • the first blockchain node can encrypt the data in the write cache and output it from the trusted execution environment to store it in the external storage space.
  • the trusted execution environment can be created in an off-chain node device outside the blockchain network, as shown in Figure 4.
  • the operation of the off-chain node device may be similar to that described above for the first blockchain node in connection with FIG. 3 .
  • Each off-chain node device can be connected to at least one on-chain node in the blockchain network to receive computing requests from the on-chain node.
  • the controller can be responsible for message forwarding between the on-chain nodes and off-chain nodes.
  • each off-chain node device can perform its own computing tasks, and the controller can schedule computing resources among multiple off-chain node devices.
  • the blockchain network can send a transaction request to the off-chain node device, such as the transaction request received by the controller from the on-chain node 4 as shown in Figure 4.
  • the transaction request can be, for example, calling an application that has been deployed in the off-chain node device.
  • the program's calculation request In response to the request of the blockchain network, the off-chain node device performs privacy calculations in a trusted execution environment and returns the calculation results to the blockchain network, for example, to the on-chain node 4 via the controller.
  • the returned calculation results can be stored in the blockchain network.
  • FIG. 5 is a flowchart of a method 200 of deploying an application to a trusted execution environment according to an embodiment of the present disclosure.
  • Method 200 includes: before deploying the application, performing privacy data leakage detection on the application (operation 210); in response to determining that the private data input source cannot be propagated to one or more privacy leakage detection points, the trusted execution environment is located The node device performs a remote attestation process to prove to the client that the node device is a trusted node (operation 220); and the node device receives a transaction request to deploy the application from the client, stores and deploys the application, and returns the application to the client.
  • Hash value operation 230
  • Operation 210 may be accomplished by method 100 as described above.
  • the node device where the trusted execution environment is located can be an on-chain node in the blockchain network or an off-chain node outside the blockchain network.
  • the hash value of the application program returned to the client in operation 230 may be used for verification by the client.
  • the client compares the hash value returned by the trusted execution environment with the hash value of the application stored locally. If they are identical, the application deployed by the trusted execution environment is the application it requested to be deployed. Additionally, the application's hash can be used as the application's ID for clients to initiate calls to the application. After completing operation 230, the application that has passed the privacy data leakage detection is deployed to the node device.
  • the client can then initiate a call to the application, for example, through the ID of the application (for example, it can be returned by the power-saving device the above hash value given to the client).
  • FIG. 6 is a schematic structural diagram of at least part of a node device 600 (or computing device) according to an embodiment of the present disclosure.
  • the node device 600 may be, for example, the above-mentioned on-chain node device or off-chain node device.
  • Node device 600 includes one or more processors 610, one or more memories 620, and other components typically found in a computer or the like (not shown).
  • Each of the one or more memories 620 may store content that may be accessed by the one or more processors 610 , including instructions 621 that may be executed by the one or more processors 610 and that may be executed by the one or more processors 610 . retrieve, manipulate or store data 622.
  • Instructions 621 may be any set of instructions, such as machine code, to be executed directly by one or more processors 610, or any set of instructions to be executed indirectly, such as a script.
  • the terms “instructions,” “applications,” “processes,” “steps,” and “programs” in this disclosure may be used interchangeably in this disclosure.
  • Instructions 621 may be stored in object code format for direct processing by one or more processors 610, or in any other computer language, including a script or collection of independent source code modules that are interpreted on demand or compiled ahead of time. The functions, methods, and routines of instructions 621 are explained in greater detail elsewhere in this disclosure.
  • the one or more memories 620 may be any transitory or non-transitory computer-readable storage medium capable of storing content accessible by the one or more processors 610, such as a hard drive, memory card, ROM, RAM, DVD, CD, USB memory, writable memory, read-only memory, etc.
  • One or more of the memory 620 may include a distributed storage system, in which instructions 621 and/or data 622 may be stored on multiple different storage devices that may be physically located at the same or different geographic locations.
  • One or more of the one or more memories 620 may be connected to the one or more first devices 610 via a network, and/or may be directly connected to or incorporated into any of the one or more processors 610 .
  • One or more processors 610 may retrieve, store, or modify data 622 in accordance with instructions 621 .
  • data 622 may also be stored in a computer register (not shown), as a table with many different fields and records, or as an XML document in a relational database.
  • Data 622 may be formatted in any format readable by a computing device, such as, but not limited to, binary values, ASCII, or Unicode. Additionally, data 622 may include any information sufficient to identify the relevant information, such as numbers, descriptive text, proprietary code, pointers, references to data stored in other memory, such as at other network locations, or used by functions to calculate correlations. Data information.
  • the one or more processors 610 may be any conventional processor, such as a commercially available central processing unit (CPU), graphics processing unit (GPU), or the like. Alternatively, one or more processors 610 may also be dedicated components, such as application specific integrated circuits (ASICs) or other hardware-based processors. Although not required, one or more processors 610 may include specialized hardware components to perform certain computing processes faster or more efficiently.
  • CPU central processing unit
  • GPU graphics processing unit
  • ASICs application specific integrated circuits
  • processors 610 may include specialized hardware components to perform certain computing processes faster or more efficiently.
  • processors 610 and one or more memories 620 are schematically shown in the same box in Figure 6, the node device 600 may actually include multiple processors that may exist within the same physical enclosure or in different Multiple processors or memories within one physical enclosure.
  • reference to a processor, computer, computing device, or memory should be understood to include reference to a collection of processors, computers, computing devices, or memories that may or may not operate in parallel.
  • System 700 is an exemplary block diagram of a general hardware system 700 applicable in accordance with one or more exemplary embodiments of the present disclosure.
  • System 700 will now be described with reference to Figure 7, which is an example of a hardware device that may be applied to aspects of the present disclosure.
  • the node device 600 or the computing device in the above embodiments may include all or part of the system 700.
  • System 700 may be any machine configured to perform processing and/or computation, and may be, but is not limited to, a workstation, a server, a desktop computer, a laptop computer, a tablet computer, a personal data assistant, a smartphone, a vehicle-mounted computer, or any combination.
  • System 700 may include elements that may be coupled to or in communication with bus 702 via one or more interfaces.
  • system 700 may include bus 702, as well as one or more processors 704, one or more input devices 706, and one or more output devices 707.
  • the one or more processors 704 may be any type of processor and may include, but are not limited to, one or more general purpose processors and/or one or more special purpose processors (eg, special processing chips). Each operation and/or step in the method described above can be implemented by one or more processors 704 executing instructions.
  • Input device 706 may be any type of device that can input information to a computing device and may include, but is not limited to, a mouse, a keyboard, a touch screen, a microphone, and/or a remote control.
  • Output device 707 may be any type of device that can present information and may include, but is not limited to, a display, speakers, video/audio output terminal, vibrator, and/or printer.
  • the System 700 may also include or be connected to non-transitory storage device 710 .
  • the non-transitory storage device 710 may be any storage device that is non-transitory and can implement data storage, and may include but is not limited to a disk drive, an optical storage device, a solid state memory, a floppy disk, a hard disk, a tape or any other magnetic media, an optical disk or any Other optical media, ROM (read only memory), RAM (random access memory), cache memory, and/or any other memory chip/chipset, and/or from which the computer can read data, instructions and/or code any other media.
  • Non-transitory storage device 710 is removable from the interface.
  • the non-transitory storage device 710 may have data/instructions/code for implementing the methods, operations, steps and processes described above.
  • System 700 may also include communications device 712.
  • Communication device 712 may be any type of device or system capable of communicating with external devices and/or with a network, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication device, and/or a chipset, such as a Bluetooth device, 702.11 equipment, WiFi equipment, WiMax equipment, cellular communications equipment, satellite communications equipment, and/or the like.
  • Bus 702 may include, but is not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.
  • bus 702 may also include a controller area network (CAN) bus or other architecture designed for use on a vehicle.
  • ISA Industry Standard Architecture
  • MCA Micro Channel Architecture
  • EISA Enhanced ISA
  • VESA Video Electronics Standards Association
  • PCI Peripheral Component Interconnect
  • bus 702 may also include a controller area network (CAN) bus or other architecture designed for use on a vehicle.
  • CAN controller area network
  • Software elements may be located in working memory 714, including, but not limited to, operating system 716, one or more applications 717, drivers, and/or other data and code. Instructions for performing the methods, operations, and steps described above may be included in one or more applications 717.
  • the executable code or source code of the instructions of the software elements may be stored in a non-transitory computer-readable storage medium, such as the storage device 710 described above, and may be read into the working memory 714 through compilation and/or installation.
  • the executable code or source code of the instructions for the software element may also be downloaded from a remote location.
  • system 700 can be distributed over a network. For example, some processing may be performed using one processor, while other processing may be performed by another processor remote from the one processor. Other components of system 700 may be similarly distributed. As such, system 700 may be interpreted as a distributed computing system that performs processing at multiple locations.
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • the controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor. , logic gates, switches, Application Specific Integrated Circuit (ASIC), programmable logic controllers and embedded microcontrollers.
  • controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, For Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic.
  • the controller in addition to implementing the controller in the form of pure computer-readable program code, the controller can be completely programmed with logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded logic by logically programming the method steps. Microcontroller, etc. to achieve the same function. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the means for implementing various functions can be considered as structures within hardware components as well as software modules implementing the methods.
  • the systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions.
  • a typical implementation device is a server system.
  • the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, or a personal digital assistant. , media player, navigation device, email device, game console, tablet, wearable device, or a combination of any of these devices.
  • the functions of each module can be implemented in the same or multiple software and/or hardware, or the modules that implement the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. .
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions
  • the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • Memory may include non-permanent storage in computer-readable media, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash random access memory
  • Computer-readable media includes permanent and non-transitory, removable and non-removable media and may be implemented by any method or technology for storage of information. Information may be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), and read-only memory.
  • PRAM phase change memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • RAM random access memory
  • read-only memory read-only memory
  • ROM read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • flash memory or other memory technology
  • compact disc read-only memory CD-ROM
  • DVD digital versatile disc
  • Magnetic tape magnetic tape storage, graphene storage or other magnetic storage devices or any other non-transmission medium can be used to store information that can be accessed by a computing device.
  • computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
  • one or more embodiments of the present disclosure may be provided as a method, system, or computer program product. Accordingly, one or more embodiments of the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, one or more embodiments of the present disclosure may employ a computer program embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein. Product form.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • One or more embodiments of the present disclosure may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer.
  • program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types.
  • One or more embodiments of the present disclosure may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network.
  • program modules may be located in both local and remote computer storage media including storage devices.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Debugging And Monitoring (AREA)
  • Storage Device Security (AREA)

Abstract

本公开涉及针对能够在可信执行环境中运行的应用程序检测隐私数据泄漏的方法, 包括: 确定隐私数据输入源; 根据所述应用程序向所述可信执行环境之外的输出确定一个或多个隐私泄漏检测点; 以及基于所述应用程序中与所述隐私数据输入源或所述一个或多个隐私泄漏检测点相关联的语句, 确定所述隐私数据输入源是否能够传播到所述一个或多个隐私泄漏检测点. 本公开还涉及将应用程序部署到可信执行环境的方法, 非临时性计算机可读存储介质和计算设备.

Description

检测隐私数据泄漏的方法
本申请要求于2022年6月29日提交中国专利局、申请号为202210748238.7、发明名称为“检测隐私数据泄漏的方法”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本公开实施例属于计算机技术领域，尤其涉及针对能够在可信执行环境中运行的应用程序检测隐私数据泄漏的方法、以及将应用程序部署到可信执行环境的方法。
背景技术
可信执行环境(Trusted Execution Environment，TEE)是隐私计算的解决方式。TEE是基于CPU硬件的安全扩展，且与外部完全隔离。TEE最早是由Global Platform提出的概念，用于解决移动设备上资源的安全隔离，平行于操作系统为应用程序提供可信安全的执行环境。随着技术的发展，TEE相比于最初提出的概念已经是更加广义的TEE。例如，服务器芯片厂商Intel、AMD等都先后推出了硬件辅助的TEE并丰富了TEE的概念和特性。现在提起的TEE通常更多指这类硬件辅助的TEE技术。不同于移动端，云端访问需要远程访问，终端用户对硬件平台不可见，因此使用TEE的第一步就是要确认TEE的真实可信。因此现在的TEE技术都引入了远程证明机制，由硬件厂商(主要是CPU厂商)背书并通过数字签名技术确保用户对TEE状态可验证。同时仅仅是安全的资源隔离也无法满足的安全需求，进一步的数据隐私保护也被提出。包括Intel SGX、AMD SEV在内的商用TEE也都提供了内存加密技术，将可信硬件限定在CPU内部，总线和内存的数据均是密文防止恶意用户进行窥探。例如，英特尔的软件保护扩展(SGX)等TEE技术隔离了代码执行、远程证明、安全配置、数据的安全存储以及用于执行代码的可信路径。在TEE中运行的应用程序受到安全保护，几乎不可能被第三方访问。
以Intel SGX技术为例，SGX提供了围圈(enclave，也称为飞地)，即内存中一个加密的可信执行区域，由CPU保护数据不被窃取。以采用支持SGX的CPU为例，利用新增的处理器指令，在内存中可以分配一部分区域EPC(Enclave Page Cache，围圈页面缓存或飞地页面缓存)，通过CPU内的加密引擎MEE(Memory Encryption Engine)对其中的数据进行加密。EPC中加密的内容只有进入CPU后才会被解密成明文。实际应用中，可以将隐私数据加密后以密文形式传递至围圈中，并通过远程证明将对应的秘钥也传入围圈。然后，在CPU的加密保护下利用数据进行运算，结果会以密文形式返回。
发明内容
本公开的目的在于提供针对能够在可信执行环境中运行的应用程序检测隐私数据泄漏的方法、将应用程序部署到可信执行环境的方法、非临时性计算机可读存储介质和计算设备。
根据本公开的第一方面，提供了一种针对能够在可信执行环境中运行的应用程序检测隐私数据泄漏的方法，包括：确定隐私数据输入源；根据所述应用程序向所述可信执行环境之外的输出确定一个或多个隐私泄漏检测点；以及基于所述应用程序中与所述隐私数据输入源或所述一个或多个隐私泄漏检测点相关联的语句，确定所述隐私数据输入源是否能够传播到所述一个或多个隐私泄漏检测点。
根据本公开的第二方面，提供了一种将应用程序部署到可信执行环境的方法，包括：在部署所述应用程序之前，根据如下对所述应用程序进行隐私数据泄漏检测：确定隐私数据输入源；根据所述应用程序向所述可信执行环境之外的输出确定一个或多个隐私泄漏检测点；以及基于所述应用程序中与所述隐私数据输入源或所述一个或多个隐私泄漏检测点相关联的语句，确定所述隐私数据输入源是否能够传播 到所述一个或多个隐私泄漏检测点。
根据本公开的第三方面，提供了一种非临时性计算机可读存储介质，所述非临时性计算机可读存储介质上存储有一系列计算机可执行的指令，当所述一系列计算机可执行的指令被一个或多个计算设备执行时，使得所述一个或多个计算设备进行如上所述的方法。
根据本公开的第四方面，提供了一种计算设备，包括一个或多个处理器和一个或多个存储器，所述一个或多个存储器被配置为存储一系列计算机可执行指令，其中，所述一系列计算机可执行指令在由所述一个或多个处理器执行时，使所述一个或多个处理器执行如上所述的方法。
附图说明
为了更清楚地说明本公开实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本公开中记载的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是根据本公开实施例的针对能够在可信执行环境中运行的应用程序检测隐私数据泄漏的方法的示意性流程图；
图2是根据本公开实施例的针对能够在可信执行环境中运行的应用程序检测隐私数据泄漏的方法的示意性框图；
图3是包括可信执行环境的区块链网络中的链上节点的示意图；
图4是包括可信执行环境的区块链网络的链下节点的示意图；
图5是根据本公开实施例的将应用程序部署到可信执行环境的方法的流程图；
图6是根据本公开实施例的节点设备的至少部分的结构示意图；
图7是可应用于根据本公开实施例的通用硬件系统的示例性框图。
具体实施方式
为了使本技术领域的人员更好地理解本公开中的技术方案，下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本公开一部分实施例，而不是全部的实施例。然而应当理解的是，本公开一个或多个实施例可以以多种不同的方式呈现出来，并不局限于下文描述的实施例。还应当理解的是，本公开一个或多个实施例能够以各种方式进行组合，从而提供更多额外的实施例。基于本公开中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都应当属于本公开保护的范围。
应当理解的是，本文中的用语仅用于描述特定的实施例，并不旨在限定。本文使用的所有术语(包括技术术语和科学术语)除非另外定义，均具有本领域技术人员通常理解的含义。为简明和/或清楚起见，公知的功能或结构可以不再详细说明。
在本文中，用语“连接”意图包含一个特征与另一个特征的物理、电性、和/或通信连接，并且这一个特征与另一个特征之间可以存在也可以不存在中间特征。当连接为通信连接时，即使提及A与B“直接连接”，只是意图强调A与B的连接之间不存在本公开一个或多个实施例所强调的一个或多个特征，但并不代表限制A与B之间不经过任何元件而连接，本领域技术人员应理解，A与B之间可以通过线缆、路由器、网关、信道、链路、网络等相连接。需要说明的是，在本公开一个或多个实施例的附图中，A与B之间的无论是直接连接还是间接连接都通过连接在A与B之间的直线或其他图形元素来表示。
在本文中，用语“A或B”包括“A和B”以及“A或B”，而不是排他地仅包括“A”或者仅包括“B”，除非另有特别说明。
在本文中，用语“示例性的”意指“用作示例、实例或说明”，而不是作为将被精确复制的“模型”。 在此示例性描述的任意实现方式并不一定要被解释为比其它实现方式优选的或有利的。而且，本公开一个或多个实施例不受在上述技术领域、背景技术、发明内容或具体实施方式中所给出的任何所表述的或所暗示的理论所限定。
在本文中，用语“基本上”意指包含由设计或制造的缺陷、器件或元件的容差、环境影响和/或其它因素所致的任意微小的变化。用语“基本上”还允许由寄生效应、噪声以及可能存在于实际的实现方式中的其它实际考虑因素所致的与完美的或理想的情形之间的差异。
另外，仅仅为了参考的目的，还可以在本文中使用“第一”、“第二”等类似术语，并且因而并非意图限定。例如，除非上下文明确指出，否则涉及结构或元件的词语“第一”、“第二”和其它此类数字词语并没有暗示顺序或次序。
还应理解，“包括/包含”一词在本文中使用时，说明存在所指出的特征、整体、步骤、操作、单元和/或组件，但是并不排除存在或增加一个或多个其它特征、整体、步骤、操作、单元和/或组件以及/或者它们的组合。
需要说明的是：在其他实施例中并不一定按照本公开示出和描述的顺序来执行相应方法的步骤。在一些其他实施例中，其方法所包括的步骤可以比本公开所描述的更多或更少。此外，本公开中所描述的单个步骤，在其他实施例中可能被分解为多个步骤进行描述；而本公开中所描述的多个步骤，在其他实施例中也可能被合并为单个步骤进行描述。
能够创建可信执行环境TEE的计算设备，可以确保隐私数据仅在TEE中被解密读取或执行，而一旦离开TEE时均处于加密状态，从而在隐私数据被处理的过程中保证隐私和安全。然而，虽然应用程序运行在TEE中时能够保证运行状态不被TEE外部获取，但运行在TEE中的应用程序(以下简称隐私应用或TAPP)也是由开发者编写的，并不能保证编写的应用程序不会存在隐私泄露。如果开发者在隐私应用中，将隐私输入数据通过一定的方式，比如赋值语句，写入到隐私应用的输出中，作为结果返回给隐私应用的调用者，则存在隐私泄露的可能。因此，需要对隐私应用的隐私数据泄露进行检测。本文所称的隐私数据，可以是数据拥有方或数据提供方不希望其他人获知的任何类型的数据，例如可以包括：用户名、密码、账户名、支票账号、储蓄账号、信用卡号、身份证号码、交易内容、执行结果、设备标识符、手机号码、地理位置、联系人列表、和消息内容等信息。
图1和图2是根据本公开实施例的针对能够在可信执行环境中运行的应用程序检测隐私数据泄漏的方法100的示意图。方法100包括确定隐私数据输入源(操作110)；根据应用程序向可信执行环境之外的输出确定一个或多个隐私泄漏检测点(操作120)；以及基于应用程序中与隐私数据输入源或一个或多个隐私泄漏检测点相关联的语句，确定隐私数据输入源是否能够传播到一个或多个隐私泄漏检测点(操作130)。
在操作110中，确定隐私数据输入源。隐私数据的拥有方或提供方可以指定隐私数据输入源，以便针对指定的隐私数据输入源进行隐私数据泄漏检测。对于应用程序来说，隐私数据从应用程序的外部输入，例如读取的文件内容、网络接收的数据、命令行传入的参数等。因此，隐私数据输入源可以包括应用程序的输入参数中的隐私数据、应用程序在运行中会读取的文件中的隐私数据、或应用程序在运行中会从网络中获取的隐私数据中的至少一个。可以根据用户(例如隐私数据的拥有方或提供方)的指定来确定隐私数据输入源。根据用户的指定来确定隐私数据输入源，可以不用对来自应用程序外部的所有输入数据均进行检测，有助于减少隐私数据泄漏检测的运算量。
在操作120中，根据应用程序向可信执行环境之外的输出确定一个或多个隐私泄漏检测点。应用程序向可信执行环境之外的输出可以是应用程序输出参数、向文件中写入的数据、以及向网络中输出的数据。需要说明的是，本文所称的“应用程序的输出参数”包括应用程序的返回值。应当理解，应用程序的输出参数可以有一个或多个，并且应用程序的输出参数可以同时还是输入参数。输出参数的形式可以包括数值、字符、字符串或指针等。因此，一个或多个隐私泄漏检测点中的每个隐私泄漏检测点可以包括应用程序的输出参数、应用程序在运行中会向文件中写入的数据、或应用程序在运行中会向网络中输出的数据中的至少一个。
在操作130中，基于应用程序中与隐私数据输入源或一个或多个隐私泄漏检测点相关联的语句，确定隐私数据输入源是否能够传播到一个或多个隐私泄漏检测点。应用程序中的语句是指程序代码中的任何语句，其可以是对变量进行处理的语句，例如进行数学运算、赋值、拷贝或改写等操作的语句；也可以是未对变量进行处理的语句，例如返回特定内容、打印特定内容等操作的语句。语句可以是命令行、函数、应用程序接口(API)、动态链接库(DLL)接口或系统调用接口等具体形式。
在确定隐私数据输入源之后，可以以隐私数据输入源为出发点进行污点分析，以确定在隐私数据输入源和确定的一个或多个隐私泄漏检测点之间是否存在传播链。在一些实施例中，可以污染隐私数据输入源，并针对应用程序中与隐私数据输入源或一个或多个隐私泄漏检测点相关联的语句中的每条语句进行输入输出分析，确定该语句的输出是否对该语句的输入具有数据依赖。如果该语句的输出对该语句的输入具有数据依赖并且该语句的输入被污染，则将该语句的输出确定为被污染。语句的输出对该语句的输入具有数据依赖的情况例如可以是，直接返回输入参数，可逆处理之后返回输入参数，半可逆处理之后返回输入参数(这种情况下拥有密钥的人能够通过输出数据逆向反推出输入数据)等。在一个具体的示例中，程序语句c＝a+b中如果a或者b任意一个变量是被污染变量，则c也变成污染变量，因为c的值是依赖于a和b的值的。因此，通过对应用程序中相关的每条语句的变量的定义和变量间的使用关系进行分析，就能追踪隐私数据的传播路径。如果被污染的数据到达任何一个在上述操作中确定的隐私泄漏检测点，则确定为隐私数据输入源能够传播到该隐私泄漏检测点，即该隐私泄漏检测点包含隐私数据泄漏。
在分析语句的输出对该语句的输入是否具有数据依赖时，在一些情况下，如果根据该语句的输出不能反推出该语句的输入，则即便该语句的输入时被污染的变量，也应当将该语句的输出确定为未被污染。例如，如果语句为加密函数，比如哈希散列函数，因为不能根据哈希的结果反推出哈希的输入信息，因此遇到这种情况将停止污点的传播。在一些情况下，如果该语句包括由未知代码实现的函数，例如实现代码无法被获取的函数，则根据该函数的抽象实现来确定该语句的输出是否对该语句的输入具有数据依赖。函数的抽象实现可以由应用程序的开发者提供。根据该函数的抽象实现的输入与输出之间的关系，来确定污点是否能够从该函数的输入传播到该函数的输出。
如果确定为隐私数据输入源能够传播到一个或多个隐私泄漏检测点中的特定隐私泄漏检测点，则说明该特定隐私泄漏检测点在应用程序运行时可能会泄漏隐私数据。因此，可以输出告警信息以对这种情况进行告警，或者输出隐私数据泄漏的检测报告，以呈现各隐私数据输入源的传播路径、以及其到各隐私泄漏检测点之间是否具备传播链等信息。
在以上描述的本公开实施例中，在一些情况下，可信执行环境可以是创建在区块链网络中的链上节点设备中的，例如在图3所示的第一区块链节点中。在这些情况下，应用程序可以是将要被部署在区块链网络中的智能合约。第一区块链节点可以划分为常规执行环境和可信执行环境，客户端提交的交易(以客户端提交的交易为例)首先进入常规执行环境中的“交易/查询接口”进行类型识别，将识别出的可以明文处理的交易留在常规执行环境中进行处理，而将识别出的需要隐私处理的交易(简称为“隐私交易”)传递至可信执行环境中进行处理。
如果常规执行环境中的“交易/查询接口”识别出的交易类型为隐私交易，则隐私交易传递至第一区块链节点的可信执行环境，第一区块链节点在可信执行环境中解密该隐私交易。假定上述的隐私交易由用户在某一客户端处生成，该客户端可以首先生成明文交易内容，然后将该明文交易内容用密钥加密。所述加密，可以采用对称加密，也可以采用非对称加密。相应地，第一区块链节点可以用对应的密钥解密该隐私交易，以获得明文交易内容。本公开中的交易可以用于实现相对简单的处理逻辑，例如类似于相关技术中的转账逻辑。在这些情况下，明文交易内容例如在以太坊网络中可以包含to、value、data等字段，以分别指示交易接收方地址、交易转移的以太币数量、以及交易可以携带的其他数据等。本公开中的交易还可以用于实现相对复杂的处理逻辑，例如可以借助于智能合约来实现。在这些情况下，明文交易内容可以包含智能合约的代码，以用于在区块链中创建智能合约；明文交易内容可以包含区块链中已创建的某一智能合约的合约地址，以用于调用该智能合约。
使用上文所述的方法进行隐私数据泄漏检测之后并通过了该检测的应用程序，可以被部署到该区块链网络中各链上节点的TEE中，以便在该区块链网络中部署该智能合约以用于隐私交易。在部署该智能合约之后，该智能合约可以被调用。响应于该智能合约被调用，第一区块链节点可以利用CPU中新增的处理器指令，在内存中可以分配一部分区域EPC，通过CPU内的加密引擎MEE对上述的明文代码进行加密存入EPC中。EPC中加密的内容进入CPU后被解密成明文。在CPU中，对该明文的代码进行运算，完成智能合约的执行过程。一般的，CPU执行明文代码后，账户状态或合约状态会发生变化。将账户状态或合约状态存入区块链，从区块链节点的角度，是将该账户状态或合约状态写入数据库，例如本地的数据库。该数据库，一般存储于存储介质之中，更多见的是持久性存储介质。持久性存储介质，可以是磁盘、软盘，也可以是通电后可恢复数据从而可以持久存储的内存之类。第一区块链节点通过将明文执行结果通过密钥加密为密文执行结果，且该密文执行结果只有通过可信执行环境进行解密，可以确保该密文执行结果本身足够安全。在此基础上，第一区块链节点可以在可信执行环境之外执行存储功能代码，将密文执行结果存储至可信执行环境之外的外部存储空间。第一区块链节点可以在可信执行环境内执行写缓存功能代码，以将明文执行结果存入可信执行环境内的写缓存中，比如该写缓存可以对应于如图3所示的“缓存”。进一步的，第一区块链节点可以将写缓存中的数据加密后从可信执行环境输出，以存储至外部存储空间。
在一些情况下，可信执行环境可以是创建在区块链网络之外的链下节点设备中的，如图4所示。在这些情况下，链下节点设备的操作可以类似于上文结合图3对第一区块链节点的描述。为简便起见，这里省略与上述情况中类似的操作。链下节点设备可以有一个或多个。每个链下节点设备可以连接到至少一个区块链网络中的链上节点，以便从该链上节点接收计算请求。当多个链下节点设备组成集群时，可以通过控制器连接到链上节点，控制器可以负责链上节点和链下节点之间的消息转发。应当理解，链下节点设备不需要在设备间进行共识过程，因此，每个链下节点设备可以进行各自的计算任务，控制器可以在多个链下节点设备之间进行计算资源的调度。区块链网络可以向链下节点设备发送交易请求，例如如图4所示控制器从链上节点4接收的交易请求，该交易请求可以是例如调用已被部署到链下节点设备中的应用程序的计算请求。响应于区块链网络的请求，链下节点设备在可信执行环境中进行隐私计算，并将计算结果返回给区块链网络，例如经由控制器发送给链上节点4。返回的计算结果可以在区块链网络中进行存证。
图5是根据本公开实施例的将应用程序部署到可信执行环境的方法200的流程图。方法200包括：在部署应用程序之前，对应用程序进行隐私数据泄漏检测(操作210)；响应于确定为隐私数据输入源不能够传播到一个或多个隐私泄漏检测点，可信执行环境所在的节点设备执行远程证明过程以向客户端证明节点设备为可信节点(操作220)；以及节点设备从客户端接收部署应用程序的交易请求，存储并部署应用程序，并向客户端返回应用程序的哈希值(操作230)。操作210可以通过如上所述的方法100来完成。可信执行环境所在的节点设备，如上文所述，可以是区块链网络中的链上节点，也可以是区块链网络之外的链下节点。在操作230中向客户端返回的应用程序的哈希值，可以用于客户端的校验。客户端将可信执行环境返回的哈希值与本地存储的该应用程序的哈希值进行比较，如果完全相同说明可信执行环境部署的应用程序是其请求部署的应用程序。此外，该应用程序的哈希值还可以用作该应用程序的ID以便客户端发起对该应用程序的调用。完成操作230之后，通过了隐私数据泄漏检测的该应用程序被部署到了该节点设备中，客户端之后可以发起对该应用程序的调用，例如通过该应用程序的ID(例如可以是节电设备返回给客户端的上述哈希值)。
图6是根据本公开实施例的节点设备600(或计算设备)的至少部分的结构示意图。节点设备600例如可以是上述链上节点设备或链下节点设备。节点设备600包括一个或多个处理器610、一个或多个存储器620、以及通常存在于计算机等装置中的其他组件(未示出)。一个或多个存储器620中的每一个可以存储可由一个或多个处理器610访问的内容，包括可以由一个或多个处理器610执行的指令621、以及可以由一个或多个处理器610来检索、操纵或存储的数据622。
指令621可以是将由一个或多个处理器610直接地执行的任何指令集，诸如机器代码，或者间接地 执行的任何指令集，诸如脚本。本公开中的术语“指令”、“应用”、“过程”、“步骤”和“程序”在本公开中可以互换使用。指令621可以存储为目标代码格式以便由一个或多个处理器610直接处理，或者存储为任何其他计算机语言，包括按需解释或提前编译的独立源代码模块的脚本或集合。本公开其他部分更加详细地解释了指令621的功能、方法和例程。
一个或多个存储器620可以是能够存储可由一个或多个处理器610访问的内容的任何临时性或非临时性计算机可读存储介质，诸如硬盘驱动器、存储卡、ROM、RAM、DVD、CD、USB存储器、能写存储器和只读存储器等。一个或多个存储器620中的一个或多个可以包括分布式存储系统，其中指令621和/或数据622可以存储在可以物理地位于相同或不同的地理位置处的多个不同的存储装置上。一个或多个存储器620中的一个或多个可以经由网络连接至一个或多个第一装置610，和/或可以直接地连接至或并入一个或多个处理器610中的任何一个中。
一个或多个处理器610可以根据指令621来检索、存储或修改数据622。虽然本公开所描述的主题不受任何特定数据结构限制，但是数据622还可能存储在计算机寄存器(未示出)中，作为具有许多不同的字段和记录的表格或XML文档存储在关系型数据库中。数据622可以被格式化为任何计算装置可读格式，诸如但不限于二进制值、ASCII或统一代码。此外，数据622可以包括足以识别相关信息的任何信息，诸如编号、描述性文本、专有代码、指针、对存储在诸如其他网络位置处等其他存储器中的数据的引用或者被函数用于计算相关数据的信息。
一个或多个处理器610可以是任何常规处理器，诸如市场上可购得的中央处理单元(CPU)、图形处理单元(GPU)等。可替换地，一个或多个处理器610还可以是专用组件，诸如专用集成电路(ASIC)或其他基于硬件的处理器。虽然不是必需的，但是一个或多个处理器610可以包括专门的硬件组件来更快或更有效地执行特定的计算过程。
虽然图6中示意性地将一个或多个处理器610以及一个或多个存储器620示出在同一个框内，但是节点设备600可以实际上包括可能存在于同一个物理壳体内或不同的多个物理壳体内的多个处理器或存储器。因此，引用处理器、计算机、计算装置或存储器应被理解成包括引用可能并行操作或可能非并行操作的处理器、计算机、计算装置或存储器的集合。
图7是可应用于根据本公开一个或多个示例性实施例的通用硬件系统700的示例性框图。现在将参考图7描述系统700，其是可以应用于本公开的各方面的硬件设备的示例。上述各实施例中的节点设备600或计算设备可以包括系统700的全部或部分。系统700可以是被配置为执行处理和/或计算的任何机器，可以是但不限于工作站、服务器、台式计算机、膝上型计算机、平板计算机、个人数据助理、智能电话、车载电脑、或其任何组合。
系统700可以包括可能经由一个或多个接口与总线702连接或与总线702通信的元件。例如，系统700可以包括总线702，以及一个或多个处理器704，一个或多个输入设备706和一个或多个输出设备707。一个或多个处理器704可以是任何类型的处理器，可以包括但不限于一个或多个通用处理器和/或一个或多个专用处理器(例如特殊处理芯片)。上文所述的方法中的各个操作和/或步骤均可以通过一个或多个处理器704执行指令来实现。
输入设备706可以是可以向计算设备输入信息的任何类型的设备，可以包括但不限于鼠标、键盘、触摸屏、麦克风和/或遥控器。输出设备707可以是可以呈现信息的任何类型的设备，可以包括但不限于显示器、扬声器、视频/音频输出终端、振动器和/或打印机。
系统700还可以包括非暂时性存储设备710或者与非暂时性存储设备710连接。非暂时性存储设备710可以是非暂时性的并且可以实现数据存储的任何存储设备，可以包括但不限于磁盘驱动器、光学存储设备、固态存储器、软盘、硬盘、磁带或任何其他磁介质、光盘或任何其他光学介质、ROM(只读存储器)、RAM(随机存取存储器)、高速缓冲存储器、和/或任何其他存储器芯片/芯片组、和/或计算机可从其读取数据、指令和/或代码的任何其他介质。非暂时性存储设备710可以从接口拆卸。非暂时性存储设备710可以具有用于实现上述方法、操作、步骤和过程的数据/指令/代码。
系统700还可以包括通信设备712。通信设备712可以是能够与外部设备和/或与网络通信的任何类 型的设备或系统，可以包括但不限于调制解调器、网卡、红外通信设备、无线通信设备、和/或芯片组，例如蓝牙设备、702.11设备、WiFi设备、WiMax设备、蜂窝通信设备、卫星通信设备、和/或类似物。
总线702可以包括但不限于工业标准体系结构(ISA)总线、微通道架构(MCA)总线、增强型ISA(EISA)总线、视频电子标准协会(VESA)本地总线、和外围部件互连(PCI)总线。特别地，对于车载设备，总线702还可以包括控制器区域网络(CAN)总线或设计用于在车辆上应用的其他架构。
系统700还可以包括工作存储器714，其可以是可以存储对处理器704的工作有用的指令和/或数据的任何类型的工作存储器，可以包括但不限于随机存取存储器和/或只读存储设备。
软件元素可以位于工作存储器714中，包括但不限于操作系统716、一个或多个应用程序717、驱动程序、和/或其他数据和代码。用于执行上述方法、操作和步骤的指令可以包括在一个或多个应用程序717中。软件元素的指令的可执行代码或源代码可以存储在非暂时性计算机可读存储介质中，例如上述存储设备710，并且可以通过编译和/或安装被读入工作存储器714中。还可以从远程位置下载软件元素的指令的可执行代码或源代码。
还应该理解，可以根据具体要求进行变化。例如，也可以使用定制硬件，和/或可以用硬件、软件、固件、中间件、微代码、硬件描述语言或其任何组合来实现特定元件。此外，可以采用与诸如网络输入/输出设备之类的其他计算设备的连接。例如，根据本公开实施例的方法或设备中的一些或全部可以通过使用根据本公开的逻辑和算法的、用汇编语言或硬件编程语言(诸如VERILOG，VHDL，C++)的编程硬件(例如，包括现场可编程门阵列(FPGA)和/或可编程逻辑阵列(PLA)的可编程逻辑电路)来实现。
还应该理解，系统700的组件可以分布在网络上。例如，可以使用一个处理器执行一些处理，而可以由远离该一个处理器的另一个处理器执行其他处理。系统700的其他组件也可以类似地分布。这样，系统700可以被解释为在多个位置执行处理的分布式计算系统。
尽管到目前为止已经参考附图描述了本公开的各方面，但是上述方法，系统和设备仅仅是示例性示例，并且本公开的范围不受这些方面的限制，而是仅由以下方面限定：所附权利要求及其等同物。可以省略各种元件，或者可以用等效元件代替。另外，可以以与本公开中描述的顺序不同的顺序执行这些步骤。此外，可以以各种方式组合各种元件。同样重要的是，随着技术的发展，所描述的许多元素可以由在本公开之后出现的等同元素代替。
在20世纪90年代，对于一个技术的改进可以很明显地区分是硬件上的改进(例如，对二极管、晶体管、开关等电路结构的改进)还是软件上的改进(对于方法流程的改进)。然而，随着技术的发展，当今的很多方法流程的改进已经可以视为硬件电路结构的直接改进。设计人员几乎都通过将改进的方法流程编程到硬件电路中来得到相应的硬件电路结构。因此，不能说一个方法流程的改进就不能用硬件实体模块来实现。例如，可编程逻辑器件(Programmable Logic Device,PLD)(例如现场可编程门阵列(Field Programmable Gate Array，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设计人员自行编程来把一个数字系统“集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用“逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并非仅有一种，而是有许多种，如ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language)等，目前最普遍使用的是VHDL(Very-High-Speed Integrated Circuit Hardware Description Language)与Verilog。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。
控制器可以按任何适当的方式实现，例如，控制器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用 集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式，控制器的例子包括但不限于以下微控制器：ARC 625D、Atmel AT91SAM、Microchip PIC18F26K20以及Silicone Labs C8051F320，存储器控制器还可以被实现为存储器的控制逻辑的一部分。本领域技术人员也知道，除了以纯计算机可读程序代码方式实现控制器以外，完全可以通过将方法步骤进行逻辑编程来使得控制器以逻辑门、开关、专用集成电路、可编程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构。或者甚至，可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件部件内的结构。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为服务器系统。当然，本申请不排除随着未来计算机技术的发展，实现上述实施例功能的计算机例如可以为个人计算机、膝上型计算机、车载人机交互设备、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。
虽然本公开一个或多个实施例提供了如实施例或流程图所述的方法操作步骤，但基于常规或者无创造性的手段可以包括更多或者更少的操作步骤。实施例中列举的步骤顺序仅仅为众多步骤执行顺序中的一种方式，不代表唯一的执行顺序。在实际中的装置或终端产品执行时，可以按照实施例或者附图所示的方法顺序执行或者并行执行(例如并行处理器或者多线程处理的环境，甚至为分布式数据处理环境)。术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、产品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、产品或者设备所固有的要素。在没有更多限制的情况下，并不排除在包括所述要素的过程、方法、产品或者设备中还存在另外的相同或等同要素。例如若使用到第一，第二等词语用来表示名称，而并不表示任何特定的顺序。
为了描述的方便，描述以上装置时以功能分为各种模块分别描述。当然，在实施本公开一个或多个时可以把各模块的功能在同一个或多个软件和/或硬件中实现，也可以将实现同一功能的模块由多个子模块或子单元的组合实现等。以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
本公开是参照根据本公开实施例的方法、装置(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息 存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储、石墨烯存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
本领域技术人员应明白，本公开一个或多个实施例可提供为方法、系统或计算机程序产品。因此，本公开一个或多个实施例可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本公开一个或多个实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本公开一个或多个实施例可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本本公开一个或多个实施例，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
本公开中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。在本公开的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包含于本公开的至少一个实施例或示例中。在本公开中，对上述术语的示意性表述不必须针对的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特点可以在任一个或多个实施例或示例中以合适的方式结合。此外，在不相互矛盾的情况下，本领域的技术人员可以将本公开中描述的不同实施例或示例以及不同实施例或示例的特征进行结合和组合。
以上所述仅为本公开一个或多个实施例的实施例而已，并不用于限制本本公开一个或多个实施例。对于本领域技术人员来说，本公开一个或多个实施例可以有各种更改和变化。凡在本公开的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在权利要求范围之内。

Claims (27)

  1. 一种针对能够在可信执行环境中运行的应用程序检测隐私数据泄漏的方法，包括：
    确定隐私数据输入源；
    根据所述应用程序向所述可信执行环境之外的输出确定一个或多个隐私泄漏检测点；以及
    基于所述应用程序中与所述隐私数据输入源或所述一个或多个隐私泄漏检测点相关联的语句，确定所述隐私数据输入源是否能够传播到所述一个或多个隐私泄漏检测点。
  2. 根据权利要求1所述的方法，还包括：
    根据用户的指定确定所述隐私数据输入源。
  3. 根据权利要求1所述的方法，其中，所述隐私数据输入源包括以下中的至少一个：
    所述应用程序的输入参数中的隐私数据；
    所述应用程序在运行中会读取的文件中的隐私数据；和
    所述应用程序在运行中会从网络中获取的隐私数据。
  4. 根据权利要求1所述的方法，其中，所述一个或多个隐私泄漏检测点中的每个隐私泄漏检测点包括以下中的至少一个：
    所述应用程序的输出参数；
    所述应用程序在运行中会向文件中写入的数据；和
    所述应用程序在运行中会向网络中输出的数据。
  5. 根据权利要求1所述的方法，还包括：
    响应于确定为所述隐私数据输入源能够传播到所述一个或多个隐私泄漏检测点，输出告警信息。
  6. 根据权利要求1所述的方法，还包括：
    根据所确定的所述隐私数据输入源是否能够传播到所述一个或多个隐私泄漏检测点，输出隐私数据泄漏的检测报告。
  7. 根据权利要求1所述的方法，还包括：
    污染隐私数据输入源；
    针对所述应用程序中与所述隐私数据输入源或所述一个或多个隐私泄漏检测点相关联的语句中的每条语句，确定该语句的输出是否对该语句的输入具有数据依赖；
    响应于该语句的输出对该语句的输入具有数据依赖并且该语句的输入被污染，将该语句的输出确定为被污染；以及
    响应于被污染的数据到达所述一个或多个隐私泄漏检测点，确定所述隐私数据输入源能够传播到所述一个或多个隐私泄漏检测点。
  8. 根据权利要求7所述的方法，还包括：
    响应于根据该语句的输出不能反推出该语句的输入，将该语句的输出确定为未被污染。
  9. 根据权利要求8所述的方法，其中，所述语句包括加密函数。
  10. 根据权利要求7所述的方法，还包括：
    响应于该语句包括由未知代码实现的函数，根据该函数的抽象实现来确定该语句的输出是否对该语句的输入具有数据依赖。
  11. 根据权利要求1所述的方法，其中，所述可信执行环境在区块链网络中的链上节点设备中实现，所述应用程序为将要被部署在区块链网络中的智能合约。
  12. 根据权利要求1所述的方法，其中，所述可信执行环境在区块链网络之外的链下节点设备中实现，所述链下节点设备被配置为响应于区块链网络的请求，在所述可信执行环境中进行隐私计算，并将计算结果返回给所述区块链网络。
  13. 一种将应用程序部署到可信执行环境的方法，包括：
    在部署所述应用程序之前，根据如下对所述应用程序进行隐私数据泄漏检测：
    确定隐私数据输入源；
    根据所述应用程序向所述可信执行环境之外的输出确定一个或多个隐私泄漏检测点；以及
    基于所述应用程序中与所述隐私数据输入源或所述一个或多个隐私泄漏检测点相关联的语句，确定所述隐私数据输入源是否能够传播到所述一个或多个隐私泄漏检测点。
  14. 根据权利要求13所述的方法，还包括：
    根据用户的指定确定所述隐私数据输入源。
  15. 根据权利要求13所述的方法，其中，所述隐私数据输入源包括以下中的至少一个：
    所述应用程序的输入参数中的隐私数据；
    所述应用程序在运行中会读取的文件中的隐私数据；和
    所述应用程序在运行中会从网络中获取的隐私数据。
  16. 根据权利要求13所述的方法，其中，所述一个或多个隐私泄漏检测点中的每个隐私泄漏检测点包括以下中的至少一个：
    所述应用程序的输出参数；
    所述应用程序在运行中会向文件中写入的数据；和
    所述应用程序在运行中会向网络中输出的数据。
  17. 根据权利要求13所述的方法，还包括：
    响应于确定为所述隐私数据输入源能够传播到所述一个或多个隐私泄漏检测点，输出告警信息。
  18. 根据权利要求13所述的方法，还包括：
    根据所确定的所述隐私数据输入源是否能够传播到所述一个或多个隐私泄漏检测点，输出隐私数据泄漏的检测报告。
  19. 根据权利要求13所述的方法，还包括：
    污染隐私数据输入源；
    针对所述应用程序中与所述隐私数据输入源或所述一个或多个隐私泄漏检测点相关联的语句中的每条语句，确定该语句的输出是否对该语句的输入具有数据依赖；
    响应于该语句的输出对该语句的输入具有数据依赖并且该语句的输入被污染，将该语句的输出确定 为被污染；以及
    响应于被污染的数据到达所述一个或多个隐私泄漏检测点，确定所述隐私数据输入源能够传播到所述一个或多个隐私泄漏检测点。
  20. 根据权利要求19所述的方法，还包括：
    响应于根据该语句的输出不能反推出该语句的输入，将该语句的输出确定为未被污染。
  21. 根据权利要求20所述的方法，其中，所述语句包括加密函数。
  22. 根据权利要求19所述的方法，还包括：
    响应于该语句包括由未知代码实现的函数，根据该函数的抽象实现来确定该语句的输出是否对该语句的输入具有数据依赖。
  23. 根据权利要求13所述的方法，其中，所述可信执行环境在区块链网络中的链上节点设备中实现，所述应用程序为将要被部署在区块链网络中的智能合约。
  24. 根据权利要求13所述的方法，其中，所述可信执行环境在区块链网络之外的链下节点设备中实现，所述链下节点设备被配置为响应于区块链网络的请求，在所述可信执行环境中进行隐私计算，并将计算结果返回给所述区块链网络。
  25. 根据权利要求13所述的方法，还包括：
    响应于确定为所述隐私数据输入源不能够传播到所述一个或多个隐私泄漏检测点，所述可信执行环境所在的节点设备执行远程证明过程以向客户端证明所述节点设备为可信节点；
    所述节点设备从客户端接收部署所述应用程序的交易请求，存储并部署所述应用程序，并向客户端返回所述应用程序的哈希值。
  26. 一种非临时性计算机可读存储介质，所述非临时性计算机可读存储介质上存储有一系列计算机可执行的指令，当所述一系列计算机可执行的指令被一个或多个计算设备执行时，使得所述一个或多个计算设备进行如权利要求1至25中任一项所述的方法。
  27. 一种计算设备，包括一个或多个处理器和一个或多个存储器，所述一个或多个存储器被配置为存储一系列计算机可执行指令，其中，所述一系列计算机可执行指令在由所述一个或多个处理器执行时，使所述一个或多个处理器执行如权利要求1至25中任一项所述的方法。
PCT/CN2022/135611 2022-06-29 2022-11-30 检测隐私数据泄漏的方法 Ceased WO2024001038A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210748238.7 2022-06-29
CN202210748238.7A CN115098866A (zh) 2022-06-29 2022-06-29 检测隐私数据泄漏的方法

Publications (1)

Publication Number Publication Date
WO2024001038A1 true WO2024001038A1 (zh) 2024-01-04

Family

ID=83295368

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/135611 Ceased WO2024001038A1 (zh) 2022-06-29 2022-11-30 检测隐私数据泄漏的方法

Country Status (2)

Country Link
CN (1) CN115098866A (zh)
WO (1) WO2024001038A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN119557915A (zh) * 2024-10-23 2025-03-04 北京百度网讯科技有限公司 隐私数据处理方法和装置、电子设备、可读存储介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11972007B2 (en) * 2021-12-09 2024-04-30 Cisco Technology, Inc. Enforcing location-based data privacy rules across networked workloads
US11960607B2 (en) 2021-12-09 2024-04-16 Cisco Technology, Inc. Achieving minimum trustworthiness in distributed workloads
CN115098866A (zh) * 2022-06-29 2022-09-23 蚂蚁区块链科技(上海)有限公司 检测隐私数据泄漏的方法
CN115756599A (zh) * 2022-10-31 2023-03-07 蚂蚁区块链科技(上海)有限公司 一种针对隐私计算流程图的静态分析方法及装置
CN117077151B (zh) * 2023-10-16 2024-01-26 北京华云安信息技术有限公司 漏洞挖掘方法、装置、设备以及存储介质
CN118734325B (zh) * 2024-07-12 2025-12-09 北京工业大学 安卓应用调用可信执行环境的检测方法、装置和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112836217A (zh) * 2021-01-12 2021-05-25 清华大学深圳国际研究生院 基于sgx的动态减小tcb的区块链虚拟机方法及系统
CN113704211A (zh) * 2021-10-26 2021-11-26 浙江口碑网络技术有限公司 数据查询方法及装置、电子设备、存储介质
CN114357492A (zh) * 2022-01-10 2022-04-15 天津大学 一种基于区块链的医疗数据隐私融合方法及装置
CN115098866A (zh) * 2022-06-29 2022-09-23 蚂蚁区块链科技(上海)有限公司 检测隐私数据泄漏的方法
CN115134067A (zh) * 2022-06-29 2022-09-30 蚂蚁区块链科技(上海)有限公司 检测隐私数据泄漏的方法

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107330345B (zh) * 2017-07-05 2020-11-27 北京理工大学 一种检测隐私数据泄露的方法和装置
CN111090875B (zh) * 2020-03-18 2020-10-02 支付宝(杭州)信息技术有限公司 部署合约的方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112836217A (zh) * 2021-01-12 2021-05-25 清华大学深圳国际研究生院 基于sgx的动态减小tcb的区块链虚拟机方法及系统
CN113704211A (zh) * 2021-10-26 2021-11-26 浙江口碑网络技术有限公司 数据查询方法及装置、电子设备、存储介质
CN114357492A (zh) * 2022-01-10 2022-04-15 天津大学 一种基于区块链的医疗数据隐私融合方法及装置
CN115098866A (zh) * 2022-06-29 2022-09-23 蚂蚁区块链科技(上海)有限公司 检测隐私数据泄漏的方法
CN115134067A (zh) * 2022-06-29 2022-09-30 蚂蚁区块链科技(上海)有限公司 检测隐私数据泄漏的方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN119557915A (zh) * 2024-10-23 2025-03-04 北京百度网讯科技有限公司 隐私数据处理方法和装置、电子设备、可读存储介质

Also Published As

Publication number Publication date
CN115098866A (zh) 2022-09-23

Similar Documents

Publication Publication Date Title
CN111539813B (zh) 业务行为的回溯处理方法、装置、设备及系统
US10594489B2 (en) Method and device for processing service request
US10917394B2 (en) Data operations using a proxy encryption key
CN114297692B (zh) 基于数据处理系统的隐私数据处理方法
CN109886682B (zh) 区块链中实现合约调用的方法及节点、存储介质
CN113079200A (zh) 一种数据处理的方法、装置及系统
CN115134067B (zh) 检测隐私数据泄漏的方法
CN115098866A (zh) 检测隐私数据泄漏的方法
TWI725709B (zh) 資料儲存方法、裝置及設備
CN107111433B (zh) 具有访问管理机制的电子系统及操作该电子系统的方法
CN112434326B (zh) 一种基于数据流的可信计算方法及装置
CN110008735A (zh) 区块链中实现合约调用的方法及节点、存储介质
CN113282959A (zh) 业务数据处理方法、装置及电子设备
US10250642B2 (en) System, method and apparatus for fine-grained privacy specification and verification
CN117131541A (zh) 一种用于隐私保护的数据处理方法和计算设备
CN115640571A (zh) 用于可信执行环境TEE的库操作系统LibOS的方法
WO2021228230A1 (zh) 一种基于安全执行环境的数据验证方法及装置
WO2024221905A1 (zh) 区块链中账户数据的隐私保护方法及装置
CN110866274A (zh) 一种数据融合方法、平台、系统以及数据处理平台
CN116156000A (zh) 服务处理方法、装置及系统
CN116050847A (zh) 一种数据风险评估的方法、装置、存储介质及电子设备
US10382952B2 (en) Generating and utilizing a secondary security key
CN107566499A (zh) 数据同步的方法、装置和系统
CN109995773A (zh) 数据处理方法和装置
CN116521360A (zh) 一种数据处理系统、方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22949117

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22949117

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 22949117

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 25.06.2025)