Methods, apparatuses and systems for obtaining data authorization

1 . A computer-implemented method for obtaining data authorization, comprising:

receiving, by a first computing node among a plurality of trusted computing nodes of a trusted computing center, an authentication request from a first provider, wherein the trusted computing center comprises a data storage center and the plurality of trusted computing nodes, and the data storage center maintains at least plurality of encrypted shards of first private data of the first provider;

returning authentication information to the first provider, wherein the authentication information comprises at least a first code hash corresponding to a first computation logic running on the first computing node, wherein the first computation logic is configured to compute a target encrypted shard corresponding to a target encryption key, wherein the first code hash is generated based on a program code of the first computation logic, and wherein the first code hash is used to verify legitimacy of the first computation logic;

receiving a channel establishment request sent by the first provider after it is determine that the first computing node has passed trusted authentication and the first code hash has passed correctness verification;

establishing a first trusted channel with the first provider based on the channel establishment request; and

obtaining, via the first trusted channel, the target encryption key from respective encryption keys corresponding to the plurality of encrypted shards, thereby obtaining authorization to compute the target encrypted shard corresponding to the target encryption key based on the first computation logic.

2 . The computer-implemented method according to claim 1 , further comprising:

encrypting, by the first computing node, the target encryption key using a private key corresponding to the first computing node and the first computation logic to obtain an encrypted target encryption key; and

storing the encrypted target encryption key in the data storage center.

3 . The computer-implemented method according to claim 2 , wherein the trusted computing center further comprises a management center for managing the plurality of trusted computing nodes, the data storage center also maintains respective key identifiers corresponding to the plurality of encrypted shards; and the computer-implemented method further comprises:

receiving, by the first computing node, a computation request from the management center;

in response to the computation request, reading the encrypted target encryption key from the data storage center, decrypting the encrypted target encryption key using a decryption key corresponding to the private key to obtain the target encryption key;

based on a key identifier of the target encryption key, reading a corresponding target encrypted shard from the data storage center;

decrypting the corresponding target encrypted shard using the target encryption key to obtain a corresponding target plaintext shard; and

computing the corresponding target plaintext shard based on the first computation logic.

4 . The computer-implemented method according to claim 1 , further comprising:

determining, by the first computing node from the plurality of trusted computing nodes, a second computing node belonging to a same role category as the first computing node; and

sharing the target encryption key with the second computing node, causing the second computing node to obtain authorization to compute the target encrypted shard based on the first computation logic.

5 . The computer-implemented method according to claim 1 , wherein the correctness verification comprises comparing the first code hash with a target code hash of a target computation logic that is pre-stored and reviewed by the first provider.

6 . A computer-implemented method for obtaining data authorization, comprising:

obtaining, by a first proxy node of a trusted computing center from a first provider, encryption keys corresponding to a plurality of encrypted shards, wherein the trusted computing center comprises a data storage center, a plurality of trusted computing nodes, and proxy nodes corresponding to the plurality of trusted computing nodes, and the data storage center maintains at least plurality of encrypted shards of first private data of the first provider;

sending, by the first proxy node among the proxy nodes, an authentication request to a corresponding first computing node;

receiving, by the first proxy node, authentication information returned by the first computing node, wherein the authentication information comprises at least a first code hash corresponding to a first computation logic running on the first computing node, wherein the first computation logic is configured to compute a target encrypted shard corresponding to a target encryption key, wherein the first code hash is generated based on a program code of the first computation logic, and wherein the first code hash is used to verify legitimacy of the first computation logic;

performing, by the first proxy node based on the authentication information, trusted authentication on the first computing node;

determining, by the first proxy node, whether the first code hash is verifiably stored;

in response to that the trusted authentication passes and the first code hash is verifiably stored, establishing, by the first proxy node, a first trusted channel with the first computing node; and

sending, by the first proxy node, the target encryption key to the first computing node through the first trusted channel.

7 . The computer-implemented method according to claim 6 , further comprising:

obtaining, by the first computing node, authorization to compute the target encrypted shard corresponding to the target encryption key based on the first computation logic.

8 . The computer-implemented method according to claim 6 , wherein determining whether the first code hash is verifiably stored comprises:

obtaining from the first computing node a certificate of verifiable storage that is pre-stored in the first computing node, wherein the certificate of verifiable storage includes at least a second code hash of the first computation logic;

comparing the first code hash with the second code hash; and

in response to that the first code hash matches with the second code hash, determining that the first code hash is verifiably stored.

9 . The computer-implemented method according to claim 8 , wherein the certificate of verifiable storage is received and forwarded to the first computing node by a third party or administrator recognized by the trusted computing center after the second code hash is provided to a verifiable storage center.

10 . The computer-implemented method according to claim 9 , wherein the trusted computing center further comprises a code storage center that maintains at least the first computation logic; and the computer-implemented method further comprises:

receiving, by the code storage center, a data retrieval request from the first provider, wherein the data retrieval request comprises at least the second code hash obtained by the first provider from the verifiable storage center; and

in response to the data retrieval request, providing, by the code storage center, the first computation logic to the first provider for the first provider to review legitimacy of the first computation logic.

11 . A system for obtaining data authorization, comprising:

a data storage center, wherein the data storage center comprises at least one first processor and at least one first memory, and wherein the at least one first memory stores first programming instructions for execution by the at least one first processor;

a plurality of trusted computing nodes, wherein each of the plurality of trusted computing nodes comprises at least one second processor and at least one second memory, and wherein the at least one second memory stores second programming instructions for execution by the at least one second processor; and

a plurality of proxy nodes corresponding to the plurality of trusted computing nodes, wherein each of the plurality of proxy nodes comprises at least one third processor and at least one third memory, and wherein the at least one third memory stores third programming instructions for execution by the at least one third processor;

wherein the data storage center is configured to:

maintain at least a plurality of encrypted shards of first private data of a first provider;

wherein the plurality of proxy nodes are configured to:

obtain, from the first provider, encryption keys corresponding to the plurality of encrypted shards;

wherein at least a first proxy node among the plurality of proxy nodes is configured to:

send an authentication request to a corresponding first computing node, and receive authentication information returned by the first computing node, wherein the authentication information at least comprises a first code hash corresponding to a first computation logic running in the first computing node, wherein the first computation logic is configured to compute a target encrypted shard corresponding to a target encryption key, wherein the first code hash is generated based on a program code of the first computation logic, and wherein the first code hash is used to verify legitimacy of the first computation logic;

perform trusted authentication on the first computing node based on the authentication information;

determine whether the first code hash is verifiably stored;

in response to determining that the trusted authentication passes and the first code hash is verifiably stored, establish a first trusted channel with the first computing node; and

send the target encryption key to the first computing node through the first trusted channel.

12 . The system according to claim 11 , wherein the first computing node is configured to obtain authorization to perform computation on the target encrypted shard corresponding to the target encryption key based on the first computation logic.

13 . The system according to claim 11 , wherein the first proxy node is configured to:

obtain a certificate of verifiable storage pre-stored in the first computing node, wherein the certificate of verifiable storage at least comprises a second code hash of the first computation logic; and

compare the first code hash with the second code hash, and if the first code hash with the second code hash matches, determine that the first code hash is verifiably stored.

14 . The system according to claim 13 , wherein the certificate of verifiable storage is received and forwarded to the first computing node by a trusted third party or administrator after the trusted third party or administrator provides the second code hash to a verifiable storage center.

15 . The system according to claim 14 , wherein the system further comprises a code storage center that maintains at least the first computation logic;

the code storage center is configured to receive a data acquisition request from the first provider, wherein the data acquisition request at least comprises the second code hash acquired by the first provider from the verifiable storage center; and

the code storage center is further configured to provide the first computation logic to the first provider in response to the data acquisition request for the first provider to review legitimacy of the first computation logic.

16 . The system according to claim 11 , wherein the first computing node is configured to:

receive the authentication request from the first provider;

return authentication information to the first provider, wherein the authentication information comprises at least the first code hash of the first computation logic running on the first computing node;

receive a channel establishment request sent by the first provider after it is determined that the first computing node has passed the trusted authentication and the first code hash has passed correctness verification;

establish a second trusted channel with the first provider based on the channel establishment request; and

obtain, via the second trusted channel, a second target encryption key from the encryption keys corresponding to the plurality of encrypted shards, thereby obtaining authorization to compute a second target encrypted shard corresponding to the second target encryption key based on the first computation logic.

17 . The system according to claim 16 , wherein the first computing node is configured to:

encrypt the target encryption key using a private key corresponding to the first computing node and the first computation logic to obtain an encrypted target encryption key; and

store the encrypted target encryption key in the data storage center.

18 . The system according to claim 17 , wherein the system further comprises a management center for managing the plurality of trusted computing nodes, the data storage center also maintains respective key identifiers corresponding to the plurality of encrypted shards; and the first computing node is configured to:

receive a computation request from the management center;

in response to the computation request, read the encrypted target encryption key from the data storage center, decrypt the encrypted target encryption key using a decryption key corresponding to the private key to obtain the target encryption key;

based on a key identifier of the target encryption key, read a corresponding target encrypted shard from the data storage center;

decrypt the corresponding target encrypted shard using the target encryption key to obtain a corresponding target plaintext shard; and

compute the corresponding target plaintext shard based on the first computation logic.

19 . The system according to claim 16 , wherein the first computing node is configured to:

determine a second computing node belonging to a same role category as the first computing node; and

share the target encryption key with the second computing node.

20 . The system according to claim 19 , wherein the second computing node is configured to obtain authorization to compute the second target encrypted shard based on the first computation logic.