Method, apparatus, device and medium for processing genetic data

1 . A method for processing genetic data, comprises:

receiving, in a normal execution environment in a data processing system, ciphertext of genetic data from a data providing system via a public channel between the normal execution environment and the data providing system;

in a trusted execution environment in the data processing system,

receiving, a key for decrypting the ciphertext of the genetic data, from the data providing system via a secure channel between the trusted execution environment and the data providing system;

decrypting the ciphertext of the genetic data using the key to obtain plaintext of the genetic data;

processing the plaintext of the genetic data to determine a processing result of the genetic data;

receiving from the data providing system a first key generated based on first data; and

determining a shared key of the secure channel based on the first key and second data in the trusted execution environment.

2 . The method of claim 1 , further comprising: in the trusted execution environment, sending the second key to the data providing system, so that the data providing system generates the shared key of the secure channel via the first data and the received second key.

3 . The method of claim 2 , further comprising: in the trusted execution environment,

generating, based on a root certificate of the trusted execution environment, an authentication certificate associated with an authentication private key of the trusted execution environment; and

sending the authentication certificate to the data providing system, so that the data providing system authenticates the data processing system based on the authentication certificate.

4 . The method of claim 3 , further comprising: in the trusted execution environment,

determining configuration information of the trusted execution environment and signature data of a hash value associated with the first key and the second key based on the authentication private key; and

sending the signature data to the data providing system so that the data providing system authenticates the data processing system based on the authentication certificate and the signature data.

5 . The method of claim 4 , further comprising: in the trusted execution environment,

receiving an indication from the data providing system, the indication being sent in response to the data providing system successfully authenticating the data processing system; and

confirming that the secure channel is established between the trusted execution environment and the data providing system based on the indication.

6 . The method of claim 1 , wherein receiving the key via the secure channel comprises: in the trusted execution environment,

receiving ciphertext of the key from the data providing system, the ciphertext of the key being encrypted using the shared key; and

decrypting the received ciphertext of the key using the shared key to obtain plaintext of the key.

7 . The method of claim 6 , wherein obtaining the plaintext of the genetic data comprises:

loading the ciphertext of the genetic data from the normal execution environment to the trusted execution environment; and

in the trusted execution environment, decrypting the ciphertext of the genetic data using the plaintext of the key to obtain the plaintext of the genetic data.

8 . The method of claim 1 , further comprising:

in the trusted execution environment, encrypting the processing result using the key to form ciphertext of the processing result;

writing the ciphertext of the processing result to the normal execution environment from the trusted execution environment; and

in the normal execution environment, sending the ciphertext of the processing result to the data providing system via the public channel.

9 . An electronic device comprises:

at least one processing unit; and

at least one memory coupled to the at least one processing unit and storing instructions executed by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the electronic device to perform a method for processing genetic data, comprising:

receiving, in a normal execution environment in a data processing system, ciphertext of genetic data from a data providing system via a public channel between the normal execution environment and the data providing system;

in a trusted execution environment in the data processing system,

receiving, a key for decrypting the ciphertext of the genetic data, from the data providing system via a secure channel between the trusted execution environment and the data providing system;

decrypting the ciphertext of the genetic data using the key to obtain plaintext of the genetic data;

processing the plaintext of the genetic data to determine a processing result of the genetic data;

receiving from the data providing system a first key generated based on first data; and

determining a shared key of the secure channel based on the first key and second data in the trusted execution environment.

10 . The electronic device of claim 9 , wherein the method further comprises: in the trusted execution environment, sending the second key to the data providing system, so that the data providing system generates the shared key of the secure channel via the first data and the received second key.

11 . The electronic device of claim 10 , wherein the method further comprises: in the trusted execution environment,

generating, based on a root certificate of the trusted execution environment, an authentication certificate associated with an authentication private key of the trusted execution environment; and

sending the authentication certificate to the data providing system, so that the data providing system authenticates the data processing system based on the authentication certificate.

12 . The electronic device of claim 11 , wherein the method further comprises: in the trusted execution environment,

determining configuration information of the trusted execution environment and signature data of a hash value associated with the first key and the second key based on the authentication private key; and

sending the signature data to the data providing system so that the data providing system authenticates the data processing system based on the authentication certificate and the signature data.

13 . The electronic device of claim 12 , wherein the method further comprises: in the trusted execution environment,

receiving an indication from the data providing system, the indication being sent in response to the data providing system successfully authenticating the data processing system; and

confirming that the secure channel is established between the trusted execution environment and the data providing system based on the indication.

14 . The electronic device of claim 9 , wherein receiving the key via the secure channel comprises: in the trusted execution environment,

receiving ciphertext of the key from the data providing system, the ciphertext of the key being encrypted using the shared key; and

decrypting the received ciphertext of the key using the shared key to obtain plaintext of the key.

15 . The electronic device of claim 14 , wherein obtaining the plaintext of the genetic data comprises:

loading the ciphertext of the genetic data from the normal execution environment to the trusted execution environment; and

in the trusted execution environment, decrypting the ciphertext of the genetic data using the plaintext of the key to obtain the plaintext of the genetic data.

16 . The electronic device of claim 9 , wherein the method further comprises:

in the trusted execution environment, encrypting the processing result using the key to form ciphertext of the processing result;

writing the ciphertext of the processing result to the normal execution environment from the trusted execution environment; and

in the normal execution environment, sending the ciphertext of the processing result to the data providing system via the public channel.

17 . A non-transitory computer-readable storage medium, storing a computer program thereon, the computer program, when executed by a processor, causing the processor to implement a method for processing genetic data, comprising:

receiving, in a normal execution environment in a data processing system, ciphertext of genetic data from a data providing system via a public channel between the normal execution environment and the data providing system;

in a trusted execution environment in the data processing system,

receiving, a key for decrypting the ciphertext of the genetic data, from the data providing system via a secure channel between the trusted execution environment and the data providing system;

decrypting the ciphertext of the genetic data using the key to obtain plaintext of the genetic data;

processing the plaintext of the genetic data to determine a processing result of the genetic data;

receiving from the data providing system a first key generated based on first data; and

determining a shared key of the secure channel based on the first key and second data in the trusted execution environment.