Method and system for data security based on quantum communication and trusted computing

1. A computer-implemented method for ensuring data and computation security, comprising:

selecting, by a server from of a plurality of trusted control nodes forming a trusted authorization center, a subset of trusted control nodes;

transmitting, by the server, to each selected trusted control node a service request, wherein the service request includes a first certificate that is bound to a first trusted-computing module associated with the server;

receiving, by the server from each selected trusted control node a response comprising a second certificate that is bound to a second trusted-computing module associated with the selected trusted control node, thereby facilitating a mutual authentication between the server and each selected trusted control node;

receiving, by the server from each selected trusted control node, a subkey, wherein the subkey is generated by the selected trusted control node based on: a share of a private key associated with the trusted authorization center, an identity of the server, a unique identifier of the first trusted-computing module associated the server, and platform configuration register (PCR) values of the first trusted-computing module associated with the server; and

generating, by the server, a server-specific private key based on a set of subkeys received from the selected subset of trusted control nodes of the trusted authorization center.

2. The computer-implemented method of claim 1 , wherein the plurality of trusted control nodes forming the trusted control center share the private key using a secret-sharing scheme.

3. The computer-implemented method of claim 1 , further comprising:

establishing a secure communication channel between the server and the trusted authorization center using a quantum key distribution process.

4. The computer-implemented method of claim 1 , further comprising:

generating a trusted certificate based on the server-specific private key; and

sending the trusted certificate to a client to allow the client to authenticate the server.

5. A server computer, comprising:

a processor; and

a storage device coupled to the processor and storing instructions which when executed by the processor cause the processor to perform a method for ensuring data and computation security, wherein the method comprises:

selecting, by the server computer from of a plurality of trusted control nodes forming a trusted authorization center, a subset of trusted control nodes;

transmitting, by the server computer, to each selected trusted control node a service request, wherein the service request includes a first certificate that is bound to a first trusted-computing module associated with the server computer;

receiving, by the server computer from each selected trusted control node a response comprising a second certificate that is bound to a second trusted-computing module associated with the selected trusted control node, thereby facilitating a mutual authentication between the server computer and each selected trusted control node;

receiving, by the server computer from each selected trusted control node, a subkey, wherein the subkey is generated by the selected trusted control node based on: a share of a private key associated with the trusted authorization center, an identity of the server computer, a unique identifier of the first trusted-computing module associated the server computer, and platform configuration register (PCR) values of the first trusted-computing module associated with the server computer; and

generating a server-specific private key based on a set of subkeys received from the selected subset of trusted control nodes of the trusted authorization center.

6. The server computer of claim 5 , wherein the plurality of trusted control nodes forming the trusted authorization center share the private key using a secret-sharing scheme.

7. The server computer of claim 5 , wherein the method further comprises:

generating a trusted certificate based on the server-specific private key; and

sending the trusted certificate to a client computer to allow the client computer to authenticate the server computer.

8. A computer-implemented method for receiving a trusted certificate, comprising:

sending, by an entity in a cloud computing environment, a certificate request to a trusted authorization center, wherein the trusted authorization center comprises a set of trusted control nodes that share, using a secret-sharing scheme, a private key associated with the cloud computing environment, wherein each trusted control node is configured to store a share of the private key in a first trusted-computing module associated with the trusted control node, and wherein sending the certificate request comprises selecting a subset of trusted control nodes from the set of trusted control nodes and transmitting a service request to each selected trusted control node, wherein the service request includes a first certificate that is bound to a second trusted-computing module associated with the entity;

receiving, by the entity from each selected trusted control node, a response comprising a second certificate that is bound to the first trusted-computing module associated with the selected trusted control node, thereby facilitating a mutual authentication between the entity and each selected trusted control node;

receiving, from each selected trusted control node, a subkey, wherein the subkey is generated by the trusted control node based on: identity information associated with the entity, a unique identifier of the second trusted-computing module associated with the entity, platform configuration register (PCR) values of the second trusted-computing module, and the share of the private key stored in the first trusted-computing module;

generating an entity-specific private key based on a set of subkeys received from the selected subset of trusted control nodes of the trusted authorization center; and

deriving a trusted certificate from the entity-specific private key.