FPGA hardware-based secure computing method and apparatus

1. A method for processing data based on FPGA hardware, comprising:

obtaining, at an FPGA hardware device, encrypted data of each participant of a secure computing system, wherein the FPGA hardware device stores a plurality of immutable first keys, wherein the plurality of immutable first keys are a plurality of immutable first keys of all participants in the secure computing system, wherein the FPGA hardware device comprises an FPGA chip, wherein the FPGA chip is configured based on running logic jointly determined by two or more participants to prevent tampering of the configuration of the FPGA chip, wherein each particular immutable first key of the plurality of immutable first keys is not disclosed to any participant other than a participant that provides the particular immutable first key;

decrypting, at the FPGA hardware device, the encrypted data of each participant by using a dynamic working key of each participant, to obtain plaintext data of each participant, wherein the dynamic working key of each participant is obtained based on a corresponding immutable first key of the plurality of immutable first keys;

performing, at the FPGA hardware device, computing based on the plaintext data of each participant to obtain a computing result; and

outputting, at the FPGA hardware device, the computing result.

2. The method according to claim 1 , wherein the encrypted data of each participant is obtained through symmetric encryption, wherein all of the participants comprise a first party, and wherein outputting the computing result comprises:

encrypting the computing result by using a dynamic working key of the first party, to obtain a first encryption result; and

outputting the first encryption result to the first party.

3. The method according to claim 1 , wherein the encrypted data of each participant is obtained through asymmetric encryption, wherein the dynamic working key is a decryption key of the asymmetric encryption, wherein the asymmetric encryption further comprises an encryption key corresponding to the dynamic working key, wherein all of the participants comprise a first party, wherein an encryption key of the first party is obtained based on an immutable first key corresponding to the first party, and wherein outputting the computing result comprises:

encrypting the computing result by using the encryption key of the first party, to obtain a first encryption result; and

outputting the first encryption result to the first party.

4. The method according to claim 1 , wherein all of the participants comprise a first party, and wherein the FPGA hardware device obtains a dynamic working key of the first party based on the following steps:

obtaining an encrypted working key of the first party, wherein the encrypted working key is generated by encrypting the dynamic working key of the first party by using an immutable first key of the first party; and

decrypting the encrypted working key by using the immutable first key of the first party, to obtain the dynamic working key of the first party.

5. The method according to claim 1 , wherein the FPGA hardware device further comprises a first storage device connected to the FPGA chip, wherein the first storage device is a nonvolatile storage device, wherein the FPGA chip is configured based on a configuration file currently stored in the first storage device, and wherein the method further comprises:

obtaining a first configuration file stored in the first storage device, wherein the first configuration file comprises the plurality of immutable first keys and the running logic jointly determined by the two or more participants; and

reconfiguring the FPGA chip based on the first configuration file.

6. The method according to claim 5 , wherein the first configuration file is generated and provided under joint surveillance of the two or more participants at a location of the FPGA hardware device.

7. The method according to claim 5 , further comprising:

obtaining an encrypted file, wherein the encrypted file is obtained by performing encryption in a first predetermined sequence by at least one party of the two or more participants, wherein the encrypted file comprises a second configuration file, and wherein the second configuration file comprises second running logic jointly determined by the two or more participants;

decrypting the encrypted file in a second predetermined sequence by using at least one dynamic working key of the at least one party, to obtain the second configuration file;

storing the second configuration file in the first storage device, wherein the second predetermined sequence corresponds to the first predetermined sequence; and

reconfiguring the FPGA chip based on the second configuration file.

8. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:

obtaining, at an FPGA hardware device, encrypted data of each participant of a secure computing system, wherein the FPGA hardware device stores a plurality of immutable first keys, wherein the plurality of immutable first keys are a plurality of immutable first keys of all participants in the secure computing system, wherein the FPGA hardware device comprises an FPGA chip, wherein the FPGA chip is configured based on running logic jointly determined by two or more participants to prevent tampering of the configuration of the FPGA chip, wherein each particular immutable first key of the plurality of immutable first keys is not disclosed to any participant other than a participant that provides the particular immutable first key;

decrypting, at the FPGA hardware device, the encrypted data of each participant by using a dynamic working key of each participant, to obtain plaintext data of each participant, wherein the dynamic working key of each participant is obtained based on a corresponding immutable first key of the plurality of immutable first keys;

performing, at the FPGA hardware device, computing based on the plaintext data of each participant to obtain a computing result; and

outputting, at the FPGA hardware device, the computing result.

9. The non-transitory, computer-readable medium according to claim 8 , wherein the encrypted data of each participant is obtained through symmetric encryption, wherein all of the participants comprise a first party, and wherein outputting the computing result comprises:

encrypting the computing result by using a dynamic working key of the first party, to obtain a first encryption result; and

outputting the first encryption result to the first party.

10. The non-transitory, computer-readable medium according to claim 8 , wherein the encrypted data of each participant is obtained through asymmetric encryption, wherein the dynamic working key is a decryption key of the asymmetric encryption, wherein the asymmetric encryption further comprises an encryption key corresponding to the dynamic working key, wherein all of the participants comprise a first party, wherein an encryption key of the first party is obtained based on an immutable first key corresponding to the first party, and wherein outputting the computing result comprises:

encrypting the computing result by using the encryption key of the first party, to obtain a first encryption result; and

outputting the first encryption result to the first party.

11. The non-transitory, computer-readable medium according to claim 8 , wherein all of the participates comprise a first party, and wherein the FPGA hardware device obtains a dynamic working key of the first party based on the following steps:

obtaining an encrypted working key of the first party, wherein the encrypted working key is generated by encrypting the dynamic working an immutable first key of the first party; and

decrypting the encrypted working key by using the immutable first key of the first party, to obtain the dynamic working key of the first party.

12. The non-transitory, computer-readable medium according to claim 8 , wherein the FPGA hardware device further comprises a first storage device connected to the FPGA chip, wherein the first storage device is a nonvolatile storage device, wherein the FPGA chip is configured based on a configuration file currently stored in the first storage device, and wherein the operations further comprise:

obtaining a first configuration file stored in the first storage device, wherein the first configuration file comprises the plurality of immutable first keys and the running logic jointly determined by the two or more participants; and

reconfiguring the FPGA chip based on the first configuration file.

13. The non-transitory, computer-readable medium according to claim 12 , wherein the first configuration file is generated and provided under joint surveillance of the two or more participants at a location of the FPGA hardware device.

14. The non-transitory, computer-readable medium according to claim 12 , further comprising:

obtaining an encrypted file, wherein the encrypted file is obtained by performing encryption in a first predetermined sequence by at least one party of the two or more participants, wherein the encrypted file comprises a second configuration file, and wherein the second configuration file comprises second running logic jointly determined by the two or more participants;

decrypting the encrypted file in a second predetermined sequence by using at least one dynamic working key of the at least one party, to obtain the second configuration file;

storing the second configuration file in the first storage device, wherein the second predetermined sequence corresponds to the first predetermined sequence; and

reconfiguring the FPGA chip based on the second configuration file.

15. A computer-implemented system, comprising:

one or more computers; and

one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:

obtaining, at an FPGA hardware device, encrypted data of each participant of a secure computing system, wherein the FPGA hardware device stores a plurality of immutable first keys, wherein the plurality of immutable first keys are a plurality of immutable first keys of all participants in the secure computing system, wherein the FPGA hardware device comprises an FPGA chip, wherein the FPGA chip is configured based on running logic jointly determined by two or more participants to prevent tampering of the configuration of the FPGA chip, wherein each particular immutable first key of the plurality of immutable first keys is not disclosed to any participant other than a participant that provides the particular immutable first key;

decrypting, at the FPGA hardware device, the encrypted data of each participant by using a dynamic working key of each participant, to obtain plaintext data of each participant, wherein the dynamic working key of each participant is obtained based on a corresponding immutable first key of the plurality of immutable first keys;

performing, at the FPGA hardware device, computing based on the plaintext data of each participant to obtain a computing result; and

outputting, at the FPGA hardware device, the computing result.

16. The computer-implemented system according to claim 15 , wherein the encrypted data of each participant is obtained through symmetric encryption, wherein all of the participants comprise a first party, and wherein outputting the computing result comprises:

encrypting the computing result by using a dynamic working key of the first party, to obtain a first encryption result; and

outputting the first encryption result to the first party.

17. The computer-implemented system according to claim 15 , wherein the encrypted data of each participant is obtained through asymmetric encryption, wherein the dynamic working key is a decryption key of the asymmetric encryption, wherein the asymmetric encryption further comprises an encryption key corresponding to the dynamic working key, wherein all of the participants comprise a first party, wherein an encryption key of the first party is obtained based on an immutable first key corresponding to the first party, and wherein outputting the computing result comprises:

encrypting the computing result by using the encryption key of the first party, to obtain a first encryption result; and

outputting the first encryption result to the first party.

18. The computer-implemented system according to claim 15 , wherein all of the participants comprise a first party, and wherein the FPGA hardware device obtains a dynamic working key of the first party based on the following steps:

obtaining an encrypted working key of the first party, wherein the encrypted working key is generated by encrypting the dynamic working key of the first party by using an immutable first key of the first party; and

decrypting the encrypted working key by using the immutable first key of the first party, to obtain the dynamic working key of the first party.

19. The computer-implemented system according to claim 15 , wherein the FPGA hardware device further comprises a first storage device connected to the FPGA chip, wherein the first storage device is a nonvolatile storage device, wherein the FPGA chip is configured based on a configuration file currently stored in the first storage device, and wherein the operations further comprise:

obtaining a first configuration file stored in the first storage device, wherein the first configuration file comprises the plurality of immutable first keys and the running logic jointly determined by the two or more participants; and

reconfiguring the FPGA chip based on the first configuration file.

20. The computer-implemented system according to claim 19 , wherein the first configuration file is generated and provided under joint surveillance of two or more participants at a location of the FPGA hardware device.