Method and apparatus for performing multi-party secure computing based-on issuing certificate

1. A computer-implemented method for authentication, comprising:

receiving, from a first trusted computing unit included in a plurality of trusted computing units performing a distributed computing process, a certificate request, wherein the certificate request comprises a group identifier of a group of computing tasks to be performed by the plurality of trusted computing units during the distributed computing process, authentication information, and a hash value of programming instructions associated with a first computing task of the group of computing tasks;

authenticating the first trusted computing unit based on the authentication information;

in response to authenticating the first trusted computing unit determining, based on the hash value, that that the first computing task is included in the group of computing tasks;

obtaining a certificate chain and a private key, wherein the private key is pre-generated for the group of computing tasks, wherein the certificate chain comprises a root certificate and a corresponding public key certificate, and wherein the corresponding public key certificate and the private key form a certificate pair,

wherein the corresponding public key certificate comprises a first public key generated for the group of computing tasks and a first signature of a trusted certificate generator, and wherein the first public key and the private key form an asymmetric key pair; and

sending a certificate report to the first trusted computing unit, wherein the certificate report comprises the root certificate and the certificate pair.

2. The computer-implemented method of claim 1 , wherein the certificate report enables the first trusted computing unit to:

serve as a transport layer security (TLS) server for providing computing services to itself;

serve as a TLS client for external computing tasks;

set the certificate pair as a TLS server issued certificate pair; and

set the root certificate as a TLS client trusted root certificate.

3. The computer-implemented method of claim 1 , wherein the authentication information comprises an authentication report signed by a third-party certification authority, and wherein authenticating the first trusted computing unit is performed by verifying a signature included in the authentication report.

4. The computer-implemented method of claim 1 , wherein the authentication information comprises a report generated by the first trusted computing unit, wherein the report comprises the hash value and a digital signature of the first trusted computing unit, and wherein authenticating the first trusted computing unit comprises:

sending the report to a third-party certification authority;

receiving an authentication report signed by the third-party certification authority; and

determining that the first trusted computing unit is authenticated based on the authenticated report signed by the third-party certification authority.

5. The computer-implemented method of claim 1 , further comprising:

before receiving the certificate request, receiving a generation command from a configuration management device, wherein the generation command comprises the group identifier and a plurality of hash values of programming instructions corresponding to respective computing tasks of the group of computing tasks; and

generating the certificate chain and the private key.

6. The computer-implemented method of claim 1 , wherein determining that the first computing task is included in the group of computing tasks comprises:

obtaining a plurality of hash values of programming instructions corresponding to respective computing tasks of the group of computing tasks; and

determining that the hash value is included in the plurality of hash values.

7. The computer-implemented method of claim 1 , wherein the root certificate comprises a second public key generated for the group of computing tasks and a second signature of the trusted certificate generator, and wherein the second public key verifies the first signature and the second signature.

8. The computer-implemented method of claim 1 , wherein the root certificate comprises the first public key and a second signature of the trusted certificate generator, and wherein the first public key verifies the first signature and the second signature.

9. The computer-implemented method of claim 1 , further comprising:

before receiving the certificate request, performing key negotiation with the first trusted computing unit to generate additional encryption keys for establishing a trusted communication channel.

10. A computer-implemented system for authentication, comprising

one or more computers, and

one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, cause the one or more computers to perform one or more operations comprising:

receiving, from a first trusted computing unit included in a plurality of trusted computing units performing a distributed computing process, a certificate request, wherein the certificate request comprises a group identifier of a group of computing tasks to be performed by the plurality of trusted computing units during the distributed computing process, authentication information, and a hash value of programming instructions associated with a first computing task of the group of computing tasks;

authenticating the first trusted computing unit based on the authentication information;

in response to authenticating the first trusted computing unit determining, based on the hash value, that that the first computing task is included in the group of computing tasks;

obtaining a certificate chain and a private key, wherein the private key is pre-generated for the group of computing tasks, wherein the certificate chain comprises a root certificate and a corresponding public key certificate, and wherein the corresponding public key certificate and the private key form a certificate pair,

wherein the corresponding public key certificate comprises a first public key generated for the group of computing tasks and a first signature of a trusted certificate generator, and wherein the first public key and the private key form an asymmetric key pair; and

sending a certificate report to the first trusted computing unit, wherein the certificate report comprises the root certificate and the certificate pair.

11. The computer-implemented system of claim 10 , wherein the certificate report enables the first trusted computing unit to:

serve as a transport layer security (TLS) server for providing computing services to itself;

serve as a TLS client for external computing tasks;

set the certificate pair as a TLS server issued certificate pair; and

set the root certificate as a TLS client trusted root certificate.

12. The computer-implemented system of claim 10 , wherein the authentication information comprises an authentication report signed by a third-party certification authority, and wherein authenticating the first trusted computing unit is performed by verifying a signature included in the authentication report.

13. The computer-implemented system of claim 10 , wherein the authentication information comprises a report generated by the first trusted computing unit, wherein the report comprises the hash value and a digital signature of the first trusted computing unit, and wherein authenticating the first trusted computing unit comprises:

sending the report to a third-party certification authority;

receiving an authentication report signed by the third-party certification authority; and

determining that the first trusted computing unit is authenticated based on the authenticated report signed by the third-party certification authority.

14. The computer-implemented system of claim 10 , the operations further comprising:

before receiving the certificate request, receiving a generation command from a configuration management device, wherein the generation command comprises the group identifier and a plurality of hash values of programming instructions corresponding to respective computing tasks of the group of computing tasks; and

generating the certificate chain and the private key.

15. The computer-implemented system of claim 10 , wherein determining that the first computing task is included in the group of computing tasks comprises:

obtaining a plurality of hash values of programming instructions corresponding to respective computing tasks of the group of computing tasks; and

determining that the hash value is included in the plurality of hash values.

16. The computer-implemented system of claim 10 , wherein the root certificate comprises a second public key generated for the group of computing tasks and a second signature of the trusted certificate generator, and wherein the second public key verifies the first signature and the second signature.

17. The computer-implemented system of claim 10 , wherein the root certificate comprises the first public key and a second signature of the trusted certificate generator, and wherein the first public key verifies the first signature and the second signature.

18. The computer-implemented system of claim 10 , the operations further comprising:

before receiving the certificate request, performing key negotiation with the first trusted computing unit to generate additional encryption keys for establishing a trusted communication channel.

19. A non-transitory, computer-readable medium storing one or more instructions that, when executed by a computer-implemented authentication system, cause the computer-implemented authentication system to perform one or more operations for authentication, the operations comprising:

receiving, from a first trusted computing unit included in a plurality of trusted computing units performing a distributed computing process, a certificate request, wherein the certificate request comprises a group identifier of a group of computing tasks to be performed by the plurality of trusted computing units during the distributed computing process, authentication information, and a hash value of programming instructions associated with a first computing task of the group of computing tasks;

authenticating the first trusted computing unit based on the authentication information;

in response to authenticating the first trusted computing unit, determining, based on the hash value, that that the first computing task is included in the group of computing tasks;

obtaining a certificate chain and a private key, wherein the private key is pre-generated for the group of computing tasks, wherein the certificate chain comprises a root certificate and a corresponding public key certificate, and wherein the corresponding public key certificate and the private key form a certificate pair,

wherein the corresponding public key certificate comprises a first public key generated for the group of computing tasks and a first signature of a trusted certificate generator, and wherein the first public key and the private key form an asymmetric key pair; and

sending a certificate report to the first trusted computing unit, wherein the certificate report comprises the root certificate and the certificate pair.

20. The non-transitory, computer-readable medium of claim 19 , wherein the certificate report enables the first trusted computing unit to:

serve as a transport layer security (TLS) server for providing computing services to itself;

serve as a TLS client for external computing tasks;

set the certificate pair as a TLS server issued certificate pair; and

set the root certificate as a TLS client trusted root certificate.

21. The non-transitory, computer-readable medium of claim 19 , wherein the authentication information comprises an authentication report signed by a third-party certification authority, and wherein authenticating the first trusted computing unit is performed by verifying a signature included in the authentication report.

22. The non-transitory, computer-readable medium of claim 19 , wherein the authentication information comprises a report generated by the first trusted computing unit, wherein the report comprises the hash value and a digital signature of the first trusted computing unit, and wherein authenticating the first trusted computing unit comprises:

sending the report to a third-party certification authority;

receiving an authentication report signed by the third-party certification authority; and

determining that the first trusted computing unit is authenticated based on the authenticated report signed by the third-party certification authority.

23. The non-transitory, computer-readable medium of claim 19 , the operations further comprising:

before receiving the certificate request, receiving a generation command from a configuration management device, wherein the generation command comprises the group identifier and a plurality of hash values of programming instructions corresponding to respective computing tasks of the group of computing tasks; and

generating the certificate chain and the private key.

24. The non-transitory, computer-readable medium of claim 19 , wherein determining that the first computing task is included in the group of computing tasks comprises:

obtaining a plurality of hash values of programming instructions corresponding to respective computing tasks of the group of computing tasks; and

determining that the hash value is included in the plurality of hash values.

25. The non-transitory, computer-readable medium of claim 19 , wherein the root certificate comprises a second public key generated for the group of computing tasks and a second signature of the trusted certificate generator, and wherein the second public key verifies the first signature and the second signature.

26. The non-transitory, computer-readable medium of claim 19 , wherein the root certificate comprises the first public key and a second signature of the trusted certificate generator, and wherein the first public key verifies the first signature and the second signature.

27. The non-transitory, computer-readable medium of claim 19 , the operations further comprising:

before receiving the certificate request, performing key negotiation with the first trusted computing unit to generate additional encryption keys for establishing a trusted communication channel.