Granted Patent B2

US 12,572,679 · App. 18/440,463 · Granted Mar 10, 2026

Inventor: Kun Peng (Shenzhen, CN)

G06F21/6218G06F21/602

Abstract

Claims (56)

1 . A data security processing method, comprising:

receiving, by a trusted computing node, a trusted computing request from m pieces of user equipment, where the trusted computing request indicates a same computation task of the m pieces of user equipment, and m is an integer greater than or equal to 1;

in response to receiving the trusted computing request, determining, by the trusted computing node, n trusted applications (TAs) for the same computation task of the m pieces of user equipment, wherein n is an integer greater than 1;

receiving, by the trusted computing node via encrypted communication, data sent by each of the m pieces of user equipment, wherein the data sent by each user equipment is used for performing the same computation task;

allocating, by the trusted computing node and based on the data sent by each user equipment, a data fragment set for each TA of the n TAs participating in the computation, wherein the data fragment set of each TA comprises one data fragment in the data sent by each user equipment;

controlling, by the trusted computing node, each TA to perform computation based on the data fragment set of each TA; and

determining, by the trusted computing node, a computation result of the same computation task based on a computation result of each TA.

2 . The data security processing method according to claim 1 , wherein:

the data sent by each user equipment comprises n data fragments, and the data fragment set of each TA comprises one of the n data fragments sent by each user equipment.

3 . The data security processing method according to claim 1 , wherein:

computing logic is the same for each of the n TAs.

4 . The data security processing method according to claim 1 , wherein controlling, by the trusted computing node, each TA to perform computation based on the data fragment set of each TA comprises:

controlling, by the trusted computing node, each TA to perform computation on the data fragment set of each TA;

controlling, by the trusted computing node, each TA to output an intermediate computation result of each TA to a trusted operator for continuing computation; and

controlling, by the trusted computing node, the trusted operator to output an intermediate computation result of the trusted operator to each TA for continuing computation, to obtain the computation result of each TA.

5 . The data security processing method according to claim 4 , wherein controlling each TA to output the intermediate computation result of each TA to the trusted operator for continuing computation comprises:

controlling, by the trusted computing node, each TA to encrypt the computation result of each TA to obtain the intermediate computation result of each TA;

controlling, by the trusted computing node, each TA to output the intermediate computation result of each TA to the trusted operator; and

controlling, by the trusted computing node, the trusted operator to decrypt the intermediate computation result of each TA, to control the trusted operator to continue computation based on a decrypted computation result of each TA; and

controlling, by the trusted computing node, the trusted operator to output the intermediate computation result of the trusted operator to each TA for continuing computation, to obtain the computation result of each TA comprises:

controlling, by the trusted computing node, the trusted operator to encrypt a computation result of the trusted operator to obtain the intermediate computation result of the trusted operator;

outputting, by the trusted computing node, the intermediate computation result of the trusted operator to each TA; and

controlling, by the trusted computing node, each TA to decrypt the intermediate computation result of the trusted operator, to control each TA to continue computation based on a decrypted computation result of the trusted operator, so as to obtain the computation result of each TA.

6 . The data security processing method according to claim 2 , wherein:

each user equipment is configured to perform algorithm integrity verification on the n TAs.

7 . The data security processing method according to claim 6 , wherein before receiving, by the trusted computing node, the data sent by each of the m pieces of user equipment, the method further comprises:

receiving, by the trusted computing node, remote attestation requests respectively sent by the m pieces of user equipment, wherein the remote attestation requests are used for requesting verification on the n TAs; and

sending, by the trusted computing node, to each of the m pieces of user equipment, measurement results respectively corresponding to the n TAs, wherein a measurement result corresponding to each of the n TAs comprises a node parameter of hardware and a hash value of a software program that correspond to each TA, the measurement results respectively corresponding to the n TAs are used by each user equipment to verify whether the n TAs are tampered with, and each user equipment sends the n data fragments to the trusted computing node when the verification succeeds.

8 . A trusted computing system, wherein the trusted computing system comprises:

a trusted component, an untrusted component, and a secure extension component, wherein:

the untrusted component comprises a non-secure application, an application programming interface (API) in a non-secure trusted execution environment (TEE), and an untrusted operating system (OS);

the trusted component comprises n secure applications, an API in a secure TEE, and a trusted OS; wherein:

each of the n secure applications is configured to call the API in the secure TEE corresponding to the trusted OS, wherein the trusted OS executes a command of the secure application; and

the trusted OS is configured to:

receive a trusted computing request from m pieces of user equipment, where the trusted computing request indicates a same computation task of the m pieces of user equipment, and m is an integer greater than or equal to 1;

in response to receiving the trusted computing request, determine n trusted applications (TAs) for the same computation task of the m pieces of user equipment, wherein n is an integer greater than 1;

receive, via encrypted communication, data sent by each of the m pieces of user equipment, wherein the data sent by each user equipment is used for performing the same computation task;

allocate, based on the data sent by each user equipment, a data fragment set for each TA of the n TAs participating in the computation, wherein the data fragment set of each TA comprises one data fragment in the data sent by each user equipment;

control each TA to perform computation based on the data fragment set of each TA; and

determine a computation result of the same computation task based on a computation result of each TA.

9 . The trusted computing system according to claim 8 , wherein the data sent by each user equipment comprises n data fragments, and the data fragment set of each TA comprises one of the n data fragments sent by each user equipment.

10 . The trusted computing system according to claim 8 , wherein computing logic is the same for each of the n TAs.

11 . The trusted computing system according to claim 8 , wherein the trusted OS is configured to:

control each TA to perform computation on the data fragment set of each TA;

control each TA to output an intermediate computation result of each TA to a trusted operator for continuing computation; and

control the trusted operator to output an intermediate computation result of the trusted operator to each TA for continuing computation, to obtain the computation result of each TA.

12 . The trusted computing system according to claim 11 , wherein the trusted OS is configured to:

control each TA to encrypt the computation result of each TA to obtain the intermediate computation result of each TA, control each TA to output the intermediate computation result of each TA to the trusted operator, and control the trusted operator to decrypt the intermediate computation result of each TA, to control the trusted operator to continue computation based on a decrypted computation result of each TA; and

controlling the trusted operator to output the intermediate computation result of the trusted operator to each TA for continuing computation, to obtain the computation result of each TA comprises:

controlling the trusted operator to encrypt a computation result of the trusted operator to obtain the intermediate computation result of the trusted operator;

outputting the intermediate computation result of the trusted operator to each TA; and

controlling each TA to decrypt the intermediate computation result of the trusted operator, to control each TA to continue computation based on a decrypted computation result of the trusted operator, so as to obtain the computation result of each TA.

13 . The trusted computing system according to claim 9 , wherein each user equipment is configured to perform algorithm integrity verification on the n TAs.

14 . The trusted computing system according to claim 13 , wherein the trusted OS is further configured to:

receive remote attestation requests respectively sent by the m pieces of user equipment, wherein the remote attestation requests are used for requesting verification on the n TAs; and

send, to each of the m pieces of user equipment, measurement results respectively corresponding to the n TAs, wherein a measurement result corresponding to each of the n TAs comprises a node parameter of hardware and a hash value of a software program that correspond to each TA, the measurement results respectively corresponding to the n TAs are used by each user equipment to verify whether the n TAs are tampered with, and each user equipment sends the n data fragments to the trusted computing system when the verification succeeds.

Assignments (1)

Priority Claims (2)

Continuity (2)

References Cited (14)