Computing device supporting privacy computation

Abstract

The disclosure discloses a computing device supporting privacy computing, comprising: a platform as a service layer, the platform as a service layer comprising a privacy computing platform, the privacy computing platform being configured to perform privacy computing; an infrastructure as a service layer, comprising a hardware resource layer, a secure operating system layer and a TEE running on the secure operating system layer; wherein the hardware resource layer comprises a CPU, at least one trusted application running in the TEE, the at least one trusted application accessing the CPU through an SDK interface, and the SDK interface being compatible with SDKs of multiple TEE technologies.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, in particular to a computing device supporting privacy computing. BACKGROUND

[0002] In the era of big data, people have increasingly high requirements for data security in computing devices. As a technology that can achieve data analysis and calculation while protecting data from being leaked, privacy computing has become a research hotspot. SUMMARY

[0003] Therefore, the present disclosure provides a computing device supporting privacy computing. The computing device comprises a platform as a service layer, the platform as a service layer comprising a privacy computing platform, the privacy computing platform being configured to perform privacy computing; an infrastructure as a service layer comprising a hardware resource layer, a secure operating system layer and a TEE running on the secure operating system layer; wherein the hardware resource layer comprises a CPU, at least one trusted application running in the TEE, the at least one trusted application being configured to access the CPU by calling an SDK interface, and the SDK interface being compatible with SDKs of multiple TEE technologies.

[0004] Optionally, the hardware resource layer further comprises a first acceleration card configured to perform hardware acceleration on an algorithm of the privacy computing.

[0005] Optionally, the first acceleration card comprises one or more of an FPGA, a GPU and an ASIC.

[0006] Optionally, the first acceleration card supports acceleration on one or more of a fully homomorphic encryption algorithm, a semi-homomorphic encryption algorithm and an elliptic curve encryption algorithm.

[0007] Optionally, the hardware resource layer further comprises a cryptographic card supporting a national cryptographic algorithm and / or an international cryptographic algorithm; and a second acceleration card configured to perform acceleration on the national cryptographic algorithm and / or the international cryptographic algorithm.

[0008] Optionally, the hardware resource layer further comprises a trusted root; and the infrastructure as a service layer further comprises a trusted platform, the trusted platform being configured to perform one or more of remote authentication, trusted measurement of the computing device and firmware signature based on the trusted root.

[0009] Optionally, the trusted measurement of the computing device comprises one or more of trusted measurement of the computing device during a startup process, trusted measurement of an application of the computing device during a running process and trusted measurement of data of the application of the computing device during the running process.

[0010] Optionally, the SDK interface is compatible with one or more of the following: an SGX SDK, a Rust SDK, and an Occlum.

[0011] Optionally, the infrastructure as a service layer further includes: a container management platform running above the secure operating system layer; and a plurality of secure containers generated based on hardware resources in the hardware resource layer, and runtime environments of the plurality of secure containers are isolated from each other.

[0012] Optionally, the secure container is a lightweight container.

[0013] Optionally, the infrastructure as a service layer further includes: an operation and maintenance platform, the operation and maintenance platform including a monitoring module and an alarm module, the monitoring module being configured to monitor the computing device uniformly; and the alarm module being configured to send alarm information according to abnormal information detected by the monitoring module.

[0014] Optionally, the secure operating system in the secure operating system layer supports one or more of the following: trusted boot based on a trusted root, a national cryptographic algorithm library, permission control on access to the secure operating system, and permission control on processes in the computing device.

[0015] Optionally, the hardware resource layer further includes: a quantum random number generator configured to generate a true random number to improve security of a key used by the computing device.

[0016] Optionally, the platform as a service layer further includes one or more of the following services: a remote authentication service, a cryptographic service, and an algorithm acceleration service.

[0017] Optionally, the computing device is an all-in-one machine.

[0018] In the computing device supporting privacy computing provided by the embodiments of the present disclosure, the SDK interface corresponding to the TEE can be compatible with SDKs of multiple TEE technologies, and the trusted application running in the TEE can access CPUs of different architectures by calling the SDK interface, thereby improving compatibility of the TEE with CPUs of different architectures. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 An architecture diagram of the computing device supporting privacy computing provided by the embodiments of the present disclosure.

[0020] Figure 2 An architecture diagram of the TEE provided by the embodiments of the present disclosure.

[0021] Figure 3 An architecture diagram of the trusted platform provided by an embodiment of the present disclosure.

[0022] Figure 4 An architecture schematic of a trusted platform provided for another embodiment of the present disclosure.

[0023] Figure 5 A flow schematic of a trusted measurement provided for an embodiment of the present disclosure.

[0024] Figure 6 An architecture schematic of a secure container provided for an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application.

[0026] It should be noted that the term "multiple" mentioned in the embodiments of the present disclosure means "two or more", that is, it includes the case of two or more. The term "and / or" mentioned in the embodiments of the present disclosure is only to describe the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, B alone, and A and B together.

[0027] With the continuous development of modern information technology, the world has entered the Internet + big data era. With the continuous sharing of big data among enterprises, between enterprises and individuals, and between individuals, analyzing and mining the value of data has become a research hotspot at present. For example, banks can analyze the user's bank credit rating, personal identity information, financial transaction information, etc., to achieve precision marketing. However, the premise of using data and playing a role is to ensure data security and privacy, otherwise it will lead to data leakage, which will cause more serious adverse effects.

[0028] Therefore, in order to meet the "data usability and invisibility", researchers have proposed the concept of privacy computing. Privacy computing is a technology that realizes data analysis and calculation under the premise of protecting the data itself from being leaked. At present, multi-party secure calculation as a representative of cryptographic-based analysis and calculation is a mainstream privacy computing technology. Multi-party secure calculation can enable non-trusted multiple data holders to perform efficient data analysis and calculation under the premise of mutual data privacy, so as to achieve both the use of multi-party data for specified data analysis and calculation and the guarantee of data privacy not being leaked during use, and truly realize the usability and invisibility of data.

[0029] In privacy computing related technologies, in addition to performing privacy computing by using multi-party secure computing technology, a Trusted Execution Environment (TEE) technology can be used in a computing device supporting privacy computing to run an application in the computing device in the TEE, so that the security of code and data loaded into the TEE is guaranteed. Therefore, privacy computing can also be understood as a data fusion computing scheme for providing data security and privacy protection based on multi-party secure computing, TEE and the like.

[0030] The basic concept of TEE will be briefly introduced first.

[0031] TEE

[0032] TEE is a concept proposed by Global Platform (GP) dedicated to developing, formulating and releasing security chip technology standards. TEE is a secure computing environment that can completely isolate operations within the environment from the outside, thereby ensuring the privacy and integrity of code, applications and data assets in the environment. Compared with Rich Operating System (Rich OS) such as Android and Linux, TEE can provide a more secure execution environment for applications in the environment. Compared with a single Secure Element (SE), TEE has stronger scalability in function. Therefore, TEE has been widely used in the fields of privacy computing and mobile payment.

[0033] TEE technology

[0034] In related technologies, running an application in a TEE can be implemented based on a variety of TEE technologies. Currently, the more popular international TEE technologies include Software Guard Extensions (SGX) technology of Intel, TrustZone technology of the United Kingdom ARM, Secure Encrypted Virtualization (SEV) technology of the United States AMD and Trusted Execution Technology (TXT) of Intel; domestic TEE technologies mainly include Trusted Computing Technology (TCT) of Megachip and China Security Virtualization (CSV) technology of Hailight.

[0035] The following takes Intel SGX and ARM TrustZone as an example to briefly introduce the implementation of TEE.

[0036] Intel SGX, as a mainstream TEE implementation, is a set of instructions for enhancing the security of application code and data. SGX extends a new instruction set and memory access mechanism on the original hardware architecture. Using SGX technology, developers can create a private memory area with high access permissions in memory to form an Enclave. The Central Processing Unit (CPU) ensures that the Enclave is isolated from the outside world, thereby encapsulating the security operation of the application program in the Enclave to protect the confidentiality and integrity of the user's critical code and data. Other applications, including the Operating System (OS), Basic Input Output System (BIOS), and virtual machine system, cannot access the data in the Enclave and cannot spy on and tamper with the state and data of the application program therein. In other words, once the application and data are located in the Enclave, even the OS and Virtual Machine Monitor (VMM) cannot affect the code and data in the Enclave, and the security boundary of the Enclave only includes the CPU and itself.

[0037] ARM TrustZone is a modification of the original hardware architecture that introduces two running environments, namely a secure environment and a general environment, at the CPU level to meet different security level running requirements. The secure environment and the general environment are hardware isolated and have different permissions. In other words, the application running in the secure environment can normally access the resources in the general environment, but the application or OS running in the general environment will be strictly limited when accessing the resources in the secure environment. At any time, the CPU can only run in one of the two environments.

[0038] Trusted application

[0039] The application running in the TEE can be referred to as a Trusted Application (TAPP), which can also be referred to as TA. The trusted application can access all the functions of the CPU and memory in the computing device, and the hardware isolation can protect the trusted application from being affected by the user-installed applications running in the main operating system. In addition, in the TEE, each trusted application is independent of each other and cannot access each other without authorization.

[0040] When a trusted application running in a TEE needs to access the hardware capability of a CPU in a computing device, the trusted application needs to access the CPU by calling a software development kit (SDK) interface. However, SDKs corresponding to different TEE technologies are not the same.

[0041] In current computing devices, different CPU architectures implement different TEE technologies, so that the TEE is bound to a specific CPU. For example, most Intel CPUs, such as the Core series, can support the SGX technology, so that the TEE can be implemented using the SGX technology on the CPU of the Core series; or a domestic Haiguang CPU can support the CSV technology, so that the TEE can be implemented using the CSV technology on the Haiguang CPU. However, when a CPU does not support a certain TEE technology, the TEE cannot be implemented on the CPU based on the TEE technology, for example, if an Intel CPU does not support the CSV technology, the TEE cannot be implemented using the CSV technology on the Intel CPU.

[0042] In addition, when a developer needs to perform application migration (migrating a certain application from one TEE environment to another TEE environment), the SDK interface provided by different TEE technologies needs to be used to call the corresponding CPU resources. Since SDKs corresponding to different TEE technologies are not the same, the developer needs to adjust the application code, which brings a great learning and migration burden to the developer. For example, when a trusted application running in a TEE implemented based on the Haiguang CSV technology is migrated to a TEE implemented based on the SGX technology, the trusted application development based on the SGX technology needs to use the Intel SDK and program according to a specific development paradigm, so the existing program of the trusted application that is not programmed according to the specific development paradigm needs to be greatly modified to run in the Intel SGX, and since the Intel SGX currently only supports the C / C++ language, this leads to greater modification difficulty of the existing program of the trusted application programmed using other languages.

[0043] To solve the above problems, the embodiments of the present disclosure provide a computing device supporting privacy computing. In the computing device, the SDK interface corresponding to the TEE can be compatible with the SDKs of multiple TEE technologies, and the trusted application running in the TEE can access the CPUs of different architectures by calling the SDK interface, thereby improving the compatibility of the CPUs of different architectures with the TEE.

[0044] The following will be described in combination with Figures 1 to 6 The computing device provided by the embodiments of the present disclosure will be introduced. The computing device provided by the embodiments of the present disclosure can be used to perform privacy computing.

[0045] Figure 1An architecture schematic diagram of a computing device is provided for embodiments of the present disclosure. As shown in Figure 1 The computing device 10 can include a Platform as a Service (PaaS) layer 100 and an Infrastructure as a Service (IaaS) layer 200.

[0046] The PaaS layer 100 can provide an environment for developers to build applications and some services when building the applications, and the developers can build the applications conveniently without considering underlying hardware by means of the services provided by the PaaS layer 100.

[0047] In some embodiments, the PaaS layer 100 can include a privacy computing platform 111, where the privacy computing platform 111 can be used to perform privacy computing. However, in embodiments of the present disclosure, the services provided by the PaaS layer 100 are not limited to this, for example, the PaaS layer 100 can also provide remote authentication services, cryptographic services, and algorithm acceleration services, etc.

[0048] In some embodiments, the PaaS layer 100 can provide an environment for developers to build applications and services when building the applications based on underlying capabilities of the IaaS layer 200. The IaaS layer 200 is described in detail below.

[0049] The IaaS layer 200 can include a hardware resource layer 210, a secure operating system layer 220, and a TEE 230, where the TEE 230 can run on the secure operating system layer 220. In some embodiments, the TEE 230 running on the secure operating system layer 220 can refer to a logical architecture position relationship.

[0050] The IaaS layer 200 can provide various types of underlying capabilities such as computing resources through the hardware resource layer 210. As an example, the hardware resource layer 210 can include a CPU 211.

[0051] In some embodiments, one or more trusted applications can run in the TEE 230. As described above, the one or more trusted applications can access the CPU 211 through an SDK interface. In embodiments of the present disclosure, the SDK interface can be compatible with SDKs of various TEE technologies, for example, can be compatible with an SDK corresponding to the SGX technology and an SDK corresponding to the TrustZone technology, and of course, can be compatible with more SDKs corresponding to more TEE technologies, and embodiments of the present disclosure are not limited thereto.

[0052] In some embodiments, the SDK interface can refer to an application program interface (API), for example, can be a private API interface.

[0053] In some embodiments, in addition to being compatible with SDKs of different TEE technologies, the SDK interface can also be compatible with SDKs of different programming languages, for example, can be compatible with Rust SDKs. In addition, the SDK interface can also be compatible with different TEE operating systems, for example, can be compatible with Occlum.

[0054] The computing device provided by the embodiments of the present disclosure can be compatible with SDKs of multiple TEE technologies through the SDK interface corresponding to the TEE, and the trusted application running in the TEE can access CPUs of different architectures by calling the SDK interface, thereby improving the compatibility of CPUs of different architectures with the TEE.

[0055] In addition, since the SDK interface provided by the embodiments of the present disclosure can be compatible with multiple TEE technologies, the SDK interface provided by the embodiments of the present disclosure is unified and general to the user layer (trusted application developer), and the trusted applications corresponding to different TEE technologies can all be deployed in the TEE based on the SDK interface.

[0056] Figure 2 An example diagram of the TEE architecture provided by the embodiments of the present disclosure is shown. In this example, a virtual machine can be running in the TEE, and a virtual monitor (such as a Type1.5 virtual monitor) can also be included. In this TEE, a secure and trusted area Enclave can be formed for different trusted applications through TEE technology.

[0057] In some embodiments, the secure and trusted capability of the TEE provided by the embodiments of the present disclosure is authority-certified, for example, can be certified by the China Financial Certification Authority (CFCA). See Figure 2 The CFCA can issue a CA certificate, and then a Registration Authority (RA) of the CFCA can issue an Attestation Identity Key (AIK), and the TEE can be implemented based on the root of trust and hardware such as CPU, memory, and encryption and decryption engine. The content of the root of trust will be described in detail later, and will not be described here.

[0058] The TEE provided by the embodiments of the present disclosure can provide multiple functions, for example, can include but not limited to the following: implementing isolated execution, remote attestation, memory encryption, data sealing, etc.

[0059] The hardware resource layer 210 of the embodiments of the present disclosure can include other hardware resources in addition to the CPU 211. The following continues to refer to Figure 1 The hardware resource layer 210 is described in detail.

[0060] In some embodiments, the hardware resource layer 210 can further include a first acceleration card. The first acceleration card can be used to accelerate the algorithm of the privacy computing in hardware, thereby improving the performance of the privacy computing.

[0061] The embodiments of the present disclosure do not make specific limitations on the implementation of the first acceleration card. For example, the first acceleration card can be implemented based on a Field Programmable Gate Array (FPGA) chip 212a. Alternatively, the first acceleration card can be implemented based on a Graphics Processing Unit (GPU) chip 212b. For another example, the first acceleration card can also be implemented based on an Application-Specific Integrated Circuit (ASIC) chip.

[0062] The embodiments of the present disclosure do not make specific limitations on the form of the first acceleration card. For example, the form of the first acceleration card can be a PCIe card. The PCIe card adopts a point-to-point serial connection mode, which can allow the first acceleration card and the connected device to establish an independent data transmission channel, and exclusively share the channel bandwidth without sharing the bus bandwidth, thereby realizing high-speed and high-bandwidth transmission.

[0063] The embodiments of the present disclosure do not make specific limitations on the type of algorithm accelerated by the first acceleration card. For example, the first acceleration card can support acceleration of one or more of the following algorithms: fully homomorphic encryption algorithm, semi-homomorphic encryption algorithm, and Elliptic Curve Cryptography (ECC) algorithm.

[0064] In some embodiments, the first acceleration card can support one or more industry-related security protocols. For example, the first acceleration card can support, but is not limited to, the Transport Layer Security (TLS) protocol and the Secure Sockets Layer (SSL) protocol. As an example, the first acceleration card can support the OpenSSL protocol.

[0065] In some embodiments, the first acceleration card can integrate the native algorithm library provided by the privacy computing platform 111.

[0066] In some embodiments, the hardware resource layer 210 can further include a cryptographic card 213, which can have a first-class encryption and decryption capability. In some embodiments, the cryptographic card 213 can also be referred to as a cryptographic chip.

[0067] The cryptographic card 213 can support national cryptographic algorithms and / or international cryptographic algorithms. The type of cryptographic algorithm supported by the cryptographic card 213 is not limited in the embodiments of the present disclosure. For example, the cryptographic card 213 can support symmetric encryption algorithms, asymmetric encryption algorithms, and cryptographic hash algorithms. For example, when the cryptographic card 213 supports symmetric cryptographic algorithms, the cryptographic card 213 can support the SM4 national cryptographic algorithm or the RC5, RC6, etc. international cryptographic algorithm; when the cryptographic card 213 supports asymmetric cryptographic algorithms, the cryptographic card 213 can support the SM2 national cryptographic algorithm or the ECC international cryptographic algorithm; when the cryptographic card 213 supports cryptographic hash algorithms, the cryptographic card 213 can support the SM3 national cryptographic algorithm or the MD5 international cryptographic algorithm.

[0068] The cryptographic card 213 has a complete security key management system, thereby providing the computing device with the highest encryption level of key management. In some embodiments, the cryptographic card 213 also has a complete security detection and protection mechanism, for example, the cryptographic card 213 can have a disassembly key self-destruction function, and can resist physical disassembly and side channel attacks through hardware reinforcement, thereby having extremely high security. In some embodiments, the cryptographic card 213 can also support virtualization cloud native services.

[0069] In some embodiments, the hardware resource layer 210 can further include a second acceleration card. The second acceleration card can accelerate the cryptographic algorithms (such as national cryptographic algorithms and / or international cryptographic algorithms) supported by the cryptographic card 213. The specific implementation or other related content of the second acceleration card can be referred to the first acceleration card described above, and will not be described here.

[0070] In some embodiments, the first acceleration card and the second acceleration card can be implemented on different physical units, for example, the first acceleration card and the second acceleration card can be different chips. In other embodiments, the first acceleration card and the second acceleration card can also be integrated on the same physical unit, for example, can be integrated on the same chip.

[0071] In some embodiments, the hardware resource layer 210 can further include a quantum random number generator (QRNG) 214. The QRNG 214 can be used to generate a true random number as a key of the computing device, which can be considered as a truly randomly generated and unpredictable key, thereby improving the security of the key used by the computing device.

[0072] The embodiments of the present disclosure do not limit the manner in which the QRNG 214 generates random numbers. For example, different random number generation schemes can be employed based on different quantum random sources. Exemplarily, for discrete quantum sources, a single-photon counting scheme can be employed; for continuous quantum sources, a phase noise extraction scheme based on SLED light sources can be employed.

[0073] The embodiments of the present disclosure do not limit the implementation of the QRNG 214. As an example, the QRNG 214 can be a separate physical unit and implemented with a separate chip. As another example, the QRNG 214 can also be integrated in other components, such as a cryptographic card 213.

[0074] Continuing to refer to Figure 1 In some embodiments, the hardware resource layer 210 can further include a trusted root 215, which can also be referred to as a trust root. The trusted root 215 serves as a source of trust for the computing device and can be ensured by various security technologies, such as physical security, technical security, and management security, to jointly ensure the trustworthiness of the trusted root 215.

[0075] In the embodiments of the present disclosure, a trust chain (or trust chain) mechanism can be constructed based on the trusted root 215. The main role of the trust chain is to extend the trust relationship to the entire computing device. Based on the trusted root, the trust chain can obtain various data that affect the trustworthiness of the computing device through a trust measurement mechanism, and determine the trustworthiness of the computing device by comparing the data with expected data.

[0076] In some embodiments, the trusted root 215 can be implemented with a SOC chip. As a specific example, the trusted root can be a secure chip that complies with the Trusted Platform Module (TPM) standard, referred to as a TPM chip.

[0077] In some embodiments, the IaaS layer 200 can further include a trusted platform 240. The trusted platform 240 can implement the transmission of the trust chain based on the trusted root 215.

[0078] Figure 3 And Figure 4 An architecture schematic diagram of the trusted platform 240 provided by the embodiments of the present disclosure is shown. Referring to Figure 3 And Figure 4 The trusted platform 240 can include a trusted platform management center (which can also be referred to as a trusted platform server). The trusted platform management center can perform various operations, such as remote attestation, file recovery, baseline management, trusted rule management, and audit data management.

[0079] The trusted platform management center can interact with nodes and operation and maintenance personnel.

[0080] As an example, each node can send the state of the node to the management center of the trusted platform through a trusted agent, so that the management center of the trusted platform can perform trusted measurement on the host startup, host process startup, application runtime environment, etc. of the node based on the trusted root since the host startup of the node. The embodiments of the present disclosure do not make specific limitations on the node state sent by the node to the management center of the trusted platform. For example, the node can send one or more of the following node states to the management center of the trusted platform: baseline registration, challenge quote reporting, measurement event reporting, and configuration change.

[0081] As an example, the operation and maintenance personnel can connect to the management center of the trusted platform through an operation and maintenance interface (such as a Web interface), so that the operation and maintenance personnel can conveniently maintain and develop the trusted platform, for example, can issue configurations to the management center of the trusted platform.

[0082] In some embodiments, the trusted platform can access the existing operation and maintenance channel in the form of a plug-in to provide flexible expansion capabilities and facilitate the operation and maintenance personnel to extend custom functions. In some embodiments, the trusted platform can also support multi-language development.

[0083] In some embodiments, the management center of the trusted platform can also interact with a database (such as an OceanBase database), a key management system (such as an external key management service BKMI), etc. In some embodiments, the management center of the trusted platform can report the trusted state of the node to the AKE / Sigma node.

[0084] In some embodiments, the trusted platform 240 can perform one or more of the following operations based on the trusted root 215: remote authentication, trusted measurement of the computing device, and firmware signing, thereby providing comprehensive security and trusted capabilities for the computing device.

[0085] The firmware signing performed by the trusted platform 240 can mean that the trusted platform 240 can set a unique identity for the firmware in the computing device, for example, can assign a unique firmware serial number. The remote authentication performed by the trusted platform 240 can mean that the trusted platform can perform remote authentication on the computing device or the firmware in the computing device based on the TPM trusted root or other types of trusted roots to determine the trustworthiness of the computing device. As an example, when a certain firmware in the computing device needs to be upgraded, the trusted platform 240 can perform remote authentication to verify the serial number of the firmware by remotely initiating a challenge to determine whether the firmware is trustworthy.

[0086] In some embodiments, the trusted platform 240 can perform trusted measurement on the computing device from multiple aspects to provide full-link trusted auditing and protection, etc. As an example, the trusted platform 240 can perform trusted measurement on the booting process of the computing device. As another example, the trusted platform 240 can perform trusted measurement on the application running process of the computing device. As yet another example, the trusted platform 240 can perform trusted measurement on the data of the application during the running process.

[0087] In some embodiments, the trusted measurement of the computing device by the trusted platform 240 can refer to static trusted measurement. In some embodiments, the trusted measurement of the computing device by the trusted platform 240 can refer to dynamic trusted measurement, for example, the data in the memory of the computing device is dynamically changed, and the trusted platform can perform real-time dynamic trusted measurement on the memory of the computing device.

[0088] The following will be described in combination with Figure 5 , to illustrate the process of the trusted measurement of the computing device by the trusted platform 240.

[0089] In Figure 5 the example, when the trusted platform 240 performs trusted measurement, the operating system kernel can send an instruction to the platform security processor (PSP), the PSP receives the instruction, and can perform trusted dynamic measurement (TDM), and send the measurement result to the operating system kernel and the trusted platform agent, and the operating system kernel also receives the measurement result, and can send the result to the trusted platform agent based on the trusted root after performing trusted measurement, and finally the trusted platform agent sends the measurement result to the trusted platform 240 to confirm the trusted measurement result. In some embodiments, the trusted platform can also perform remote trusted measurement.

[0090] The trusted platform 240 can monitor the behavior of intrusion and tampering of the memory in real time by performing trusted measurement on the computing device, or can control the authorized access of the system command, and can resist dictionary brute force attack, etc.

[0091] Continuing to refer to Figure 1 , in some embodiments, the IaaS layer 200 can also include a container management platform 250 and a plurality of secure containers (secure container A, secure container B, etc.).

[0092] The container management platform 250 can run on the secure operating system layer 220. The container management platform 250 can manage a plurality of secure containers.

[0093] Secure containers can be generated based on hardware resources in hardware resource layer 210, thereby utilizing hardware virtualization to isolate the runtime environments of different containers. This allows computing devices to completely block malicious code within the secure container from attacking the host and adjacent secure containers, providing functions such as file protection, application isolation, and real-time blocking. Furthermore, it ensures that a complete operating system (such as Linux) does not need to run in each secure container; the secure isolation of virtual machines (VMs) is achieved through the overhead of secure containers. The security of isolating virtual machines using secure containers is greater than the security of isolating virtual machines using kernel-based virtualization technology. This disclosure does not limit kernel-based virtualization technology; for example, it can refer to Linux kernel-based virtualization technology (such as kernel-based virtual machines (KVM)). Secure containers start extremely quickly, with runtime overhead equivalent to runc. In some embodiments, the performance and security of secure containers can be flexibly configured.

[0094] In some embodiments, the security container can be a lightweight container to improve code reusability within the security container.

[0095] Figure 6 This is a schematic diagram of the architecture of a secure container provided in an embodiment of this disclosure. (As shown...) Figure 6 As shown in this example, the secure container can be developed using the Go programming language and is divided into two independent processes at runtime: Sentry and Gofer. The Sentry process includes the kernel, responsible for executing user code and handling system calls. The Gofer process is a file system operation agent; file system operations beyond the secure container can be sent to the Gofer process via 9P connections.

[0096] In this example, Sentry within the secure container can be used as a guest kernel to provide operating system support for applications running within the secure container. Applications running in the secure container have their own kernel and virtual devices, making them distinct from other secure containers and the host.

[0097] Figure 6Exemplarily, four manners of system call are given, which are internal call of user state kernel Sentry, call of Sentry to Gofer process through 9P connection, system call of Sentry through main kernel, and system call of Sentry to Virtual Function (VF) in smart network card through Input / Output Memory Management Unit (IOMMU). Based on this, the security container can provide a strong isolation boundary by intercepting the system call of the application program and running as a user state kernel. Based on the architecture of the security container, the security container can have the characteristics of native security, resource flexibility, platform advantage, and application credibility.

[0098] Continuing to refer to Figure 1 In some embodiments, the IaaS layer can further include an operation and maintenance platform 260 to provide system monitoring and diagnosis, abnormal process detection and alarm functions. In some embodiments, the operation and maintenance platform 260 can adopt a C / S architecture to reduce the communication overhead of the system, but the embodiments of the present disclosure are not limited thereto, for example, a B / S architecture can also be adopted.

[0099] In some embodiments, the operation and maintenance platform 260 can include a monitoring module and an alarm module. The monitoring module can monitor the computing device uniformly. The alarm module can issue alarm information according to the abnormal information detected by the monitoring module. The alarm module can issue the alarm information by itself or with the help of other related components. Exemplarily, the alarm module can issue the alarm information with the help of other application programs, such as DingTalk Webhook for alarm message pushing.

[0100] When the operation and maintenance platform monitors the computing device, the hardware resource information of the computing device can be obtained in different ways, which are not limited in the present disclosure. Exemplarily, in some embodiments, an agent can be installed on the operating system of the computing device, which can report the dynamic resource information of the IaaS layer 200 to the operation and maintenance platform 260; in some embodiments, the computing device can include a hardware resource information monitoring component, which can directly collect system logs, vendor information, Baseboard Manager Controller (BMC) information, and state information of components and sensors, and then push the collected data to the background gateway at regular intervals. The operation and maintenance platform 260 can automatically pull the latest data from the gateway.

[0101] The operation and maintenance platform 260 can be a hardware and software oriented management and control platform, which can monitor the Linux devices, network devices and other hardware and software products of the computing device, issue real-time alarms, push fault information in time, and quickly solve operation and maintenance problems to improve operation and maintenance efficiency.

[0102] In some embodiments, the secure operating system layer 220 can include a secure operating system. The secure operating system can meet mandatory requirements such as the network security protection compliance proposed by domestic and foreign regulations; in addition, the secure operating system can also support various capabilities, for example, can be based on a trusted root trusted boot, can support a national cryptographic algorithm library, can control access to the secure operating system, and can control the permissions of processes in the computing device.

[0103] For example, the secure operating system controls the permissions of processes in the computing device can mean that the secure operating system controls the execution permissions of processes in the secure container and processes in the host computer at the kernel level, thereby effectively preventing system attacks such as brute force cracking, vulnerability exploitation, and container escape.

[0104] The operation and maintenance platform 260 can resist bottom-layer security threats such as RootKit / BootKit by starting each link and each component and the integrity of the application programs and system modules specified by the user.

[0105] In some embodiments, the computing device provided by the embodiments of the present disclosure can be an all-in-one machine, and therefore the computing device can also be referred to as a privacy computing all-in-one machine.

[0106] The computing device provided by the embodiments of the present disclosure takes a hardware security chip as a trust root and takes a cryptographic method as a main means, and constructs a complete trust chain running through hardware, a virtual layer, a system layer, and an application layer through means such as measurement, detection, and proof, which can construct a trusted infrastructure device (which can also be referred to as a secure base) for upper-layer applications and data fusion computing. In other words, the computing device provided by the embodiments of the present disclosure is a trusted native computing device, and therefore the computing device provided by the embodiments of the present disclosure can also be referred to as a trusted native all-in-one machine.

[0107] In the embodiments of the present disclosure, the privacy computing all-in-one machine or the trusted native all-in-one machine can be simply referred to as an all-in-one machine.

[0108] The all-in-one machine provided by the embodiments of the present disclosure ensures the integrity and confidentiality of the platform system, the security of platform data storage, transmission and calculation, the identity and behavior state confirmation of nodes, services and components in the platform, and the identity and behavior state confirmation of users when the platform interfaces with external systems. Therefore, the all-in-one machine can provide a complete security solution from the chip level to the hardware and software. Specifically, the all-in-one machine realizes the trusted guarantee of hardware, firmware, system software and application software through the cooperation of trusted chips, trusted peripherals and processors, prevents key hardware and software components from being tampered with during operation, and provides TEE capability for the processor of the all-in-one machine, provides hardware-level isolation capability between different TEEs, and can achieve that data leaving the processor is ciphertext. The all-in-one machine provides the highest level of anti-physical attack capability and also has the acceleration capability of privacy calculation related algorithms.

[0109] In one aspect, the computing device provided by the embodiments of the present disclosure fully considers the cloud environment and is a computing device integrating software and hardware security and trust in the cloud native environment, which can run on the cloud in the best posture, fully utilizes and plays the advantages of elasticity and distribution of the cloud platform. Therefore, the computing device provided by the embodiments of the present disclosure can provide a one-stop security solution for data joint calculation (multi-party secure calculation) between organizations.

[0110] In another aspect, the computing device provided by the embodiments of the present disclosure guarantees data and application security from both hardware and software aspects in the principle of giving equal importance to security and trust. Therefore, the computing device provided by the embodiments of the present disclosure can provide a trusted data exchange platform for data security and privacy protection.

[0111] Specifically, compared with the traditional computing device, the computing device provided by the embodiments of the present disclosure realizes the optimization of hardware. For example, a dedicated processing chip can be deployed on the computing device, which can be an FPGA chip, an ASIC chip or other types of chips to improve data processing efficiency. In addition, the processing chip in the computing device can also be deployed with a trusted root, which can include a TPM chip, for example. The processing chip can be used to store the key required in the privacy calculation process. The key can be pre-burned into the processing chip by the publisher, so that the processing chip forms a hardware TEE environment on the computing device, providing a high-level secure computing environment isolated from the host environment of the computing device to ensure that the data requiring privacy protection will not be subject to privacy leakage. For another example, a cryptographic card can be deployed on the computing device. The cryptographic card can realize encrypted memory read and write data and resist side channel attacks through hardware reinforcement, which has extremely high security.

[0112] Compared with traditional computing software, the computing device provided by the embodiments of the present disclosure can also realize software optimization. For example, a trusted platform can be deployed in the computing device to provide comprehensive trusted capabilities, and provide functions such as full-link trusted auditing and protection for the host running of the computing device, the application running, and the application data. Alternatively, a secure operating system can also be deployed in the computing device to reinforce the operating system access control and the permission management, and can effectively prevent attacks such as brute force cracking, vulnerability exploitation, and container escape. For another example, an operation and maintenance platform can be deployed in the computing device, and the operation and maintenance platform can provide intelligent monitoring functions, system health diagnosis, and abnormal process detection and alarm capabilities. In addition, the computing device can be internally provided with a certificate authorization service, and can realize automatic certificate issuance and identity authentication, thereby realizing plug-and-play of the computing device. In this way, the computing device product can not only help customers quickly establish a basic hardware facility related to privacy computing, but also enable customers to quickly online an application related to privacy technology, and save the complicated application installation and authentication process, so that the computing device can be quickly deployed after being connected to an agency network. For example, the computing device can be quickly applied in financial, government, and medical scenarios. As can be seen, the computing device provided by the embodiments of the present disclosure is delivered as a whole, and can provide a secure, trusted, and high-performance privacy computing solution.

[0113] In summary, the computing device provided by the embodiments of the present disclosure is an infrastructure product specially designed for security in a cloud-native environment. The computing device has an autonomous root of trust, and from the root of trust to the hardware platform, to the operating system, and to the application security container, the integrity, confidentiality, and expected behavior of the computing resources can be ensured, and therefore, the security problem of privacy computing can be fundamentally solved.

[0114] In the embodiments described above, all or some of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or some of the embodiments can be implemented in the form of a computer program product storing computer program instructions. When the computer program instructions are loaded into and executed by a computer, all or some of the procedures or functions according to the embodiments of the present disclosure are generated. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer program instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer program instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a digital video disc (DVD)), or a semiconductor medium (such as a solid state disk (SSD)), etc.

[0115] Those skilled in the art can realize that the units and algorithm steps of each example described in connection with the embodiments of the present disclosure can be realized by electronic hardware, or a combination of computer software and electronic hardware. Whether the functions are performed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present disclosure.

[0116] In several embodiments provided by the present disclosure, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are merely schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0117] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may also be distributed to multiple network units. Part or all of the units can be selected to achieve the purpose of the embodiment of the present application according to actual needs.

[0118] In addition, each functional unit in various embodiments of the present disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0119] The above is only a specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present disclosure, which should be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. A computing device supporting privacy-preserving computation, comprising: The platform as a service layer includes a privacy computing platform, which is used to perform privacy computing. The Infrastructure as a Service (IaaS) layer includes a hardware resource layer, a secure operating system layer, and a TEE running on top of the secure operating system layer. The hardware resource layer includes a CPU, and at least one trusted application runs in the TEE. The at least one trusted application accesses the CPU by calling the SDK interface. The CPU supports a first TEE technology, and the at least one trusted application includes a first trusted application. The first trusted application is obtained based on an SDK provided by a second TEE technology. The SDK interface is compatible with SDKs of multiple TEE technologies, so that the second TEE technology can be different from the first TEE technology, and the at least one trusted application can access CPUs with different architectures by calling the SDK interface.

2. The computing device according to claim 1, wherein the hardware resource layer further comprises: The first acceleration card is used to perform hardware acceleration on the privacy computing algorithm.

3. The computing device according to claim 2, wherein the first accelerator card comprises one or more of the following: FPGA, GPU, and ASIC.

4. The computing device according to claim 2, wherein the first accelerator card supports acceleration of one or more of the following algorithms: fully homomorphic encryption algorithm, semi-homomorphic encryption algorithm, and elliptic curve encryption algorithm.

5. The computing device according to claim 1, wherein the hardware resource layer further comprises: Cryptographic cards that support national and / or international cryptographic algorithms; as well as The second acceleration card is used to accelerate the national cryptographic algorithm and / or the international cryptographic algorithm.

6. The computing device according to claim 1, wherein the hardware resource layer further includes a trusted root; The Infrastructure as a Service layer also includes a trusted platform, which performs one or more of the following operations based on the root of trust: remote authentication, trusted measurement of the computing device, and firmware signing.

7. The computing device according to claim 6, wherein the trust measure of the computing device includes one or more of the following: the trust measure of the computing device during startup, the trust measure of the application of the computing device during operation, and the trust measure of the data of the application of the computing device during operation.

8. The computing device according to claim 1, wherein the SDK interface is compatible with one or more of the following: SGX SDK, Rust SDK, and Occlum.

9. The computing device of claim 1, wherein the Infrastructure as a Service layer further comprises: The container management platform runs on top of the secure operating system layer; Multiple secure containers are generated based on hardware resources in the hardware resource layer, and the runtime environments of the multiple secure containers are isolated from each other.

10. The computing device according to claim 9, wherein the security container is a lightweight container.

11. The computing device of claim 1, wherein the Infrastructure as a Service layer further comprises: The operation and maintenance platform includes a monitoring module and an alarm module. The monitoring module is used for unified monitoring of the computing device; The alarm module is used to issue alarm information based on the abnormal information detected by the monitoring module.

12. The computing device according to claim 1, wherein the secure operating system in the secure operating system layer supports one or more of the following: trusted boot based on a root of trust, a national cryptographic algorithm library, access control for the secure operating system, and access control for processes in the computing device.

13. The computing device according to claim 1, wherein the hardware resource layer further comprises: A quantum random number generator is used to generate truly random numbers to enhance the security of the keys used by the computing device.

14. The computing device according to claim 1, wherein the platform as a service layer further includes one or more of the following services: remote authentication service, cryptographic service, and algorithm acceleration service.

15. The computing device according to claim 1, wherein the computing device is an all-in-one machine.

Images