Data access method, device, electronic device and computer storage medium

Abstract

Embodiments of the present invention provide a data access method, apparatus, electronic device, and computer storage medium. The data access method includes: determining, based on a data access request for data stored in a trusted execution environment (TEE), a data authorization object corresponding to the data to be accessed; and, if access authorization for the data to be accessed is obtained from the data authorization object, executing the operation requested by the data access request and returning the result of the operation. These embodiments of the present invention effectively improve data security.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a data access method, device, electronic device, and computer storage medium. Background Art

[0002] With the development of Internet technology, the data involved in various applications and tools has grown exponentially. In order to facilitate the storage and management of this data, database systems came into being.

[0003] A database system typically consists of a database and a database management system (DBMS). A database stores specific data and is centrally managed by the DBMS. Data insertion, modification, and retrieval all require the DBMS. With the advancement of database technology, data federation has become a growing demand. This breaks down the independence of individual databases, placing higher demands on database system security.

[0004] Currently, mainstream solutions for database system security are based on cryptographic multi-party computation protocols, applying cryptographic theory to achieve provably secure joint data processing. However, the application of cryptographic multi-party computation protocols involves multiple rounds of data communication, and the computation process also involves a certain amount of cryptographic operations. In practical applications, especially when applied to large-scale data, secure data access solutions based on cryptographic multi-party computation protocols incur significant network bandwidth and computational overhead. Summary of the Invention

[0005] In view of this, an embodiment of the present invention provides a data access solution to at least partially solve the above problems.

[0006] According to a first aspect of an embodiment of the present invention, a data access method is provided, comprising: determining a data authorization object corresponding to the data to be accessed based on a data access request for data set in a trusted execution environment (TEE); if access authorization for the data to be accessed is obtained from the data authorization object, executing the operation requested by the data access request and returning the operation result.

[0007] According to a second aspect of an embodiment of the present invention, another data access method is provided, including: receiving a data access request for data in a database set in a trusted execution environment TEE; determining all data authorization objects corresponding to the data to be accessed through a database management system DBMS set in the TEE; if it is determined that access authorization for the data to be accessed has been obtained from all data authorization objects, executing the operation requested by the data access request through the DBMS and returning the operation result.

[0008] According to a third aspect of an embodiment of the present invention, a data access device is provided, including: a determination module for determining a data authorization object corresponding to the data to be accessed based on a data access request for data set in a trusted execution environment TEE; an access module for executing the operation requested by the data access request and returning the operation result if access authorization for the data to be accessed is obtained from the data authorization object.

[0009] According to a fourth aspect of an embodiment of the present invention, an electronic device is provided, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the data access method described in the first aspect or the second aspect.

[0010] According to a fifth aspect of an embodiment of the present invention, a computer storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the data access method as described in the first aspect or the second aspect is implemented.

[0011] According to the data access solution provided by the embodiment of the present invention, on the one hand, the data is set in the trusted execution environment TEE. Due to the security characteristics of the TEE itself, the security of the data can be improved to a certain extent; on the other hand, when accessing the data in the TEE, the access authorization of the data authorization object of the data to be accessed is required. Therefore, for data that is not from the party or involves multiple data authorization objects, the data authorization object can authenticate and authorize the data access requester, so that the data corresponding to each data authorization object can be accessed, further improving data security. In addition, during the data access process of the embodiment of the present invention, there is no need to repeatedly perform secure communications and cryptographic multi-party computations related to data access, thereby avoiding the resulting network bandwidth overhead and computing overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0013] Figure 1A This is a flowchart of a data access method according to the first embodiment of the present invention;

[0014] Figure 1B for Figure 1A A schematic diagram of an example scenario in the illustrated embodiment;

[0015] Figure 2A This is a flowchart of a data access method according to the second embodiment of the present invention;

[0016] Figure 2B for Figure 2A A schematic diagram of a TEE environment in the illustrated embodiment;

[0017] Figure 2C for Figure 2A A schematic diagram of another TEE environment in the illustrated embodiment;

[0018] Figure 3 This is a structural block diagram of a data access device according to a third embodiment of the present invention;

[0019] Figure 4 This is a structural block diagram of a data access device according to a fourth embodiment of the present invention;

[0020] Figure 5 FIG. 4 is a schematic structural diagram of an electronic device according to a fifth embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments in the embodiments of the present invention should fall within the scope of protection of the embodiments of the present invention.

[0022] The specific implementation of the embodiment of the present invention is further described below with reference to the accompanying drawings of the embodiment of the present invention.

[0023] Example 1

[0024] Reference Figure 1A , shows a step flow chart of a data access method according to embodiment 1 of the present invention.

[0025] The data access method of this embodiment includes the following steps:

[0026] Step S102: According to the data access request for the data set in the TEE, determine the data authorization object corresponding to the data to be accessed.

[0027] TEE (Trusted Execution Environment) is a secure isolation area implemented by a combination of hardware and software to ensure that sensitive data and code can be securely transmitted, stored, processed, etc. within the secure isolation area, to ensure the confidentiality, integrity and end-to-end security of trusted application execution and data access rights, to protect applications and services in the trusted execution environment from general software attacks, and to resist a series of clear threats. The trusted execution environment can be implemented through a variety of technologies and can achieve different security levels. Compared with its external environment, the data in the TEE has higher security. The data access operation in the embodiment of the present invention is performed based on the data set in the TEE.

[0028] Generally speaking, specific data can be stored in databases, data tables, files, etc. A database, a data table, or a file may have one data authorization object or multiple data authorization objects. The data authorization object has the authority to authorize access to its corresponding data, for example, allowing user A to access its data, or not allowing user B to access its data, etc. For example, there are two data tables A and B in a database, corresponding to different data authorization objects X and Y respectively. For another example, data authorization objects X and Y jointly own all data in data table A. That is, the data authorization objects of data table A are X and Y, and operations on data table A require access authorization from both data authorization objects X and Y. For another example, data authorization object X owns both data tables A and B. Therefore, access to either data table A or data table B requires access authorization from data authorization object X. For another example, data table C stores data where records 1-10000 belong to data authorization object X, and records 10001-20000 belong to data authorization object Y. Therefore, access to records 1-10000 requires access authorization from data authorization object X, while access to records 10001-20000 requires access authorization from data authorization object Y, and so on.

[0029] Therefore, in one way, a data access request for data in the TEE may involve multiple data authorization objects, that is, there are multiple data authorization objects corresponding to the data to be accessed; in another way, the data access requester may need to access data that does not belong to itself. For example, user X wants to access data table A, but data table A belongs to user Y. In this case, it is also necessary to determine the data authorization object corresponding to the data to be accessed.

[0030] In this step, the specific implementation of determining the data authorization object corresponding to the data to be accessed can be implemented by those skilled in the art in any appropriate manner. For example, if the TEE stores the correspondence information between the stored data and the data authorization object, the data authorization object corresponding to the data to be accessed can be determined through the correspondence information. For another example, after the data to be accessed is determined, the corresponding data authorization object can be found from the relevant information of the data to be accessed, such as attribute information, and so on.

[0031] In addition, in the embodiment of the present invention, the data access request may be any appropriate request, including but not limited to: a data query request, a data insertion request, a data deletion request, a data modification request, a data creation request, and the like.

[0032] Step S104: If the access authorization to the data to be accessed is obtained from the data authorization object, the operation requested by the data access request is executed and the operation result is returned.

[0033] In the embodiment of the present invention, if one wants to access the data to be accessed, one must obtain access authorization from the corresponding data authorization object to effectively ensure the data security of the data authorization object.

[0034] For example, user X wants to access table A, but the data authorization object of table A is user Y. In this case, user X needs to obtain access authorization for table A from user Y before he can access table A.

[0035] For another example, user X initiates a data federation access request. The data to be accessed in this request involves data tables A, B, and C. The data authorization object for data table A is user Y, the data authorization object for data table B is user X himself, and the data authorization object for data table C is user Z. In this case, user X needs to obtain access authorization for data table A from user Y and access authorization for data table C from user Z before performing the data federation access.

[0036] Among them, the specific implementation of access authorization can be achieved by technical personnel in this field in an appropriate manner. For example, after receiving the authorization instruction or message of the data authorization object, the authorization information is recorded or the authorization mark is made in the list corresponding to the data to be accessed. When all data authorization objects corresponding to the data to be accessed are recorded or marked, it is determined that all data authorization objects have been authorized, and the operation requested by the data access request can be performed on the data to be accessed, and the corresponding operation result is returned.

[0037] The following is a brief schematic illustration of the above process using a specific scenario as an example. Figure 1B shown.

[0038] Figure 1BThe TEE shown in the figure is configured with a DBMS and multiple data tables 1, 2, 3, ..., N. The data in data table 1 is authorized to user X, and the data in data table 2 is authorized to user Y. Assume that data table 1 stores the IDs and attribute data of user set P, and data table 2 stores the IDs and historical purchase behavior data of user set P.

[0039] If user X initiates a data federation query request for the attribute data and historical purchase behavior data of users in user set P through their device X, that is, the request involves both Table 1 and Table 2. Since Table 1 is owned by user X, the DBMS will assume that user X has been granted access to Table 1. Since Table 2 is owned by user Y, the DBMS will send a request to user Y's device Y requesting user Y to grant access to Table 2. If user Y responds with an access authorization instruction through device Y, the DBMS will assume that user X has been granted access to both Table 1 and Table 2 and will execute the data federation query request. After obtaining the query results requested by the data federation query request, the query results will be sent from the TEE to user X's device X.

[0040] It can be seen that through this embodiment, on the one hand, setting the data in the trusted execution environment TEE can improve the security of the data to a certain extent due to the security characteristics of the TEE itself; on the other hand, when accessing the data in the TEE, the access authorization of the data authorization object of the data to be accessed is required before access can be made. Therefore, for non-local data or data involving multiple data authorization objects, the data authorization object can authenticate and authorize the data access requester, so that the data corresponding to each data authorization object can be accessed, further improving data security. In addition, during the data access process of the embodiment of the present invention, there is no need to repeatedly perform secure communications and cryptographic multi-party computations related to data access, thereby avoiding the resulting network bandwidth overhead and computing overhead.

[0041] The data access method of this embodiment can be executed by any appropriate electronic device with data processing capabilities, including but not limited to: a server, a mobile terminal (such as a mobile phone, a PAD, etc.) and a PC.

[0042] Example 2

[0043] Reference Figure 2A , shows a step flow chart of a data access method according to embodiment 2 of the present invention.

[0044] The data access method of this embodiment includes the following steps:

[0045] Step S202: Allocate a session key and a data key to the data authorization object of the data in the TEE.

[0046] The TEE can store data in any appropriate form, such as in a database, data table, or file format, as needed by those skilled in the art. Taking data tables as an example, one or more (two or more) data tables may correspond to a single data owner, or a single data table may correspond to multiple data owners, though this is not a limitation in the present embodiment. Based on this, session keys and data keys can be assigned to the data owners of all or part of the data stored in the TEE. The session key is used to encrypt interactions within and outside the TEE, such as encrypting requests sent by a user to the TEE or encrypting data returned to a user from the TEE. The data key is stored within the TEE and can be used to encrypt and decrypt data involved in the TEE, such as internal data objects or data managed by components (which can be located within the TEE, outside the TEE, or partially within and partially outside the TEE). The key may or may not be disclosed to the user to whom it belongs. In addition, the data key can also be used for disaster recovery backup of data involved in TEE, such as the recovery of data managed by its internal data objects or components when a TEE encounters an exception or is destroyed.

[0047] In one feasible approach, a DBMS (database management system) can be set up in TEE to achieve data storage security through TEE while also enabling effective management of the database through DBMS, providing security and support for the entire database system.

[0048] Step S204: After determining that the security verification of the TEE is passed according to the remote attestation, a trusted secure channel is established between the sender who needs to send the data access request and the TEE.

[0049] The remote attestation is used to verify the security of the TEE to prove that the data or code in the TEE has not been illegally modified. In specific implementations, those skilled in the art can use appropriate methods to remotely attest to the TEE, such as binary attestation based on entity identification or remote attestation based on attributes.

[0050] After the TEE security verification is passed, a trusted secure channel can be established between the sender who needs to send a data access request and the TEE to achieve secure communication between the sender and the TEE through the channel.

[0051] Therefore, on the one hand, the security of data used in TEE is effectively guaranteed, and on the other hand, the security of communication with TEE can also be guaranteed.

[0052] Step S206: Receive the data access request sent to the TEE through the trusted secure channel between the sender of the data access request and the TEE.

[0053] The data access request is generated after being encrypted using a session key allocated to the sender of the data access request.

[0054] As previously mentioned, when a user needs to access data in a TEE, they need to send a data access request to the TEE. This data access request is first encrypted using the session key assigned to the user, the sender of the data access request. The request is then transmitted through a trusted secure channel between the sender and the TEE. The device hosting the TEE then receives the encrypted data access request through this trusted secure channel. This effectively ensures the security of communication between the sender and the TEE, and enhances the overall security of TEE data interaction.

[0055] Step S208: Determine the data authorization object corresponding to the data to be accessed according to the data access request for the data set in the TEE.

[0056] In one possible approach, the data that the sender of the data access request needs to access, i.e., the data to be accessed, is not its own data. For example, user A needs to access user B's data. In this case, the data authorization object corresponding to the data to be accessed is different from the sender, so it is necessary to determine the data authorization object of the data to be accessed.

[0057] In another possible approach, the data that the sender of the data access request needs to access belongs to multiple data authorization objects. For example, in the case of a data federation query, the query may involve multiple data tables, each with a different data authorization object. The sender may be one of the multiple data authorization objects corresponding to the multiple data tables, or another party unrelated to any of the multiple data authorization objects. In this case, the data to be accessed corresponds to multiple data authorization objects. Based on this, this step can be implemented as follows: based on the data access request for the data stored in the TEE, determine that the data to be accessed belongs to multiple data tables; and determine the multiple data authorization objects corresponding to the multiple data tables. In this way, data authorization objects are determined at the data table granularity. However, those skilled in the art should understand that when data is stored in other formats, such as files, this approach can also be implemented to determine data authorization objects at the file granularity. Alternatively, data authorization objects can be determined at the database granularity.

[0058] In another possible approach, although the data that the sender of the data access request needs to access belongs to the same data table, the data table is divided into multiple parts, each belonging to different data authorization objects. Similar to multiple data tables, in this case, although the data to be accessed is located in the same data table, it also corresponds to multiple data authorization objects. Based on this, this step can be implemented as follows: based on the data access request for the data set in the TEE, determine the multiple data parts of the same data table that the data to be accessed belongs to; and determine the multiple data authorization objects corresponding to the multiple data parts. In this way, the determination of data authorization objects at the data granularity can be achieved, ensuring the security of access to the same data table or file.

[0059] Furthermore, in the case of deploying a DBMS based on a TEE, the data that the sender of the data access request needs to access may be data managed by the DBMS. In this case, the DBMS in the TEE can be used to achieve efficient access and secure management of the DBMS-managed data.

[0060] Step S210: If the access authorization to the data to be accessed is obtained from the data authorization object, the operation requested by the data access request is executed and the operation result is returned.

[0061] In one feasible approach, data in the TEE is stored and managed in plain text. In this case, after obtaining access authorization from the data authorization object for the data to be accessed, the operation requested by the data access request can be executed. In other words, the operation requested by the data access request is performed in plain text on the data to be accessed in the TEE. In this approach, data security is guaranteed by the TEE, making data access faster and more efficient.

[0062] In another feasible way, the data in the TEE is encrypted data. In this case, if the data authorization object obtains access authorization for the data to be accessed, the data key corresponding to the data authorization object is obtained; the encrypted and stored data to be accessed is decrypted according to the data key, and the operation requested by the data access request is performed after decryption. In this way, the data is doubly secure, that is, on the basis of the security environment provided by the TEE, the data is encrypted again, which further improves the security of the data. Therefore, when accessing the data, it is necessary to first decrypt the data to be accessed, and then perform the operation requested by the data access request. In an embodiment of the present invention, the encryption and decryption of the data in the TEE are both implemented by the data key of the data authorization object corresponding to the part of the data. When encrypting, the data can be encrypted according to the data key of the data authorization object, and when decrypting, the data key of the data authorization object is used for decryption. While ensuring data security, the implementation of the data key and data encryption and decryption is simplified.

[0063] It should be noted that the above two methods take the case where all the data to be accessed is located inside the TEE as an example, but in actual applications, it is possible that part of the data to be accessed is located inside the TEE and part is located outside the TEE; or, all the data to be accessed is located outside the TEE. In this case, before executing the operation requested by the data access request, it is also possible to determine whether all the data to be accessed is stored in the TEE; if so, the operation requested by the data access request is executed; if not, after loading the data portion stored outside the TEE in the data to be accessed into the TEE, the operation requested by the data access request is executed, wherein the data portion stored outside the TEE is data encrypted according to the data key corresponding to the data authorization object. The method of storing data outside the TEE in the form of data authorization object encryption and then transferring it into the TEE when needed can greatly expand the applicable scenarios and data application scope of the data access scheme of the embodiment of the present invention on the basis of ensuring data security, and improve the utilization efficiency of the TEE.

[0064] For example, Figure 2B As shown in the , the DB file is stored in an encrypted form (such as encrypting it according to the data key of one or more data authorization objects corresponding to the DB file) in a device outside a TEE. When the TEE receives a data access request and determines that the data in the DB file is needed, the DB file is loaded into the TEE and decrypted according to the data key of one or more data authorization objects corresponding to the DB file for easy operation. Figure 2B For other parts, please refer to Figure 2C It should be noted that the operation of determining whether all the data to be accessed is stored in the TEE can be performed after obtaining the access authorization for the data to be accessed from the data authorization object, so as to minimize data interaction and save system power consumption; but it can also be performed before obtaining the access authorization for the data to be accessed from the data authorization object, so as to improve the processing efficiency of data access requests.

[0065] Optionally, when there are multiple data authorization objects, decrypting the encrypted and stored data to be accessed based on the data key includes: performing an exclusive-OR operation on multiple data keys corresponding to the multiple data authorization objects to generate a data decryption key; and decrypting the encrypted and stored data to be accessed using the data decryption key. Generating the data decryption key through an exclusive-OR operation is simpler to implement and the key is relatively concise compared to other methods of generating a data decryption key based on multiple data keys. However, this is not limiting, and other key generation algorithms and methods are also applicable.

[0066] Furthermore, in this step, when returning the operation result, the operation result can be encrypted using the session key assigned to the sender and the established trusted secure channel. The encrypted operation result is then returned to the sender of the data access request via the trusted secure channel. This securely transfers the operation result data to the sender of the data access request.

[0067] Through the above process, secure data access is achieved between the sender of the data access request and the TEE. In an optional manner, based on the above process, the following optional steps may also be performed.

[0068] Step S212: Update the data authorization object of the data in the TEE according to the request.

[0069] In one feasible approach, the data authorization objects for some of the data in the TEE can be updated based on a data update request for that portion of the data. This approach allows for timely updates to data authorization objects caused by data changes in the TEE. For example, if a data table is added to the TEE, and that data table does not belong to the data authorization objects for the original data in the TEE, then the data authorization object corresponding to that data table must be added accordingly. For another example, if a data table is deleted from the TEE, and the data authorization object for that data table does not exist in the TEE for other data, then the data authorization object can be deleted, and so on.

[0070] In another feasible approach, the data authorization objects of some data in the TEE can be updated based on an update request for the data authorization objects of some data in the TEE. In this approach, the owner of certain data can be changed to a new data authorization object in response to a request from the original data authorization object in the TEE, or a new data authorization object can be added for a certain portion of data. For example, if the original data authorization object of data table A is user X, and user X initiates a request to change the owner of data table A to user Y, the data authorization object of data table A can be changed based on this request. For another example, if the original data authorization object of data table A is user X, and user X initiates a request to add a new data authorization object, such as user Y, to data table A, the data authorization objects of data table A can be changed to users X and Y based on this request.

[0071] When the data in the TEE is stored in encrypted form, changes in the data authorization object will also trigger re-encryption of the data.

[0072] The following first describes the encryption process of data in TEE.

[0073] For example, for data stored in the TEE, multiple corresponding data authorization objects can be determined for multiple parts of data stored in the TEE (part or all of the data in the TEE), and data keys can be assigned to the determined multiple data authorization objects; use the data keys of the data authorization objects corresponding to each part of the data to encrypt each part of the data separately.

[0074] Typically, the data in the TEE may correspond to multiple data authorization objects. For example, when a DBMS is set up in the TEE, the DBMS manages multiple data tables, and the multiple data tables can correspond to multiple data authorization objects. As mentioned above, each data authorization object is assigned a corresponding data key, and the corresponding data is encrypted and decrypted using the data key to improve data security.

[0075] On this basis, based on a data update request for part of the data in the TEE, updating the data authorization object of part of the data in the TEE may include: receiving a data update request for part of the data in the TEE; updating the part of the data according to the data update request; if it is determined that the data authorization object of the updated part of the data has changed, assigning a data key to the new data authorization object, or destroying the data key of the original data authorization object; and using the data key of the updated data authorization object of the part of the data to encrypt the updated part of the data. In this way, timely updates of data authorization objects based on data changes and timely updates of data security are achieved.

[0076] On this basis, based on an update request for a data authorization object of some data in the TEE, updating the data authorization object of some data in the TEE may include: receiving an update request for at least one of the existing data authorization objects corresponding to the part of the data in the TEE; updating the data authorization object corresponding to the part of the data based on the update request and assigning a data key to the updated data authorization object; and encrypting the part of the data using the data key of the updated data authorization object of the part of the data. This achieves timely updates of data authorization objects based on user requests and timely updates of data security.

[0077] In one feasible approach, using the data key of the data authorization object corresponding to each portion of data to encrypt each portion of data can be implemented by performing an exclusive-OR operation on the data key of the data authorization object corresponding to each portion of data to generate a data encryption key corresponding to each portion of data; and then encrypting each portion of data using this data encryption key. Compared to other data encryption key generation methods, using the exclusive-OR operation is simpler to implement and reduces the generation and implementation costs of data encryption keys.

[0078] In addition, in some cases, it may be necessary to change the TEE environment where the data is located. For example, the original TEE environment becomes abnormal or is destroyed, or the TEE where the data is located is adjusted according to the needs of the data authorization object, which may cause a change in the TEE where the data is located. In this case, the encrypted data exported from the original TEE can be obtained, and a new TEE can be created for the encrypted data; the data key of the data authorization object corresponding to the encrypted data can be obtained; the encrypted data can be decrypted using the data key, and the decrypted data can be stored in the new TEE. Among them, when the encrypted data is decrypted using the data key, if the exported encrypted data corresponds to one data authorization object, the encrypted data can be directly decrypted according to the data key of the data authorization object; if the exported encrypted data corresponds to multiple data authorization objects, the data keys of the multiple data authorization objects corresponding to the exported encrypted data can be XORed with reference to the aforementioned method of generating the data encryption key to generate a data decryption key, and the exported encrypted data can be decrypted using the data decryption key. In this way, even if the original TEE is destroyed or the data in the original TEE needs to be changed to a new TEE, the data is still stored in encrypted form, and non-owners of the data still cannot access the data, thereby ensuring that even if TEE anomalies or changes to the data TEE environment occur, the security of the data can be effectively guaranteed.

[0079] The above process is exemplified below in the form of a specific example.

[0080] Figure 2C A schematic diagram of a TEE environment is shown, Figure 2C As shown in the , a DBMS is deployed in the TEE. Alternatively, the DB file can be deployed in the same TEE as the DBMS. That is, the DBMS and the DB file are located in the same TEE, and the DBMS is responsible for managing the DB file and the data within it. In a specific implementation, a TEE can be created on the server that owns the TEE and the DBMS deployed in the TEE.

[0081] like Figure 2C As shown in , when user P needs to interact with the data stored in TEE, i You can first configure the data source as needed so that you can use the data in TEE smoothly later. After configuring the data source, user P i You can use the client Figure 2C P in i The client performs remote authentication with the TEE (hereinafter referred to as TEE) in the TEE data service cluster host. Similarly, other users such as user P j After configuring the data source, you can also jThe client and TEE perform remote attestation. For ease of description, this example sets the user who configures the data source, such as P i and P j , are all owners of the data in the TEE, i.e., the data authorization objects in this example. However, it should be noted that the data authorization object can be implemented not only as the data owner, but also as other forms, such as related entities that can be authorized.

[0082] Based on this, multiple data authorization objects (such as P i and P j ) Perform security verification on TEE through remote attestation, and after the security verification passes, establish a trusted secure channel with TEE. In this example, when establishing a trusted secure channel, establish a session key and the data key component K i (ie data key) is an example, but those skilled in the art should understand that in actual applications, session keys can be used and the data key component K i At any appropriate time before, establish the session key and the data key component K i .

[0083] Any data authorization object such as P i A data query project (a data query consisting of a series of data query statements such as SQL statements) can be created, wherein the data query project can be uploaded to the TEE as a whole or in parts. For example, after remote attestation, using the session key The uploaded data (such as part or all of the data query items) is encrypted to form ciphertext data, and then the data is encrypted through P i The client uploads the encrypted data through a trusted secure channel with TEE. After the encrypted data is uploaded to TEE, TEE is responsible for key distribution and can save the session key. To pass the session key Perform subsequent decryption (symmetric encryption); of course, you can also save the session key The corresponding decryption key is used for subsequent decryption (in the case of asymmetric encryption) and project management of the uploaded data query project.

[0084] TEE can also create a database encryption key K for the data query project DB and use P i The data key component K i Seal K DB , that is, let k = K i , and perform the sealing operation SEAL k (K DB). Among them, the implementation of the specific encryption algorithm can be implemented by those skilled in the art using any appropriate encryption algorithm according to actual needs.

[0085] In addition, any data authorization object such as P i Other data authorization objects such as P j Added to the data query project, TEE applies the data key component K of the two data authorization objects i ,K j Reseal K DB , that is, And perform the sealing operation SEAL k (K DB ).in, Represents the exclusive OR operation.

[0086] Any data authorization object such as P i You can continue to add other data authorization objects. Assume that n data authorization objects are added to the data query project. Each data authorization object P m The key component is K m (where 1<=m<=n), then Seal k (K DB ).

[0087] On the one hand, any data authorization object in the data query project, such as P i SQL Data Definition Language (DDL) can be used to create databases, data tables, and upload raw data in the TEE's DBMS through a trusted and secure channel.

[0088] On the other hand, any data authorization object in the data query project, such as P i SQL query statements described in SQL Data Manipulation Language (DML) can be submitted to TEE through a trusted secure channel. i All data authorization objects in the data query project need to be queried by SQL statement Q i Authorize access.

[0089] For example, any data authorization object in the data query project such as P i Submitted Q i Query request (such as Figure 2C As shown in select count(*)from Ti,Tj where Ti.id=Tj.id), if all data authorization objects are authorized to Q iThe data to be accessed (i.e. the data to be accessed) has been authorized for access, then TEE executes Q i Query and return the query results to P i , otherwise TEE rejects the query.

[0090] In addition, the server with TEE can destroy its TEE, but the data in the database is still stored in encrypted form on the server. When other servers with TEE create TEE, all data authorization objects in the data query project can apply their own data key components and encryption algorithm SEAL k (K DB ) and jointly recover the database encryption key K DB For example, in the case of symmetric encryption, Get a key and then use the key and the encryption algorithm SEAL k (K DB ) Decrypt the database encryption key K DB Thus, in the newly created TEE, the multiple data authorization objects can restore the data in the database and access the data.

[0091] As can be seen from the above, when the solution of the embodiment of the present invention is applied to the database scenario, that is, when a database system (including DBMS and related data files such as data tables, etc.) is set in the TEE, when the device where the TEE is located receives a data access request for data in the database set in the TEE, it can determine all data authorization objects corresponding to the data to be accessed through the DBMS set in the TEE; if it is determined that all data authorization objects corresponding to the data to be accessed have obtained access authorization for the data to be accessed, the operation requested by the data access request is executed through the DBMS, and the operation result is returned. That is, the data access process in the aforementioned embodiment can be applied to the scenario where a database system is set in the TEE, and the corresponding access operation can refer to the description of the relevant part of the aforementioned embodiment, which will not be repeated here.

[0092] Through this embodiment, on the one hand, the above-mentioned secure data query system based on multiple data authorization objects of TEE can be divided into a client and a server. The server only needs to have TEE, and the client does not need the support of TEE, which minimizes the deployment difficulty and security requirements of the client; on the other hand, multiple data authorization objects initiate remote certification to the TEE of the server through the client, and directly establish a trusted secure channel with the TEE after passing. Through this trusted secure channel, data is transmitted to the TEE, access authorization is initiated for approval, query requests are submitted, and query results are obtained. All requests are submitted directly to the TEE via a trusted secure channel, minimizing the attack surface. Thirdly, when the sender of a data access request wishes to perform a data query, they submit the data query request to the server-side TEE. After receiving access authorization from the data authorization object belonging to the data table, the TEE executes the data query in a trusted environment and returns the query results to the sender of the data access request via a trusted secure channel. This enables authorized access to data by multiple data authorization objects through the TEE. Fourthly, if data is stored in plaintext within the TEE, then, without explicit authorization from the data authorization object, the data and intermediate calculation results remain in plaintext only within the TEE. All data outside the TEE must be encrypted by the TEE. This prevents an attacker from obtaining any additional data during the data query without authorization, ensuring that data is available but not visible. This not only improves data security but also avoids incurring additional network bandwidth and computational overhead.

[0093] The data access method of this embodiment can be executed by any appropriate electronic device with data processing capabilities, including but not limited to: a server, a mobile terminal (such as a mobile phone, a PAD, etc.) and a PC.

[0094] Example 3

[0095] Reference Figure 3 , shows a structural block diagram of a data access device according to embodiment 3 of the present invention.

[0096] The data access device of this embodiment includes: a determination module 302, which is used to determine the data authorization object corresponding to the data to be accessed based on a data access request for the data set in the TEE; an access module 304, which is used to execute the operation requested by the data access request if the data authorization object obtains access authorization for the data to be accessed, and return the operation result.

[0097] The data access device of this embodiment is used to implement the corresponding data access methods in the aforementioned multiple method embodiments and has the beneficial effects of the corresponding method embodiments, which will not be described in detail here. In addition, the functional implementation of each module in the data access device of this embodiment can refer to the description of the corresponding parts in the aforementioned method embodiments, which will not be described in detail here.

[0098] Example 4

[0099] Reference Figure 4 , shows a structural block diagram of a data access device according to embodiment 4 of the present invention.

[0100] The data access device of this embodiment includes: a determination module 402, which is used to determine the data authorization object corresponding to the data to be accessed based on a data access request for the data set in the TEE; an access module 404, which is used to execute the operation requested by the data access request if the data authorization object obtains access authorization for the data to be accessed, and return the operation result.

[0101] Optionally, the access module 404 is used to, if the access authorization for the data to be accessed is obtained from the data authorization object, perform the operation requested by the data access request on the data to be accessed in the TEE in plain text; or, if the access authorization for the data to be accessed is obtained from the data authorization object, obtain the data key corresponding to the data authorization object; decrypt the encrypted and stored data to be accessed according to the data key, and perform the operation requested by the data access request after decryption, and return the operation result.

[0102] Optionally, the access module 404 is also used to determine whether all the data to be accessed are stored in the TEE before executing the operation requested by the data access request; if so, execute the operation requested by the data access request; or, if not, after loading the data portion of the data to be accessed stored outside the TEE into the TEE, execute the operation requested by the data access request, wherein the data portion stored outside the TEE is data encrypted according to the data key corresponding to the data authorization object.

[0103] Optionally, the data authorization objects include multiple; when the access module 404 decrypts the encrypted stored data to be accessed according to the data key: an XOR operation is performed on the multiple data keys corresponding to the multiple data authorization objects to generate a data decryption key; and the data decryption key is used to decrypt the encrypted stored data to be accessed.

[0104] Optionally, the determination module 402 is used to determine, based on a data access request for data set in the TEE, that the data to be accessed belongs to multiple data tables; and determine multiple data authorization objects corresponding to the multiple data tables.

[0105] Optionally, the determination module 402 is used to determine, based on a data access request for data set in the TEE, multiple data parts of the data to be accessed belonging to the same data table; and determine multiple data authorization objects corresponding to the multiple data parts.

[0106] Optionally, the data access device of this embodiment also includes: a session module 406, which is used to receive the data access request sent to the TEE through a trusted secure channel between the sender of the data access request and the TEE before the determination module 402 determines the data authorization object corresponding to the data to be accessed based on the data access request for the data set in the trusted execution environment TEE, wherein the data access request is generated after being encrypted using the session key assigned to the sender.

[0107] Optionally, the data access device of this embodiment also includes: an establishment module 408, which is used to establish the trusted secure channel between the sender and the TEE through the trusted secure channel between the session module 406 and the sender of the data access request and the TEE, and before receiving the encrypted data access request and sending it to the TEE, after determining that the security verification of the TEE has passed based on remote proof, establish the trusted secure channel between the sender and the TEE.

[0108] Optionally, when returning the operation result, the access module 404 encrypts the operation result using the session key, and returns the encrypted operation result to the sender through the trusted secure channel.

[0109] Optionally, the data access device of this embodiment also includes: an allocation module 410, which is used to determine the corresponding multiple data authorization objects for the multiple parts of data stored in the TEE before the determination module 402 determines the data authorization object corresponding to the data to be accessed based on the data access request for the data set in the trusted execution environment TEE, and allocate data keys to the determined multiple data authorization objects; use the data key of the data authorization object corresponding to each part of the data to encrypt each part of the data separately.

[0110] Optionally, the data access device of this embodiment also includes: a first update module 412, used to update the data authorization object of the part of the data in the TEE according to a data update request for the part of the data in the TEE; or, a second update module 414, used to update the data authorization object of the part of the data in the TEE according to an update request for the data authorization object of the part of the data in the TEE.

[0111] Optionally, the first update module 412 is used to receive a data update request for part of the data in the TEE; update the part of the data according to the data update request, and if it is determined that the data authorization object of the updated part of the data has changed, assign a data key to the new data authorization object, or destroy the data key of the original data authorization object; use the data key of the updated data authorization object of the part of the data to encrypt the updated part of the data.

[0112] Optionally, the second update module 414 is used to receive an update request from at least one of the existing data authorization objects corresponding to the partial data; update the data authorization object corresponding to the partial data according to the update request, and assign a data key to the updated data authorization object; and use the data key of the updated data authorization object of the partial data to encrypt the partial data.

[0113] Optionally, when the allocation module 410 uses the data key of the data authorization object corresponding to each part of the data to encrypt each part of the data respectively: it performs an XOR operation on the data key of the data authorization object corresponding to each part of the data to generate a data encryption key corresponding to each part of the data; and uses the data encryption key to encrypt each part of the data.

[0114] Optionally, the data access device of this embodiment also includes: a recovery module 416, which is used to obtain the encrypted data exported from the original TEE and create a new TEE for the encrypted data; obtain the data key of the data authorization object corresponding to the encrypted data; use the data key to decrypt the encrypted data, and store the decrypted data into the new TEE.

[0115] Optionally, the TEE is provided in a database management system DBMS, and the data to be accessed is data managed by the DBMS.

[0116] When the data access device of this embodiment is applied to a scenario in which a database system is set in a TEE, the determination module 402 is used to receive a data access request for data in a database set in the TEE; and to determine all data authorization objects corresponding to the data to be accessed through the DBMS set in the TEE; the access module 404 is used to execute the operation requested by the data access request through the DBMS if it is determined that access authorization for the data to be accessed by all data authorization objects has been obtained, and return the operation result.

[0117] The data access device of this embodiment is used to implement the corresponding data access methods in the aforementioned multiple method embodiments and has the beneficial effects of the corresponding method embodiments, which will not be described in detail here. In addition, the functional implementation of each module in the data access device of this embodiment can refer to the description of the corresponding parts in the aforementioned method embodiments, which will not be described in detail here.

[0118] Example 5

[0119] Reference Figure 5 , shows a schematic structural diagram of an electronic device according to embodiment 5 of the present invention. The specific embodiment of the present invention does not limit the specific implementation of the electronic device.

[0120] like Figure 5 As shown, the electronic device may include: a processor (processor) 502 , a communication interface (Communications Interface) 504 , a memory (memory) 506 , and a communication bus 508 .

[0121] in:

[0122] The processor 502 , the communication interface 504 , and the memory 506 communicate with each other via a communication bus 508 .

[0123] The communication interface 504 is used to communicate with other electronic devices or a server.

[0124] The processor 502 is configured to execute the program 510 , and specifically may execute the relevant steps in the above data access method embodiment.

[0125] Specifically, the program 510 may include program codes, which include computer operation instructions.

[0126] Processor 502 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The one or more processors included in a smart device may be processors of the same type, such as one or more CPUs, or processors of different types, such as one or more CPUs and one or more ASICs.

[0127] The memory 506 is used to store the program 510. The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0128] Program 510 can specifically be used to enable the processor 502 to perform the following operations: determine the data authorization object corresponding to the data to be accessed based on a data access request for data set in the trusted execution environment TEE; if access authorization for the data to be accessed is obtained from the data authorization object, execute the operation requested by the data access request and return the operation result.

[0129] In an optional embodiment, the program 510 is also used to enable the processor 502, when executing the operation requested by the data access request: to perform the operation requested by the data access request on the data to be accessed in the TEE in plain text; or, to obtain the data key corresponding to the data authorization object; to decrypt the encrypted and stored data to be accessed according to the data key, and to perform the operation requested by the data access request after decryption.

[0130] In an optional embodiment, the program 510 is also used to enable the processor 502 to determine whether all the data to be accessed are stored in the TEE before executing the operation requested by the data access request; if so, execute the operation requested by the data access request; or, if not, after loading the data portion of the data to be accessed stored outside the TEE into the TEE, execute the operation requested by the data access request, wherein the data portion stored outside the TEE is data encrypted according to the data key corresponding to the data authorization object.

[0131] In an optional embodiment, the data authorization objects include multiple; the program 510 is also used to enable the processor 502 to decrypt the encrypted stored data to be accessed according to the data key: perform an XOR operation on the multiple data keys corresponding to the multiple data authorization objects to generate a data decryption key; and use the data decryption key to decrypt the encrypted stored data to be accessed.

[0132] In an optional embodiment, the program 510 is also used to enable the processor 502 to determine the data authorization object corresponding to the data to be accessed based on a data access request for the data set in the trusted execution environment TEE: determine that the data to be accessed belongs to multiple data tables based on the data access request for the data set in the TEE; and determine multiple data authorization objects corresponding to the multiple data tables.

[0133] In an optional embodiment, the program 510 is also used to enable the processor 502 to determine the data authorization object corresponding to the data to be accessed based on the data access request for the data set in the trusted execution environment TEE: determine that the data to be accessed belongs to multiple data parts of the same data table based on the data access request for the data set in the TEE; and determine multiple data authorization objects corresponding to the multiple data parts.

[0134] In an optional embodiment, the program 510 is also used to enable the processor 502 to encrypt the data access request using a session key assigned to the sender of the data access request before determining the data authorization object corresponding to the data to be accessed based on the data access request for the data set in the trusted execution environment TEE; and send the encrypted data access request to the TEE through a trusted secure channel between the sender and the TEE.

[0135] In an optional embodiment, the program 510 is also used to enable the processor 502 to establish the trusted secure channel between the sender and the TEE after determining that the security verification of the TEE has passed based on remote attestation before sending the encrypted data access request to the TEE through the trusted secure channel between the sender and the TEE.

[0136] In an optional embodiment, the program 510 is further configured to enable the processor 502 to, when returning an operation result, encrypt the operation result using the session key, and return the encrypted operation result to the sender through the trusted secure channel.

[0137] In an optional embodiment, the program 510 is also used to enable the processor 502 to determine multiple data authorization objects corresponding to the multiple parts of data stored in the TEE before determining the data authorization object corresponding to the data to be accessed based on a data access request for the data set in the trusted execution environment TEE, and assign data keys to the determined multiple data authorization objects; use the data keys of the data authorization objects corresponding to each part of the data to encrypt each part of the data separately.

[0138] In an optional embodiment, the program 510 is also used to enable the processor 502 to update the data authorization object of the part of the data in the TEE according to a data update request for the part of the data in the TEE; or, to update the data authorization object of the part of the data in the TEE according to an update request for the data authorization object of the part of the data in the TEE.

[0139] In an optional embodiment, the program 510 is also used to enable the processor 502 to update the data authorization object of part of the data in the TEE according to a data update request for part of the data in the TEE: receive a data update request for part of the data in the TEE; update the part of the data according to the data update request, and if it is determined that the data authorization object of the updated part of the data has changed, assign a data key to the new data authorization object, or destroy the data key of the original data authorization object; use the data key of the updated data authorization object of the part of the data to encrypt the updated part of the data.

[0140] In an optional embodiment, the program 510 is also used to enable the processor 502 to update the data authorization object of part of the data in the TEE based on an update request for the data authorization object of part of the data in the TEE: receive an update request from at least one of the existing data authorization objects corresponding to the part of the data; update the data authorization object corresponding to the part of the data based on the update request, and assign a data key to the updated data authorization object; and use the data key of the updated data authorization object of the part of the data to encrypt the part of the data.

[0141] In an optional embodiment, the program 510 is also used to enable the processor 502 to use the data key of the data authorization object corresponding to each part of the data to encrypt each part of the data separately: perform an XOR operation on the data key of the data authorization object corresponding to each part of the data to generate a data encryption key corresponding to each part of the data; and use the data encryption key to encrypt each part of the data.

[0142] In an optional embodiment, the program 510 is also used to enable the processor 502 to obtain encrypted data exported from the original TEE and create a new TEE for the encrypted data; obtain the data key of the data authorization object corresponding to the encrypted data; use the data key to decrypt the encrypted data, and store the decrypted data in the new TEE.

[0143] In an optional embodiment, the TEE is provided in a database management system DBMS, and the data to be accessed is data managed by the DBMS.

[0144] The specific implementation of each step in program 510 can be found in the corresponding descriptions of the corresponding steps and units in the above-mentioned data access method embodiment, and will not be repeated here. Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding process descriptions in the above-mentioned method embodiment, and will not be repeated here.

[0145] Through the electronic device of this embodiment, on the one hand, the data is set in the trusted execution environment TEE. Due to the security characteristics of the TEE itself, the security of the data can be improved to a certain extent. On the other hand, when accessing the data in the TEE, the access authorization of the data authorization object of the data to be accessed is required. Therefore, for data that is not from the party or involves multiple data authorization objects, the data authorization object can authenticate and authorize the data access requester, so that the data corresponding to each data authorization object can be accessed, further improving data security. In addition, during the data access process of the embodiment of the present invention, there is no need to repeatedly perform secure communications and cryptographic multi-party computations related to data access, thereby avoiding the resulting network bandwidth overhead and computing overhead.

[0146] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present invention can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present invention.

[0147] The method according to the embodiment of the present invention described above can be implemented in hardware, firmware, or can be implemented as software or computer code that can be stored in a recording medium (such as CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or can be implemented as computer code that is originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded via a network and will be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a special-purpose processor or programmable or special-purpose hardware (such as ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the data access method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the data access method shown here, the execution of the code converts the general-purpose computer into a special-purpose computer for executing the data access method shown here.

[0148] Those skilled in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present invention.

[0149] The above implementation methods are only used to illustrate the embodiments of the present invention, and are not intended to limit the embodiments of the present invention. Ordinary technicians in the relevant technical field may make various changes and modifications without departing from the spirit and scope of the embodiments of the present invention. Therefore, all equivalent technical solutions also fall within the scope of the embodiments of the present invention, and the scope of patent protection of the embodiments of the present invention should be defined by the claims.

Claims

1. A data access method, comprising: Determining, based on a data access request for data set in a trusted execution environment (TEE), a plurality of data authorization objects corresponding to the data to be accessed, the data to be accessed being stored inside the trusted execution environment (TEE) and outside the trusted execution environment (TEE); If the access authorization to the data to be accessed is obtained from the data authorization object, the operation requested by the data access request is executed and the operation result is returned; Before determining the data authorization object corresponding to the data to be accessed based on the data access request for the data set in the trusted execution environment TEE, the method further includes: Determine multiple data authorization objects corresponding to the multiple parts of data stored in the TEE, and assign data keys to the determined multiple data authorization objects; Use the data key of the data authorization object corresponding to each part of the data to encrypt each part of the data; The method of using the data key of the data authorization object corresponding to each part of the data to encrypt each part of the data includes: Perform exclusive OR operations on the data keys of the data authorization objects corresponding to each part of the data to generate data encryption keys corresponding to each part of the data; Each portion of data is encrypted using the data encryption key.

2. The method according to claim 1, wherein The executing the operation requested by the data access request includes: Execute the operation requested by the data access request on the data to be accessed in the TEE in plain text; Alternatively, a data key corresponding to the data authorization object is obtained; the encrypted stored data to be accessed is decrypted according to the data key, and the operation requested by the data access request is executed after decryption.

3. The method according to claim 2, wherein: Before executing the operation requested by the data access request, the method further includes: Determine whether all the data to be accessed is stored in the TEE; If so, executing the operation requested by the data access request; Alternatively, if not, after loading the data portion stored outside the TEE in the data to be accessed into the TEE, the operation requested by the data access request is performed, wherein the data portion stored outside the TEE is data encrypted according to the data key corresponding to the data authorization object.

4. The method according to claim 2 or 3, wherein: Decrypting the encrypted stored data to be accessed according to the data key includes: Performing an XOR operation on multiple data keys corresponding to multiple data authorization objects to generate a data decryption key; The encrypted stored data to be accessed is decrypted using the data decryption key.

5. The method according to any one of claims 1 to 3, wherein: The step of determining a data authorization object corresponding to the data to be accessed based on a data access request for data set in a trusted execution environment (TEE) includes: According to a data access request for data set in the TEE, determining that the data to be accessed belongs to multiple data tables; Determine a plurality of data authorization objects corresponding to the plurality of data tables.

6. The method according to any one of claims 1 to 3, wherein: The step of determining a data authorization object corresponding to the data to be accessed based on a data access request for data set in a trusted execution environment (TEE) includes: Determining, based on a data access request for data set in the TEE, whether the data to be accessed belongs to multiple data parts of the same data table; Determine a plurality of data authorization objects corresponding to the plurality of data parts.

7. The method according to any one of claims 1 to 3, wherein: Before determining the data authorization object corresponding to the data to be accessed according to the data access request for the data set in the trusted execution environment TEE, the method further includes: The data access request sent to the TEE is received through a trusted secure channel between the sender of the data access request and the TEE, wherein the data access request is generated after being encrypted using a session key assigned to the sender.

8. The method according to claim 7, wherein: Before receiving the data access request sent to the TEE through the trusted secure channel between the sender of the data access request and the TEE, the method further includes: After determining that the security verification of the TEE has passed according to remote attestation, the trusted secure channel is established between the sender and the TEE.

9. The method according to claim 8, wherein The returned operation result includes: The operation result is encrypted using the session key, and the encrypted operation result is returned to the sender through the trusted secure channel.

10. The method according to claim 1, wherein The method further comprises: updating a data authorization object of the portion of data in the TEE according to a data update request for the portion of data in the TEE; Alternatively, according to an update request for the data authorization object of the partial data in the TEE, the data authorization object of the partial data in the TEE is updated.

11. The method according to claim 10, wherein: The updating of the data authorization object of the part of the data in the TEE according to the data update request for the part of the data in the TEE includes: Receiving a data update request for a portion of the data in the TEE; updating the portion of data according to the data update request, and if it is determined that the data authorization object of the updated portion of data has changed, allocating a data key to the new data authorization object, or destroying the data key of the original data authorization object; The updated partial data is encrypted using the data key of the data authorization object of the updated partial data.

12. The method according to claim 10, wherein: The updating of the data authorization object of the portion of data in the TEE according to the update request for the data authorization object of the portion of data in the TEE includes: receiving an update request from at least one of the existing data authorization objects corresponding to the portion of data; According to the update request, the data authorization object corresponding to the portion of data is updated, and a data key is assigned to the updated data authorization object; The updated data key of the data authorization object of the partial data is used to encrypt the partial data.

13. The method according to any one of claims 11 to 12, wherein: The method further comprises: Get the encrypted data exported from the original TEE and create a new TEE for the encrypted data; Obtaining the data key of the data authorization object corresponding to the encrypted data; The encrypted data is decrypted using the data key, and the decrypted data is stored in the new TEE.

14. The method according to claim 1, wherein The TEE is provided with a database management system DBMS, and the data to be accessed is data managed by the DBMS.

15. A data access method, comprising: Receiving a data access request for data in a database set in a trusted execution environment (TEE); Determining, by a database management system DBMS provided in the TEE, a plurality of data authorization objects corresponding to data to be accessed, the data to be accessed being stored inside the trusted execution environment TEE and outside the trusted execution environment TEE; If it is determined that access authorization to the data to be accessed has been obtained from all data authorization objects, the operation requested by the data access request is executed through the DBMS, and the operation result is returned; Before determining, by the database management system DBMS provided in the TEE, the data authorization object corresponding to the data to be accessed, the method further includes: Determine multiple data authorization objects corresponding to the multiple parts of data stored in the TEE, and assign data keys to the determined multiple data authorization objects; Use the data key of the data authorization object corresponding to each part of the data to encrypt each part of the data; The method of using the data key of the data authorization object corresponding to each part of the data to encrypt each part of the data includes: Perform exclusive OR operations on the data keys of the data authorization objects corresponding to each part of the data to generate data encryption keys corresponding to each part of the data; Each portion of data is encrypted using the data encryption key.

16. A data access device comprising: a determination module, configured to determine, based on a data access request for data set in a trusted execution environment (TEE), a plurality of data authorization objects corresponding to data to be accessed, the data to be accessed being stored inside the trusted execution environment (TEE) and outside the trusted execution environment (TEE); an access module, configured to execute the operation requested by the data access request and return an operation result if access authorization to the data to be accessed is obtained from the data authorization object; an allocation module, configured to determine, before determining, based on a data access request for data set in a trusted execution environment (TEE), a data authorization object corresponding to the data to be accessed, a plurality of data authorization objects corresponding to the plurality of parts of data stored in the TEE, and allocate data keys to the determined plurality of data authorization objects; Use the data key of the data authorization object corresponding to each part of the data to encrypt each part of the data; The distribution module is also used to perform exclusive OR operations on the data keys of the data authorization objects corresponding to each portion of data when encrypting each portion of data respectively using the data keys of the data authorization objects corresponding to each portion of data to generate data encryption keys corresponding to each portion of data; and use the data encryption keys to encrypt each portion of data.

17. An electronic device comprising: A processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the data access method according to any one of claims 1 to 14, or to perform an operation corresponding to the data access method according to claim 15.

18. A computer storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the program implements the data access method according to any one of claims 1 to 14, or executes the data access method according to claim 15.

Images