Remote attestation report processing method, database server and database client

Abstract

This application proposes a method for processing remote attestation reports, a database server, and a database client. The method comprises: obtaining a request statement related to the remote attestation report from the database client; executing a preset function corresponding to the request statement to call an interface of a first TEE remote attestation SDK to obtain a processing result related to the remote attestation report; and sending the processing result to the database client. Embodiments of this application can reduce the difficulty of developing and applying remote attestation functions.

Description

Technical Field

[0001] The present application relates to the field of cloud computing, and in particular to a remote attestation report processing method, a database server, and a database client. Background Art

[0002] Remote attestation is an essential technology for TEE (Trusted Execution Environment) confidential computing. Before users can access cloud environments, they must use remote attestation to negotiate keys and establish a secure and trusted computing environment. Currently, the primary focus of cloud-based confidential computing applications is privacy-focused computing, which involves analyzing and processing sensitive data within a TEE environment. Data providers and users in privacy-focused computing require remote attestation technology to verify databases to ensure data security and the authenticity of computational results.

[0003] In related technologies, the functions of TEE remote attestation are generally implemented by calling TEE remote attestation SDK (Software Development Kit), which has the problem of great difficulty in development and application. Summary of the Invention

[0004] The present application provides a method for processing a remote attestation report, a database server, and a database client to solve the problems existing in related technologies. The technical solution is as follows:

[0005] In a first aspect, an embodiment of the present application provides a method for processing a remote attestation report, which is applied to a database server, comprising:

[0006] Obtaining a request statement related to a remote proof report from a database client;

[0007] Execute the preset function corresponding to the request statement to call the interface of the first TEE remote attestation SDK to obtain the processing result related to the remote attestation report;

[0008] Send processing results to the database client.

[0009] In a second aspect, an embodiment of the present application provides a method for processing a remote attestation report, which is applied to a database client, and the method includes:

[0010] Sending a request statement related to the remote attestation report to the database server; wherein the request statement is used to instruct the database server to call the interface of the first TEE remote attestation SDK using the preset function corresponding to the request statement to obtain the processing result related to the remote attestation report;

[0011] Get the processing result returned by the database server.

[0012] In a third aspect, an embodiment of the present application provides a database server, including:

[0013] A first acquisition module is used to acquire a request statement related to a remote attestation report from a database client;

[0014] A first processing module is configured to execute a preset function corresponding to the request statement to call an interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report;

[0015] The first sending module is used to send the processing result to the database client.

[0016] In a fourth aspect, an embodiment of the present application provides a database client, including:

[0017] A second sending module is configured to send a request statement related to the remote attestation report to the database server; wherein the request statement is used to instruct the database server to execute a preset function corresponding to the request statement to call the interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report;

[0018] The second acquisition module is used to obtain the processing result returned by the database server.

[0019] In a fifth aspect, an embodiment of the present application provides a database server, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor implements the method provided in any embodiment of the present application when executing the computer program.

[0020] In a sixth aspect, an embodiment of the present application provides a database client, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor implements the method provided in any embodiment of the present application when executing the computer program.

[0021] In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method provided in any embodiment of the present application is implemented.

[0022] The technical solution of the embodiment of this application pre-sets a function for calling the TEE remote attestation SDK interface on the database server, so that the database client can trigger this function using the corresponding request statement to implement the call to the TEE remote attestation SDK interface. That is, the preset function interface is encapsulated on the underlying TEE remote attestation SDK, allowing users to call and execute it through the request statement corresponding to the function. The database client does not need to use the TEE function primitives defined by a specific hardware manufacturer to call the TEE remote attestation SDK interface, thereby reducing the difficulty of developing and applying the remote attestation function.

[0023] The above summary is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features of the present application will be readily apparent by reference to the accompanying drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar components or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments disclosed in this application and should not be construed as limiting the scope of this application.

[0025] Figure 1 Schematic diagram of a privacy computing scenario for implementing the remote attestation report processing method of an embodiment of the present application;

[0026] Figure 2 is a flowchart of a method for processing a remote attestation report according to an embodiment of the present application;

[0027] Figure 3 is a flowchart of a method for processing a remote attestation report according to another embodiment of the present application;

[0028] Figure 4 is a general architecture diagram of a method for processing a remote attestation report according to an embodiment of the present application;

[0029] Figure 5 This is a structural block diagram of a database server according to an embodiment of the present application;

[0030] Figure 6 is a structural block diagram of a database client according to an embodiment of the present application;

[0031] Figure 7 It is a structural block diagram of an electronic device used to implement the remote proof report processing method of the embodiment of the present application. DETAILED DESCRIPTION

[0032] Hereinafter, only certain exemplary embodiments are briefly described. As will be appreciated by those skilled in the art, the described embodiments may be modified in various ways without departing from the spirit or scope of the present application. Therefore, the drawings and description are to be regarded as illustrative in nature and not restrictive.

[0033] In order to more clearly demonstrate the remote certification report processing method provided in the embodiment of the present application, the application scenario of the method is first introduced.

[0034] For example, the remote attestation report processing method of the embodiment of the present application can be applied to privacy computing scenarios, that is, analyzing and processing sensitive data in a TEE environment. In a privacy computing scenario, multiple participants collaborate to conduct joint analysis and joint machine learning on their data without disclosing their respective data. The multi-party data is encrypted, transmitted, and stored in the TEE, and the database engine in the TEE provides SQL (Structured Query Language) query functions, using TEE to achieve the confidentiality and availability of multi-party data.

[0035] Figure 1 A schematic diagram of a privacy computing scenario is shown. Figure 1 As shown in Figure 2, the privacy computing scenario includes a database client and a database server.

[0036] The database server is used to manage and control the database for privacy computing, meaning it serves as the database management backend. The database server configures a database engine based on TEE technology to provide SQL query capabilities. Specifically, a physically isolated code execution environment, such as an enclave, is created within the database server based on TEE technology. The database engine runs within this environment. Database clients provide data to or retrieve data from the database. For example, database clients can be data providers or data users.

[0037] In practical applications, the database client needs to remotely attest to the database engine in the database server. Remote attestation refers to a technology in which a computing system (prover) proves its software / hardware configuration and status to a remote system (verifier).

[0038] For example, data providers need to remotely attest to the database engine in the TEE to establish trust and protect their data security. Data consumers also need to remotely attest to the database engine in the TEE to confirm the authenticity of the data. Specifically, the data provider or data consumer can initiate remote attestation with the database server to obtain / verify the remote attestation report, and use the remote attestation report to determine the software / hardware configuration and status of the database engine, thereby establishing trust.

[0039] The TEE Remote Attestation SDK provides TEE remote attestation functionality. Generally, developers must invoke the TEE Remote Attestation SDK's interfaces using vendor-defined functional primitives. For example, in some scenarios, these interfaces must be invoked using compiled C / C++ languages, which are unable to accommodate the client's online editing and debugging needs, thus increasing the difficulty of developing and implementing remote attestation functionality.

[0040] The technical solutions of the embodiments of this application are mainly to solve the above-mentioned technical problems. In order to enable a more detailed understanding of the features and technical content of the embodiments of this application, the implementation of the embodiments of this application is described in detail below in conjunction with the accompanying drawings. The accompanying drawings are for reference only and are not intended to limit the embodiments of this application.

[0041] Figure 2 FIG. 1 is a flow chart showing a method for processing a remote attestation report according to an embodiment of the present application. Figure 2 As shown, the method may include:

[0042] S210, obtaining a request statement related to a remote attestation report from a database client;

[0043] S220: Execute a preset function corresponding to the request statement to call the interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report;

[0044] S230: Send the processing result to the database client.

[0045] The above method can be applied to the database server, for example Figure 1 The database server shown. Optionally, an extension module can be created based on the extension capability of the database engine in the database server, and the above method can be implemented using the extension module. Exemplarily, the extension module is used to connect to the database client and receive request statements. In addition, the above preset function is set in the extension module, and the preset function is used to call the interface of the first TEE remote attestation SDK. In other words, the above method can be implemented based on the extension capability of the database engine, and the interface of the TEE remote attestation SDK can be called by triggering the preset function.

[0046] Exemplarily, the database engine in the above-mentioned database server may include a PostgreSQL database engine or an SQLite database engine that supports extension.

[0047] In an embodiment of the present application, a remote attestation report is used to prove the execution environment of the database engine. Exemplarily, the remote attestation report can be obtained based on the physical version information of the CPU, software version information, operating environment information of a trusted container (such as an enclave), measurement values, etc. The client can determine whether the execution environment of the database engine is trustworthy through the remote attestation report. For example, by verifying the remote attestation report, if the verification passes, it is determined that the execution environment of the database engine is trustworthy, and if the verification fails, it is determined that the execution environment of the database engine is untrustworthy.

[0048] Exemplarily, the request statement related to the remote attestation report is used to indicate the database client's processing requirements for the remote attestation report. The processing requirements may include obtaining a remote attestation report, verifying a remote attestation report, etc. Accordingly, the request statement in the embodiment of the present application may include a report generation statement for obtaining a remote attestation report and / or a report verification statement for verifying a remote attestation report. In the embodiment of the present application, the preset function corresponding to the above-mentioned request statement may be a function provided by the extension capability / extension module of the database engine for implementing the relevant processing procedures of the remote attestation report. Exemplarily, the preset function may include a remote attestation generation function (RaQuoteGenerate) corresponding to the report generation statement, and / or a remote attestation verification function (RaQuoteVerify) corresponding to the report verification statement.

[0049] In an embodiment of the present application, a request statement is used to trigger a preset function. By configuring the preset function, the database client can use the function's interface language to write a request statement, thereby facilitating the client's use of remote attestation related functions. Exemplarily, the above-mentioned request statement can be written in an interpreted language. Specifically, by configuring the preset function as a function that can be triggered by an interpreted language, the database client can use the request statement written in the interpreted language to obtain processing results related to the remote attestation report. Since the interpreted language does not need to be pre-compiled before running, it is easier to edit, modify, and debug, which can reduce the difficulty of application. For example, the above-mentioned preset function can be a SQL UDF (User-defined Functions, user-defined function), and the request statement can be a SQL statement, thereby providing a remote attestation-related interface with a user-understandable SQL UDF function. That is, no matter what interface the TEE remote attestation SDK of the database server adopts, it is encapsulated as a unified function interface to shield the differences in the underlying programming language.

[0050] Specifically, the report generation statement can indicate the remote proof generation function, and the report verification statement can indicate the remote proof verification function, so that the database server can accurately implement the corresponding functions. For example, the report generation statement can be the SQL statement "SELECT RaQuoteGenerate(challengeNumber)as report" (select the remote proof generation function to obtain the report), and the report verification statement can be the SQL statement "SELECT RaQuoteVerify(ra_report) (select the remote proof verification function)".

[0051] In an embodiment of the present application, the first TEE remote attestation SDK can be a native SDK provided by the TEE hardware manufacturer, which is used to provide processing capabilities related to remote attestation reports, such as generating remote attestation reports and / or verifying remote attestation reports. According to the above step S220, the preset function is used to call the interface of the first TEE remote attestation SDK to obtain processing results related to remote attestation reports, for example, obtaining the result of generating a remote attestation report (i.e., obtaining a remote attestation report) or obtaining a verification result of the remote attestation report (i.e., obtaining an indication of whether the verification passed or failed).

[0052] According to the above description, in some example scenarios, users can execute SQL statements on the client, and the database server obtains the SQL statements based on the SQL execution gateway, thereby executing the corresponding SQL UDF, calling the TEE remote attestation SDK in the function implementation, and obtaining the relevant processing results of the remote attestation report based on the SQL statements.

[0053] As can be seen, the method provided in the embodiments of this application uses a preset function to call the TEE remote attestation SDK interface. This encapsulates the underlying TEE remote attestation SDK into a functional user interface, shielding the SDK's underlying implementation details and allowing users to call and execute the corresponding function statements. This facilitates the use of interpreted languages ​​to call TEE remote attestation functions, eliminating the need for pre-compilation and enabling online modification of code logic, thereby reducing the difficulty of developing and applying remote attestation functions.

[0054] Optionally, in an exemplary embodiment, the above step S220, executing a preset function corresponding to the request statement to call the interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report, includes:

[0055] Execute the remote attestation generation function corresponding to the report generation statement to call the interface of the first TEE remote attestation SDK to obtain the remote attestation report returned by the interface; wherein, the first TEE remote attestation SDK is used to generate a remote attestation report based on the execution environment of the database engine in the database server.

[0056] This exemplary embodiment describes the process of obtaining a remote attestation report based on a report generation statement. The remote attestation generation function is used to obtain the remote attestation report through the interface of the TEE remote attestation SDK. Exemplarily, the above process may include: creating a user table for storing remote attestation reports; using the remote attestation generation function to call the interface of the first TEE remote attestation SDK to obtain the generated remote attestation report, and inserting the remote attestation report into the table, thereby providing the remote attestation report in the form of a user table.

[0057] Optionally, the remote attestation report can be a report of a preset data type. For example, the data type of the remote attestation report is a byte array (ByteArray, BYTEA) or a binary data block (BLOB). Specifically, for a PostgreSQL database, the data type of the remote attestation report is BYTEA. For an SQLite database, the data type of the remote attestation report is BLOB. By defining a data type to describe the data structure of the remote attestation report, it is convenient for users / clients to store and export the remote attestation report, and it is convenient for users / clients to parse and verify the remote attestation report by themselves.

[0058] Optionally, in an exemplary embodiment, the above step S220, executing a preset function corresponding to the request statement to call the interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report, may also include:

[0059] Execute the remote attestation verification function corresponding to the report verification statement to call the interface of the first TEE remote attestation SDK to obtain the verification result of the remote attestation report returned by the interface; wherein, the first TEE remote attestation SDK is used to verify the remote attestation report.

[0060] Among them, the remote attestation report to be verified can be a remote attestation report obtained using the above-mentioned remote attestation generation function. That is to say, after obtaining the remote attestation report, the remote attestation report can be verified on the database server by executing the report verification statement, thereby eliminating the need for verification on the client. In specific implementation, the remote attestation report can be verified by checking the data integrity of the remote attestation report. For example, the first TEE remote attestation SDK generates a remote attestation report based on random parameters and the execution environment of the database engine. The remote attestation report can be verified by determining whether the remote attestation report contains complete random parameters.

[0061] For example, the verification result of the remote attestation report can be a structured indication information, such as 0 for verification pass and non-0 for verification failure. In this way, the underlying verification process is shielded and the user can directly read the verification result.

[0062] Alternatively, a remote attestation report can be generated with a preset data type, such as BYTEA or BLOB, so that the remote attestation report can be verified without calling the first TEE remote attestation SDK. For example, the remote attestation report can be verified using the data verification function / module of the database engine to obtain the verification result of the remote attestation report.

[0063] For the client, it can obtain the execution result related to the remote proof report by executing the request statement, such as obtaining the remote proof report, or obtaining the verification result of the remote proof report. Optionally, the client can also verify the remote proof report by itself. Specifically, the embodiment of the present application also provides a method for processing the remote proof report, such as Figure 3 As shown, the method is applied to a database client, and the method includes:

[0064] S310. Send a request statement related to the remote attestation report to the database server; wherein the request statement is used to instruct the database server to execute the SQL function corresponding to the request statement to call the interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report;

[0065] S320: Obtain the processing result returned by the database server.

[0066] In one example, the request statement includes a report generation statement for obtaining a remote attestation report; the processing result includes a remote attestation report generated based on the execution environment of the database engine in the database server. In other words, the client executes the report generation statement to send the report generation statement to the database server, and the database server uses the function indicated by the report generation statement to call the interface of the first TEE remote attestation SDK, thereby obtaining the remote attestation report generated by the first TEE remote attestation SDK based on the current execution environment of the database engine, and returns the remote attestation report to the database client.

[0067] Optionally, the database client may choose to verify the remote attestation report in the database server, or may choose to verify the remote attestation report in the database client.

[0068] Illustratively, the above method may further include:

[0069] Call the interface of the second TEE remote attestation SDK to obtain the verification result of the remote attestation report returned by the interface; wherein the second TEE remote attestation SDK is used to verify the remote attestation report.

[0070] The second TEE remote attestation SDK can be a native SDK provided by the TEE hardware manufacturer and deployed on the database client. This SDK can be used to verify the remote attestation report. In other words, the database client can verify the remote attestation report by calling the native SDK interface.

[0071] Illustratively, the above method may further include:

[0072] The remote certification report is verified using a data verification module in the database client to obtain a verification result for the remote certification report.

[0073] The remote certification report may be a report of a preset data type, and thus the database client may utilize the data verification module therein, that is, utilize the database's own data verification function to verify the remote certification report.

[0074] The specific implementation of each information used in the above method can refer to the technical details of the above embodiment and will not be repeated here.

[0075] In order to more clearly present the technical ideas of the remote proof report processing method provided in the embodiment of this application, a specific application example is provided below using SQL statements as an example. Figure 4 The overall architecture diagram of this application example is shown in FIG. Figure 4 As shown, a trusted database client can obtain a remote attestation report by executing a first SQL statement (a report generation statement). The SQL execution gateway in the trusted database server receives the first SQL statement and transmits it to the TEE secure enclave. Within the TEE secure enclave, a remote attestation extension module is built based on the database engine's extension capabilities, which provides a remote attestation user-defined function (UDF). The remote attestation UDF can call interfaces of various TEE remote attestation SDKs, including those corresponding to TEEs provided by different hardware. Examples of TEEs provided by different hardware include SGX (Software Guard Extensions), TDX (Trust Domain Extensions), SEV (Secure Encrypted Virtualization), and TrustZone. By calling the TEE remote attestation SDK interface, a remote attestation report can be obtained. Based on the remote attestation report, the trusted database client can export the remote attestation report and verify it locally on the user's side. Alternatively, the remote attestation report can be verified on the server side by executing a second SQL statement (a report verification statement). The process of verifying the remote attestation report on the server is similar to the process of obtaining the remote attestation report described above. Both are triggered by SQL statements and implemented based on SQL UDFs, so they will not be detailed here. Verifying the report locally on the user side can be achieved through the remote attestation report verification library, which can call the interface of each TEE remote attestation SDK.

[0076] Specifically, the technical details of this application example can be referred to the following description.

[0077] In the first aspect of this application example, a new data type is defined to describe a remote attestation report.

[0078] Specifically, the data type of Remote Attestation Report (RA_REPORT) is defined as follows:

[0079] (1) In the PostgreSQL database, the data type of RA_REPORT is defined as BYTEA (byte array).

[0080] (2) In the SQLite database, the data type of RA_REPORT is defined as BLOB (binary data block).

[0081] The second aspect of this application example is to create a remote proof extension to provide a remote proof SQL UDF.

[0082] Specifically, the remote proof SQL UDF includes:

[0083] (1) Remote proof generation function: RaQuoteGenerate(BYTEA challenge_data);

[0084] This function calls the TEE remote attestation SDK interface to generate a remote attestation report and returns a remote attestation report of the RA_REPORT data type.

[0085] (2) Remote attestation verification function: int RaQuoteVerify(RA_REPORT);

[0086] This function calls the TEE remote attestation SDK interface to verify the remote attestation report and returns the verification result.

[0087] A verification result of 0 indicates that the verification is successful, and a non-zero verification result indicates that the verification fails / is not successful.

[0088] The third aspect of this application example uses PostgreSQL syntax as an example to provide examples of obtaining and verifying remote attestation reports.

[0089] (1) Obtaining a remote attestation report includes the following steps:

[0090] Create a user table to store remote attestation reports;

[0091] Generates and inserts remote attestation report into table.

[0092] (2) Verify the remote attestation report, which can be achieved by executing the SQL statement "SELECT RaQuoteVerify(ra_report)as VerificationResult".

[0093] Fourthly, users can read the RA_REPORT data and verify the remote attestation report themselves, including using the native SDK provided by the TEE manufacturer or the database data verification function for verification.

[0094] In this application example, the database engine extension is leveraged to encapsulate the TEE remote attestation functionality within the extension. This provides an interface for generating and verifying remote attestation reports in the form of SQL UDF functions, which users can call and execute within SQL statements. New data types are also defined to describe the data structure of remote attestation reports, facilitating their storage and export. This application example leverages the characteristics of an interpreted language, eliminating the need for pre-compilation and enabling online code logic modification, making development and debugging easier.

[0095] Corresponding to the application scenario and method of the method provided in the embodiment of the present application, the embodiment of the present application also provides a database server. Figure 5 , the database server can include:

[0096] A first acquisition module 510 is configured to acquire a request statement related to a remote attestation report from a database client;

[0097] The first processing module 520 is configured to execute a preset function corresponding to the request statement to call the interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report;

[0098] The first sending module 530 is configured to send the processing result to the database client.

[0099] Optionally, the first processing module 520 is specifically configured to:

[0100] Execute the remote attestation generation function corresponding to the report generation statement to call the interface of the first TEE remote attestation SDK to obtain the remote attestation report returned by the interface; wherein, the first TEE remote attestation SDK is used to generate a remote attestation report based on the execution environment of the database engine in the database server.

[0101] Optionally, the data type of the remote attestation report is a byte array or a binary data block.

[0102] Optionally, the first processing module 520 is specifically configured to:

[0103] Execute the remote attestation verification function corresponding to the report verification statement to call the interface of the first TEE remote attestation SDK to obtain the verification result of the remote attestation report returned by the interface; wherein, the first TEE remote attestation SDK is used to verify the remote attestation report.

[0104] Among them, the functions of each module can be found in the corresponding description in the above method, and have corresponding beneficial effects, which will not be repeated here.

[0105] The embodiment of the present application also provides a database client. Figure 6 , database clients can include:

[0106] A second sending module 610 is configured to send a request statement related to the remote attestation report to the database server. The SQL statement is configured to instruct the database server to execute a preset function corresponding to the request statement, thereby invoking an interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report.

[0107] The second acquisition module 620 is used to obtain the processing result returned by the database server.

[0108] Optionally, the request statement includes a report generation statement for obtaining a remote attestation report; and the processing result includes a remote attestation report generated based on the execution environment of the database engine in the database server.

[0109] Optionally, the database client may also include:

[0110] The second processing module is used to call the interface of the second TEE remote attestation SDK to obtain the verification result of the remote attestation report returned by the interface; wherein, the second TEE remote attestation SDK is used to verify the remote attestation report.

[0111] Optionally, the database client may also include:

[0112] The third processing module is used to verify the remote certification report using the data verification module in the database client to obtain a verification result for the remote certification report.

[0113] Among them, the functions of each module can be found in the corresponding description in the above method, and have corresponding beneficial effects, which will not be repeated here.

[0114] The embodiment of the present application further provides an electronic device for implementing the above method, such as the above database server or database client. Figure 7 FIG. 1 shows a structural block diagram of an electronic device according to an embodiment of the present application. Figure 7 As shown, the electronic device includes a memory 710 and a processor 720. The memory 710 stores a computer program that can be executed on the processor 720. When the processor 720 executes the computer program, it implements the method for processing remote attestation reports in the above embodiment. The number of memory 710 and processor 720 can be one or more.

[0115] The electronic device also includes:

[0116] The communication interface 730 is used to communicate with external devices and perform data exchange transmission.

[0117] If the memory 710, processor 720, and communication interface 730 are implemented independently, the memory 710, processor 720, and communication interface 730 can be connected to each other via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0118] Optionally, in a specific implementation, if the memory 710, the processor 720 and the communication interface 730 are integrated on a chip, the memory 710, the processor 720 and the communication interface 730 can communicate with each other through an internal interface.

[0119] An embodiment of the present application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the method provided in any embodiment of the present application.

[0120] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the method provided in any embodiment of the present application.

[0121] An embodiment of the present application also provides a chip, which includes a processor for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes the method provided in the embodiment of the present application.

[0122] An embodiment of the present application also provides a chip, including: an input interface, an output interface, a processor and a memory. The input interface, the output interface, the processor and the memory are connected through an internal connection path. The processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method provided in the embodiment of the application.

[0123] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor that supports the Advanced RISC Machines (ARM) architecture.

[0124] Furthermore, optionally, the above-mentioned memory may include a read-only memory and a random access memory, and may also include a non-volatile random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct rambus random access memory (DR RAM).

[0125] In the above embodiments, all or part of the embodiments may be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions according to the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0126] In the description of this specification, the reference terms "one embodiment," "some embodiments," "example," "specific example," or "some examples" mean that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials, or characteristics described may be combined in any appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification, as well as features of different embodiments or examples, unless they are mutually inconsistent.

[0127] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. Throughout the description of this application, "plurality" means two or more, unless otherwise specifically defined.

[0128] Any process or method description in a flow chart or otherwise described herein can be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a specific logical function or process. The scope of the preferred embodiments of the present application includes additional implementations in which the functions may be performed in a different order than shown or discussed, including in a substantially simultaneous manner or in a reverse order depending on the functions involved.

[0129] The logic and / or steps represented in the flowchart or otherwise described herein may be considered, for example, as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device).

[0130] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above embodiment method can be completed by instructing the relevant hardware through a program, which can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0131] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing module, or each unit may exist physically separately, or two or more units may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or in the form of software functional modules. If the aforementioned integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may also be stored in a computer-readable storage medium. The storage medium may be a read-only memory, a magnetic disk, or an optical disk, etc.

[0132] The above are only specific embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily conceive of various modifications or substitutions within the technical scope disclosed in this application, and such modifications or substitutions should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for processing a remote attestation report, applied to a database server, wherein: The database server is a database used to manage privacy computing, including: Obtaining a request statement related to a remote proof report from a database client; Executing a preset function corresponding to the request statement to call an interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report; the preset function is set in an extension module created based on the extension capability of the database engine in the database server; the interface is an interface corresponding to the preset function encapsulated in the first TEE remote attestation SDK; The processing result is sent to the database client.

2. The method according to claim 1, wherein The request statement includes a report generation statement for obtaining a remote attestation report; and executing a preset function corresponding to the request statement to call an interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report includes: Execute the remote attestation generation function corresponding to the report generation statement to call the interface of the first TEE remote attestation SDK to obtain the remote attestation report returned by the interface; wherein, the first TEE remote attestation SDK is used to generate the remote attestation report based on the execution environment of the database engine in the database server.

3. The method according to claim 2, wherein: The data type of the remote attestation report is a byte array or a binary data block.

4. The method according to claim 1, wherein The request statement includes a report verification statement for requesting verification of a remote attestation report; and executing a preset function corresponding to the request statement to call an interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report includes: Execute the remote attestation verification function corresponding to the report verification statement to call the interface of the first TEE remote attestation SDK to obtain the verification result of the remote attestation report returned by the interface; wherein, the first TEE remote attestation SDK is used to verify the remote attestation report.

5. The method according to any one of claims 1 to 4, wherein The request statement is an SQL statement, and the preset function is an SQL user-defined function.

6. A method for processing a remote attestation report, applied to a database client, the method comprising: Sending a request statement related to a remote attestation report to a database server; wherein the request statement is used to instruct the database server to execute a preset function corresponding to the request statement to call an interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report; the preset function is set in an extension module created based on the extension capability of the database engine in the database server; the interface is an interface corresponding to the preset function encapsulated in the first TEE remote attestation SDK; Obtain the processing result returned by the database server, wherein the database server is a database used to manage privacy computing.

7. The method according to claim 6, wherein: The request statement includes a report generation statement for obtaining a remote attestation report; the processing result includes a remote attestation report generated based on the execution environment of the database engine in the database server.

8. The method according to claim 7, wherein: The method further comprises: Call the interface of the second TEE remote attestation SDK to obtain the verification result of the remote attestation report returned by the interface; wherein the second TEE remote attestation SDK is used to verify the remote attestation report.

9. The method according to claim 7, wherein: The method further comprises: The remote certification report is verified using a data verification module in the database client to obtain a verification result for the remote certification report.

10. A database server, wherein: The database server is a database used to manage privacy computing, including: A first acquisition module is used to acquire a request statement related to a remote attestation report from a database client; A first processing module, configured to execute a preset function corresponding to the request statement to call an interface of the first TEE remote attestation SDK to obtain a processing result related to the remote attestation report; the preset function is provided in an extension module created based on the extensible capability of the database engine in the database server; the interface is an interface corresponding to the preset function encapsulated in the first TEE remote attestation SDK; The first sending module is used to send the processing result to the database client.

11. A database client, comprising: A second sending module is configured to send a request statement related to a remote attestation report to a database server; wherein the request statement is configured to instruct the database server to execute a preset function corresponding to the request statement, so as to call an interface of the first TEE remote attestation SDK and obtain a processing result related to the remote attestation report; the preset function is provided in an extension module created based on the extension capability of the database engine in the database server; and the interface is an interface corresponding to the preset function encapsulated in the first TEE remote attestation SDK; The second acquisition module is used to obtain the processing result returned by the database server, wherein the database server is a database used to manage privacy computing.

12. A database server, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor implements the method according to any one of claims 1 to 5 when executing the computer program.

13. A database client, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor implements the method according to any one of claims 6 to 9 when executing the computer program.

14. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images