Data security chain implementation method based on trusted execution environment

Abstract

A kind of data security chain implementation method based on trusted execution environment, data is obtained from external data source by trusted execution environment, and after completing data calculation according to computing logic, first, digital signature is generated according to the calculation result to ensure the credibility of the calculation result, then the signature of the entire trusted execution environment is generated to ensure the credibility of the computing logic;Finally, the calculation result and the corresponding signature are pushed to the blockchain system through the blockchain remote interface, the present application realizes the security of data from input to the whole process of chain by using trusted execution environment, can realize the chain process of the security and credibility of external data source, the data is generated by unaltered code according to correct logic by twice signature, the present application has high flexibility, and its calculation process can support numerical calculation, statistical calculation, logic calculation and more complex data mining, machine learning and other algorithms.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of information security, and particularly relates to a data security chain implementation method based on a trusted execution environment (TEE). BACKGROUND

[0002] The trusted execution environment is a computing chip embedded with an endogenous security protection function in design, and a unique signature key can be built in the chip during the chip manufacturing process, the security of the key is determined by the protection mechanism of the chip itself. The signature key can only be used by the program running in the TEE security area to generate a signature, and the signature can verify the correctness under the cooperation of the chip manufacturer. The mechanism can verify the integrity of the executable program in the TEE security area, that is, a digital signature is generated after the program is hashed, the program is verified by the signature, and the correctness of the program logic is ensured. SUMMARY

[0003] The application aims at the defects that the prior art does not support self-defined data processing logic and cannot guarantee the security and integrity of the processed data, and the original collected data cannot be directly chained in most application scenarios due to the limited throughput of the blockchain itself. A data security chain implementation method based on a trusted execution environment is provided, the security of data from input to chain is realized by using the trusted execution environment, the secure and trusted chain process of external data sources can be realized, the data is generated by the unaltered code according to the correct logic through twice signature, and the application has high flexibility, and the calculation process can support numerical calculation, statistical calculation, logical calculation and more complex data mining, machine learning and other algorithms.

[0004] The application is realized by the following technical scheme:

[0005] The application relates to a data security chain method based on a trusted execution environment, data is acquired from an external data source by the trusted execution environment, and after data calculation is completed according to a calculation logic, a digital signature is generated according to the calculation result to guarantee the credibility of the calculation result, and a signature of the entire trusted execution environment is generated to guarantee the credibility of the calculation logic; finally, the calculation result and the corresponding signature are pushed to a blockchain system through a blockchain remote interface, and the specific steps include:

[0006] Step 1) data acquisition: the trusted execution environment accesses any external data source through a network, a bus or the like, and the data source can be a sensor device, a network service or the like in different forms.

[0007] Step 2) data calculation: customize the corresponding data calculation logic for different applications and data acquisition sources, including numerical calculation, logical calculation, artificial intelligence reasoning and other ways. Data calculation timing is completed or driven by new data acquisition.

[0008] Step 3) calculation result signature: the trusted computing environment generates a pair of public and private keys. The public key is published externally through the form of a blockchain, and the private key is stored in the trusted computing environment. The data calculation result is signed using the private key. The signature result can be verified by the published public key.

[0009] Step 4) calculation environment signature: the trusted execution environment uses the unmodifiable private key built in the chip production phase to sign the executable code loaded in the trusted execution environment and other important data such as the generated public key. The signature is also attached to the calculation result, so that the user can verify that the calculation logic has not been tampered with.

[0010] Step 5) remote on-chain: the trusted computing environment submits the calculation result that needs to be on-chain and the corresponding calculation result signature and calculation environment signature to the blockchain system through the remote call interface.

[0011] The present application relates to a system for implementing the above method, comprising a digital signature unit, a calculation logic unit and a data transmission unit arranged in a secure chip supporting a trusted execution environment, wherein: after the secure chip is started, the calculation logic unit enters the security zone to perform initialization, generates a pair of public and private keys for data signature, and uses the built-in private key of the digital signature unit to complete the signature of the calculation logic unit itself code and the generated public and private key pairs; after initialization, the calculation logic unit collects external data and completes data calculation according to the calculation logic, signs the calculation result according to the generated private key, and attaches the program signature of the initialization stage and the public key as a complete data package to the data transmission unit, and the data transmission unit uploads the complete data package to the blockchain system through a remote interface.

[0012] The public and private key pairs are stored in the chip, and the private key part cannot be read by any program. The signature completed by the private key can be verified with the assistance of the chip manufacturer.

[0013] Technical effects

[0014] The present application realizes the secure on-chain of the collected and calculated data through a two-stage signature method. The data collection and calculation logic are dynamically loaded through two signatures, thereby meeting the logic requirements of different applications. In this process, the dynamically loaded program logic is verified by the built-in key of the secure chip, and the data calculation result of the program logic can be protected by the generated data key signature, avoiding the pressure of storing a large amount of original data in the blockchain, and ensuring that the calculation logic and the calculation result are not tampered with during the entire calculation process. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 Flowchart for the present application;

[0016] Figure 2 Flowchart for the present application; DETAILED DESCRIPTION

[0017] As Figure 1 shown, the present embodiment relates to a data security chaining method based on a trusted execution environment, which obtains data from an external data source through a trusted execution environment, and after completing data calculation according to a calculation logic, first generates a digital signature according to the calculation result to ensure the credibility of the calculation result, and then generates a signature of the entire trusted execution environment to ensure the credibility of the calculation logic; finally, the calculation result and the corresponding signature are pushed to the blockchain system through a blockchain remote interface.

[0018] As Figure 2 shown, the present embodiment implements the above method in the Chang'an chain system using an Intel SGX chip, which specifically includes:

[0019] Step 1) initialization phase: after generating a pair of public and private keys (pk, sk) for data verification and signature in the security zone through TEE, the code loaded and the public key pk generated by TEE are used to complete the digital signature σ.

[0020] Step 2) data security chaining execution phase: TEE waits to obtain data from a specified data source, and when the data is successfully obtained, completes data calculation according to the program logic, and then signs the calculation result with the private key sk to complete the signature σ'; then the calculation result, the corresponding signature σ', the public key pk, and the signature σ are completed as a piece of data for chaining or the public key pk and the digital signature σ are chained as a one-time registration after the initialization phase is executed separately, and the registered pk and σ are reused as verification basis in subsequent execution.

[0021] Step 3) other users use pk to verify the data and the corresponding signature σ' to determine that the data is signed by sk, and under the assistance of the chip vendor's service, the program is verified using σ and pk is executed in the TEE environment, so that the security of the data can be confirmed.

[0022] Compared with the prior art, the present method defines data collection and calculation logic arbitrarily, and ensures that the final calculation result is the result output by the original data through a trusted calculation logic through two signatures.

[0023] The above specific implementation can be adjusted in different ways by those skilled in the art without departing from the principles and purposes of the present application, the protection scope of the present application is subject to the claims and is not limited by the above specific implementation, each implementation scheme within the scope is subject to the constraints of the present application.

Claims

1. A system based on a trusted execution environment data security chain method, characterized in that, Comprise: A digital signature unit, a computing logic unit and a data transmission unit are arranged in a secure chip supporting a trusted execution environment, wherein: after the secure chip is started, the computing logic unit enters a secure area to perform initialization, generates a public-private key pair for data signature, and completes the signature of the code of the computing logic unit itself and the generated public-private key pair using the built-in private key of the digital signature unit; after the initialization is completed, the computing logic unit collects external data and completes data calculation according to the computing logic, signs the calculation result according to the generated private key, and attaches the program signature in the initialization stage and the public key as a complete data package to the data transmission unit, and the data transmission unit uploads the complete data package to the blockchain system through a remote interface; The data security chain method based on the trusted execution environment, specifically comprises: Step 1) data acquisition: the trusted execution environment accesses an external data source to obtain data; Step 2) data calculation: customize the corresponding data calculation logic for different applications and data acquisition sources, and the data calculation is completed at a certain time or driven by new data obtained; Step 3) calculation result signature: the trusted computing environment generates a pair of public and private keys, wherein the public key is published externally in the form of a blockchain, and the private key is stored in the trusted computing environment, and the data calculation result is signed using the private key; the signature result is verified by the published public key; Step 4) computing environment signature: the trusted execution environment uses the unmodifiable private key built in the chip production stage to sign the executable code loaded in the trusted execution environment and the generated public key, and the signature is also attached to the calculation result to verify that the calculation logic has not been tampered with; Step 5) remote chain: the trusted computing environment submits the calculation result and the corresponding calculation result signature and computing environment signature that need to be chained to the blockchain system through a remote calling interface; The public and private key pair is stored in the chip, and the private key part cannot be read by any program, and the signature completed by the private key can be verified with the assistance of the chip manufacturer.

Images