Data processing method and device based on trusted execution environment

Abstract

The embodiments of this specification provide a data processing method and device based on a trusted execution environment, which is applied to a ciphertext data processing kernel on a data processing server. The data processing server is configured with a trusted execution environment, which creates an isolated area, and the ciphertext data processing kernel is loaded into the isolated area. The method includes: receiving a ciphertext data processing request sent by a data processing engine built on the data processing server; parsing the ciphertext data processing request, determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces; calling a target ciphertext data processing service according to the target ciphertext data processing interface, and performing data processing on the ciphertext data to be processed according to the target ciphertext data processing service to obtain processed ciphertext data; and returning the processed ciphertext data to the data processing engine. The above method greatly reduces manpower consumption.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of computer technology, and in particular, to two data processing methods based on a trusted execution environment. One or more embodiments of this specification also relate to two data processing devices based on a trusted execution environment. Background Art

[0002] With the development of Trusted Execution Environment (TEE) technology, more and more TEE-based encrypted storage systems are designed to protect data confidentiality. Currently, many data processing systems (such as encrypted storage systems) place the data processing engine code and sensitive data in the enclave (isolated area) in the TEE during design, and perform data processing of sensitive data in the enclave. Since the enclave is secure, the security of sensitive data can be guaranteed when the data processing engine processes data in the enclave.

[0003] However, in the above solution, the code of the data processing engine itself still has security risks, such as bugs (errors) or backdoors left by developers during development. Therefore, in actual applications, it is necessary to verify that the code of the data processing engine is safe. The data processing system is often upgraded or patched during daily use. Once the code of the data processing system is modified, the code of the data processing system needs to be re-verified, which results in a large amount of human resources. Therefore, a safe and human resource-saving technical solution is urgently needed to solve the above technical problems. Summary of the Invention

[0004] In view of this, the embodiments of this specification provide two data processing methods based on a trusted execution environment. One or more embodiments of this specification also involve two data processing devices based on a trusted execution environment to address technical deficiencies in the prior art.

[0005] According to a first aspect of an embodiment of this specification, a data processing method based on a trusted execution environment is provided, which is applied to a ciphertext data processing kernel of a data processing server. The data processing server is configured with a trusted execution environment, and the trusted execution environment creates an isolated area. The ciphertext data processing kernel is loaded into the isolated area. The method includes:

[0006] Receiving a ciphertext data processing request sent by a data processing engine built on the data processing server, wherein the ciphertext data processing request carries ciphertext data to be processed;

[0007] parsing the encrypted data processing request and determining a target encrypted data processing interface from a set of encrypted data processing interfaces, wherein each encrypted data processing interface in the set of encrypted data processing interfaces corresponds to a encrypted data processing service;

[0008] calling a target ciphertext data processing service according to the target ciphertext data processing interface, and performing data processing on the ciphertext data to be processed according to the target ciphertext data processing service to obtain processed ciphertext data;

[0009] The processed ciphertext data is returned to the data processing engine.

[0010] According to a second aspect of an embodiment of this specification, another data processing method based on a trusted execution environment is provided, which is applied to a data processing engine built on a data processing server. The data processing server is configured with a trusted execution environment, and the trusted execution environment creates an isolated area. The isolated area contains a ciphertext data processing kernel. The method includes:

[0011] Responding to a data processing request sent by a data processing client, parsing the data processing request and generating a target data processing task;

[0012] If it is determined that the target data processing task includes a ciphertext data processing task, generating a ciphertext data processing request according to the ciphertext data processing task, wherein the ciphertext data processing request carries the ciphertext data to be processed corresponding to the ciphertext data processing task;

[0013] Sending the ciphertext data processing request to the isolated area, so that the ciphertext data processing kernel loaded in the isolated area receives and parses the ciphertext data processing request, determines a target ciphertext data processing interface from a set of ciphertext data processing interfaces, calls a target ciphertext data processing service according to the target ciphertext data processing interface, and processes the ciphertext data to be processed according to the target ciphertext data processing service, thereby obtaining and returning processed ciphertext data;

[0014] The processed ciphertext data returned by the isolation area is received, and the target data processing task is executed according to the processed ciphertext data to obtain a data processing result.

[0015] According to a third aspect of the embodiments of this specification, a data processing device based on a trusted execution environment is provided, which is applied to a ciphertext data processing kernel of a data processing server. The data processing server is configured with a trusted execution environment, and the trusted execution environment creates an isolated area. The ciphertext data processing kernel is loaded in the isolated area. The device includes a coordination module and a functional module provided in the ciphertext data processing kernel, wherein:

[0016] The coordination module is configured to receive a ciphertext data processing request sent by a data processing engine built on the data processing server, wherein the ciphertext data processing request carries ciphertext data to be processed;

[0017] parsing the encrypted data processing request and determining a target encrypted data processing interface from a set of encrypted data processing interfaces, wherein each encrypted data processing interface in the set of encrypted data processing interfaces corresponds to a encrypted data processing service;

[0018] calling the target ciphertext data processing service in the functional module according to the target ciphertext data processing interface, and performing data processing on the ciphertext data to be processed according to the target ciphertext data processing service to obtain processed ciphertext data;

[0019] The processed ciphertext data is returned to the data processing engine.

[0020] According to a fourth aspect of an embodiment of this specification, another data processing device based on a trusted execution environment is provided, which is applied to a data processing engine built on a data processing server. The data processing server is configured with a trusted execution environment, and the trusted execution environment creates an isolated area. The isolated area is loaded with a ciphertext data processing kernel. The device includes:

[0021] A parsing module, configured to respond to a data processing request sent by a data processing client, parse the data processing request, and generate a target data processing task;

[0022] a generating module configured to, upon determining that the target data processing task includes a ciphertext data processing task, generate a ciphertext data processing request according to the ciphertext data processing task, wherein the ciphertext data processing request carries the ciphertext data to be processed corresponding to the ciphertext data processing task;

[0023] a sending module, configured to send the ciphertext data processing request to the isolated area, so that the ciphertext data processing kernel loaded in the isolated area receives and parses the ciphertext data processing request, determines a target ciphertext data processing interface from a set of ciphertext data processing interfaces, calls a target ciphertext data processing service according to the target ciphertext data processing interface, and processes the ciphertext data to be processed according to the target ciphertext data processing service, thereby obtaining and returning processed ciphertext data;

[0024] A receiving module is used to receive the processed ciphertext data returned by the isolation area, and execute the target data processing task according to the processed ciphertext data to obtain a data processing result.

[0025] The data processing method based on a trusted execution environment provided in the embodiments of this specification is applied to the ciphertext data processing kernel of a data processing server, the data processing server is configured with a trusted execution environment, the trusted execution environment creates an isolation area, and the ciphertext data processing kernel is loaded in the isolation area, the method comprising: receiving a ciphertext data processing request sent by a data processing engine built on the data processing server, wherein the ciphertext data processing request carries ciphertext data to be processed; parsing the ciphertext data processing request, determining a target ciphertext data processing interface from a ciphertext data processing interface set, wherein each ciphertext data processing interface in the ciphertext data processing interface set corresponds to a ciphertext data processing service; calling a target ciphertext data processing service according to the target ciphertext data processing interface, and performing data processing on the ciphertext data to be processed according to the target ciphertext data processing service to obtain processed ciphertext data; and returning the processed ciphertext data to the data processing engine.

[0026] Specifically, the method receives the ciphertext data processing request sent by the data processing engine built on the data processing server end by loading the ciphertext data processing kernel in the isolation area, thereby transferring only the part of the data processing engine that needs to perform ciphertext data processing to the isolation area. By loading only the ciphertext data processing kernel in the isolation area, the ciphertext data processing request is parsed according to the ciphertext data processing kernel loaded in the isolation area while reducing the amount of code in the isolation area, and the target ciphertext data processing interface and the ciphertext data processing service corresponding to the interface are determined to realize data processing of the ciphertext data to be processed. Therefore, in this method, it is only necessary to verify the code of each ciphertext data processing service provided by the ciphertext data processing kernel loaded in the isolation area to ensure the security of the ciphertext data to be processed during the data processing process. The total amount of the code is small, so the verification of the code reduces manpower consumption and space occupation of the isolation area. Moreover, when the data processing engine is updated or patched, only the part outside the isolation area needs to be updated, and there is no need to update the ciphertext data processing services in the isolation area. Therefore, there is no need to repeatedly verify the code of each ciphertext data processing service in the isolation area, which greatly reduces manpower consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a specific application scenario diagram of a data processing method based on a trusted execution environment provided according to an embodiment of this specification;

[0028] Figure 2 is a flow chart of a data processing method based on a trusted execution environment provided according to one embodiment of this specification;

[0029] Figure 3is a flowchart of another data processing method based on a trusted execution environment provided according to one embodiment of this specification;

[0030] Figure 4 This is a schematic diagram of a trusted kernel structure used in a data processing method based on a trusted execution environment provided in one embodiment of this specification;

[0031] Figure 5 This is a schematic diagram of a plaintext data block of a data processing method based on a trusted execution environment provided by an embodiment of this specification;

[0032] Figure 6 This is a structural diagram of a data processing device based on a trusted execution environment provided by an embodiment of this specification;

[0033] Figure 7 This is a structural diagram of another data processing device based on a trusted execution environment provided by an embodiment of this specification. DETAILED DESCRIPTION

[0034] The following description sets forth many specific details to facilitate a thorough understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the scope of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0035] The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of this specification. The singular forms "a," "the," and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0036] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0037] In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0038] First, the terms involved in one or more embodiments of this specification are explained.

[0039] TEE (Trusted Execution Environment): A highly secure execution environment consisting of a special combination of software and hardware for securely running sensitive applications. It protects data and code from unauthorized access and modification through isolation, encryption, secure boot, and other technologies.

[0040] Enclave: An isolated execution space security area deployed in the EPC of the TEE. Trusted programs running in the enclave can prevent infringement by ordinary applications, operating systems (OS) and even virtual machine supervisors (Hypervisors).

[0041] Encrypted storage system: The storage system can be understood as a system in a computer that is composed of various storage devices for storing programs and data, control components, and equipment (hardware) and algorithms (software) for managing information scheduling. It is one of the important components of a computer. It provides the ability to write and read the information (programs and data) required for computer operation, realizing the computer's information memory function; and the encrypted storage system is a type of storage system. Based on the storage system, the encrypted storage system can also realize data processing of sensitive data.

[0042] Cryptographic storage engine: A software component that is part of the algorithm (software) in an encrypted storage system and is used to perform operations such as create, query, update, delete, store, and retrieve data in the storage system.

[0043] MySQL: A relational database management system. MySQL is developed using the SQL (Structured Query Language) language and implements operations such as creating, querying, updating, and deleting data in the database through a storage engine developed in the SQL language.

[0044] LevelDB (Level DataBase): A key-value (kv) database. LevelDB is developed in C++ (C Plus Kiva) and implements operations such as creating, querying, updating, and deleting data in the database through a storage engine developed in C++.

[0045] Redis (Remote Dictionary Server): An open-source key-value (KV) database. Developed in the American National Standard Institute C (ANSI C) language, Redis uses a storage engine developed in ANSI C to implement operations such as creating, querying, updating, and deleting data in the database.

[0046] B-tree (B-tree Indexing Method): A balanced multi-way search tree. B-tree stores multiple key-value pairs at each node, which reduces the tree height, increases the branching factor, and reduces the number of disk input / output operations. B-tree is widely used in databases, file systems, distributed systems, and index structures.

[0047] LSM-tree (Log-Structured Merge-Tree): A distributed data structure for storing ordered data. LSM-tree combines the concepts of log structure and merge sort. It has the advantages of efficient writing, reading, and space utilization. It is often used in high-performance storage systems and high-performance databases.

[0048] API (Application Programming Interface): A set of predefined functions, methods, or objects. APIs provide access to and manipulation of corresponding applications, have specific parameters and return values, and follow certain calling conventions. By using APIs, developers do not need to write internal application code corresponding to the API. Instead, they can use existing API functions and data to implement integrated development or build other applications by calling them.

[0049] Bug (program error): The error code in the program itself. The bug in the software program will cause abnormal functions, freezes, data loss, abnormal interruptions, etc.

[0050] With the development of TEE technology, more and more TEE-based encrypted storage systems are designed to protect data confidentiality. These encrypted storage systems can effectively prevent attackers or privileged users (such as operating system or database administrators) from accessing the plaintext of sensitive data stored therein by placing the storage system code (including but not limited to storage engine code, file system code, etc.) and sensitive data in an isolated area called Enclave. Although Enclave can ensure that the code execution process therein is not tampered with, there are no restrictions on the code executed inside. For example, the code inside the Enclave can easily send sensitive data to the outside.

[0051] To ensure the security of the encrypted storage system, one solution is to have the developers of the encrypted storage system open source their storage system code. Specifically, users of the encrypted storage system are allowed to view and verify the security of the storage engine. After that, the verified storage system code is placed in the enclave to implement the functions of the encrypted storage system.

[0052] However, this approach has several drawbacks in terms of effectiveness and efficiency, such as:

[0053] (1) When developers develop encrypted storage systems, the encryption storage engine code they develop may contain security risks, such as unintentional bugs (program errors) or intentional code backdoors;

[0054] (2) Commercial encryption storage systems are often upgraded and patched frequently. During the upgrade or patching process, once the encryption storage engine code is modified, the encryption storage engine code must be re-verified.

[0055] (3) In actual projects, multiple encrypted storage systems will deploy multiple types of storage engines, such as MySQL storage engine, LevelDB storage engine, Redis storage engine, etc. Therefore, when using each encrypted storage system, users need to independently verify the corresponding type of storage engine code of each storage system. Verifying the code one by one will waste a lot of time and energy of users or third parties entrusted by users.

[0056] In view of this, the embodiments of this specification provide a technical solution to the trust issues faced in building an encrypted storage system through a trusted kernel, thereby excluding the developers of the encrypted storage system from the trusted domain by prohibiting developers from directly writing code running in the Enclave (i.e., code for processing sensitive data), thereby preventing the occurrence of security vulnerabilities in the encrypted storage system; users of the encrypted storage system only need to verify the trusted kernel and trust its security, and then they can trust all encrypted storage engines built based on the kernel, as well as the encrypted storage systems corresponding to the encrypted storage engines, without having to trust the developers of each encrypted storage engine.

[0057] Specifically, this specification provides two data processing methods based on a trusted execution environment. This specification also involves two data processing devices based on a trusted execution environment, which are described in detail one by one in the following embodiments.

[0058] See also Figure 1 , Figure 1 This is a specific application scenario diagram of a data processing method based on a trusted execution environment provided according to an embodiment of this specification.

[0059] like Figure 1 As shown, users can use the encrypted storage engine of the encrypted storage system to implement storage-related operations (such as Figure 1 The encrypted storage engine performs data storage processing flow (0x2451--0x01a4 / 0x2d73 / 0x83ea / 0x65b30x7d10--...--0x3749 / 0x5539 / 0x7962...0xb1d9 / 0x4a72), and the encrypted storage engine is implemented by the storage engine developer by writing custom code.

[0060] The embodiments of this specification abstract the core ciphertext calculation and storage-related logic (i.e., the related services that implement data processing functions are placed in the functional module) into a trusted kernel and execute it in the TEE's Enclave, and provide an interface for calling data processing functions outside the Enclave (i.e., the API interface provided by the trusted kernel), so that developers (i.e., storage engine developers) can only write code outside the Enclave and complete storage-related operations of ciphertext data by calling the API interface provided by the trusted kernel (i.e., the above-mentioned interface for calling data processing functions). Because users trust the trusted kernel, they trust the ciphertext data processing flow implemented by the above-mentioned encryption storage engine based on the trusted kernel.

[0061] Specifically, the trusted kernel of the embodiment of this specification is as follows Figure 1As shown, the trusted kernel provides a unified set of call interfaces for storage engine developers. These interfaces can be divided into three categories based on functionality: ciphertext computation interface, ciphertext search interface, and ciphertext block operation interface. The trusted kernel consists of a coordination module and a functional module (which consists of three core functional modules: the computation operator module, the trusted search algorithm module, and the trusted data structure module). These three core functional modules reuse code (i.e., reuse functions) to reduce the size of the code base.

[0062] When the encryption storage engine calls the API interface provided by the trusted kernel (i.e., the above-mentioned ciphertext calculation interface and / or ciphertext search interface and / or ciphertext block operation interface), the coordination module parses the call request sent by the encryption storage engine, and dispatches the call request and the ciphertext data carried in the call request to the corresponding functional module based on the parsing result, so that the corresponding functional module provides corresponding services and performs corresponding data processing on the ciphertext data according to the call request.

[0063] The data processing method based on a trusted execution environment provided by the embodiments of this specification reduces the size of the code that needs to be verified while ensuring the security of the user's sensitive data by placing only the code for functional services for processing encrypted data in the trusted kernel trusted by the user. By prohibiting storage engine developers from editing the code in the trusted kernel, the leakage of sensitive data due to bugs or backdoors in the code is avoided, thereby ensuring the security of data processing of sensitive data, and improving the efficiency of users using the data processing engine loaded with the trusted kernel of the embodiments of this specification, thereby greatly reducing the consumption of human resources.

[0064] The following combination Figure 2 , further explains the data processing method based on the trusted execution environment provided in the embodiments of this specification.

[0065] See also Figure 2 , Figure 2 This is a flowchart of a data processing method based on a trusted execution environment provided according to an embodiment of the present specification. The data processing method based on the trusted execution environment is applied to the ciphertext data processing kernel of the data processing server. The data processing server is configured with a trusted execution environment. The trusted execution environment creates an isolation area. The ciphertext data processing kernel is loaded in the isolation area. The method specifically includes the following steps.

[0066] Step 202: Receive a ciphertext data processing request sent by a data processing engine built on the data processing server.

[0067] The ciphertext data processing request carries ciphertext data to be processed.

[0068] In actual applications, this data processing method based on a trusted execution environment can be used to process (calculate or analyze, etc.) sensitive data of any technical field, any type, and any amount of data, such as the analysis of medical diagnostic data in the medical field, or the analysis of consumption habits of online shoppers in the online shopping field; this specification does not impose any restrictions on this.

[0069] Specifically, the data processing server can be understood as the server of the data processing system (i.e., the above-mentioned encrypted storage system), which also includes a client. The server of the data processing system includes but is not limited to cloud servers, physical servers, etc., and the client of the data processing system includes but is not limited to mobile phones, tablet computers, desktop computers, etc.

[0070] The server side of the data processing system is configured with a trusted execution environment, and an isolated area is created in the trusted execution environment. The isolated area is loaded with a ciphertext data processing kernel. The trusted execution environment can be understood as the TEE of the above-mentioned embodiment, the isolated area can be understood as the Enclave of the above-mentioned embodiment, and the ciphertext data processing kernel can be understood as the trusted kernel in the above-mentioned embodiment.

[0071] The server side of the data processing system also has a data processing engine. When the data processing engine needs to process ciphertext data, it sends a ciphertext data processing request carrying the ciphertext data to be processed to the ciphertext data processing kernel, so that the ciphertext data processing kernel can process the ciphertext data to be processed and then return the processed ciphertext data to the data processing engine.

[0072] It should be noted that the embodiments of this specification do not limit the encryption type of the ciphertext data to be processed sent by the data processing engine. Commonly used encryption algorithms include hash encryption algorithms, asymmetric encryption algorithms, etc.; in order to further improve the security of the system, it is also possible to adopt a mixture of multiple encryption algorithms, or use different encryption algorithms in a time-sharing manner, etc., to prevent the data processing system from being attacked and causing the loss of ciphertext data.

[0073] The ciphertext data processing request can be understood as a request for processing the ciphertext data to be processed. The ciphertext data to be processed includes but is not limited to the ciphertext data to be processed (i.e., fine-grained ciphertext data to be processed), the ciphertext data block to be processed (i.e., coarse-grained ciphertext data block to be processed in the form of a data block), etc.

[0074] When the ciphertext data to be processed is understood as the ciphertext data to be processed (i.e., fine-grained ciphertext data to be processed), ciphertext data processing can be understood as ciphertext data calculation, ciphertext data search, etc., and when the ciphertext data to be processed is understood as the ciphertext data block to be processed (i.e., coarse-grained, data block-form ciphertext data block to be processed), ciphertext data processing can be understood as ciphertext data calculation in the ciphertext data block, ciphertext data search in the ciphertext data block, ciphertext data block operation, etc.

[0075] In specific implementation, the specific steps for implementing the ciphertext data processing request sent by the data processing engine on the data processing server are as follows:

[0076] The user first performs an operation on the client of the data processing system (such as a data query operation, a data storage operation, etc.). The client generates a data processing request (such as a data query request, a data storage request, etc.) in response to the user's operation and sends the data processing request to the server of the data processing system. After receiving the data processing request, the server of the data processing system responds to the data processing request, parses the data processing request, and generates a target data processing task, wherein the target data processing task includes a plaintext data processing task and / or a ciphertext data processing task.

[0077] In order to ensure the security of ciphertext data processing, the data processing engine, when determining that the target data processing task includes a ciphertext data processing task, determines the ciphertext data to be processed corresponding to the ciphertext data processing task based on the ciphertext data processing task, generates a ciphertext data processing request carrying the ciphertext data to be processed, and sends the ciphertext data processing request to the isolation area; the isolation area receives the ciphertext data processing request, so that the ciphertext data processing core in the isolation area processes the ciphertext data to be processed according to the ciphertext data processing request.

[0078] Furthermore, after receiving the ciphertext data processing request and the ciphertext data to be processed carried in the ciphertext data processing request, the ciphertext data processing core loaded in the isolation area performs ciphertext data processing on the ciphertext data to be processed.

[0079] Step 204: Parse the ciphertext data processing request and determine a target ciphertext data processing interface from the ciphertext data processing interface set.

[0080] Wherein, each ciphertext data processing interface in the ciphertext data processing interface set corresponds to a ciphertext data processing service.

[0081] Specifically, the ciphertext data processing interface can be understood as the API (Application Programming Interface) in the above embodiment. The target ciphertext data processing interface determined by parsing the ciphertext data processing request can be one API or multiple APIs, which is not limited in the embodiments of this specification.

[0082] The ciphertext data processing interface set can be understood as a set of various ciphertext data processing interfaces (ie, various APIs), and each API corresponds to a ciphertext data processing service.

[0083] For example, the ciphertext data processing interface can be understood as the ciphertext calculation interface and / or the ciphertext search interface and / or the ciphertext block operation interface, etc. Then, when the ciphertext data processing interface is understood as the ciphertext calculation interface, the ciphertext data processing service can be understood as the ciphertext calculation service corresponding to the ciphertext calculation interface; when the ciphertext data processing interface is understood as the ciphertext search interface, the ciphertext data processing service can be understood as the ciphertext search service corresponding to the ciphertext search interface; when the ciphertext data processing interface is understood as the ciphertext block operation interface, the ciphertext data processing service can be understood as the ciphertext block operation service corresponding to the ciphertext block operation interface; when the ciphertext data processing interface is understood as multiple ciphertext data processing interfaces, the ciphertext data processing service can be understood as multiple ciphertext data processing services corresponding to multiple ciphertext data processing interfaces.

[0084] During specific implementation, after receiving the ciphertext data processing request, the ciphertext data processing kernel in the isolation area parses the ciphertext data processing request to determine the various ciphertext data processing services required for ciphertext data processing contained in the ciphertext data processing request, and determines the ciphertext data processing interface required for ciphertext data processing from the ciphertext data processing interface set, which is the target ciphertext data processing interface.

[0085] In practical applications, the target ciphertext data processing interface includes the target ciphertext data calculation interface. Therefore, the specific implementation of the corresponding target ciphertext data processing interface is determined as follows:

[0086] The target ciphertext data processing interface includes a target ciphertext data calculation interface;

[0087] Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes:

[0088] The ciphertext data processing request is parsed, and when it is determined according to the parsing result that the ciphertext data processing request is for implementing ciphertext data calculation, a target ciphertext data calculation interface is determined.

[0089] The ciphertext data calculation may be understood as performing calculations on the ciphertext data to be processed. For example, the ciphertext data calculation may be understood as performing comparative calculations on the ciphertext data to be processed or performing hash calculations on the ciphertext data to be processed.

[0090] The target ciphertext data calculation interface can be understood as an interface for implementing ciphertext data calculation. For example, when ciphertext data calculation is understood as comparative calculation of the ciphertext data to be processed, the target ciphertext data calculation interface can be understood as a target ciphertext data comparison calculation interface; for another example, when ciphertext data calculation is understood as hash calculation of the ciphertext data to be processed, the target ciphertext data calculation interface can be understood as a target ciphertext data hash calculation interface.

[0091] Furthermore, the ciphertext data processing request is parsed, and when it is determined based on the parsing result that the ciphertext data processing request is for implementing ciphertext data calculation, the target ciphertext data calculation interface is determined. It can be understood that after the ciphertext data processing request is received from the data processing engine, the ciphertext data processing kernel parses the ciphertext data processing request, and determines the ciphertext data processing instructions contained in the ciphertext data processing request based on the parsing result. When it is determined that the ciphertext data processing instruction is for implementing ciphertext data calculation based on the ciphertext data to be processed, the target ciphertext data calculation interface corresponding to the ciphertext data calculation is determined.

[0092] For example, ciphertext data calculation is understood as comparative calculation of ciphertext data to be processed, the ciphertext data to be processed is two ciphertext arrays, the ciphertext data processing request is to determine whether the two ciphertext arrays contain the same ciphertext data, and the ciphertext data processing request is parsed as ciphertext data calculation to determine whether each corresponding pair of elements in the two ciphertext arrays are equal. According to the ciphertext data processing request, the CmpBatch interface (that is, the above-mentioned target ciphertext data comparison calculation interface) is determined.

[0093] For another example, ciphertext data calculation is understood as performing hash calculation on the ciphertext data to be processed, the ciphertext data to be processed is a ciphertext array, and the ciphertext array contains multiple ciphertext data. The ciphertext data processing request is to calculate the hash values ​​corresponding to the individual data in the array, and the ciphertext data processing request is parsed as performing batch hash calculation on the array to generate the hash values ​​corresponding to the individual data. According to the ciphertext data processing request, the HashBatch interface (i.e., the above-mentioned target ciphertext data hash calculation interface) is determined; for another example, the ciphertext data to be processed is a ciphertext data, and the ciphertext data processing request is to find a suitable storage address for the ciphertext data. According to the ciphertext data processing request, the HashBatch interface (i.e., the above-mentioned target ciphertext data hash calculation interface) is determined.

[0094] The data processing method based on a trusted execution environment provided in the embodiments of this specification parses the ciphertext data processing request and, when it is determined based on the parsing result that the ciphertext data processing request is for implementing ciphertext data calculation, determines the target ciphertext data calculation interface to implement ciphertext data calculation of the data to be processed in the ciphertext data processing kernel, thereby ensuring the security of the ciphertext data to be processed.

[0095] In practical applications, the target ciphertext data processing interface may further include a target ciphertext data search interface to reduce frequent context switching (i.e., switching between a trusted execution environment and an untrusted execution environment). The specific implementation is as follows:

[0096] The target ciphertext data processing interface includes a target ciphertext data search interface;

[0097] Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes:

[0098] The ciphertext data processing request is parsed, and when it is determined according to the parsing result that the ciphertext data processing request is for implementing a ciphertext data search, a target ciphertext data search interface is determined.

[0099] Among them, the ciphertext data search can be understood as searching for ciphertext data that meets the requirements from the ciphertext data to be processed. For example, the ciphertext data search can be understood as searching for the ciphertext data with the smallest value from the ciphertext data to be processed, or searching for the ciphertext data with the smallest value that is not less than the preset parameters from the ciphertext data to be processed, etc.

[0100] The target ciphertext data search interface can be understood as an interface for implementing ciphertext data search. For example, when the ciphertext data search is understood as searching for the ciphertext data with the smallest numerical value from the ciphertext data to be processed, the target ciphertext data search interface can be understood as a target ciphertext data minimum data search interface, which is used to search for the ciphertext data with the smallest numerical value from the ciphertext data to be processed; for another example, when the ciphertext data search is understood as searching for the ciphertext data with the smallest numerical value that is not less than the preset parameters from the ciphertext data to be processed, the target ciphertext data search interface can be understood as a target ciphertext data specified range minimum data search interface, and the specified range minimum data can be understood as the above-mentioned ciphertext data with the smallest numerical value that is not less than the preset parameters. The target ciphertext data specified range minimum data search interface is used to search for the ciphertext data with the smallest numerical value that is not less than the preset parameters from the ciphertext data to be processed.

[0101] Furthermore, the ciphertext data processing request is parsed, and when it is determined based on the parsing result that the ciphertext data processing request is for implementing a ciphertext data search, the target ciphertext data search interface is determined. This can be understood as the ciphertext data processing kernel parsing the ciphertext data processing request after receiving the ciphertext data processing request sent by the data processing engine, and determining the ciphertext data processing instructions contained in the ciphertext data processing request based on the parsing result. When it is determined that the ciphertext data processing instructions are for implementing a ciphertext data search based on the ciphertext data to be processed, the target ciphertext data search interface corresponding to the ciphertext data search is determined.

[0102] For example, ciphertext data search is understood as searching for the ciphertext data with the smallest value from the ciphertext data to be processed, the ciphertext data to be processed is a ciphertext array, the ciphertext data processing request is to search for the ciphertext data with the smallest value from the ciphertext array, and the ciphertext data processing request is parsed as a ciphertext data search to search for the ciphertext data with the smallest value from the ciphertext array. Based on the ciphertext data search, the Min interface (i.e., the above-mentioned target ciphertext data minimum data search interface) is determined.

[0103] For another example, ciphertext data search is understood as searching for ciphertext data with a minimum value that is not less than a preset parameter from the ciphertext data to be processed. The ciphertext data to be processed is a ciphertext array. The ciphertext data processing request is to search for ciphertext data with a minimum value that is not less than a preset parameter from the ciphertext data to be processed. The ciphertext data processing request is parsed as a ciphertext data search to search for ciphertext data with a minimum value that is not less than a preset parameter from the ciphertext data to be processed. According to the ciphertext data processing request, the Search interface (i.e., the minimum data search interface in the specified range of the target ciphertext data) is determined.

[0104] The data processing method based on a trusted execution environment provided in the embodiments of this specification parses a ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data processing request is for implementing a ciphertext data search, determines a target ciphertext data search interface to implement a ciphertext data search for the data to be processed in the ciphertext data processing kernel, thereby reducing the number of context switches and improving the performance of the data processing system.

[0105] In actual applications, data processing engines may also use a coarse-grained approach to encrypt data. This allows the data processing engine to encrypt multiple ciphertext data into a single ciphertext data block. For example, this may involve encrypting nodes within a B-tree or encrypting data blocks within an LSM-tree. To support operations on elements within a ciphertext data block, the embodiments of this specification further add a coarse-grained data processing interface to the ciphertext data processing kernel, i.e., an interface for data processing of ciphertext data blocks, to increase practicality. The specific implementation is as follows:

[0106] The target ciphertext data processing interface includes a target ciphertext data block operation interface;

[0107] Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes:

[0108] Parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to implement an operation on the ciphertext data block to be processed, determine a target ciphertext data block operation interface.

[0109] Among them, the ciphertext data block to be processed can be understood as the ciphertext data to be processed stored in the form of a data block, and the operation on the ciphertext data block to be processed can be understood as, for example, inserting elements, updating elements, deleting elements, reading elements, etc. in the ciphertext data block to be processed, and an element can be understood as one or more ciphertext data.

[0110] The target ciphertext data block operation interface can be understood as an interface for implementing operations on the ciphertext data block to be processed. For example, when the operation on the ciphertext data block to be processed is understood as inserting an element into the ciphertext data block to be processed, the target ciphertext data block operation interface can be understood as a target ciphertext data block element insertion interface; for another example, when the operation on the ciphertext data block to be processed is understood as deleting an element from the ciphertext data block to be processed, the target ciphertext data block operation interface can be understood as a target ciphertext data block element deletion interface.

[0111] Further, the ciphertext data processing request is parsed, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is for implementing an operation on the ciphertext data block to be processed, the target ciphertext data block operation interface is determined. It can be understood that after receiving the ciphertext data processing request sent by the data processing engine, the ciphertext data processing core parses the ciphertext data processing request, and determines based on the parsing result the data form of the ciphertext data to be processed carried in the ciphertext data processing request and the ciphertext data processing instructions contained therein. When it is determined that the data form of the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed in the form of a data block, and the ciphertext data processing instruction is for implementing an operation on the ciphertext data block based on the ciphertext data block to be processed, the target ciphertext block operation interface corresponding to the operation on the ciphertext data block is determined.

[0112] For example, operating on a ciphertext data block is understood as inserting an element into the ciphertext data block to be processed, the ciphertext data block to be processed is a ciphertext data block, the ciphertext data processing request is to insert an element into the ciphertext data block to be processed, and the ciphertext data processing request is parsed as a ciphertext data block operation instruction to insert an element into the ciphertext data block to be processed. According to the ciphertext data block operation instruction, the PutByKey (PutByPos) interface (i.e., the above-mentioned target ciphertext data block element insertion interface) is determined.

[0113] For another example, operating on a ciphertext data block is understood as deleting an element in the ciphertext data block to be processed, the ciphertext data block to be processed is a ciphertext data block, the ciphertext data processing request is to delete an element in the ciphertext data block to be processed, and the ciphertext data processing request is parsed as a ciphertext data block operation instruction to delete an element in the ciphertext data block to be processed. Based on the ciphertext data block operation instruction, the DeleteByKey (DeleteByPos) interface (i.e., the above-mentioned target ciphertext data block element deletion interface) is determined.

[0114] The data processing method based on the trusted execution environment provided in the embodiments of this specification increases the scope of application and the practicality of the method by adding a ciphertext data block operation interface and implementing corresponding ciphertext data block operations.

[0115] In practical applications, the target ciphertext data processing interface may further include at least two interfaces. When the target ciphertext data processing interface includes a target ciphertext data calculation interface and a target ciphertext data search interface, the specific implementation is as follows:

[0116] The target ciphertext data processing interface includes a target ciphertext data calculation interface and a target ciphertext data search interface;

[0117] Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes:

[0118] The ciphertext data processing request is parsed, and when it is determined according to the parsing result that the ciphertext data processing request is to implement ciphertext data calculation and ciphertext data search, the target ciphertext data calculation interface and the target ciphertext data search interface are determined.

[0119] Specifically, the specific implementation method of the embodiment of this specification can refer to the embodiment of the above specification. The only difference is that the ciphertext data processing request in the embodiment of this specification includes the implementation of ciphertext data calculation and ciphertext data search, and therefore two interfaces need to be determined.

[0120] The data processing method based on a trusted execution environment provided in the embodiments of this specification parses a ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data processing request is for ciphertext data calculation and ciphertext data search, determines a target ciphertext data calculation interface and a target ciphertext data search interface, so as to implement ciphertext data calculation and search for the data to be processed in the ciphertext data processing kernel, thereby ensuring the security of the ciphertext data processing process, reducing the number of context switches, and improving the performance of the data processing system.

[0121] In practical applications, the target ciphertext data processing interface may also include a target ciphertext data calculation interface and a target ciphertext data block operation interface. The specific implementation is as follows:

[0122] The target ciphertext data processing interface includes a target ciphertext data calculation interface and a target ciphertext data block operation interface;

[0123] Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes:

[0124] Parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to perform calculations and operations on the ciphertext data block to be processed, determine the target ciphertext data calculation interface and the target ciphertext data block operation interface.

[0125] Specifically, the specific implementation method of the embodiments of this specification can refer to the embodiments of the above specification. The only difference is that in the ciphertext data processing request in the embodiments of this specification, the ciphertext data calculation and the ciphertext data block to be processed are implemented, and therefore two interfaces need to be determined.

[0126] The data processing method based on a trusted execution environment provided in the embodiments of this specification reduces code redundancy and code size by operating on the target ciphertext data block while involving the calculation of the target ciphertext data, and is implemented through the target ciphertext data calculation interface, thereby reducing the human resource consumption of manual code verification.

[0127] In practical applications, the target ciphertext data processing interface may further include a target ciphertext data search interface and a target ciphertext data block operation interface, the specific implementation of which is as follows:

[0128] The target ciphertext data processing interface includes a target ciphertext data search interface and a target ciphertext data block operation interface;

[0129] Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes:

[0130] Parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to search for and operate on the ciphertext data block to be processed, determine the target ciphertext data search interface and the target ciphertext data block operation interface.

[0131] Specifically, the specific implementation method of the embodiments of this specification can refer to the embodiments of the above specification. The only difference is that in the ciphertext data processing request in the embodiments of this specification, the ciphertext data search and the ciphertext data block to be processed are implemented, and therefore two interfaces need to be determined.

[0132] The data processing method based on a trusted execution environment provided in the embodiments of this specification increases the operating efficiency of the ciphertext data processing kernel for ciphertext data block operations by searching for target ciphertext data while operating on the target ciphertext data block, and reduces code redundancy and code size by calling at least two interfaces to combine and implement corresponding ciphertext data processing, thereby reducing the resource consumption required to verify the security of the code.

[0133] In practical applications, the target ciphertext data processing interface may further include at least three interfaces, for example, at least a target ciphertext data calculation interface, a target ciphertext data search interface, and a target ciphertext data block operation interface. The specific implementation is as follows:

[0134] The target ciphertext data processing interface includes a target ciphertext data calculation interface, a target ciphertext data search interface and a target ciphertext data block operation interface;

[0135] Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes:

[0136] Parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to realize calculation, search and operation on the ciphertext data block to be processed, determine the target ciphertext data calculation interface, the target ciphertext data search interface and the target ciphertext data block operation interface.

[0137] Specifically, the specific implementation method of the embodiments of this specification can refer to the embodiments of the above specification. The only difference is that in the ciphertext data processing request in the embodiments of this specification, the ciphertext data search, calculation and operation of the ciphertext data block to be processed are implemented, and therefore three interfaces need to be determined.

[0138] The data processing method based on a trusted execution environment provided in the embodiments of this specification improves the adaptability and performance optimization of the method by providing an operation interface for the target ciphertext data block and a search and calculation interface for the target ciphertext data in the target ciphertext data block, making the method more functional and more efficient in processing, and supporting different data encryption granularities, with higher flexibility. Code reuse is achieved by combining calling interfaces, making the code smaller and reducing the cost of manual code verification.

[0139] Step 206: calling a target ciphertext data processing service according to the target ciphertext data processing interface, and performing data processing on the ciphertext data to be processed according to the target ciphertext data processing service to obtain processed ciphertext data.

[0140] The target ciphertext data processing service can be understood as a functional service for implementing target ciphertext data processing, and the target ciphertext data processing service corresponds one-to-one to the target ciphertext data processing interface.

[0141] For example, an interface and its corresponding service can be understood as one or more of the following:

[0142] The CmpBatch interface (target ciphertext data comparison interface) corresponds to the service for checking whether certain elements of the ciphertext data to be processed are equal;

[0143] The HashBatch interface (target ciphertext data hash calculation interface) is a service that performs hash calculations on ciphertext data to be processed.

[0144] The Min(arr) interface (target ciphertext minimum data search interface) corresponds to the service of searching for the ciphertext data with the smallest value from the ciphertext data to be processed;

[0145] Search interface (target ciphertext data minimum range search interface): corresponding to the service that searches for the ciphertext data to be processed that is not less than the preset parameter and has the smallest value;

[0146] PutByKey (PutByPos) interface: the target ciphertext data block insert element interface, corresponding to the service of inserting elements into the ciphertext data block to be processed;

[0147] UpdateByKey (UpdateByPos) interface: the target ciphertext data block update element interface, corresponding to the service of updating elements in the ciphertext data block to be processed;

[0148] DeleteByKey (DeleteByPos) interface: The interface for deleting elements in the target ciphertext data block, corresponding to the service for deleting elements in the ciphertext data block to be processed;

[0149] GetByKey (GetByPos) interface: an interface for reading a single element in a target ciphertext data block, corresponding to the service for reading a single element in a ciphertext data block to be processed;

[0150] ScanByKey(ScanByPos): The interface for reading elements within a preset range in the target ciphertext data block, corresponding to the service for reading elements within a preset range in the ciphertext data block to be processed.

[0151] Furthermore, taking the interface and the corresponding service as an example where one interface corresponds to one service, the target ciphertext data processing service is called according to the target ciphertext data processing interface, and the ciphertext data to be processed is processed according to the target ciphertext data processing service to obtain the processed ciphertext data. It can be understood that after the target ciphertext data processing interface is determined in the above-mentioned embodiment of the specification, the ciphertext data processing kernel calls the target ciphertext data processing service corresponding to the interface, and executes the program corresponding to the target ciphertext data processing service to realize data processing of the ciphertext data to be processed and obtain the processed ciphertext data.

[0152] In the case where there are at least two interfaces, the specific implementation of the above steps is as follows:

[0153] The target ciphertext data processing interface includes at least two;

[0154] Correspondingly, calling a target ciphertext data processing service according to the target ciphertext data processing interface, and performing data processing on the ciphertext data to be processed according to the target ciphertext data processing service to obtain processed ciphertext data includes:

[0155] calling at least two target ciphertext data processing services according to the at least two target ciphertext data processing interfaces;

[0156] The ciphertext data to be processed is processed according to the at least two target ciphertext data processing services to obtain processed ciphertext data.

[0157] Specifically, the specific implementation method of the embodiments of this specification can refer to the embodiments of the above specification. The only difference is that when the embodiments of the above specification determine at least two interfaces, the embodiments of this specification call at least two target ciphertext data processing services corresponding to at least two interfaces, and implement data processing to obtain processed ciphertext data.

[0158] For example, an application example is provided in which the ciphertext data processing request sent by the data processing engine is used as a designated position in a ciphertext array (for example, the starting position of the ciphertext array), and the minimum data greater than the preset parameter of the ciphertext array is inserted into the ciphertext array.

[0159] After receiving the ciphertext data processing request sent by the data processing engine, the ciphertext data processing kernel decrypts the ciphertext data block to be processed and parses the ciphertext data processing request, and determines that the data processing required for the ciphertext data block to be processed is to insert an element in the target ciphertext data block, and the inserted element is determined by searching for the minimum data greater than the preset parameter in the ciphertext data block to be processed, thereby determining that the target ciphertext data processing interface is the PutByKey interface (i.e., the target ciphertext data block insertion element interface, a type of target ciphertext data block operation interface) and the Search interface (i.e., the target ciphertext data specified range minimum data search interface). According to these two interfaces, the ciphertext data processing kernel calls the target ciphertext data block insertion element service and the target ciphertext data specified range minimum data search service.

[0160] Furthermore, the ciphertext data processing kernel first searches for the minimum data greater than the preset parameters from the ciphertext data to be processed by calling the minimum data search service of the specified range of the target ciphertext data, and inserts the searched data into the corresponding position in the target ciphertext data block to be processed through the target ciphertext data block insertion element service. Therefore, there is no need to add search data related code in the target ciphertext data block insertion element service. The data processing of the ciphertext data to be processed can be achieved only by reusing the code (reusing the function).

[0161] The data processing method based on a trusted execution environment provided in the embodiments of this specification processes the ciphertext data to be processed by calling the target ciphertext data processing service corresponding to the interface after determining the target ciphertext data processing interface, thereby ensuring the normal progress of the data processing of the ciphertext data to be processed and the security of the data processing of the ciphertext data to be processed. In the case of at least two interfaces, it can be implemented by reusing code (reusing functions), reducing the size of the code and reducing the resource consumption of the code for verifying the ciphertext data processing.

[0162] Step 208: Return the processed ciphertext data to the data processing engine.

[0163] Specifically, after the data processing core completes processing the ciphertext data to be processed, the data processing core returns the processed ciphertext data to the data processing engine.

[0164] Furthermore, after receiving the processed ciphertext data, the data processing engine executes the target data processing task according to the processed ciphertext data and obtains the data processing result; for example, the processed ciphertext data is the hash value of each ciphertext data in a ciphertext array, and executing the target data processing task is to store each ciphertext data in the ciphertext array according to the hash value, thereby storing each ciphertext data in the ciphertext array according to the storage address given by the hash value.

[0165] The data processing method based on a trusted execution environment provided in the embodiments of this specification receives a ciphertext data processing request sent by a data processing engine built on a data processing server end by loading a ciphertext data processing kernel in an isolated area, thereby transferring only the portion of the data processing engine that needs to perform ciphertext data processing to the isolated area for implementation. By loading only the ciphertext data processing kernel in the isolated area, the amount of code in the isolated area is reduced while the ciphertext data processing request is parsed according to the ciphertext data processing kernel loaded in the isolated area to determine the target ciphertext data processing interface and the ciphertext data processing service corresponding to the interface, thereby implementing data processing of the ciphertext data to be processed. Therefore, in this method, only the code of each ciphertext data processing service provided by the ciphertext data processing kernel loaded in the isolated area needs to be verified to ensure the security of the ciphertext data to be processed during the data processing process. The total amount of this code is small, so the verification of this code reduces manpower consumption and space occupation of the isolated area. Moreover, when the data processing engine is updated or patched, only the portion outside the isolated area needs to be updated, without the need to update each ciphertext data processing service in the isolated area. Therefore, there is no need to repeatedly verify the code of each ciphertext data processing service in the isolated area, which greatly reduces manpower consumption.

[0166] See also Figure 3 , Figure 3 This is a flowchart of another data processing method based on a trusted execution environment provided according to an embodiment of the present specification, which is applied to a data processing engine built on a data processing server. The data processing server is configured with a trusted execution environment, and the trusted execution environment creates an isolation area. The isolation area is loaded with a ciphertext data processing kernel. The method specifically includes the following steps.

[0167] Step 302: In response to the data processing request sent by the data processing client, the data processing request is parsed to generate a target data processing task.

[0168] Step 304: When it is determined that the target data processing task includes a ciphertext data processing task, a ciphertext data processing request is generated according to the ciphertext data processing task.

[0169] The ciphertext data processing request carries the ciphertext data to be processed corresponding to the ciphertext data processing task.

[0170] Optionally, the ciphertext data to be processed includes a ciphertext data block to be processed.

[0171] Step 306: Send the ciphertext data processing request to the isolation area, so that the ciphertext data processing kernel loaded in the isolation area receives and parses the ciphertext data processing request, determines the target ciphertext data processing interface from the ciphertext data processing interface set, calls the target ciphertext data processing service according to the target ciphertext data processing interface, and processes the ciphertext data to be processed according to the target ciphertext data processing service, and obtains and returns the processed ciphertext data.

[0172] Step 308: Receive the processed ciphertext data returned by the isolation area, and execute the target data processing task according to the processed ciphertext data to obtain a data processing result.

[0173] Optionally, executing the target data processing task according to the processed ciphertext data to obtain a data processing result includes:

[0174] When it is determined that the target data processing task includes a plaintext data processing task, performing data processing on the to-be-processed plaintext data corresponding to the plaintext data processing task to obtain processed plaintext data;

[0175] A data processing result is obtained according to the processed ciphertext data and the processed plaintext data.

[0176] Specifically, the specific implementation methods of the embodiments of this specification can be found in the above-mentioned embodiments, which will not be repeated here.

[0177] The embodiment of the present specification provides a data processing method based on a trusted execution environment. When the data processing engine processes ciphertext data, the ciphertext data processing kernel loaded in the isolation area receives the ciphertext data processing request sent by the data processing engine built on the data processing server, thereby only transferring the part of the data processing engine that needs to process ciphertext data to the isolation area for implementation. By loading only the ciphertext data processing kernel in the isolation area, the amount of code in the isolation area is reduced while the ciphertext data processing request is parsed according to the ciphertext data processing kernel loaded in the isolation area to determine the target ciphertext data processing interface and the ciphertext data processing server corresponding to the interface. service, to realize data processing of the ciphertext data to be processed; therefore, in this method, it is only necessary to verify the code of each ciphertext data processing service provided by the ciphertext data processing kernel loaded in the isolation area to ensure the security of the ciphertext data to be processed during the data processing process, and the total amount of the code is small, so the verification of the code reduces manpower consumption and space occupation of the isolation area, and when the data processing engine is updated or patched, it is only necessary to update the part outside the isolation area, without updating the ciphertext data processing services in the isolation area, so there is no need to repeatedly verify the code of each ciphertext data processing service in the isolation area, which greatly reduces the manpower consumption brought about by the verification of the data processing engine.

[0178] See also Figure 4 , Figure 4 This is a structural diagram of a trusted kernel provided in a data processing method based on a trusted execution environment provided in one embodiment of this specification.

[0179] The trusted kernel can be understood as the ciphertext data processing kernel in the above-mentioned embodiment. It supports a relatively rich set of functions and adheres to the concept of simplicity to prevent the trusted kernel from becoming fragile due to being too large. To ensure that the trusted kernel only contains necessary functional services, the trusted kernel in the embodiments of this specification achieves at least the following four design goals:

[0180] (1) Versatility: The trusted kernel provides a unified interface to accommodate the needs of multiple storage engines;

[0181] (2) Flexibility: The trusted kernel supports the storage engine to use multiple data encryption granularities by providing multiple interfaces to achieve performance trade-offs;

[0182] (3) Simplicity: The code of each functional service of the trusted kernel is reused to minimize the size of the code base in the trusted kernel;

[0183] (4) Efficiency: The trusted kernel reduces context switching to optimize the inherent performance degradation caused by using TEE technology.

[0184] Based on this, the trusted kernel structure provided by the embodiment of this specification is as follows Figure 4 As shown, the trusted kernel consists of a coordinator module (i.e., the above-mentioned coordination module) and three core modules (computing operator module, trusted search algorithm module, and trusted data structure module). The three core modules are the functional sub-modules that implement various functions in the functional modules in the above-mentioned embodiments. In actual applications, the number of core modules is not limited.

[0185] The following uses three core modules as an example to illustrate the trusted kernel.

[0186] (1) Computation operator module

[0187] The embodiments of this specification provide a CmpBatch interface and a HashBatch interface, which support hash calculation and comparison operations on batch data; when the two interfaces are called from the outside (untrusted context, i.e., the data processing engine of the above embodiment), the coordinator module (i.e., the coordination module) of the trusted kernel (trusted context, i.e., the ciphertext data processing kernel of the above embodiment) will convert the batch processing request into a call to the Cmp function (Cmp(x,y) function, i.e., the ciphertext data processing service corresponding to the CmpBatch interface) and the Hash function (Hash(x,seed) function, i.e., the ciphertext data processing service corresponding to the HashBatch interface) of the calculation operator module. Since the input parameters of these two functions may be ciphertext (for example, when these functions are called in an untrusted context) or plaintext format (for example, when they are called by other functions inside the Enclave that process plaintext data), in order to support different input formats without introducing redundant code, the type EncData is additionally defined as the input parameter of these two functions, and the type of input data is distinguished by is_cipher in EncData; in addition, the embodiments of this specification also provide a seed parameter for the Hash function to support scenarios where multiple independent hash functions need to be generated.

[0188] For example, taking the CmpBatch interface as an example, the specific execution process is introduced:

[0189] Step a. The external caller calls the CmpBatch interface;

[0190] Step b. The coordinator module calls the Cmp function to process batch requests in sequence, and returns the execution result after the request processing is completed;

[0191] Step c. The Cmp function determines whether the two input parameters are of the same type, that is, both are ciphertext or both are plaintext, and executes the next step; otherwise, it detects that the caller is trying to compare the size of the plaintext and ciphertext, and the execution fails.

[0192] Step d. If the input data is all ciphertext, decrypt it to obtain plaintext.

[0193] Step e. Compare the plaintext to obtain the calculation result, and then go to step b to continue execution.

[0194] (2) Trusted Search Algorithm Module

[0195] In the encryption storage engine, although only providing ciphertext calculation operators is sufficient to support the implementation of the encryption storage engine, this will lead to frequent TEE context switching. In order to solve this technical problem, the embodiment of this specification extends the function of the trusted kernel by using advanced search algorithms. This solution provides Min(arr) and Search(arr, ordered, condKey) interfaces, which respectively support finding the minimum value on an EncData array arr and finding the minimum element that is not less than condKey; Among them, the Min function is a special case of the Search function. When the parameter ordered is false and condKey is -inf, the Search function Its function is to search for the minimum value in the array, which is the definition of the Min function. When these two interfaces are called externally, the coordinator module of the trusted kernel will convert the request into a call to the BinarySearch function (i.e., the BinarySearch(arr,condKey) function) or the LinearSearch function (i.e., the LinearSearch(arr,condKey) function), corresponding to the cases where the ordered parameter is true and false respectively. Among them, the BinarySearch function uses a binary search algorithm to search the array, while the LinearSearch function finds the key that meets the conditions by traversing the array.

[0196] Furthermore, since the storage engine based on data item granularity encryption (each data item is encrypted separately) does not change the storage structure of the plaintext version, its data processing operations can be reduced to add, delete, modify and query operations on basic data structures (arrays and linked lists), and the logic related to ciphertext calculation in these operations can be converted into a search process for a specified key on the array; therefore, based on the Min and Search interfaces provided by the trusted kernel, developers do not need to write trusted code and can implement the encrypted storage engine by directly calling these two interfaces.

[0197] For example, taking the Search interface as an example, the specific execution process is introduced:

[0198] Step a. The external caller (ie, the data processing engine) calls the Search interface;

[0199] Step b. The coordinator module further processes according to the value of the ordered parameter: if it is true, the BinarySearch function is called; if it is false, the LinearSearch function is called;

[0200] Step c. The BinarySearch function uses the binary search algorithm (the LinearSearch function traverses the array) to find the smallest element in the array that is not less than condKey, and records the position of the element in the array in the variable pos; when the element is equal to condKey, the variable found is set to true, otherwise it is set to false; pos and found are returned to the external caller.

[0201] (3) Trusted Data Structure Module

[0202] The technical solution provided in the embodiments of this specification also supports the storage engine to encrypt data in a coarse-grained manner, that is, it allows multiple data items to be encrypted into a ciphertext block within the storage engine, such as encrypting nodes within a B-tree and encrypting data blocks within an LSM-tree. In order to support operations on elements within a ciphertext block, this solution provides a PutByKey interface (or PutByPos interface), an UpdateByKey interface (or UpdateByPos interface), a DeleteByKey interface (or DeleteByPos interface), a GetByKey interface (or GetByPos interface), and a ScanByKey interface (or ScanByPos interface), which are respectively used to insert elements, update elements, delete elements, read a single element, and read elements within a range in a ciphertext block. When these interfaces are called externally, the coordinator module of the trusted kernel will decrypt the ciphertext block and obtain the following: Figure 5 The plaintext data block is similar to the array structure shown, and then the corresponding operation is performed on the data block.

[0203] See also Figure 5 , Figure 5 This is a schematic diagram of a plaintext data block of a data processing method based on a trusted execution environment provided by an embodiment of this specification, wherein the plaintext data block is divided into an array area and a binary data area. It should be noted that: Figure 5 The data storage model is shown as an example of a key-value data structure for storing plaintext data blocks. In actual applications, it can be replaced according to needs, and this manual does not limit this.

[0204] When the called interface is a data query interface, the storage engine needs to first query the plaintext data block, then encrypt the query structure and return it to the caller. When the called interface involves data update, it needs to first decrypt the data block, update the corresponding data in the decrypted data block, and then re-encrypt the data block.

[0205] Furthermore, the decrypted plaintext data block is divided into an array area and a binary data area. The binary data area stores a variable-length data payload (i.e., the key and value of the data item) and uses an append-only approach for insertion operations. The first 12 bytes of the array area are used to record metadata for the data block (block size, offset at the end of the array area, offset at the beginning of the binary area), and the remaining space is used to record the offset of each data item within the binary data area. To facilitate data updates within a data block, this solution provides an UnorderedArray class that supports key-based and position-based add, delete, modify, and query operations on this layout. For example, to insert a data item at a specific position in a data block, the data item is first appended to the binary data area, and then the offset is inserted into the corresponding position in the array area. To support searching for a data item by key in an UnorderedArray, the LinearSearch function can be reused to search the array area. The data items in an UnorderedArray are unordered; that is, the offsets of each data item in the array area are organized in chronological order of the added data. This solution further extends UnorderedArray to support OrderedArray, so that the offset of each data item in the array area is organized according to the key order of the corresponding data, so the BinarySearch method can be used to query the data in the OrderedArray.

[0206] For example, the specific execution process is introduced using the PutByKey interface as an example (for data query interfaces, such as GetByKey, the re-encryption step in step e is not required):

[0207] Step a. The external caller calls the PutByKey interface;

[0208] Step b. The coordinator module decrypts the ciphertext block and further processes it according to the value of the ordered parameter: if it is true, the data is written according to the logic of OrderedArray and the process goes to step c; if it is false, the data is written according to the logic of UnorderedArray and the process goes to step d;

[0209] In step c. OrderedArray first calls BinarySearch based on the input parameter key to find the position of the data item to be inserted in the array area (denoted as pos), appends the data item to the binary data area, and then inserts its offset into the array area at position pos, and then goes to step e.

[0210] Step d. UnorderedArray appends the data item to the binary data area, then inserts its offset into the array area at position pos, and then goes to step e.

[0211] Step e. The coordinator module re-encrypts the plaintext block and the execution is completed.

[0212] In addition, the embodiments of this specification provide a set of unified interfaces to increase practicality. The definitions of these interfaces are shown in Table 1 below:

[0213] Table 1

[0214]

[0215]

[0216] Table 1 above schematically shows a set of unified interfaces to increase practicality. In actual applications, some or all of the above interfaces can be used, and interfaces not shown in Table 1 above can be added as needed. This manual does not limit this.

[0217] For example, the EncData interface is used to identify specific data, which contains the is_cipher parameter to identify whether the data is ciphertext data; for another example, the Result interface is used to store query results, where the query results include but are not limited to the returned encryption key data, the returned encrypted value data, the returned index array, the number of returned data items, etc.

[0218] The data processing method based on a trusted execution environment provided in the embodiments of this specification proposes a trusted kernel to solve the trust issues faced in building an encrypted storage system. By excluding the developers of the encrypted storage system from the trusted domain, vulnerabilities are prevented. Users only need to verify the trusted kernel to believe in its security, and then they can trust all encrypted storage systems built based on the kernel, without having to trust the developers of each encrypted storage engine. In addition, the developers of the storage system call the API provided by the trusted kernel by writing code running in an untrusted environment, thereby expanding the trusted kernel into a variety of complete encrypted storage systems, and supporting multiple encrypted storage engines and organizing data at different data encryption granularities, thereby increasing the versatility of the trusted kernel. In addition, the embodiments of this specification also make the trusted kernel more concise through technical means such as code reuse and different modules providing different types of functional interfaces, and avoid the problem of vulnerability to attacks caused by an overly large trusted kernel.

[0219] See also Figure 6 , Figure 6 This is a structural diagram of a data processing device based on a trusted execution environment provided by an embodiment of this specification.

[0220] Combine Figure 6 In one or more embodiments of this specification, the data processing device is applied to the ciphertext data processing kernel of the data processing server. The data processing server is configured with a trusted execution environment, and the trusted execution environment creates an isolated area. The ciphertext data processing kernel is loaded in the isolated area. The data processing device includes a coordination module 602 and a functional module 604 provided in the ciphertext data processing kernel, wherein:

[0221] The coordination module 602 is configured to receive a ciphertext data processing request sent by a data processing engine built on the data processing server, wherein the ciphertext data processing request carries ciphertext data to be processed;

[0222] parsing the encrypted data processing request and determining a target encrypted data processing interface from a set of encrypted data processing interfaces, wherein each encrypted data processing interface in the set of encrypted data processing interfaces corresponds to a encrypted data processing service;

[0223] calling the target ciphertext data processing service in the functional module 604 according to the target ciphertext data processing interface, and performing data processing on the ciphertext data to be processed according to the target ciphertext data processing service to obtain processed ciphertext data;

[0224] The processed ciphertext data is returned to the data processing engine.

[0225] Optionally, the target ciphertext data processing interface includes a target ciphertext data calculation interface;

[0226] Correspondingly, the coordination module 602 is further configured to parse the ciphertext data processing request, and determine a target ciphertext data calculation interface when it is determined according to the parsing result that the ciphertext data processing request is for implementing ciphertext data calculation.

[0227] Optionally, the target ciphertext data processing interface includes a target ciphertext data search interface;

[0228] Correspondingly, the coordination module 602 is further configured to parse the ciphertext data processing request, and determine a target ciphertext data search interface when it is determined according to the parsing result that the ciphertext data processing request is for implementing a ciphertext data search.

[0229] Optionally, the target ciphertext data processing interface includes a target ciphertext data block operation interface;

[0230] Correspondingly, the coordination module 602 is also used to parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to implement an operation on the ciphertext data block to be processed, determine the target ciphertext data block operation interface.

[0231] Optionally, the target ciphertext data processing interface includes a target ciphertext data calculation interface and a target ciphertext data search interface;

[0232] Correspondingly, the coordination module 602 is further used to parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data processing request is to implement ciphertext data calculation and ciphertext data search, determine the target ciphertext data calculation interface and the target ciphertext data search interface.

[0233] Optionally, the target ciphertext data processing interface includes a target ciphertext data calculation interface and a target ciphertext data block operation interface;

[0234] Correspondingly, the coordination module 602 is also used to parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to perform calculations and operations on the ciphertext data block to be processed, the target ciphertext data calculation interface and the target ciphertext data block operation interface are determined.

[0235] Optionally, the target ciphertext data processing interface includes a target ciphertext data search interface and a target ciphertext data block operation interface;

[0236] Correspondingly, the coordination module 602 is also used to parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to search and operate the ciphertext data block to be processed, the target ciphertext data search interface and the target ciphertext data block operation interface are determined.

[0237] Optionally, the target ciphertext data processing interface includes a target ciphertext data calculation interface, a target ciphertext data search interface, and a target ciphertext data block operation interface;

[0238] Correspondingly, the coordination module 602 is also used to parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to realize calculation, search and operation of the ciphertext data block to be processed, determine the target ciphertext data calculation interface, the target ciphertext data search interface and the target ciphertext data block operation interface.

[0239] Optionally, the target ciphertext data processing interface includes at least two;

[0240] Accordingly, the coordination module 602 is further configured to call at least two target ciphertext data processing services according to the at least two target ciphertext data processing interfaces;

[0241] The ciphertext data to be processed is processed according to the at least two target ciphertext data processing services to obtain processed ciphertext data.

[0242] The above is a schematic diagram of a data processing device based on a trusted execution environment according to this embodiment. It should be noted that the technical solution of the data processing device based on a trusted execution environment and the technical solution of the data processing method based on a trusted execution environment share the same concept. For details not described in detail in the technical solution of the data processing device based on a trusted execution environment, please refer to the description of the technical solution of the data processing method based on a trusted execution environment.

[0243] See also Figure 7 , Figure 7 This is a schematic diagram of the structure of another data processing device based on a trusted execution environment provided by one embodiment of this specification, wherein the device is applied to a data processing engine built on a data processing server, the data processing server is configured with a trusted execution environment, the trusted execution environment creates an isolated area, and the isolated area is loaded with a ciphertext data processing kernel, the device includes:

[0244] The parsing module 702 is configured to respond to a data processing request sent by a data processing client, parse the data processing request, and generate a target data processing task;

[0245] a generating module 704 configured to, upon determining that the target data processing task includes a ciphertext data processing task, generate a ciphertext data processing request according to the ciphertext data processing task, wherein the ciphertext data processing request carries the ciphertext data to be processed corresponding to the ciphertext data processing task;

[0246] a sending module 706 configured to send the ciphertext data processing request to the isolated area, so that the ciphertext data processing kernel loaded in the isolated area receives and parses the ciphertext data processing request, determines a target ciphertext data processing interface from a set of ciphertext data processing interfaces, calls a target ciphertext data processing service according to the target ciphertext data processing interface, and processes the ciphertext data to be processed according to the target ciphertext data processing service, thereby obtaining and returning processed ciphertext data;

[0247] The receiving module 708 is configured to receive the processed ciphertext data returned by the isolated area, and execute the target data processing task according to the processed ciphertext data to obtain a data processing result.

[0248] Optionally, the receiving module 708 is further configured to, when it is determined that the target data processing task includes a plaintext data processing task, perform data processing on the to-be-processed plaintext data corresponding to the plaintext data processing task to obtain processed plaintext data;

[0249] A data processing result is obtained according to the processed ciphertext data and the processed plaintext data.

[0250] Optionally, the ciphertext data to be processed includes a ciphertext data block to be processed.

[0251] The above is a schematic diagram of another embodiment of a data processing device based on a trusted execution environment. It should be noted that the technical solution of this data processing device based on a trusted execution environment and the technical solution of the data processing method based on a trusted execution environment are based on the same concept. For details not described in detail in the technical solution of the data processing device based on a trusted execution environment, please refer to the description of the technical solution of the data processing method based on a trusted execution environment.

[0252] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0253] It should be noted that for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0254] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0255] The preferred embodiments disclosed above are intended only to help illustrate this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and variations can be made based on the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that those skilled in the art can better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A data processing method based on a trusted execution environment, applied to a ciphertext data processing kernel of a data processing server, wherein the data processing server is configured with a trusted execution environment, the trusted execution environment creates an isolated area, and the ciphertext data processing kernel is loaded into the isolated area, the method comprising: Receiving a ciphertext data processing request sent by a data processing engine built on the data processing server, wherein the ciphertext data processing request carries ciphertext data to be processed; parsing the encrypted data processing request and determining a target encrypted data processing interface from a set of encrypted data processing interfaces, wherein each encrypted data processing interface in the set of encrypted data processing interfaces corresponds to a encrypted data processing service; calling a target ciphertext data processing service according to the target ciphertext data processing interface, and performing data processing on the ciphertext data to be processed according to the target ciphertext data processing service to obtain processed ciphertext data; The processed ciphertext data is returned to the data processing engine.

2. The data processing method based on a trusted execution environment according to claim 1, wherein the target ciphertext data processing interface comprises a target ciphertext data calculation interface; Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes: The ciphertext data processing request is parsed, and when it is determined according to the parsing result that the ciphertext data processing request is for implementing ciphertext data calculation, a target ciphertext data calculation interface is determined.

3. The data processing method based on a trusted execution environment according to claim 1, wherein the target ciphertext data processing interface comprises a target ciphertext data search interface; Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes: The ciphertext data processing request is parsed, and when it is determined according to the parsing result that the ciphertext data processing request is for implementing a ciphertext data search, a target ciphertext data search interface is determined.

4. The data processing method based on a trusted execution environment according to claim 1, wherein the target ciphertext data processing interface comprises a target ciphertext data block operation interface; Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes: Parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to implement an operation on the ciphertext data block to be processed, determine a target ciphertext data block operation interface.

5. The data processing method based on a trusted execution environment according to claim 1, wherein the target ciphertext data processing interface includes a target ciphertext data calculation interface and a target ciphertext data search interface; Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes: The ciphertext data processing request is parsed, and when it is determined according to the parsing result that the ciphertext data processing request is to implement ciphertext data calculation and ciphertext data search, the target ciphertext data calculation interface and the target ciphertext data search interface are determined.

6. The data processing method based on a trusted execution environment according to claim 1, wherein the target ciphertext data processing interface includes a target ciphertext data calculation interface and a target ciphertext data block operation interface; Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes: Parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to perform calculations and operations on the ciphertext data block to be processed, determine the target ciphertext data calculation interface and the target ciphertext data block operation interface.

7. The data processing method based on a trusted execution environment according to claim 1, wherein the target ciphertext data processing interface includes a target ciphertext data search interface and a target ciphertext data block operation interface; Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes: Parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to search for and operate on the ciphertext data block to be processed, determine the target ciphertext data search interface and the target ciphertext data block operation interface.

8. The data processing method based on a trusted execution environment according to claim 1, wherein the target ciphertext data processing interface includes a target ciphertext data calculation interface, a target ciphertext data search interface, and a target ciphertext data block operation interface; Accordingly, the parsing of the ciphertext data processing request and determining a target ciphertext data processing interface from a set of ciphertext data processing interfaces includes: Parse the ciphertext data processing request, and when it is determined based on the parsing result that the ciphertext data to be processed carried in the ciphertext data processing request is a ciphertext data block to be processed, and the ciphertext data processing request is to realize calculation, search and operation on the ciphertext data block to be processed, determine the target ciphertext data calculation interface, the target ciphertext data search interface and the target ciphertext data block operation interface.

9. The data processing method based on a trusted execution environment according to claim 1, wherein the target ciphertext data processing interface includes at least two; Correspondingly, calling a target ciphertext data processing service according to the target ciphertext data processing interface, and performing data processing on the ciphertext data to be processed according to the target ciphertext data processing service to obtain processed ciphertext data includes: calling at least two target ciphertext data processing services according to the at least two target ciphertext data processing interfaces; The ciphertext data to be processed is processed according to the at least two target ciphertext data processing services to obtain processed ciphertext data.

10. A data processing method based on a trusted execution environment, applied to a data processing engine built on a data processing server, wherein the data processing server is configured with a trusted execution environment, the trusted execution environment creates an isolated area, and the isolated area is loaded with a ciphertext data processing kernel, the method comprising: Responding to a data processing request sent by a data processing client, parsing the data processing request and generating a target data processing task; If it is determined that the target data processing task includes a ciphertext data processing task, generating a ciphertext data processing request according to the ciphertext data processing task, wherein the ciphertext data processing request carries the ciphertext data to be processed corresponding to the ciphertext data processing task; Sending the ciphertext data processing request to the isolated area, so that the ciphertext data processing kernel loaded in the isolated area receives and parses the ciphertext data processing request, determines a target ciphertext data processing interface from a set of ciphertext data processing interfaces, calls a target ciphertext data processing service according to the target ciphertext data processing interface, and processes the ciphertext data to be processed according to the target ciphertext data processing service, thereby obtaining and returning processed ciphertext data; The processed ciphertext data returned by the isolation area is received, and the target data processing task is executed according to the processed ciphertext data to obtain a data processing result.

11. The data processing method based on a trusted execution environment according to claim 10, wherein executing the target data processing task according to the processed ciphertext data to obtain a data processing result comprises: When it is determined that the target data processing task includes a plaintext data processing task, performing data processing on the to-be-processed plaintext data corresponding to the plaintext data processing task to obtain processed plaintext data; A data processing result is obtained according to the processed ciphertext data and the processed plaintext data. 12 . The data processing method based on a trusted execution environment according to claim 10 , wherein the ciphertext data to be processed comprises a ciphertext data block to be processed.

13. A data processing device based on a trusted execution environment, applied to a ciphertext data processing kernel of a data processing server, wherein the data processing server is configured with a trusted execution environment, the trusted execution environment creates an isolated area, and the ciphertext data processing kernel is loaded into the isolated area. The device includes a coordination module and a functional module provided in the ciphertext data processing kernel, wherein: The coordination module is configured to receive a ciphertext data processing request sent by a data processing engine built on the data processing server, wherein the ciphertext data processing request carries ciphertext data to be processed; parsing the encrypted data processing request and determining a target encrypted data processing interface from a set of encrypted data processing interfaces, wherein each encrypted data processing interface in the set of encrypted data processing interfaces corresponds to a encrypted data processing service; calling the target ciphertext data processing service in the functional module according to the target ciphertext data processing interface, and performing data processing on the ciphertext data to be processed according to the target ciphertext data processing service to obtain processed ciphertext data; The processed ciphertext data is returned to the data processing engine.

14. A data processing device based on a trusted execution environment, applied to a data processing engine built on a data processing server, wherein the data processing server is configured with a trusted execution environment, the trusted execution environment creates an isolated area, and the isolated area is loaded with a ciphertext data processing kernel, the device comprising: A parsing module, configured to respond to a data processing request sent by a data processing client, parse the data processing request, and generate a target data processing task; a generating module configured to, upon determining that the target data processing task includes a ciphertext data processing task, generate a ciphertext data processing request according to the ciphertext data processing task, wherein the ciphertext data processing request carries the ciphertext data to be processed corresponding to the ciphertext data processing task; a sending module, configured to send the ciphertext data processing request to the isolated area, so that the ciphertext data processing kernel loaded in the isolated area receives and parses the ciphertext data processing request, determines a target ciphertext data processing interface from a set of ciphertext data processing interfaces, calls a target ciphertext data processing service according to the target ciphertext data processing interface, and processes the ciphertext data to be processed according to the target ciphertext data processing service, thereby obtaining and returning processed ciphertext data; A receiving module is used to receive the processed ciphertext data returned by the isolation area, and execute the target data processing task according to the processed ciphertext data to obtain a data processing result.

Images