Data cross-domain sharing method and device, equipment and medium

Abstract

The invention discloses a data cross-domain sharing method and device, equipment and a medium, and relates to the field of data security, and the method comprises the steps that a data provider obtains a first SM4 key and a first certificate; encrypting local data by using the first SM4 key to obtain encrypted data, and encrypting the first SM4 key by using a second certificate returned by the trusted execution environment after successful authentication of the trusted execution environment to obtain a first encrypted key; encrypting a preset authorization file by using the first certificate, sending the encrypted authorization file and the first encrypted key to the trusted execution environment, so that the trusted execution environment authenticates the target trusted program, and generating a second encrypted key after the authentication is passed; and sending the encrypted data to the target trusted program, so that the target trusted program decrypts the encrypted data based on the second encrypted key to restore the encrypted data to obtain local data, and completing cross-domain sharing of the local data. And the confidentiality and integrity of the data cross-domain sharing process are ensured.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a method, device, equipment and medium for cross-domain data sharing. Background Art

[0002] In the field of artificial intelligence and big data, data flows between different entities, that is, sharing sensitive data, thereby bringing greater value, but also brings security risks such as data leakage, abuse, infringement, etc. to the data itself and the data holder, which drives the data subject to establish a mechanism for cross-domain control of data. At present, the cross-domain data control solutions on the market involve the safe storage, secure transmission, and authorized use of data. Traditional data desensitization and authentication methods are often used. The existing technology lacks the combination of national secret algorithms and TEE (Trusted execution environment) to ensure the confidentiality and integrity of data transmission, use, storage, etc. in cross-domain sharing and control, and cannot meet the needs of certain high-security and commercial secret compliance application scenarios.

[0003] To sum up, how to ensure the confidentiality and integrity of data during cross-domain data sharing and management, and meet the requirements of high-security and commercial secret compliance application scenarios is an urgent problem to be solved. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for cross-domain data sharing, which can ensure the confidentiality and integrity of data during cross-domain data sharing and management, and meet the application scenario requirements of high security and commercial secret compliance while ensuring that data is used efficiently. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a method for cross-domain data sharing, which is applied to a data provider, and includes:

[0006] Obtain a first SM4 key sent by a key management center based on a first SM4 key application request and a first certificate sent by a certificate authority based on a certificate application request;

[0007] Encrypting local data using the first SM4 key to obtain encrypted data, remotely authenticating the trusted execution environment, obtaining a second certificate returned by the trusted execution environment after successful authentication, and encrypting the first SM4 key using the second certificate to obtain a first encrypted key;

[0008] Encrypting a preset authorization file using the first certificate, and sending the corresponding encrypted authorization file and the first encrypted key to the trusted execution environment through a first secure channel, so that the trusted execution environment authenticates the target trusted program based on the encrypted authorization file, and generates a second encrypted key based on the first encrypted key after the authentication is passed;

[0009] The encrypted data is sent to the target trusted program through a second secure channel, so that the target trusted program decrypts the encrypted data based on the second encrypted key sent by the trusted execution environment to restore the local data, thereby completing the cross-domain sharing of the local data.

[0010] Optionally, after the remote authentication of the trusted execution environment, the method further includes:

[0011] If the trusted execution environment remote authentication fails, the process ends directly.

[0012] Optionally, the using the first certificate to encrypt the preset authorization file includes:

[0013] The preset authorization file is encrypted using the private key signature corresponding to the signature certificate in the first certificate.

[0014] Optionally, obtaining a first certificate sent by a certificate authority based on a certificate application request includes:

[0015] The certificate application request is sent to the certificate authority, so that the certificate authority sends the first certificate to the data provider and the trusted execution environment based on the certificate application request.

[0016] Optionally, the process of generating the second encrypted key includes:

[0017] After the trusted execution environment receives the key acquisition request sent by the target trusted program and its own third certificate, it uses the first certificate to decrypt the encrypted authorization file, uses the corresponding decrypted authorization file to authenticate the target trusted program, and generates the second encrypted key based on the third certificate and the first encrypted key after the authentication is passed.

[0018] Optionally, the generating the second encrypted key based on the third certificate and the first encrypted key after authentication is passed includes:

[0019] After the trusted execution environment authenticates the target trusted program, it uses the second certificate to decrypt the first encrypted key, encrypts the corresponding first decrypted key based on the third certificate to obtain the second encrypted key, and sends the second encrypted key to the target trusted program.

[0020] Optionally, the process of restoring the local data includes:

[0021] The target trusted program decrypts the second encrypted key sent by the trusted execution environment through the third certificate to obtain a second SM4 key, and uses the second SM4 key to decrypt the encrypted data to restore the local data.

[0022] In a second aspect, the present application provides a data cross-domain sharing device, which is applied to a data provider, including:

[0023] A key and certificate acquisition module, used to acquire a first SM4 key sent by a key management center based on a first SM4 key application request and a first certificate sent by a certificate authority based on a certificate application request;

[0024] A key encryption module, configured to encrypt local data using the first SM4 key to obtain encrypted data, remotely authenticate the trusted execution environment, obtain a second certificate returned by the trusted execution environment after successful authentication, and encrypt the first SM4 key using the second certificate to obtain a first encrypted key;

[0025] a key sending module, configured to encrypt a preset authorization file using the first certificate, and send the corresponding encrypted authorization file and the first encrypted key to the trusted execution environment through a first secure channel, so that the trusted execution environment authenticates the target trusted program based on the encrypted authorization file, and generates a second encrypted key based on the first encrypted key after the authentication is passed;

[0026] A data restoration module is used to send the encrypted data to the target trusted program through a second secure channel, so that the target trusted program decrypts the encrypted data based on the second encrypted key sent by the trusted execution environment to restore the local data, thereby completing the cross-domain sharing of the local data.

[0027] In a third aspect, the present application provides an electronic device, including:

[0028] Memory, used to store computer programs;

[0029] The processor is used to execute the computer program to implement the cross-domain data sharing method as described above.

[0030] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the cross-domain data sharing method as described above is implemented.

[0031] To summarize, the present application first obtains the first SM4 key sent by the key management center based on the first SM4 key application request and the first certificate sent by the certificate authority based on the certificate application request; uses the first SM4 key to encrypt local data to obtain encrypted data, remotely authenticates the trusted execution environment, and obtains the second certificate returned by the trusted execution environment after successful authentication, and uses the second certificate to encrypt the first SM4 key to obtain the first encrypted key; uses the first certificate to encrypt the preset authorization file, and sends the corresponding encrypted authorization file and the first encrypted key to the trusted execution environment through a first secure channel, so that the trusted execution environment authenticates the target trusted program based on the encrypted authorization file, and generates a second encrypted key based on the first encrypted key after the authentication is passed; sends the encrypted data to the target trusted program through a second secure channel, so that the target trusted program decrypts the encrypted data based on the second encrypted key sent by the trusted execution environment to restore the local data, so as to complete the cross-domain sharing of the local data. It can be seen that the present application first obtains the first SM4 key sent by the key management center and the first certificate sent by the certificate authority, uses the first SM4 key to encrypt the local data, and remotely authenticates the trusted execution environment. After the authentication is completed, the second certificate is obtained, and the first SM4 key is encrypted again using the obtained second certificate to generate the first encrypted key. The preset authorization file is encrypted using the obtained first certificate, and the encrypted authorization file and its corresponding first encrypted key are transmitted to the trusted execution environment through the first secure channel, so as to perform identity authentication for the designated target trusted program based on the received data. If the verification is successful and the permission requirements are met, the trusted execution environment will generate a second encrypted key based on the first encrypted key, and the encrypted data will be transmitted to the target trusted program through a different second secure channel. The target trusted program decrypts the encrypted data with the second encrypted key and restores it to the local data. That is, the present application encrypts the local data and the key for encrypting the local data before data transmission, and verifies the different subjects of data sharing, combines TEE technology with commercial secret algorithms to meet the integrity and confidentiality of data cross-domain sharing and data control process chains, and ensures that the data is used efficiently while meeting certain high-security and commercial secret compliance application scenario requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0033] Figure 1 A schematic diagram of a system framework applicable to a cross-domain data sharing method disclosed in the present application;

[0034] Figure 2 A flow chart of a cross-domain data sharing method disclosed in this application;

[0035] Figure 3 A flowchart of a specific cross-domain data sharing method disclosed in this application;

[0036] Figure 4 This is a timing diagram of a specific cross-domain data sharing method disclosed in this application;

[0037] Figure 5 This is a timing diagram of a specific cross-domain data sharing method disclosed in this application;

[0038] Figure 6 This is a timing diagram of a specific cross-domain data sharing method disclosed in this application;

[0039] Figure 7 This is a schematic diagram of the structure of a data cross-domain sharing device disclosed in this application;

[0040] Figure 8 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] At present, the existing technology is a cross-domain data management and control solution, which often uses traditional data desensitization and authentication methods when it comes to the secure storage, secure transmission, and authorized use of data. The existing technology lacks the combination of national secret algorithms and TEE to ensure the confidentiality and integrity of data in the process of transmission, use, storage, etc. during cross-domain sharing and management, and cannot meet the needs of certain high-security and commercial secret compliance application scenarios. In order to solve the above technical problems, the present application discloses a cross-domain data sharing method, device, equipment and medium, which can ensure the confidentiality and integrity of data in the process of cross-domain data sharing and management, and meet the needs of high-security and commercial secret compliance application scenarios while ensuring that data is used efficiently.

[0043] The system framework used in the cross-domain data sharing solution of this application can be found in Figure 1 As shown, it may specifically include a data provider, a trusted execution environment, a target trusted program, a key management center, and a certificate authority.

[0044] In the present application, the data provider is used to execute the steps of the cross-domain data sharing method, including obtaining a first SM4 key sent by a key management center based on a first SM4 key application request and a first certificate sent by a certificate authority based on a certificate application request; using the first SM4 key to encrypt local data to obtain encrypted data, remotely authenticate the trusted execution environment, obtain a second certificate returned by the trusted execution environment after successful authentication, and use the second certificate to encrypt the first SM4 key to obtain a first encrypted key; using the first certificate to encrypt a preset authorization file, and sending the corresponding encrypted authorization file and the first encrypted key to the trusted execution environment through a first secure channel, so that the trusted execution environment authenticates the target trusted program based on the encrypted authorization file, and generates a second encrypted key based on the first encrypted key after the authentication is passed; sending the encrypted data to the target trusted program through a second secure channel, so that the target trusted program decrypts the encrypted data based on the second encrypted key sent by the trusted execution environment to restore the local data, so as to complete the cross-domain sharing of local data.

[0045] It is important to know that the data provider, as the owner of the original data, not only controls the source data, but also has the right to determine the use rights and purposes of the data. The data provider inputs data to the target trusted program and can receive the results of complex operations such as machine learning in the TEE environment from the latter. During the entire data sharing process, it is ensured that the source data and calculation results can only be accessed by itself or other authorized objects, ensuring the security and privacy of the data. The trusted execution environment acts as a bridge between the upper-layer applications and services and the underlying trusted execution environment. It mainly provides the implementation of the remote attestation protocol, that is, to prove that a TEE has not been tampered with and is running as expected, and maintains basic functions related to key management and authentication, such as generating, storing, rotating and deleting TEE-specific authentication reports. The target trusted program is a software component running in a secure environment within the TEE, which can process confidential data submitted by the data provider and perform operations such as machine learning training. All computing processes are completed in isolation in the TEE to ensure that the data will not be maliciously attacked or snooped during the computing stage. The key management center is a system component designed specifically to securely manage cryptographic materials. The core mission of the key management center is to ensure that data is fully protected during the process of entering, being stored in, and leaving the TEE. The key management center not only distributes the session keys required for symmetric data encryption and decryption to all parties involved in the transmission, but also collaborates with the certificate authority to create and maintain key pairs for non-ciphertext content exchange. In addition, the key management center needs to rotate keys regularly to prevent the risk of leakage, and provide key destruction services when necessary. The role of the certificate authority is to issue digital certificates based on domestic cryptographic algorithms, providing a shared verification mechanism for each participant in the system. Each target trusted program, data provider, or key management center can apply for and obtain a certificate issued by the certificate authority after review to verify its own legal identity and the integrity and source correctness of the messages it sends.

[0046] See also Figure 2 As shown, an embodiment of the present invention discloses a method for cross-domain data sharing, which is applied to a data provider and includes:

[0047] Step S11: Acquire a first SM4 key sent by a key management center based on a first SM4 key application request and a first certificate sent by a certificate authority based on a certificate application request.

[0048] In this embodiment, in order to ensure information security and achieve end-to-end secure communication, first, the data provider will initiate a first SM4 key application request to the key management center. After receiving this request, the key management center will return the first SM4 key to the data provider.

[0049] In this embodiment, in order to obtain the first certificate, the data provider sends a certificate application request to the certificate authority, so that the certificate authority sends the first certificate to the data provider based on the certificate application request, and sends it to the trusted execution environment at the same time. Specifically, the data provider sends a certificate application request containing user information to the certificate authority. After the certificate application request is delivered to the certificate authority, the certificate authority performs a strict review to determine the legitimacy of the applicant. This step is completed by comparing the multi-dimensional information such as the physical credentials and contact information provided by the user. After confirmation, the certificate authority will issue the first certificate to the data provider who sent the certificate application request. The first certificate includes an encryption certificate and a signature certificate.

[0050] Step S12: Use the first SM4 key to encrypt local data to obtain encrypted data, remotely authenticate the trusted execution environment, obtain the second certificate returned by the trusted execution environment after successful authentication, and use the second certificate to encrypt the first SM4 key to obtain a first encrypted key.

[0051] In this embodiment, first, the data provider uses the first SM4 key to encrypt local data to ensure data security after the local data leaves the data provider. After encrypting the local data, the data provider needs to remotely authenticate the trusted execution environment and obtain the corresponding authentication report, and determine whether the authentication is successful based on the content of the authentication report. Once the remote authentication is successful, it means that the trusted execution environment is safe and meets the expected conditions, then the second certificate returned by the trusted execution environment can be further obtained, and the first SM4 key can be encrypted using the second certificate to obtain the first encrypted key. The second certificate is usually a security token or digital certificate of the trusted execution environment, which can not only serve as an identity certificate of the trusted execution environment, but also carry public key information to enhance the data exchange security during the interaction process. After obtaining this certificate, the user will use the public key provided in the second certificate to encrypt the generated first SM4 key, thereby generating the first encrypted key. The encrypted key can be securely transmitted to the trusted execution environment in this way. Overall, in the above process, the encryption of local data and the encryption of the first SM4 key are combined with the remote trusted execution environment to effectively ensure the data security and privacy protection before and after transmission.

[0052] In this embodiment, after the remote authentication of the trusted execution environment, if the remote authentication of the trusted execution environment fails, it ends directly. Specifically, if the remote authentication process fails, that is, the verification fails, it means that the trusted execution environment may be tampered with or have other unknown risks, and the reliability and security of its current operating state cannot be ensured. In the case of a remote authentication failure of the trusted execution environment, all ongoing subsequent processes are immediately interrupted, and the connection with the suspicious trusted execution environment and any data exchange activities are stopped. This measure can effectively prevent sensitive data from being exposed to a potentially unsafe operating environment, and avoid serious consequences caused by the use of a contaminated or forged trusted execution environment.

[0053] Step S13: Use the first certificate to encrypt the preset authorization file, and send the corresponding encrypted authorization file and the first encrypted key to the trusted execution environment through the first secure channel, so that the trusted execution environment can authenticate the target trusted program based on the encrypted authorization file, and generate a second encrypted key based on the first encrypted key after the authentication is passed.

[0054] In this embodiment, the data provider first encrypts the preset authorization file using the private key signature corresponding to the signature certificate in the first certificate. This not only ensures that the content of the preset authorization file is not tampered with during transmission, but also allows the trusted execution environment to verify the authenticity of the signature and the consistency of the file by comparing the public key, thereby confirming that the file originates from a legitimate data provider. Among them, the preset authorization file usually contains information about specific resource access rights, terms of service or other sensitive configurations, which plays a vital role in ensuring normal interaction between applications and maintaining good order. Then, the data provider passes the encrypted authorization file together with the first encrypted key to the corresponding trusted execution environment using a first secure channel that has been pre-constructed and strictly authenticated, so that the subsequent target trusted program can apply for the key from the trusted execution environment. In this way, the data is prevented from being intercepted or tampered with midway.

[0055] In this embodiment, after receiving the key acquisition request sent by the target trusted program and its own third certificate, the trusted execution environment uses the first certificate to decrypt the encrypted authorization file, uses the corresponding decrypted authorization file to authenticate the target trusted program, and generates the second encrypted key based on the third certificate and the first encrypted key after the authentication is passed. Specifically, after receiving the encrypted authorization file and the first encrypted key, the trusted execution environment first authenticates the target trusted program according to the trusted execution environment. In this process, the trusted execution environment determines whether the data provider's data is allowed to be used by the target trusted program based on the various permission instructions contained in the encrypted authorization file. If the trusted execution environment authenticates the target trusted program, it indicates that the data provider's data is allowed to be used by the target trusted program, the first encrypted key is decrypted using the second certificate, the corresponding first decrypted key is encrypted based on the third certificate to obtain the second encrypted key, and the second encrypted key is sent to the target trusted program. In addition, if the authentication fails, a notification of authentication failure is sent to the target trusted program, prohibiting the target trusted program from obtaining the data provider's data.

[0056] Step S14: Send the encrypted data to the target trusted program through a second secure channel, so that the target trusted program decrypts the encrypted data based on the second encrypted key sent by the trusted execution environment to restore the local data, thereby completing the cross-domain sharing of the local data.

[0057] In this embodiment, first, the data provider will send the encrypted data to the target trusted program through the second secure channel, and it can be known that the trusted execution environment will send the second encrypted key to the target trusted program through the second secure channel. This is to ensure that the data can be transmitted securely and confidentially between two different security domains. Then, once the target trusted program receives the encrypted data, the target trusted program will use the second encrypted key sent by the trusted execution environment to decrypt the data to accurately restore the original local data. In this way, not only the security level of the entire data processing process is greatly improved, but also the risk of unauthorized access or modification of data is effectively prevented. This process ensures the authenticity and integrity of all transmitted data, lays a solid foundation for efficient and secure cross-domain resource sharing, and also highlights the key role of the TEE architecture in the security and privacy protection of modern information systems.

[0058] It can be seen that the embodiment of the present application first obtains the first SM4 key sent by the key management center and the first certificate sent by the certificate authority, uses the first SM4 key to encrypt local data, and remotely authenticates the trusted execution environment. After the authentication is completed, the second certificate is obtained, and the first SM4 key is encrypted again using the obtained second certificate to generate the first encrypted key, and the preset authorization file is encrypted using the obtained first certificate. The encrypted authorization file and its corresponding first encrypted key are transmitted to the trusted execution environment through the first secure channel, so as to perform identity authentication for the designated target trusted program based on the received data. If the verification is successful and the permission requirements are met, the trusted execution environment will generate a second encrypted key based on the first encrypted key, and the encrypted data will be transmitted to the target trusted program through a different second secure channel. The target trusted program decrypts the encrypted data with the second encrypted key and restores it to the local data. That is, the present application encrypts the local data and the key for encrypting the local data before data transmission, and verifies the different subjects of data sharing, combines TEE technology with commercial secret algorithms to meet the integrity and confidentiality of data cross-domain sharing and data control process chains, and ensures that the data is used efficiently while meeting certain high-security and commercial secret compliance application scenario requirements.

[0059] Based on the previous embodiment, it can be known that the present application can use the first certificate to encrypt the preset authorization file, and send the corresponding encrypted authorization file and the first encrypted key to the trusted execution environment through the first secure channel, so that the trusted execution environment can authenticate the target trusted program based on the encrypted authorization file, and generate the second encrypted key based on the first encrypted key after the authentication is passed, and decrypt the encrypted data with the second encrypted key to restore the local data. The following will describe in detail the process of decrypting specific encrypted data. See Figure 3 As shown, the embodiment of the present invention discloses a specific cross-domain data sharing method, including:

[0060] Step S21: After receiving the key acquisition request sent by the target trusted program and its own third certificate, the trusted execution environment uses the first certificate to decrypt the encrypted authorization file, and uses the corresponding decrypted authorization file to authenticate the target trusted program.

[0061] In this embodiment, the target trusted program will send a key acquisition request and its own third certificate to the trusted execution environment. The purpose of sending this request is to request the trusted execution environment to allocate a necessary encryption key to facilitate the subsequent data decryption work. At the same time, providing its own third certificate is to allow the trusted execution environment to authenticate the identity of the requester. After receiving the request and the third certificate from the target trusted program, the trusted execution environment first uses the first certificate corresponding to it to decrypt the previously encrypted authorization file, and recovers the decrypted authorization file. In this process, the trusted execution environment determines whether the data provider's data is allowed to be used by the target trusted program based on the various permission instructions contained in the decrypted authorization file. If the trusted execution environment authenticates the target trusted program, it means that the data provider's data is allowed to be used by the target trusted program. In addition, if the authentication fails, the trusted execution environment sends a notification of authentication failure to the target trusted program, prohibiting the target trusted program from obtaining the data provider's data.

[0062] Step S22: After the trusted execution environment authenticates the target trusted program, the first encrypted key is decrypted using the second certificate, the corresponding first decrypted key is encrypting based on the third certificate to obtain the second encrypted key, and the second encrypted key is sent to the target trusted program.

[0063] In this embodiment, when the trusted execution environment successfully authenticates the target trusted program, the encrypted key is decrypted using the second certificate. Then, the corresponding first decrypted key is encrypted again based on the third certificate to obtain the second encrypted key. Then, the trusted execution environment sends the second encrypted key to the target trusted program. This process involves multiple encryption and decryption operations and the use of certificates, which ensures the security of the key during transmission and use, provides important guarantees for the safe operation of the target trusted program, and enables the entire system to process and interact data more stably and reliably.

[0064] Step S23: The target trusted program decrypts the second encrypted key sent by the trusted execution environment through the third certificate to obtain a second SM4 key, and uses the second SM4 key to decrypt the encrypted data to restore the local data.

[0065] In this embodiment, after receiving the second encrypted key, the target trusted program will use the third certificate to perform a decryption operation on it, thereby obtaining the second SM4 key. Then, the second SM4 key is used to perform a decryption operation on the encrypted data, and finally the local data is successfully obtained. In this process, each step of the decryption operation has a strict order and specific basis. The third certificate provides the necessary authentication and support for the decryption of the second encrypted key, and the second SM4 key becomes the key to unlock the encrypted data, so that the target trusted program can smoothly restore the original local data and ensure the correct use and processing of the data.

[0066] It can be seen that in this process in the embodiment of the present application, the target trusted program first sends an encrypted key acquisition request and its own third certificate to the trusted execution environment. Its purpose is to request the encryption key for subsequent data decryption, and at the same time provide the third certificate for the trusted execution environment to authenticate the identity. After receiving the request, the trusted execution environment decrypts the encrypted authorization file with the first certificate, and authenticates the target trusted program based on the decrypted authorization file. If the authentication is successful, proceed to the next step. The trusted execution environment decrypts the encrypted key using the second certificate, and then encrypts the first decrypted key based on the third certificate to obtain the second encrypted key, and sends it to the target trusted program. This series of encryption and decryption and certificate application operations ensures the security of key transmission and use, and lays the foundation for stable and reliable data processing and interaction of the system. Finally, the target trusted program decrypts the second encrypted key with the help of the third certificate to obtain the second SM4 key, and then uses the key to decrypt the encrypted data, and successfully obtains the local data. The whole process strictly follows a specific order and basis, and each certificate plays a key role in different links, jointly ensuring that the data is safely and accurately acquired and used by the target trusted program, and realizing the safe conversion of data from an encrypted state to a normally usable state.

[0067] The technical solution in this application includes but is not limited to application in model training for cross-domain data sharing based on private data of multiple parties. Figure 4 , Figure 5 as well as Figure 6As shown in the figure, data providers A and B apply for SM4 data encryption keys from KeyManager (key management center) and apply for certificates generated based on SM2 algorithm from self-built CA (Certificate Authority) center. After the application is successful, the self-built CA center will issue their respective certificates to A\B and send them to TeeManager (trusted execution environment); TeeManager will also apply for its own certificate C (TeeM); data provider A and data provider B each obtain SM4 keys and specific SM2-based certificates. Taking the certificate obtained by data provider A as an example, certificates C1 (A) and C2 (A) bear the important responsibilities of encryption and signing. After the above initialization work is completed, data providers A\B encrypt their local data using SM4 keys; data providers A\B remotely authenticate TeeManager and obtain TeeManager's certificate C (TeeM) (including public key).

[0068] After successful authentication, A and B use the SM2 public key in C (TeeM) to encrypt the SM4 key; A and B generate a data control policy authorization document based on their own data and sign it with the private key corresponding to C1 (A). A and B send the data control policy authorization document and the SM4 key encrypted by C (TeeM) to TeeManager through a secure channel. A and B send the encrypted data to TeeApps (target trusted program) in the secure channel, and then the target trusted program requests the encrypted SM4 key from the trusted execution environment to decrypt the encrypted local data, and will carry its own certificate; in turn, TeeManager will perform a series of authentications on TeeApps. After receiving the request sent by the target trusted program, the trusted execution environment begins to authenticate the target trusted environment. If the authentication is successful, the encrypted SM4 key is decrypted and then encrypted based on the certificate of the target trusted program and sent to the target trusted program. The target trusted program decrypts the encrypted SM4 key and decrypts the encrypted local data based on the decrypted SM4 key. Finally, the decrypted local data can be used to train the model.

[0069] After the model training is completed, the model is encrypted with the SM4 key obtained in the previous step. The data provider applies for the model from the target trusted program, attaches the data ID and signs it. Taking the process of data provider A obtaining the trained model as an example, the target trusted program applies for the certificate C2(A) of data provider A from the trusted execution environment. After the trusted execution environment returns C2(A), it verifies the identity of data provider A. If the verification passes, the target trusted program returns the encrypted model to data provider A with the model ID. If the data provider wants to decrypt the model, it needs to apply for the model decryption key from the target trusted program, attach the model ID and encrypt the model decryption key application. After receiving the application, the target trusted program verifies the identity of data provider A, verifies the data control policy file of data provider A, encrypts the SM4 key of the model with C1(A) and returns the encrypted key. Data provider A uses the private key corresponding to C1(A) to decrypt the key, and finally decrypts the model, and the process ends.

[0070] It can be seen that this application provides a solution for the secure processing and reliable transmission of data through multiple security measures, strict authentication mechanisms and efficient data encryption transmission methods, and provides strong support for privacy model training and the protection of sensitive information.

[0071] See also Figure 7 As shown, an embodiment of the present invention discloses a data cross-domain sharing device, which is applied to a data provider, including:

[0072] A key and certificate acquisition module 11, configured to acquire a first SM4 key sent by a key management center based on a first SM4 key application request and a first certificate sent by a certificate authority based on a certificate application request;

[0073] A key encryption module 12, configured to encrypt local data using the first SM4 key to obtain encrypted data, remotely authenticate the trusted execution environment, obtain a second certificate returned by the trusted execution environment after successful authentication, and encrypt the first SM4 key using the second certificate to obtain a first encrypted key;

[0074] A key sending module 13 is used to encrypt a preset authorization file using the first certificate, and send the corresponding encrypted authorization file and the first encrypted key to the trusted execution environment through a first secure channel, so that the trusted execution environment authenticates the target trusted program based on the encrypted authorization file, and generates a second encrypted key based on the first encrypted key after the authentication is passed;

[0075] The data restoration module 14 is used to send the encrypted data to the target trusted program through a second secure channel, so that the target trusted program decrypts the encrypted data based on the second encrypted key sent by the trusted execution environment to restore the local data, thereby completing the cross-domain sharing of the local data.

[0076] It can be seen that the present application first obtains the first SM4 key sent by the key management center and the first certificate sent by the certificate authority, uses the first SM4 key to encrypt the local data, and remotely authenticates the trusted execution environment. After the authentication is completed, the second certificate is obtained, and the first SM4 key is encrypted again using the obtained second certificate to generate the first encrypted key. The preset authorization file is encrypted using the obtained first certificate, and the encrypted authorization file and its corresponding first encrypted key are transmitted to the trusted execution environment through the first secure channel, so as to perform identity authentication for the designated target trusted program based on the received data. If the verification is successful and the permission requirements are met, the trusted execution environment will generate a second encrypted key based on the first encrypted key, and the encrypted data will be transmitted to the target trusted program through a different second secure channel. The target trusted program decrypts the encrypted data with the second encrypted key and restores it to the local data. That is, the present application encrypts the local data and the key for encrypting the local data before data transmission, and verifies the different subjects of data sharing, combines TEE technology with commercial secret algorithms to meet the integrity and confidentiality of data cross-domain sharing and data control process chains, and ensures that the data is used efficiently while meeting certain high-security and commercial secret compliance application scenario requirements.

[0077] In a specific embodiment, the cross-domain data sharing device may further include:

[0078] The data sharing ending module is used to directly end the trusted execution environment if the remote authentication fails.

[0079] In a specific embodiment, the key sending module 13 may specifically include:

[0080] The file encryption unit is used to encrypt the preset authorization file using the private key signature corresponding to the signature certificate in the first certificate.

[0081] In a specific embodiment, the key certificate acquisition module 11 may specifically include:

[0082] The certificate application request sending unit is used to send the certificate application request to the certificate authority, so that the certificate authority sends the first certificate to the data provider and the trusted execution environment based on the certificate application request.

[0083] In a specific embodiment, the cross-domain data sharing device may specifically include:

[0084] A target trusted program authentication module is used for, after the trusted execution environment receives a key acquisition request sent by the target trusted program and its own third certificate, to decrypt the encrypted authorization file using the first certificate, authenticate the target trusted program using the corresponding decrypted authorization file, and generate the second encrypted key based on the third certificate and the first encrypted key after the authentication is passed.

[0085] In a specific embodiment, the target trusted program authentication module may specifically include:

[0086] The second SM4 key acquisition unit is used to decrypt the first encrypted key using the second certificate after the trusted execution environment authenticates the target trusted program, encrypt the corresponding first decrypted key based on the third certificate to obtain the second encrypted key, and send the second encrypted key to the target trusted program.

[0087] In a specific embodiment, the cross-domain data sharing device may further include:

[0088] A local data acquisition module is used for the target trusted program to decrypt the second encrypted key sent by the trusted execution environment through the third certificate to obtain a second SM4 key, and use the second SM4 key to decrypt the encrypted data to restore the local data.

[0089] Furthermore, the present application also discloses an electronic device. Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0090] Figure 8 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the data cross-domain sharing method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0091] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0092] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0093] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the data cross-domain sharing method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0094] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed cross-domain data sharing method. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, and no further description will be given here.

[0095] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0096] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0097] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0098] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0099] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for cross-domain data sharing, characterized in that: Applicable to data providers, including: Obtain a first SM4 key sent by a key management center based on a first SM4 key application request and a first certificate sent by a certificate authority based on a certificate application request; Encrypting local data using the first SM4 key to obtain encrypted data, remotely authenticating the trusted execution environment, obtaining a second certificate returned by the trusted execution environment after successful authentication, and encrypting the first SM4 key using the second certificate to obtain a first encrypted key; Encrypting a preset authorization file using the first certificate, and sending the corresponding encrypted authorization file and the first encrypted key to the trusted execution environment through a first secure channel, so that the trusted execution environment authenticates the target trusted program based on the encrypted authorization file, and generates a second encrypted key based on the first encrypted key after the authentication is passed; The encrypted data is sent to the target trusted program through a second secure channel, so that the target trusted program decrypts the encrypted data based on the second encrypted key sent by the trusted execution environment to restore the local data, thereby completing the cross-domain sharing of the local data.

2. The data cross-domain sharing method according to claim 1, characterized in that: After the trusted execution environment is remotely authenticated, the method further includes: If the trusted execution environment remote authentication fails, the process ends directly.

3. The data cross-domain sharing method according to claim 1, characterized in that: The using the first certificate to encrypt the preset authorization file includes: The preset authorization file is encrypted using the private key signature corresponding to the signature certificate in the first certificate.

4. The data cross-domain sharing method according to any one of claims 1 to 3, characterized in that: Obtaining the first certificate sent by the certificate authority based on the certificate application request, including: The certificate application request is sent to the certificate authority, so that the certificate authority sends the first certificate to the data provider and the trusted execution environment based on the certificate application request.

5. The cross-domain data sharing method according to claim 4, characterized in that: The process of generating the second encrypted key includes: After the trusted execution environment receives the key acquisition request sent by the target trusted program and its own third certificate, it uses the first certificate to decrypt the encrypted authorization file, uses the corresponding decrypted authorization file to authenticate the target trusted program, and generates the second encrypted key based on the third certificate and the first encrypted key after the authentication is passed.

6. The method for cross-domain data sharing according to claim 5, characterized in that: The generating the second encrypted key based on the third certificate and the first encrypted key after authentication, comprises: After the trusted execution environment authenticates the target trusted program, it uses the second certificate to decrypt the first encrypted key, encrypts the corresponding first decrypted key based on the third certificate to obtain the second encrypted key, and sends the second encrypted key to the target trusted program.

7. The cross-domain data sharing method according to claim 6, characterized in that: The process of restoring the local data includes: The target trusted program decrypts the second encrypted key sent by the trusted execution environment through the third certificate to obtain a second SM4 key, and uses the second SM4 key to decrypt the encrypted data to restore the local data.

8. A data cross-domain sharing device, characterized in that: Applicable to data providers, including: A key and certificate acquisition module, used to acquire a first SM4 key sent by a key management center based on a first SM4 key application request and a first certificate sent by a certificate authority based on a certificate application request; A key encryption module, configured to encrypt local data using the first SM4 key to obtain encrypted data, remotely authenticate the trusted execution environment, obtain a second certificate returned by the trusted execution environment after successful authentication, and encrypt the first SM4 key using the second certificate to obtain a first encrypted key; a key sending module, configured to encrypt a preset authorization file using the first certificate, and send the corresponding encrypted authorization file and the first encrypted key to the trusted execution environment through a first secure channel, so that the trusted execution environment authenticates the target trusted program based on the encrypted authorization file, and generates a second encrypted key based on the first encrypted key after the authentication is passed; A data restoration module is used to send the encrypted data to the target trusted program through a second secure channel, so that the target trusted program decrypts the encrypted data based on the second encrypted key sent by the trusted execution environment to restore the local data, thereby completing the cross-domain sharing of the local data.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the cross-domain data sharing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program; wherein, when the computer program is executed by a processor, the cross-domain data sharing method as described in any one of claims 1 to 7 is implemented.

Images