Privacy computing method, system and device based on trusted execution environment and fully homomorphic encryption

Abstract

The invention discloses a privacy computing method, system and device based on a trusted execution environment (TEE) and fully homomorphic encryption. The method comprises the following steps: a key management party generates an RSA key pair in the TEE, RSA private keys are sealed and stored in the TEE, and RSA public keys are distributed to a data party and a computing party; the TEE obtains ciphertext data generated by a data party and a calculation party, and judges whether the current calculation task needs privacy protection or not based on the task type and the data type of the calculation task; the tasks without privacy protection are decrypted through an RSA private key and then are subjected to plaintext calculation, and the tasks needing protection are directly subjected to BFV homomorphic calculation; and finally, the key management party decrypts and returns a result. According to the method, plaintext calculation or ciphertext calculation is flexibly selected according to the type of the calculation task and the sensitive degree of the data, the calculation efficiency is improved on the premise of ensuring the data privacy, and the sensitive data is encrypted through the BFV fully homomorphic encryption algorithm, so that the security of the data is further enhanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security and privacy protection, and specifically relates to a privacy computing method, system and device based on a trusted execution environment and fully homomorphic encryption. Background Art

[0002] In the data-driven era, the value of data is becoming increasingly prominent, but the risk of data privacy leaks also increases. Traditional data processing methods often require centralized data storage and processing, which puts data owners at risk of data leakage. To address this problem, privacy-preserving computing technology has emerged.

[0003] Privacy computing refers to a series of information technologies that analyze and compute data while protecting the data from external disclosure. Its core goal is to enable data analysis and mining without disclosing the original data. Currently, privacy computing technologies primarily include multi-party secure computing, homomorphic encryption, and trusted execution environments.

[0004] However, existing privacy-preserving computing technologies still face some challenges in practical applications. For example, multi-party secure computation requires complex interactions and calculations among multiple participants, resulting in low efficiency. While homomorphic encryption can perform computations on ciphertext, it is computationally complex and has poor performance. While trusted execution environments can provide hardware-level security, they still pose a risk of leaking sensitive data.

[0005] How to combine multiple privacy-preserving computing technologies to improve their efficiency and security is a pressing issue. Therefore, this paper proposes a privacy-preserving computing method based on a trusted execution environment and fully homomorphic encryption to address the low efficiency and poor security of existing privacy-preserving computing technologies. Summary of the Invention

[0006] In response to the shortcomings of the prior art, the present invention provides a privacy computing method, system and device based on a trusted execution environment and fully homomorphic encryption.

[0007] In order to solve the above technical problems, the present invention is solved by the following technical solutions: A privacy computing method based on a trusted execution environment and fully homomorphic encryption includes the following steps: The key manager within the Trusted Execution Environment (TEE) uses the RSA encryption algorithm to generate keys, including RSA private keys and RSA public keys, sends the RSA public keys to other participants, and stores the RSA private keys within the TEE. The participants include the data provider and the computing provider. TEE obtains the encrypted data generated by the data party and the computing party, and determines whether the current computing task requires privacy protection based on the task type and data type; If the computing task does not require privacy protection, the RSA private key is used to decrypt the ciphertext data in the TEE to obtain the intermediate plaintext result, and the calculation result is obtained based on the intermediate plaintext result. The calculation result is fully homomorphically encrypted using the BFV public key to generate the ciphertext result. If the computing task requires privacy protection, the BFV algorithm is used to perform homomorphic calculations on the ciphertext data in the TEE to obtain the ciphertext result. The ciphertext results are distributed to each participant, and each participant initiates a decryption request to the key management party to decrypt the ciphertext results based on the RSA private key to obtain the final calculation result.

[0008] As an implementable embodiment, it also includes: By obtaining the reputation value, computing resources, and historical task completion status of each participant, different weights are assigned to each participant, and a weighted scoring mechanism is adopted to select the participant with the highest comprehensive score as the key manager.

[0009] As an implementable method, the RSA encryption algorithm is used to generate a key, including an RSA private key and an RSA public key, including the following steps: Pick two large prime numbers and , calculate the modulus of the RSA algorithm , which is expressed as follows:

[0010] Using two large prime numbers, the Euler function value of the modulus of the RSA algorithm is calculated as follows:

[0011] is the value of Euler function for n; Get an integer e and use it as part of the RSA public key, where e satisfies and ; The RSA private key d is obtained by using the Euler function value of n and the integer e, which is expressed as follows: , Generate the RSA public key based on the integer e and the modulus of the RSA algorithm , and the key length is set to 2048 bits.

[0012] As an implementation method, the TEE obtains the encrypted data generated by the data party and the computing party, including the following steps: The data provider obtains the plaintext data required for the computing task, encrypts the plaintext data using the received RSA public key and the BFV fully homomorphic encryption algorithm, generates ciphertext data, and transmits it to the computing provider. The computing party performs digital certificate verification and integrity check on the ciphertext data, and transmits the verified and checked ciphertext data to TEE.

[0013] As an implementable method, the plaintext data is encrypted based on the BFV fully homomorphic encryption algorithm to generate ciphertext data, including the following steps: Constructing a polynomial ring ,in It is a power of 2, and its value is 2 14 , q is a large integer modulus, and its bit length ranges from 300 to 400 bits; Randomly select polynomials ,calculate , generate a key and public key ,in ,satisfy , is a small error polynomial; For plaintext data (t is the plaintext modulus, the value is 2 20 ), randomly selected polynomial , calculate the ciphertext data ,in , , , is a small error polynomial; Masking technology is introduced to add a random mask r to the plaintext data m to increase encryption security.

[0014] As an implementation method, the method further includes performing digital certificate verification on the trusted execution environment (TEE), specifically: Establish a whitelist of trusted institutions, obtain the TEE's digital certificate, check whether the issuing institution of the digital certificate is on the whitelist of trusted institutions, confirm that the digital certificate is within the validity period, and verify whether the public key in the digital certificate fully matches the TEE's identification information; Calculate the hash value of the TEE and compare it with the pre-stored correct hash value, and perform integrity verification on the TEE based on the comparison result.

[0015] As an implementable method, determining whether the current computing task requires privacy protection includes the following steps: If the computing task type is data query or statistical analysis, and the data involved includes sensitive data such as user identity information and financial data, then the computing task is determined to require privacy protection; Otherwise, it is determined to be a computing task that does not require privacy protection.

[0016] As an implementable method, for computing tasks that do not require privacy protection, when calculating the intermediate plaintext results within the TEE, parallel computing technology is used to improve computing efficiency, and the corresponding computing function library is called according to the specific type of computing task; During the calculation process, the usage of computing resources is monitored in real time. When the usage of computing resources exceeds the pre-set threshold, resources are dynamically allocated immediately. For computing tasks that require privacy protection, when performing homomorphic calculations on encrypted data within the TEE, dedicated encryption chips are used to accelerate the homomorphic operations.

[0017] A privacy computing system based on a trusted execution environment and fully homomorphic encryption, including a key generation module, a computing task classification module, a hybrid computing module, and a result output module: The key generation module, the key management party within the trusted execution environment (TEE), uses the RSA encryption algorithm to generate keys, including RSA private keys and RSA public keys, sends the RSA public keys to other participants, and stores the RSA private keys within the TEE. The participants include the data party and the computing party; The computing task classification module, TEE obtains the ciphertext data generated by the data party and the computing party, and determines whether the current computing task requires privacy protection based on the task type and data type of the computing task; The hybrid computing module, if the computing task does not require privacy protection, uses the RSA private key to decrypt the ciphertext data in the TEE to obtain the intermediate plaintext result, and obtains the calculation result based on the intermediate plaintext result, and performs fully homomorphic encryption on the calculation result using the BFV public key to generate the ciphertext result; if the computing task requires privacy protection, the BFV algorithm is used to perform homomorphic calculation on the ciphertext data in the TEE to obtain the ciphertext result; The result output module distributes the ciphertext result to each participant, and each participant initiates a decryption application to the key management party to decrypt the ciphertext result based on the RSA private key to obtain the final calculation result.

[0018] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following method: The key manager within the Trusted Execution Environment (TEE) uses the RSA encryption algorithm to generate keys, including RSA private keys and RSA public keys, sends the RSA public keys to other participants, and stores the RSA private keys within the TEE. The participants include the data provider and the computing provider. TEE obtains the encrypted data generated by the data party and the computing party, and determines whether the current computing task requires privacy protection based on the task type and data type; If the computing task does not require privacy protection, the RSA private key is used to decrypt the ciphertext data in the TEE to obtain the intermediate plaintext result, and the calculation result is obtained based on the intermediate plaintext result. The calculation result is fully homomorphically encrypted using the BFV public key to generate the ciphertext result. If the computing task requires privacy protection, the BFV algorithm is used to perform homomorphic calculations on the ciphertext data in the TEE to obtain the ciphertext result. The ciphertext results are distributed to each participant, and each participant initiates a decryption request to the key management party to decrypt the ciphertext results based on the RSA private key to obtain the final calculation result.

[0019] A privacy computing device based on a trusted execution environment and fully homomorphic encryption includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the following method: The key manager within the Trusted Execution Environment (TEE) uses the RSA encryption algorithm to generate keys, including RSA private keys and RSA public keys, sends the RSA public keys to other participants, and stores the RSA private keys within the TEE. The participants include the data provider and the computing provider. TEE obtains the encrypted data generated by the data party and the computing party, and determines whether the current computing task requires privacy protection based on the task type and data type; If the computing task does not require privacy protection, the RSA private key is used to decrypt the ciphertext data in the TEE to obtain the intermediate plaintext result, and the calculation result is obtained based on the intermediate plaintext result. The calculation result is fully homomorphically encrypted using the BFV public key to generate the ciphertext result. If the computing task requires privacy protection, the BFV algorithm is used to perform homomorphic calculations on the ciphertext data in the TEE to obtain the ciphertext result. The ciphertext results are distributed to each participant, and each participant initiates a decryption request to the key management party to decrypt the ciphertext results based on the RSA private key to obtain the final calculation result.

[0020] The present invention has significant technical effects due to the adoption of the above technical solutions: (1) A privacy computing method and system based on a trusted execution environment and fully homomorphic encryption is proposed. This method combines the trusted execution environment and fully homomorphic encryption technology, flexibly selecting plaintext computing or ciphertext computing according to the type of computing task and the sensitivity of the data, thereby improving computing efficiency while ensuring data privacy. (2) A privacy computing method and system based on a trusted execution environment and fully homomorphic encryption is proposed. The RSA private key is stored in the trusted execution environment, and strict digital certificate verification and integrity check are performed on the TEE to ensure the security of the key and data. At the same time, the BFV fully homomorphic encryption algorithm is used to encrypt sensitive data, further enhancing data security.

[0021] Other advantages, objectives and features of the present invention will be reflected in part from the following description and will be understood by those skilled in the art through study and practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a flow chart of the method of the present invention; Figure 2 It is an overall schematic diagram of the system of the present invention; Figure 3 Schematic diagram of the calculation process of the method of the present invention. DETAILED DESCRIPTION

[0023] In order to clearly explain the present invention and make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention are clearly and completely described below in combination with the drawings in the embodiments of the present invention, so that those skilled in the art can implement them according to the text of the description.

[0024] In the context of the present invention, a trusted execution environment (TEE) provides an isolated runtime environment from the perspective of the underlying hardware and operating system, protecting the code and data running within it from external attacks, including attacks from the operating system, hardware, and other applications. This technology has been used in some fields to achieve the objectives described above, and some of the basic principles of this technology are also known to those skilled in the art. However, after reading this application, those skilled in the art will understand how to apply this technology in this context and will clearly understand the novelty of this technology when combined with other features in a specific context.

[0025] The technology of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0026] Example 1: A privacy computing method based on trusted execution environment and fully homomorphic encryption, such as Figure 1 As shown, the following steps are included: S100, a key manager within a trusted execution environment (TEE) generates a key using an RSA encryption algorithm, including an RSA private key and an RSA public key, sends the RSA public key to other participants, and stores the RSA private key within the TEE. The participants include the data provider and the computing provider. S200, TEE obtains the ciphertext data generated by the data party and the computing party, and determines whether the current computing task requires privacy protection based on the task type and data type of the computing task; S300. If the computing task does not require privacy protection, the RSA private key is used to decrypt the ciphertext data in the TEE to obtain the intermediate plaintext result, and the calculation result is obtained based on the intermediate plaintext result. The calculation result is fully homomorphically encrypted using the BFV public key to generate the ciphertext result; if the computing task requires privacy protection, the BFV algorithm is used to perform homomorphic calculation on the ciphertext data in the TEE to obtain the ciphertext result; S400: Distribute the ciphertext result to each participant. Each participant initiates a decryption request to the key management party to decrypt the ciphertext result based on the RSA private key to obtain the final calculation result.

[0027] The specific calculation process diagram in this embodiment is as follows Figure 3 As shown, the dotted box represents the process within the TEE, which specifically includes the following steps: (1) During the key generation phase, the specific rules for determining the key manager are as follows: different weights are assigned to each participant based on their reputation, computing resources, and historical task completion status. Through a weighted scoring mechanism, the participant with the highest comprehensive score is determined as the key manager.

[0028] (2) In the key generation phase, the public key and private key are generated using the RSA encryption algorithm, including the following steps: Pick two large prime numbers and ,satisfy , usually 1024 or 2048 bits; Calculating the modulus ; Calculate Euler function ; Choose a public key exponent: Choose an integer e that satisfies and , usually choose e=65537 (ie 2 16 +1); Calculate the private key exponent: Use the extended Euclidean algorithm to calculate d, satisfying ; Generate key pair: RSA public key is , the RSA private key is d.

[0029] (3) In the data encryption phase, when the BFV fully homomorphic encryption algorithm is used for encryption, the following steps are included: Select polynomial ring ,in A power of 2, usually 2 14 , It is a large integer modulus with a bit length ranging from 300 to 400 bits. Randomly select polynomials ,calculate , generate BFV key and the BFV public key ,in ,satisfy , is a small error polynomial; For plaintext data (t is the plaintext modulus, the value is 2 20 ), randomly selected polynomial , calculate the ciphertext ,in , , , is a small error polynomial; Add a random mask r to the plaintext data m to increase encryption security; The data party transmits the encrypted ciphertext data ct to the computing party.

[0030] (4) During the secure transmission phase, the process of verifying the digital certificate of the TEE includes the following steps: Establish a whitelist of trusted institutions: maintain a list of trusted certificate authorities (CAs) TrustedCAs; Get the digital certificate of TEE: Get the digital certificate from TEE ; Verify certificate validity: Check whether the issuing authority of the digital certificate is a Trusted CA, confirm that the digital certificate is within the validity period, and verify whether the public key in the digital certificate fully matches the TEE identification information; The steps for performing integrity check on the TEE are as follows: Calculating TEE hash value: using hash function Calculate the current hash value of TEE ; Compare hash values: With the correct hash value stored in advance For comparison, if , then the TEE is complete.

[0031] (5) In the computing task classification stage, if the task type of the computing task belongs to data query, statistical analysis, and the data types involved include sensitive data such as user identity information and financial data, then the computing task is determined to require privacy protection; otherwise, it is determined to be a computing task that does not require privacy protection.

[0032] (6) In the hybrid computing phase, computing tasks that do not require privacy protection include the following steps: Using RSA private keys within TEE Decrypt BFV private key sk; Use the BFV private key sk to decrypt the ciphertext data ct and obtain the intermediate plaintext result m. ; The intermediate plaintext result m is calculated and processed within the TEE, parallel computing technology is used to improve computing efficiency, and the corresponding computing function library is called according to the task type; Use BFV public key pk to calculate the result Re-encryption;

[0033]

[0034] Generate ciphertext result .

[0035] The computation of a privacy-preserving computation task involves the following steps: Use the BFV algorithm to perform homomorphic calculations on the ciphertext data ct directly within the TEE; Homomorphic operations are accelerated with the help of dedicated encryption chips.

[0036] (7) The result output stage includes the following steps: TEE will generate the ciphertext result Distribute to all participants; Each participant initiates a decryption request to the key manager; The key manager verifies the identity and authority of each participant; Decrypt the BFV private key sk using the REA private key d within the TEE; Decrypt the ciphertext using the BFV private key sk , get the final plaintext result ;

[0037] The final plaintext result Return to all parties involved.

[0038] In summary, the present invention provides a privacy computing method and system based on a trusted execution environment and fully homomorphic encryption. It proposes a privacy computing method and system based on a trusted execution environment and fully homomorphic encryption. It combines the trusted execution environment and fully homomorphic encryption technology, and flexibly selects plaintext computing or ciphertext computing according to the type of computing task and the sensitivity of the data. Under the premise of ensuring data privacy, it improves computing efficiency. In addition, the RSA private key is stored in the trusted execution environment, and the TEE is strictly verified and the integrity check is performed to ensure the security of the key and data. At the same time, the BFV fully homomorphic encryption algorithm is used to encrypt sensitive data, further enhancing the security of the data.

[0039] Example 2: A privacy computing system based on a trusted execution environment and fully homomorphic encryption, such as Figure 2 As shown, it includes a key generation module 100, a computing task classification module 200, a hybrid computing module 300 and a result output module 400: The key generation module 100, a key management party within a trusted execution environment (TEE), uses an RSA encryption algorithm to generate keys, including an RSA private key and an RSA public key, sends the RSA public key to other participants, and stores the RSA private key within the TEE. The participants include the data party and the computing party. The computing task classification module 200, TEE obtains the ciphertext data generated by the data party and the computing party, and determines whether the current computing task requires privacy protection based on the task type and data type of the computing task; The hybrid computing module 300, if the computing task does not require privacy protection, uses the RSA private key to decrypt the ciphertext data in the TEE to obtain the intermediate plaintext result, and obtains the calculation result based on the intermediate plaintext result, and performs fully homomorphic encryption on the calculation result using the BFV public key to generate the ciphertext result; if the computing task requires privacy protection, the BFV algorithm is used to perform homomorphic calculation on the ciphertext data in the TEE to obtain the ciphertext result; The result output module 400 distributes the ciphertext result to each participant, and each participant initiates a decryption request to the key management party to decrypt the ciphertext result based on the RSA private key to obtain the final calculation result.

[0040] Various changes and modifications can be made without departing from the spirit and scope of the present invention, and all equivalent technical solutions also fall within the scope of the present invention.

[0041] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referenced to each other.

[0042] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0043] The present invention is described with reference to the flowcharts and / or block diagrams of the method, terminal device (system), and computer program product according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0044] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0045] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0046] It should be noted that: References in this specification to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Therefore, appearances of the phrases "one embodiment" or "an embodiment" in various places throughout this specification do not necessarily refer to the same embodiment.

[0047] The above description of the embodiments is intended to facilitate understanding and application of the present invention by those skilled in the art. It will be apparent that those skilled in the art can readily make various modifications to the above embodiments and apply the general principles described herein to other embodiments without requiring inventive effort. Therefore, the present invention is not limited to the above embodiments, and improvements and modifications made by those skilled in the art based on the disclosure of the present invention should fall within the scope of protection of the present invention.

Claims

1. A privacy computing method based on a trusted execution environment and fully homomorphic encryption, characterized in that: The following steps are involved: The key manager within the Trusted Execution Environment (TEE) uses the RSA encryption algorithm to generate keys, including RSA private keys and RSA public keys, sends the RSA public keys to other participants, and stores the RSA private keys within the TEE. The participants include the data provider and the computing provider. TEE obtains the encrypted data generated by the data party and the computing party, and determines whether the current computing task requires privacy protection based on the task type and data type; If the computing task does not require privacy protection, the RSA private key is used in the TEE to decrypt the ciphertext data, obtain the intermediate plaintext result, and obtain the calculation result based on the intermediate plaintext result. The calculation result is fully homomorphically encrypted using the BFV public key to generate the ciphertext result; If the computing task requires privacy protection, the BFV algorithm is used to perform homomorphic calculations on the encrypted data within the TEE to obtain the encrypted result; The ciphertext results are distributed to each participant, and each participant initiates a decryption request to the key management party to decrypt the ciphertext results based on the RSA private key to obtain the final calculation result.

2. The privacy computing method based on a trusted execution environment and fully homomorphic encryption according to claim 1, characterized in that: Also includes: By obtaining the reputation value, computing resources, and historical task completion status of each participant, different weights are assigned to each participant, and a weighted scoring mechanism is adopted to select the participant with the highest comprehensive score as the key manager.

3. The privacy computing method based on a trusted execution environment and fully homomorphic encryption according to claim 1, characterized in that: The RSA encryption algorithm is used to generate a key, including an RSA private key and an RSA public key, including the following steps: Pick two large prime numbers and , calculate the modulus of the RSA algorithm , which is expressed as follows: Using two large prime numbers, the Euler function value of the modulus of the RSA algorithm is calculated as follows: is the value of Euler function for n; Get an integer e and use it as part of the RSA public key, where e satisfies and ; The RSA private key d is obtained by using the Euler function value of n and the integer e, which is expressed as follows: ， Generate the RSA public key based on the integer e and the modulus of the RSA algorithm , and the key length is set to 2048 bits.

4. The privacy computing method based on a trusted execution environment and fully homomorphic encryption according to claim 1, characterized in that: The TEE obtains the encrypted data generated by the data party and the computing party, including the following steps: The data provider obtains the plaintext data required for the computing task, encrypts the plaintext data using the received RSA public key and the BFV fully homomorphic encryption algorithm, generates ciphertext data, and transmits it to the computing provider. The computing party performs digital certificate verification and integrity check on the ciphertext data, and transmits the verified and checked ciphertext data to TEE.

5. The privacy computing method based on a trusted execution environment and fully homomorphic encryption according to claim 4 is characterized in that: The method of encrypting plaintext data based on the BFV fully homomorphic encryption algorithm to generate ciphertext data includes the following steps: Constructing a polynomial ring ,in It is a power of 2, and its value is 2 14 , q is a large integer modulus, and its bit length ranges from 300 to 400 bits; Randomly select polynomials ,calculate , generate a key and public key ,in ,satisfy , is a small error polynomial; For plaintext data (t is the plaintext modulus, the value is 2 20 ), randomly selected polynomial , calculate the ciphertext data ,in , , , is a small error polynomial; Masking technology is introduced to add a random mask r to the plaintext data m to increase encryption security.

6. The privacy computing method based on a trusted execution environment and fully homomorphic encryption according to claim 1, characterized in that: The process also includes verifying the digital certificate of the trusted execution environment (TEE), specifically: Establish a whitelist of trusted institutions, obtain the TEE's digital certificate, check whether the issuing institution of the digital certificate is on the whitelist of trusted institutions, confirm that the digital certificate is within the validity period, and verify whether the public key in the digital certificate fully matches the TEE's identification information; Calculate the hash value of the TEE and compare it with the pre-stored correct hash value, and perform integrity verification on the TEE based on the comparison result.

7. The privacy computing method based on a trusted execution environment and fully homomorphic encryption according to claim 1, characterized in that: Determining whether the current computing task requires privacy protection includes the following steps: If the computing task type is data query or statistical analysis, and the data involved includes sensitive data such as user identity information and financial data, then the computing task is determined to require privacy protection; Otherwise, it is determined to be a computing task that does not require privacy protection.

8. The privacy computing method based on a trusted execution environment and fully homomorphic encryption according to claim 1, characterized in that: For computing tasks that do not require privacy protection, parallel computing technology is used to improve computing efficiency when calculating the intermediate plaintext results within the TEE, and the corresponding computing function library is called according to the specific type of computing task; During the calculation process, the usage of computing resources is monitored in real time. When the usage of computing resources exceeds the pre-set threshold, resources are dynamically allocated immediately. For computing tasks that require privacy protection, when performing homomorphic calculations on encrypted data within the TEE, dedicated encryption chips are used to accelerate the homomorphic operations.

9. A privacy computing system based on a trusted execution environment and fully homomorphic encryption, characterized in that: It includes key generation module, computing task classification module, hybrid computing module and result output module: The key generation module, the key management party within the trusted execution environment (TEE), uses the RSA encryption algorithm to generate keys, including RSA private keys and RSA public keys, sends the RSA public keys to other participants, and stores the RSA private keys within the TEE. The participants include the data party and the computing party; The computing task classification module, TEE obtains the ciphertext data generated by the data party and the computing party, and determines whether the current computing task requires privacy protection based on the task type and data type of the computing task; If the computing task does not require privacy protection, the hybrid computing module uses the RSA private key to decrypt the ciphertext data in the TEE to obtain the intermediate plaintext result, and obtains the calculation result based on the intermediate plaintext result. The calculation result is fully homomorphically encrypted using the BFV public key to generate the ciphertext result; If the computing task requires privacy protection, the BFV algorithm is used to perform homomorphic calculations on the encrypted data within the TEE to obtain the encrypted result; The result output module distributes the ciphertext result to each participant, and each participant initiates a decryption application to the key management party to decrypt the ciphertext result based on the RSA private key to obtain the final calculation result.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A privacy computing device based on a trusted execution environment and fully homomorphic encryption, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images