Remote verification method and device for confidential calculation, related equipment, storage medium and computer program product

Abstract

The invention discloses a remote verification method and device for confidential calculation, a first platform, first equipment, fourth equipment, a storage medium and a computer program product. The method comprises the steps that a first platform obtains first data and obtains second data, the first data comprises first evidence data related to a first trusted execution environment (TEE) of first equipment and first related data of a first transport layer security (TLS) certificate of the first TEE, and the first equipment is used for providing confidential computing service through the first TEE; the second data comprises certificate chain related data of the first TEE; verifying the first evidence data based on certificate chain related data of the first TEE to obtain a first verification result, and packaging the first verification result, the first evidence data and the first related data by using a first protocol to obtain third data; the third data is sent to the first device and a second device, the second device being a user of the confidential computing service.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a remote verification method and device for confidential computing, related equipment, a storage medium and a computer program product. BACKGROUND

[0002] Confidential computing is a computing mode that builds an encrypted, isolated and provable computing environment on the basis of trusted hardware, combines firmware and software, and guarantees data confidentiality, data integrity, code integrity and operation process confidentiality in the environment. Confidential computing can build a secure area through an isolation mechanism, that is, a confidential computing environment, which can also be understood as a trusted execution environment (TEE), thereby isolating the general computing environment from the confidential computing environment, guaranteeing that the programs and data loaded in the confidential computing environment are protected in terms of confidentiality and integrity, only specific code can access the data in the confidential computing environment, and any other user without authorization cannot access and tamper with the programs and data executed in the confidential computing environment; and the data generated when related computing is performed in the memory can be guaranteed to be in an encrypted form through an encryption mechanism, preventing privileged software or even hardware from snooping, thereby protecting user data privacy. In related technologies, in order to ensure the correctness and credibility of the confidential computing result, the application program running in the confidential computing environment can be verified through a remote verification (which can also be understood as remote proof or remote authentication) manner, thereby guaranteeing the integrity of the program.

[0003] However, the remote verification process in related technologies can have problems such as high complexity. SUMMARY

[0004] To solve the problems in related technologies, the present application provides a remote verification method and device for confidential computing, related equipment, a storage medium and a computer program product.

[0005] The technical solution of the present application embodiment is implemented as follows:

[0006] The present application provides a remote verification method for confidential computing, applied to a first platform, comprising:

[0007] obtaining first data and second data, the first data comprising first evidence data related to a first TEE of a first device and first related data of a first Transport Layer Security (TLS) certificate of the first TEE, the first device being configured to provide confidential computing services through the first TEE, and the second data comprising certificate chain related data of the first TEE;

[0008] verify the first evidence data based on the first TEE's certificate chain related data to obtain a first verification result, and encapsulate the first verification result, the first evidence data and the first related data by using a first protocol to obtain third data;

[0009] send the third data to the first device and a second device, the second device being a user of the confidential computing service.

[0010] In the above scheme, the sending of the third data to the first device and the second device comprises:

[0011] sign the third data by using a first private key to obtain signed third data;

[0012] send the signed third data to the first device and the second device.

[0013] In the above scheme, the obtaining of the first data comprises:

[0014] send first information to the first device, the first information being used to request the first data;

[0015] receive signed first data sent by the first device, the signed first data being data obtained by signing the first data by using a second private key by the first device.

[0016] In the above scheme, the obtaining of the second data comprises:

[0017] obtain the second data from a third device, the third device being infrastructure of a vendor of the first TEE.

[0018] In the above scheme, the first related data comprises one or more of the following:

[0019] an identity of the first TLS certificate;

[0020] a public key of the first TLS certificate;

[0021] a hash value corresponding to the first TLS certificate.

[0022] In the above scheme, the first evidence data comprises one or more of the following:

[0023] an identity of the first TEE;

[0024] a version of the first TEE;

[0025] a first check value, the first check value being used to verify integrity of a first application, the first application running in the first TEE and the first application being used to provide the confidential computing service.

[0026] In the above solution, in a case where the confidential computing service includes federated learning and the first device is a coordinator of the federated learning, the method further includes:

[0027] obtaining fourth data and fifth data, the fourth data including second evidence data related to a second TEE of a fourth device and second related data of a second TLS certificate of the second TEE, the fourth device being a participant of the federated learning, and the fifth data including certificate chain related data of the second TEE;

[0028] verifying the second evidence data based on the certificate chain related data of the second TEE to obtain a second verification result, and encapsulating the second verification result, the second evidence data, and the first related data by using the first protocol to obtain sixth data;

[0029] sending the sixth data to the fourth device.

[0030] Embodiments of the present application also provide a remote verification method of confidential computing, applied to a first device, including:

[0031] receiving third data sent by a first platform, the third data being data obtained by the first platform by encapsulating a first verification result, first evidence data related to a first TEE of the first device, and first related data of a first TLS certificate of the first TEE by using a first protocol, the first verification result being a result obtained by the first platform by verifying the first evidence data based on certificate chain related data of the first TEE, and the first device being configured to provide a confidential computing service through the first TEE.

[0032] In the above solution, the receiving third data sent by the first platform includes:

[0033] receiving signed third data sent by the first platform, the signed third data being data obtained by the first platform by signing the third data by using a first private key.

[0034] In the above solution, the method further includes:

[0035] receiving first information sent by the first platform, the first information being used to request first data, and the first data including the first evidence data and the first related data;

[0036] signing the first data by using a second private key to obtain signed first data;

[0037] sending the signed first data to the first platform.

[0038] In the foregoing solution, the first related data includes one or more of the following:

[0039] an identity of the first TLS certificate;

[0040] a public key of the first TLS certificate;

[0041] a hash value corresponding to the first TLS certificate.

[0042] In the foregoing solution, the first evidence data includes one or more of the following:

[0043] an identity of the first TEE;

[0044] a version of the first TEE;

[0045] a first check value, the first check value being used to verify integrity of a first application, the first application running in the first TEE, and the first application being used to provide the confidential computing service.

[0046] In the foregoing solution, in a case where the confidential computing service includes federated learning, and the first device is a coordinator of the federated learning, the method further includes:

[0047] establishing a TLS secure channel with a fourth device, and obtaining third related data of a second TLS certificate of a second TEE of the fourth device, the fourth device being a participant of the federated learning;

[0048] sending the third data to the fourth device, and receiving sixth data sent by the fourth device, the sixth data being data obtained by the first platform by encapsulating a second verification result, second evidence data related to the second TEE, and second related data of a second TLS certificate of the second TEE using the first protocol, the second verification result being a result obtained by the first platform by verifying the second evidence data based on certificate chain related data of the second TEE;

[0049] comparing the third related data with the second related data, and performing a related operation of the federated learning in a case where the third related data is consistent with the second related data.

[0050] Embodiments of the present application further provide a remote verification method of confidential computing, applied to a fourth device, and including:

[0051] receive sixth data sent by the first platform, the sixth data being data obtained by the first platform encapsulating second verification result, second evidence data related to the second TEE of the fourth device, and second related data of the second TLS certificate of the second TEE by using a first protocol, the second verification result being a result obtained by the first platform verifying the second evidence data based on the certificate chain related data of the second TEE.

[0052] In the above scheme, the method further includes:

[0053] establish a TLS secure channel with a first device, and obtain fourth related data of a first TLE certificate of a first TEE of the first device, the first device being configured to provide a confidential computing service by using the first TEE, the confidential computing service including federated learning, the first device being a coordinator of the federated learning, and the fourth device being a participant of the federated learning;

[0054] send the sixth data to the first device, and receive third data sent by the first device, the third data being data obtained by the first platform encapsulating first verification result, first evidence data related to the first TEE, and first related data of the first TLS certificate of the first TEE by using the first protocol, the first verification result being a result obtained by the first platform verifying the first evidence data based on the certificate chain related data of the first TEE;

[0055] compare the fourth related data with the first related data, and perform a related operation of the federated learning in a case where the fourth related data is consistent with the first related data.

[0056] Embodiments of the present application further provide a confidential computing remote verification device, including:

[0057] a first obtaining unit configured to obtain first data and second data, the first data including first evidence data related to a first TEE of a first device and first related data of a first TLS certificate of the first TEE, the first device being configured to provide a confidential computing service by using the first TEE, and the second data including certificate chain related data of the first TEE;

[0058] a first processing unit configured to verify the first evidence data based on the certificate chain related data of the first TEE to obtain first verification result, and encapsulate the first verification result, the first evidence data, and the first related data by using a first protocol to obtain third data;

[0059] The first sending unit is configured to send the third data to the first device and a second device, the second device being a user of the confidential computing service.

[0060] The embodiments of the present application further provide a remote verification device for confidential computing, comprising:

[0061] The first receiving unit is configured to receive third data sent by a first platform, the third data being data obtained by the first platform by encapsulating a first verification result, first evidence data related to a first TEE of a first device, and first related data of a first TLS certificate of the first TEE by using a first protocol, the first verification result being a result obtained by the first platform by verifying the first evidence data based on certificate chain related data of the first TEE, and the first device being configured to provide a confidential computing service by using the first TEE.

[0062] The embodiments of the present application further provide a remote verification device for confidential computing, comprising:

[0063] The second receiving unit is configured to receive sixth data sent by a first platform, the sixth data being data obtained by the first platform by encapsulating a second verification result, second evidence data related to a second TEE of a fourth device, and second related data of a second TLS certificate of the second TEE by using a first protocol, the second verification result being a result obtained by the first platform by verifying the second evidence data based on certificate chain related data of the second TEE.

[0064] The embodiments of the present application further provide a first platform, comprising: a first communication interface and a first processor; wherein

[0065] The first processor is configured to:

[0066] obtain first data by using the first communication interface, and obtain second data by using the first communication interface, the first data comprising first evidence data related to a first TEE of a first device, and first related data of a first TLS certificate of the first TEE, the first device being configured to provide a confidential computing service by using the first TEE, and the second data comprising certificate chain related data of the first TEE;

[0067] verify the first evidence data based on the certificate chain related data of the first TEE, obtain a first verification result, and encapsulate the first verification result, the first evidence data, and the first related data by using a first protocol, to obtain third data;

[0068] send the third data to the first device and a second device by using the first communication interface, the second device being a user of the confidential computing service.

[0069] The embodiment of the present application further provides a first device, comprising a second communication interface and a second processor; wherein,

[0070] The second processor is configured to receive third data sent by the first platform through the second communication interface, wherein the third data is data obtained by the first platform by encapsulating a first verification result, first evidence data related to a first TEE of the first device, and first related data of a first TLS certificate of the first TEE by using a first protocol, the first verification result is a result obtained by the first platform by verifying the first evidence data based on certificate chain related data of the first TEE, and the first device is configured to provide a confidential computing service through the first TEE.

[0071] The embodiment of the present application further provides a fourth device, comprising a third communication interface and a third processor; wherein,

[0072] The third processor is configured to receive sixth data sent by the first platform through the third communication interface, wherein the sixth data is data obtained by the first platform by encapsulating a second verification result, second evidence data related to a second TEE of the fourth device, and second related data of a second TLS certificate of the second TEE by using a first protocol, and the second verification result is a result obtained by the first platform by verifying the second evidence data based on certificate chain related data of the second TEE.

[0073] The embodiment of the present application further provides a first platform, comprising a first processor and a first memory for storing a computer program capable of running on the processor,

[0074] When the first processor runs the computer program, the steps of any method of the first platform side described above are executed.

[0075] The embodiment of the present application further provides a first device, comprising a second processor and a second memory for storing a computer program capable of running on the processor,

[0076] When the second processor runs the computer program, the steps of any method of the first device side described above are executed.

[0077] The embodiment of the present application further provides a fourth device, comprising a third processor and a third memory for storing a computer program capable of running on the processor,

[0078] When the third processor runs the computer program, the steps of any method of the fourth device side described above are executed.

[0079] The embodiment of the present application further provides a storage medium, which has a computer program stored thereon, and the computer program is executed by a processor to implement the steps of any of the first platform-side methods, or to implement the steps of any of the first device-side methods, or to implement the steps of any of the fourth device-side methods.

[0080] The embodiment of the present application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of any of the first platform-side methods, or to implement the steps of any of the first device-side methods, or to implement the steps of any of the fourth device-side methods.

[0081] The confidential computing remote verification method, device, related equipment, storage medium and computer program product provided by the embodiment of the present application, the first platform obtains first data and obtains second data, the first data includes first evidence data related to a first TEE of a first device and first related data of a first transport layer security TLS certificate of the first TEE, the first device is used to provide a confidential computing service through the first TEE, and the second data includes certificate chain related data of the first TEE; based on the certificate chain related data of the first TEE, the first evidence data is verified to obtain a first verification result, and the first verification result, the first evidence data and the first related data are encapsulated by using a first protocol to obtain third data; the third data is sent to the first device and a second device, and the second device is a user of the confidential computing service. The scheme provided by the embodiment of the present application remotely verifies the provider of the confidential computing service (that is, the first device) by a specific platform (that is, the first platform), and sends the verification result encapsulated by using a specific protocol (that is, the first protocol) to the user of the confidential computing service. In this way, the user of the confidential computing service does not need to build and run a remote verification program corresponding to each confidential computing manufacturer, but only needs to parse a unified protocol encapsulated by the specific platform to obtain the remote verification result, so as to simplify the remote verification work of the confidential computing application (that is, the user of the confidential computing service) and improve the user experience. At the same time, through the specific platform, the management of the computing power resource (that is, the provider of the confidential computing service) of the confidential computing by the computing power operator can be enhanced. In addition, since the related data of the TLS certificate of the TEE is encapsulated in the protocol, subsequent communication between heterogeneous TEEs can be realized based on the data, so as to effectively guarantee the communication security between the heterogeneous TEEs. BRIEF DESCRIPTION OF DRAWINGS

[0082] Figure 1 A flowchart of a confidential computing remote verification method according to an embodiment of the present application;

[0083] Figure 2A flowchart of another remote attestation method of confidential computing according to an embodiment of the present application;

[0084] Figure 3 A flowchart of a third remote attestation method of confidential computing according to an embodiment of the present application;

[0085] Figure 4 A schematic diagram of an example confidential computing remote attestation system architecture applied in the present application;

[0086] Figure 5 A schematic diagram of an example heterogeneous confidential computing TEE interworking process in a federated learning scenario applied in the present application;

[0087] Figure 6 A schematic diagram of a remote attestation device structure of confidential computing according to an embodiment of the present application;

[0088] Figure 7 A schematic diagram of another remote attestation device structure of confidential computing according to an embodiment of the present application;

[0089] Figure 8 A schematic diagram of a third remote attestation device structure of confidential computing according to an embodiment of the present application;

[0090] Figure 9 A schematic diagram of a first platform structure according to an embodiment of the present application;

[0091] Figure 10 A schematic diagram of a first device structure according to an embodiment of the present application;

[0092] Figure 11 A schematic diagram of a fourth device structure according to an embodiment of the present application;

[0093] Figure 12 A schematic diagram of a remote attestation system structure of confidential computing according to an embodiment of the present application. DETAILED DESCRIPTION

[0094] The present application will be described in further detail below with reference to the accompanying drawings and embodiments.

[0095] At present, confidential computing technology is developing rapidly, and many hardware manufacturers have released different confidential computing architectures. At the same time, some cloud computing manufacturers have also begun to use confidential computing hardware to implement cloud services with confidential computing functions. Among them, remote attestation is a key step to ensure that the confidential computing environment is trusted by users. Users will only configure their own privacy data into the confidential computing environment for running after evaluating the evidence of remote attestation and obtaining a trusted evaluation result. In addition, processors supporting confidential computing usually support remote attestation.

[0096] In the related art, different confidential computing architectures may use different implementation manners for the evidence collection process of remote verification. Exemplarily, when a confidential computing application party needs to use a confidential computing service, a remote verification challenge (which can also be understood as a remote verification request) can be initiated to the confidential computing TEE; after the TEE receives the challenge, a manifest file can be generated, which can contain the identification information, version number, and digest of user-defined data (which can be an optional item when the user has custom requirements) of the confidential computing hardware device, and the manifest file content can be signed using the TEE private key to generate an evidence report and sent to the confidential computing application party; the confidential computing application party needs to deploy a specific TEE type software package and program, and run the verification process corresponding to the evidence report locally, thereby interacting with the hardware manufacturer infrastructure, obtaining a certificate chain, and performing evidence report analysis, hardware signature verification, and measurement value (i.e., digest) verification, and finally obtaining a proof result.

[0097] However, the remote verification process in the related art can have the following two problems:

[0098] Problem 1: The confidential computing application party needs to deploy a specific TEE type software package and program, and if different confidential computing TEEs are needed, multiple types of TEE remote verification software packages and programs need to be deployed, which increases the complexity of the confidential computing application for the application party, i.e., the remote verification process is complex.

[0099] Problem 2: Considering that the application of confidential computing is becoming more and more widespread, especially in artificial intelligence computing scenarios (such as federated learning, etc.) that pay more and more attention to privacy protection, the demand for computing power of confidential computing is also increasing; in the case of confidential computing TEE as a participant or coordinator for federated learning training, remote verification is needed between the participants and the coordinator, and when the TEE is confirmed to be trustworthy, federated learning training is performed; however, because the remote verification processes of various TEEs in the related art are different, heterogeneous TEEs (i.e., TEEs from different manufacturers) cannot communicate with each other, and only TEE hardware from the same manufacturer can participate in federated learning training, which limits the application of confidential computing in machine learning scenarios that require a large amount of computing power.

[0100] In addition, for the above problem 2, further, applying confidential computing TEE to a federated learning and the like scenario can also have a man-in-the-middle attack problem of a secure channel (which can be recorded as problem 3 in the following description). Specifically, the original data of each participant in the federated learning does not leave the local, and each participant trains a machine learning model using its own local data, thereby being able to reduce data privacy leakage. In the process of federated learning training, interaction of model information (such as model parameters, parameter gradients, etc.) between participants and coordinators, or between participants is needed, in order to collaboratively train a machine learning model. However, directly transmitting the model information in plaintext is not safe, and an attacker can restore all or part of the original data information by stealing these model information, thereby causing data privacy leakage. Therefore, federated learning training in TEE can solve the problem of data privacy leakage, that is, each participant and coordinator can perform model training and parameter aggregation in TEE; taking the coordinator as an example, although the model information of each participant is aggregated at the coordinator, because the model information is processed in TEE, the model information cannot be obtained outside TEE, and data is available but not visible, so the safety of the data information of the participants can be ensured. In addition to ensuring data safety during training, the establishment of a secure channel between TEEs of each participant / coordinator is also crucial for data security. A secure channel can usually be established using the TLS protocol, but because the TLS authentication process and the remote verification process between TEEs are two independent processes, a vulnerability for a man-in-the-middle attack can be formed; for example, after TEE A and TEE B complete remote verification, A can change the route and forward data originally sent to the trusted application in TEE A to an untrusted application A', and establish a TLS connection between A' and TEE B, so that A' can participate in the entire training process and steal the training data of B.

[0101] In summary, the remote verification process of the related art can have problems such as high complexity (i.e., problem 1) and inability of heterogeneous TEEs to communicate with each other (i.e., problem 2), and further, applying confidential computing TEE to a federated learning and the like scenario can also have a man-in-the-middle attack problem of a secure channel (i.e., problem 3).

[0102] Based on this, in various embodiments of the present application, the provider of the confidential computing service is remotely verified by a specific platform, and the verification result is packaged and sent to the user of the confidential computing service using a specific protocol. In this way, the user of the confidential computing service does not need to build and run the remote verification program corresponding to each confidential computing manufacturer, but only needs to parse the unified protocol packaged by the specific platform to obtain the remote verification result, thereby simplifying the remote verification work of the confidential computing application (i.e., the user of the confidential computing service) and improving the user experience, i.e., at least solving the above problem 1. At the same time, through the specific platform, the management of the computing power resource (i.e., the provider of the confidential computing service) of the computing power operator on the confidential computing can be enhanced. In addition, since the related data of the TLS certificate of the TEE is packaged in the protocol, subsequent communication between heterogeneous TEEs can be implemented based on the data, thereby effectively ensuring the communication security between heterogeneous TEEs, i.e., at least solving the above problems 2 and 3.

[0103] It should be noted that in various embodiments of the present application, "one or more" means at least one, and "multiple" means at least two.

[0104] The embodiments of the present application provide a remote verification method for confidential computing, applied to a first platform, as shown in the following Figure 1 The method comprises the following steps:

[0105] Step 101: Obtain first data and second data, wherein the first data comprises first evidence data related to a first TEE of a first device and first related data of a first TLS certificate of the first TEE, the first device is used to provide a confidential computing service through the first TEE, and the second data comprises certificate chain related data of the first TEE;

[0106] Step 102: Verify the first evidence data based on the certificate chain related data of the first TEE to obtain a first verification result, and package the first verification result, the first evidence data, and the first related data using a first protocol to obtain third data;

[0107] Step 103: Send the third data to the first device and a second device, wherein the second device is a user of the confidential computing service.

[0108] In actual application, the first platform can also be referred to as a confidential computing unified management platform, and the first device can also be referred to as a confidential computing device. The specific name of the first platform and the first device is not limited in the embodiments of the present application, as long as the functions thereof are implemented. In addition, the first device is configured to provide a confidential computing service through the first TEE. It can also be understood that the first device is a provider of the confidential computing service, or it can be understood that the first device belongs to the computing power resource of confidential computing. The first platform can also have a management function for the computing power resource of confidential computing, that is, the first platform can enhance the management of the computing power resource of confidential computing by the computing power operator. For example, the certificate of the first platform can be pre-installed in the first device in advance, or the first device can obtain the certificate of the first platform online. The first platform can be connected with the user (i.e., the second device) of the confidential computing service, receive the confidential computing service application submitted by the second device, and allocate confidential computing resources to the second device, that is, allocate the provider of the confidential computing service (which can also be understood as allocating the confidential computing device), that is, determine the first device. Then, the first platform can send a specific trusted application (which can be referred to as a first application in the subsequent description) provided by the second device to the first TEE, and remotely verify the first device when the second device needs to use the confidential computing service, that is, remotely verify the first application. It can be understood that the first application runs in the first TEE, and the first application can be used to provide the confidential computing service.

[0109] In actual application, the remote verification can also be understood as remote proof or remote authentication, and the first evidence data can be understood as the data to be verified in the remote verification process. The first related data can be used to identify the first TLS certificate, that is, the first related data can include data that can uniquely represent the first TLS certificate. For example, the first evidence data can include one or more of the identifier (such as ID, etc.) of the first TEE, the version of the first TEE, and the first check value, which can be used to verify the integrity of the first application. The first related data can include one or more of the identifier (such as ID, etc.) of the first TLS certificate, the public key of the first TLS certificate, and the hash value corresponding to the first TLS certificate. Here, the specific generation method of the first check value can also be set as needed, for example, the digest of the identifier of the first TEE and the version of the first TEE can be generated as the first check value. The first check value can also be referred to as a digest or a metric value, and the specific name of the first digest value is not limited in the embodiments of the present application, as long as the function thereof is implemented.

[0110] In actual application, the first platform can request the first device to obtain the first data. After receiving the request of the first platform, the first device can sign the first data by using a private key of the first device, and then send the signed first data to the first platform.

[0111] Based on this, in an embodiment, the obtaining the first data can include:

[0112] sending first information to the first device, the first information being used for requesting the first data, i.e., the first information being used for requesting to obtain the first data;

[0113] receiving the signed first data sent by the first device, the signed first data being data obtained by signing the first data by using a second private key of the first device.

[0114] In actual application, the specific content included in the second data can be set according to actual needs, and embodiments of the present application do not limit this; for example, the second data can include one or more of the following: an identifier (such as an ID, etc.) of the first TEE, a version of the first TEE, and a public key of the first device. In addition, the first platform can obtain the second data from an infrastructure of a vendor (i.e., a manufacturer) of the first TEE.

[0115] Based on this, in an embodiment, the obtaining the second data can include:

[0116] obtaining the second data from a third device, the third device being an infrastructure of a vendor of the first TEE.

[0117] In actual application, in order to further guarantee data security, the first platform can sign the third data by using a private key of the first platform, and then send the signed third data to the first device and the second device.

[0118] Based on this, in an embodiment, the sending the third data to the first device and the second device can include:

[0119] signing the third data by using a first private key to obtain signed third data;

[0120] sending the signed third data to the first device and the second device.

[0121] In actual application, the specific manner in which the first platform verifies the first evidence data can be set according to actual needs, and embodiments of the present application do not limit this. For example, verifying the first evidence data based on the certificate chain related data of the first TEE can include one or more of the following:

[0122] verify the signature in the signed first data, i.e., verify the second private key, by using the public key of the first device contained in the second data;

[0123] verify the identity of the first TEE contained in the first evidence data by using the identity of the first TEE contained in the second data;

[0124] verify the version of the first TEE contained in the first evidence data by using the version of the first TEE contained in the second data;

[0125] verify the integrity of the first application by using the second data and the first check value.

[0126] The first platform can generate a third check value by using the second data, such as generating a digest of the identity of the first TEE and the version of the first TEE contained in the second data as the third check value, and then compare the third check value with the first check value, so as to verify the integrity of the first application. In the case where the third check value is consistent with the first check value, it can be determined that the integrity of the first application passes the verification; in the case where the third check value is inconsistent with the first check value, it can be determined that the integrity of the first application fails the verification. In the case where all the above verifications pass, the first verification result can represent that the first evidence data passes the verification; in the case where any of the above verifications fails, the first verification result can represent that the first evidence data fails the verification.

[0127] In actual application, the first platform can encapsulate the first verification result, the first evidence data, and the first related data by using the first protocol to obtain the third data, regardless of whether the first evidence data passes the verification. Alternatively, the first platform can encapsulate the first verification result, the first evidence data, and the first related data by using the first protocol to obtain the third data only in the case where the first verification result represents that the first evidence data passes the verification. Here, the first protocol can be understood as a unified protocol newly added for shielding the differences between manufacturers, and can be specifically as shown in Table 1 in the subsequent description.

[0128] In actual application, after receiving the third data, the second device does not need to build and run a remote verification program of the corresponding confidential computing vendor when using the confidential computing service, but only needs to parse the first protocol, that is, parse the third data, to obtain a remote verification result (that is, the first verification result). In the case that the first verification result represents that the first evidence data passes the verification, the second device can send specific confidential computing data to the first device for confidential computing in the first TEE, or the second device can further obtain one or more of the first TEE identifier, the first TEE version, the first check value, and the first related data included in the third data for subsequent processing according to needs.

[0129] In actual application, in a heterogeneous confidential computing TEE interworking scenario such as federated learning, the end confidential computing TEE can be used as a user of the confidential computing service and interwork with the local confidential computing TEE to jointly perform confidential computing. In other words, after the first device and the second device receive the third data, in the case that the first verification result represents that the first evidence data passes the verification, the first device and the second device can jointly perform confidential computing. Or, taking the federated learning scenario as an example, the first platform can respectively perform remote verification on the coordinator and participants of the federated learning, and then the coordinator and participants of the federated learning can perform federated learning based on the respective verification results.

[0130] Based on this, in an embodiment, in the case that the confidential computing service includes federated learning and the first device is a coordinator (that is, a collaborator) of the federated learning, the method can further include:

[0131] obtaining fourth data and fifth data, the fourth data including second evidence data related to a second TEE of a fourth device and second related data of a second TLS certificate of the second TEE, the fourth device being a participant of the federated learning, and the fifth data including certificate chain related data of the second TEE;

[0132] verifying the second evidence data based on the certificate chain related data of the second TEE to obtain a second verification result, and encapsulating the second verification result, the second evidence data, and the first related data by using the first protocol to obtain sixth data;

[0133] sending the sixth data to the fourth device.

[0134] In actual application, it can be understood that the fourth device can also provide the confidential computing service through the second TEE, that is, the fourth device can be a provider of the confidential computing service or a user of the confidential computing service. In addition, the fourth device and the second device can be the same or different devices, and the embodiments of the present application do not limit this.

[0135] In actual application, the fourth device can also be referred to as a confidential computing device, and the embodiments of the present application do not limit the specific name of the fourth device as long as the function is realized.

[0136] In actual application, the second related data can be used to identify the second TLS certificate, that is, the second related data can include data capable of uniquely representing the second TLS certificate. Exemplarily, the second related data can include one or more of the following:

[0137] the identification (such as ID, etc.) of the second TLS certificate;

[0138] the public key of the second TLS certificate;

[0139] the hash value corresponding to the second TLS certificate.

[0140] In actual application, the second evidence data can be understood as to-be-verified data in a remote verification process. Exemplarily, the second evidence data can include one or more of the following:

[0141] the identification (such as ID, etc.) of the second TEE;

[0142] the version of the second TEE;

[0143] a second check value, the second check value being used to verify the integrity of a second application, the second application running in the second TEE, and the second application being used to provide the confidential computing service.

[0144] In actual application, the specific generation manner of the second check value can be set as needed, for example, the identification of the second TEE and the version of the second TEE can be generated as a digest as the second check value; the second check value can also be referred to as a digest or a measurement value, and the embodiments of the present application do not limit the specific name of the second digest value as long as the function is realized.

[0145] In actual application, the first platform can also sign the sixth data by using a private key of the first platform, and then send the sixth data to the fourth device; that is, the first platform can sign the sixth data by using the first private key, obtain signed sixth data, and then send the signed sixth data to the fourth device. In addition, the fourth device can also sign the fourth data by using a private key of the fourth device, and then send the fourth data to the first platform; specifically, the first platform can send second information to the fourth device, where the second information is used to request the fourth data; then, the first platform can receive the signed fourth data sent by the fourth device, where the signed fourth data is data obtained by signing the fourth data by using a third private key.

[0146] In actual application, the first platform can obtain the fifth data from an infrastructure of a manufacturer of the second TEE; that is, the first platform can obtain the fifth data from a fifth device, where the fifth device is the infrastructure of the manufacturer of the second TEE. In addition, specific content included in the fifth data can be set as needed, and embodiments of the present application do not limit the specific content; for example, the fifth data can include one or more of an identifier (such as an ID) of the second TEE, a version of the second TEE, and a public key of the fourth device.

[0147] In actual application, the specific manner in which the first platform verifies the second evidence data can be understood with reference to the specific manner in which the first platform verifies the first evidence data, which will not be described herein again. After the first device obtains the third data and the fourth device obtains the sixth data, the first device and the fourth device can perform federated learning based on the third data and the sixth data.

[0148] Correspondingly, the embodiments of the present application also provide a remote verification method of confidential computing, applied to a first device, as shown in the method includes: Figure 2

[0149] Step 201: receiving third data sent by a first platform, where the third data is data obtained by the first platform by encapsulating a first verification result, first evidence data related to a first TEE of the first device, and first related data of a first TLS certificate of the first TEE by using a first protocol, the first verification result is a result obtained by the first platform by verifying the first evidence data based on certificate chain related data of the first TEE, and the first device is configured to provide a confidential computing service through the first TEE.

[0150] In an embodiment, the receiving third data sent by the first platform can include:​

[0151] receiving third data signed by the first platform, the third data signed by the first platform being data obtained by the first platform signing the third data by using a first private key.

[0152] In an embodiment, the method can further include:

[0153] receiving first information sent by the first platform, the first information being used for requesting first data, the first data including the first evidence data and the first related data;

[0154] signing the first data by using a second private key to obtain signed first data;

[0155] sending the signed first data to the first platform.

[0156] In actual application, in a federated learning scenario, after the first platform remotely verifies the coordinator and the participant of the federated learning respectively, the coordinator and the participant of the federated learning can exchange their respective remote verification results and perform federated learning based on the remote verification results of both parties.

[0157] Based on this, in an embodiment, when the confidential computing service includes federated learning and the first device is a coordinator of the federated learning, as shown in Figure 2 the method can further include:

[0158] Step 202: establishing a TLS secure channel with a fourth device and obtaining third related data of a second TLS certificate of a second TEE of the fourth device, the fourth device being a participant of the federated learning;

[0159] Step 203: sending the third data to the fourth device and receiving sixth data sent by the fourth device, the sixth data being data obtained by the first platform encapsulating a second verification result, second evidence data related to the second TEE, and second related data of the second TLS certificate of the second TEE by using the first protocol, the second verification result being a result obtained by the first platform verifying the second evidence data based on the certificate chain related data of the second TEE;

[0160] Step 204: comparing the third related data with the second related data, and performing a related operation of the federated learning in a case where the third related data is consistent with the second related data.

[0161] In actual application, the first device can send a federated learning application request to a participant of the federated learning (such as the fourth device, etc.) as a coordinator of the federated learning. Then, the coordinator of the federated learning and the participant of the federated learning can establish a TLS secure channel, and exchange respective remote verification results (such as the third data, the sixth data, etc.) based on the channel. Here, the third related data of the second TLS certificate of the second TEE of the fourth device is obtained in the process of establishing the TLS secure channel with the fourth device, or can be understood as being obtained through the TLS secure channel establishment process (i.e., the TLS authentication process). In addition, it can be understood that the third related data and the second related data are related data of the same TLS certificate (i.e., the second TLS certificate) obtained through different processes. The third related data can include one or more of the identifier (such as ID, etc.) of the second TLS certificate, the public key of the second TLS certificate, and the hash value corresponding to the second TLS certificate.

[0162] In actual application, while the first device obtains the third related data, the fourth device can obtain fourth related data of the first TLE certificate of the first TEE of the first device in the process of establishing a TLS secure channel with the first device, or can be understood as being obtained through the TLS secure channel establishment process (i.e., the TLS authentication process). Here, it can be understood that the fourth related data and the first related data are related data of the same TLS certificate (i.e., the first TLS certificate) obtained through different processes. The fourth related data can include one or more of the identifier (such as ID, etc.) of the first TLS certificate, the public key of the first TLS certificate, and the hash value corresponding to the first TLS certificate. Then, the fourth device can send the sixth data to the first device, receive the third data sent by the first device, compare the fourth related data with the first related data, and perform the related operation of the federated learning in the case that the fourth related data is consistent with the first related data.

[0163] In actual application, the first device can send the third data to the fourth device through the TLS secure channel, and can receive the sixth data sent by the fourth device through the TLS secure channel; correspondingly, the fourth device can send the sixth data to the first device through the TLS secure channel, and can receive the third data sent by the first device through the TLS secure channel. Then, in the case that the first verification result represents that the first evidence data passes the verification (i.e. passes the remote verification of the first platform), the second verification result represents that the second evidence data passes the verification (i.e. passes the remote verification of the first platform), the first device determines that the third related data is consistent with the second related data, and the fourth device determines that the fourth related data is consistent with the first related data, the first device and the fourth device can perform the related operation of the federated learning; for example, the first device can send specific federated learning model parameters to the fourth device through the TLS secure channel; the fourth device can perform federated learning training based on the received parameters, and send the intermediate result of federated learning training to the first device through the TLS secure channel, and the first device performs parameter aggregation of federated learning.

[0164] In actual application, it can be understood that, in the case that one or more of the following conditions is met, the first device and the fourth device will not perform the related operation of the federated learning:

[0165] the first verification result represents that the first evidence data does not pass the verification (i.e. does not pass the remote verification of the first platform);

[0166] the second verification result represents that the second evidence data does not pass the verification (i.e. does not pass the remote verification of the first platform);

[0167] the first device determines that the third related data is inconsistent with the second related data;

[0168] the fourth device determines that the fourth related data is inconsistent with the first related data.

[0169] Correspondingly, the embodiments of the present application also provide a remote verification method of confidential computing, applied to a fourth device, as shown in the figure, the method comprises: Figure 3

[0170] ​Step 301: receiving sixth data sent by a first platform, the sixth data being data obtained by the first platform encapsulating, by using a first protocol, second verification result, second evidence data related to a second TEE of the fourth device, and second related data of a second TLS certificate of the second TEE, the second verification result being a result obtained by the first platform verifying the second evidence data based on certificate chain related data of the second TEE.

[0171] In an embodiment, as shown in Figure 3 The method can further include:

[0172] Step 302: establishing a TLS secure channel with a first device, and obtaining fourth related data of a first TLE certificate of a first TEE of the first device, the first device being configured to provide confidential computing service by using the first TEE, the confidential computing service including federated learning, the first device being a coordinator of the federated learning, and the fourth device being a participant of the federated learning;

[0173] Step 303: sending the sixth data to the first device, and receiving third data sent by the first device, the third data being data obtained by the first platform encapsulating, by using the first protocol, first verification result, first evidence data related to the first TEE, and first related data of a first TLS certificate of the first TEE, the first verification result being a result obtained by the first platform verifying the first evidence data based on certificate chain related data of the first TEE;

[0174] Step 304: comparing the fourth related data with the first related data, and performing a related operation of the federated learning in a case where the fourth related data is consistent with the first related data.

[0175] The confidential computing remote verification method provided by the embodiments of the present application comprises the following steps: a first platform obtains first data and obtains second data, the first data comprises first evidence data related to a first TEE of a first device and first related data of a first Transport Layer Security (TLS) certificate of the first TEE, the first device is configured to provide a confidential computing service through the first TEE, the second data comprises certificate chain related data of the first TEE; the first evidence data is verified based on the certificate chain related data of the first TEE, a first verification result is obtained, and the first verification result, the first evidence data and the first related data are encapsulated by using a first protocol to obtain third data; and the third data is sent to the first device and a second device, the second device is a user of the confidential computing service. The scheme provided by the embodiments of the present application remotely verifies a provider of a confidential computing service (i.e. the first device) by a specific platform (i.e. the first platform), and sends the verification result encapsulated by using a specific protocol (i.e. the first protocol) to a user of the confidential computing service. In this way, the user of the confidential computing service does not need to build and run a remote verification program corresponding to each confidential computing manufacturer, and can obtain the remote verification result by only analyzing the unified protocol encapsulated by the specific platform, thereby simplifying the remote verification work of the user of the confidential computing application (i.e. the user of the confidential computing service) and improving the user experience, i.e. at least solving the above problem 1. At the same time, the specific platform can enhance the management of the computing power resource (i.e. the provider of the confidential computing service) of the confidential computing by the computing power operator. In addition, since the related data of the TLS certificate of the TEE is encapsulated in the protocol, subsequent communication between heterogeneous TEEs can be realized based on the data, thereby effectively ensuring the communication security between the heterogeneous TEEs, i.e. at least solving the above problems 2 and 3.

[0176] The present application will be further described in detail below in combination with application examples.

[0177] In the present application example, remote verification is referred to as remote proof. The present application example provides a confidential computing remote proof system (which can also be referred to as a confidential computing remote authentication system), as shown in Figure 4 , which comprises a confidential computing device (such as the first device, the fourth device, etc.), a confidential computing unified management platform (i.e. the first platform), a user of a confidential computing service (i.e. a confidential computing application, such as the second device, the fourth device, etc.), and a TEE manufacturer infrastructure (such as the third device, the fifth device, etc.).

[0178] Based on the confidential computing remote proof system shown in Figure 4 , the confidential computing remote proof process (i.e. the confidential computing remote authentication process) of the present application example can comprise the following steps:

[0179] Step 401: The confidential computing unified management platform sends a remote attestation request (such as the first information, the second information, etc. described above) to the confidential computing device, and then step 402 can be performed;

[0180] Step 402: The confidential computing device sends a remote attestation evidence report (such as the first data, the fourth data, etc. described above) to the confidential computing unified management platform, and then step 403 can be performed;

[0181] Step 403: The confidential computing unified management platform performs certificate chain acquisition, that is, the confidential computing unified management platform acquires the certificate chain from the TEE manufacturer infrastructure (such as the second data, the fifth data, etc. described above), and then step 404 can be performed;

[0182] Step 404: The confidential computing unified management platform performs remote attestation processing, that is, performs evidence analysis, hardware signature verification, measurement value (that is, digest, such as the first check value, the second check value, etc. described above) verification, device information packaging, and platform endorsement signature, and generates a remote attestation result report (such as the third data, the sixth data, etc. described above), and then step 405 can be performed;

[0183] Step 405: The confidential computing unified management platform sends the remote attestation result report to the confidential computing service user and the confidential computing device, and then step 406 can be performed;

[0184] Step 406: The confidential computing service user sends confidential computing data to the confidential computing device.

[0185] The confidential computing device (such as the first device, the fourth device, etc. described above) is a device that provides confidential computing services through a TEE (such as the first TEE, the second TEE, etc. described above); the form of the confidential computing device can be special hardware, or can be a virtual machine or a container running on special hardware, etc. For example, Figure 4As shown, the confidential computing configuration agent and the trusted application are both deployed in the TEE. The confidential computing configuration agent can be responsible for the deployment, update, remote attestation, etc. of the confidential computing application, and the confidential computing configuration agent can pre-configure or obtain online the certificate of the confidential computing unified management platform (i.e. the first platform described above). When the confidential computing service user proposes a confidential computing service application to the confidential computing unified management platform, after the confidential computing unified management platform allocates confidential computing resources (i.e. confidential computing devices) to the confidential computing service user, the trusted application provided by the confidential computing service user can be installed in the TEE of the confidential computing device. When the confidential computing device receives a remote attestation request (such as the first information and the second information described above), the confidential computing configuration agent can generate a remote attestation evidence report (such as the first data and the fourth data described above) according to the request, which can include confidential hardware device identification information (such as the identification of the first TEE and the identification of the second TEE), version numbers (such as the version of the first TEE and the version of the second TEE), and integrity check values of the trusted application (such as the first check value and the second check value described above); in addition, in order to solve the communication security problem of heterogeneous TEE interworking, the report can also include TLS certificate identification or TLS authentication certificate public key, hash value, etc. data (such as the first related data and the second related data described above) that can uniquely represent the TLS certificate. The confidential computing configuration agent can sign the manifest file content using the TEE private key to generate the remote attestation evidence report.

[0186] In the application example, the confidential computing unified management platform can have at least the following two functions:

[0187] Function 1: interface with the confidential computing service user, receive the confidential computing service application sent by the confidential computing service user, allocate confidential computing devices to the confidential computing service user, and install the trusted application provided by the confidential computing service user in the TEE through the confidential computing configuration agent;

[0188] Function 2: interface with the confidential computing device, send a remote attestation request to the confidential computing device, receive the remote attestation evidence report sent by the confidential computing device, and perform remote attestation evidence verification.

[0189] Wherein, the remote attestation evidence verification by the confidential computing unified management platform can include the following steps:

[0190] Step 1: Obtain the certificate chain data (such as the second data and the fifth data described above) of the confidential computing device from the TEE vendor infrastructure (such as the third device and the fifth device described above), and verify the signature in the evidence report (such as the first data and the fourth data described above);

[0191] Step 2: Identify and analyze the remote attestation evidence report generated by the confidential computing device (such as the first data, fourth data, etc. described above), verify the confidential hardware device identification information (such as the identification of the first TEE, the identification of the second TEE, etc.), the version number (such as the version of the first TEE, the version of the second TEE, etc.), and the integrity check value of the trusted application (such as the first check value, the second check value, etc. described above); after verification, the confidential hardware device identification information, the version number, the integrity check value of the trusted application, and the TLS certificate identification are encapsulated using a unified protocol (i.e. the first protocol described above); here, the unified protocol used by the heterogeneous confidential computing TEE can be as shown in Table 1;

[0192] Step 3: The confidential computing unified management platform uses the private key of the unified management platform to sign the unified protocol data containing the remote attestation result (i.e. the data shown in Table 1, such as the third data, the sixth data, etc. described above) to obtain a signature value, encapsulates the signature value together to generate a final remote attestation result report, and sends the report to the confidential computing service user. After receiving the result report endorsed by the confidential computing unified management platform, the user sends the confidential computing data to the trusted application through a secure channel for confidential computing.

[0193]

[0194] Table 1

[0195] In the application example, the confidential computing service user does not need to build and run each remote attestation program of the corresponding confidential computing manufacturer when using the confidential computing service, but only needs to parse the unified protocol (i.e. the first protocol described above) encapsulated by the unified management platform to obtain the remote attestation result. When the remote attestation is passed, the confidential computing data can be sent to the confidential computing environment for confidential computing, or one or more of the confidential hardware device identification information, the version number, the integrity check value of the trusted application, and the TLS certificate identification in the unified protocol can be further obtained according to the need for subsequent processing. In addition, in the heterogeneous confidential computing TEE interworking scenario, the end confidential computing TEE can also be used as a confidential computing service user to interwork with the local confidential computing TEE for joint confidential computing.

[0196] In addition, in order to solve the man-in-the-middle attack problem of the secure channel (i.e. problem 3 described above), the application example combines the TLS authentication process with the TEE remote attestation process. Specifically, the heterogeneous confidential computing TEE interworking process provided by the application example is as follows Figure 5As shown, first, before joint confidential computing between heterogeneous confidential computing TEEs, the confidential computing unified management platform (i.e., the first platform) can respectively perform remote attestation on the federated learning collaborator (which can correspond to the confidential computing TEE A, i.e., the first TEE, i.e., corresponding to the first device) and the federated learning participant (which can correspond to the confidential computing TEE B, i.e., the second TEE, i.e., corresponding to the fourth device); in other words, the confidential computing TEE A and the confidential computing TEE B have both submitted the remote attestation evidence report (i.e., the first data and the fourth data) to the confidential computing unified management platform, and the confidential computing unified management platform has respectively performed remote attestation on the confidential computing TEE A and the confidential computing TEE B, i.e., generated the remote attestation result report (i.e., the third data and the sixth data) and returned to the corresponding confidential computing TEE. After that, the confidential computing TEE A and B can perform joint confidential computing, i.e., the following steps can be performed:

[0197] Step 501: The confidential computing TEE A (i.e., the first TEE, i.e., corresponding to the first device) sends a federated learning application request to the confidential computing TEE B (i.e., the second TEE, i.e., corresponding to the fourth device), and then step 502 can be performed;

[0198] Here, the confidential computing TEE A can act as a federated learning collaborator and initiate a federated learning application request to each federated learning participant TEE;

[0199] Step 502: The confidential computing TEE A and the confidential computing TEE B establish a TLS secure channel, and then step 503 can be performed;

[0200] Here, the confidential computing TEE A can act as a federated learning collaborator and establish a TLS secure channel with each federated learning participant TEE;

[0201] Step 503: The confidential computing TEE A and the confidential computing TEE B exchange the remote attestation result report (i.e., the third data and the sixth data), and then step 504 can be performed;

[0202] Step 504: The confidential computing TEE A / confidential computing TEE B parses the remote attestation result report of the opposite end, obtains the TLS certificate identifier in the report, and then step 505 can be performed:

[0203] Here, the federated learning collaborator and the federated learning participant can each parse the remote attestation result report of the opposite end TEE, verify the signature of the confidential computing unified management platform, confirm that the remote attestation of the confidential computing unified management platform on the opposite end TEE is passed, and then obtain the TLS certificate identifier in the report;

[0204] Step 505: The confidential computing TEE A / confidential computing TEE B judges whether the TLS certificate identifier in the report is consistent with the certificate identifier obtained in the TLS authentication process; if not, the process can be ended; if yes, step 506 can be performed;

[0205] Here, if the TLS certificate identifier in the remote attestation result report is inconsistent with the TLS certificate identifier obtained in the TLS authentication process, joint confidential computing cannot be performed between the heterogeneous confidential computing TEE A and the confidential computing TEE B, and the process can be ended.

[0206] Step 506: The confidential computing TEE A / confidential computing TEE B performs related operations of federated learning, which can be performed once or in a loop; for example, the confidential computing TEE A can send a federated learning model parameter to the confidential computing TEE B, the confidential computing TEE B can perform federated learning training, and send a federated learning training intermediate result to the confidential computing TEE A, and the confidential computing TEE A can perform federated learning parameter aggregation.

[0207] Here, if the TLS certificate identifier in the remote attestation result report is consistent with the TLS certificate identifier obtained in the TLS authentication process, the federated learning collaborator can issue a federated learning model parameter to the federated learning participant, the federated learning participant can perform federated learning training, and return a federated learning training intermediate result to the federated learning collaborator, and the federated learning collaborator can aggregate and update the training parameters of each participant, and perform iterative training.

[0208] The confidential computing remote attestation system provided by the application example is unified to each TEE manufacturer infrastructure by the confidential computing unified management platform, obtains certificate chain data of the confidential computing TEE, and completes verification of remote attestation evidence provided by the TEE. The remote evidence report submitted by the confidential computing TEE contains a TLS certificate identifier or a TLS authentication certificate public key, a hash value, and other data that can uniquely represent the TLS certificate, so as to solve the communication security problem of heterogeneous TEE interworking. After the confidential computing unified management platform completes the evidence verification, the confidential hardware device identifier information, the version number, the integrity check value of the trusted application program, and the TLS certificate identifier can be encapsulated using a unified protocol, so as to facilitate joint confidential computing of heterogeneous TEE interworking. After the confidential computing unified management platform completes the verification and protocol encapsulation, the remote attestation result report can be signed using a private key of the platform, and the report can be endorsed. In this way, by using the unified remote attestation of the confidential computing unified management platform, the confidential computing application party does not need to pay attention to different TEEs, and only needs to verify the attestation result of the management platform, so as to use the confidential computing environment for confidential computing.

[0209] In addition, the heterogeneous TEE interworking method provided by the application example submits a remote attestation evidence report to the confidential computing unified management platform before joint confidential computing between the heterogeneous confidential computing TEEs, and obtains a remote attestation result report; the confidential computing TEEs each analyze the result report of the opposite end TEE, verify the signature of the confidential computing unified management platform, confirm that the confidential computing unified management platform passes the remote attestation, and the confidential computing TEEs obtain the TLS certificate identifier in the report, compare the TLS certificate identifier in the result report with the TLS certificate identifier obtained through the TLS authentication process, and confirm whether they are consistent; if they are inconsistent, joint confidential computing between the heterogeneous confidential computing TEEs cannot be performed, and the process can be ended; if they are consistent, joint confidential computing between the heterogeneous confidential computing TEEs can be performed.

[0210] To sum up, the scheme provided by the application example can simplify the remote attestation work of the confidential computing application party and enhance the management of the computing power operation party on the computing power resources of the confidential computing, because all the computing power resources of the confidential computing are uniformly verified, signed and managed by the confidential computing unified management platform; and the problem that various TEEs cannot interwork in the machine learning scenario can be solved, and the communication security between the heterogeneous TEEs can be effectively ensured.

[0211] To implement the method of the first platform side of the application embodiment, the application embodiment further provides a remote verification device for confidential computing, which is arranged on a first platform, as shown in the device includes: Figure 6

[0212] The first obtaining unit 601 is configured to obtain first data and second data, the first data including first evidence data related to a first TEE of a first device and first related data of a first TLS certificate of the first TEE, the first device being configured to provide a confidential computing service through the first TEE, and the second data including certificate chain related data of the first TEE;

[0213] The first processing unit 602 is configured to verify the first evidence data based on the certificate chain related data of the first TEE to obtain a first verification result, and encapsulate the first verification result, the first evidence data and the first related data by using a first protocol to obtain third data;

[0214] The first sending unit 603 is configured to send the third data to the first device and a second device, the second device being a user of the confidential computing service.

[0215] In an embodiment, the first processing unit 602 is further configured to sign the third data by using a first private key to obtain signed third data. ​

[0216] Correspondingly, the first sending unit 603 is further configured to send the signed third data to the first device and the second device.

[0217] In an embodiment, the first obtaining unit 601 is further configured to:

[0218] send first information to the first device, the first information being used to request the first data;

[0219] receive signed first data sent by the first device, the signed first data being data obtained by the first device by signing the first data using a second private key.

[0220] In an embodiment, the first obtaining unit 601 is further configured to obtain the second data from a third device, the third device being infrastructure of a vendor of the first TEE.

[0221] In an embodiment, in a case where the confidential computing service includes federated learning and the first device is a coordinator of the federated learning, the first obtaining unit 601 is further configured to obtain fourth data and obtain fifth data, the fourth data including second evidence data related to a second TEE of a fourth device and second related data of a second TLS certificate of the second TEE, the fourth device being a participant of the federated learning, the fifth data including certificate chain related data of the second TEE.

[0222] Correspondingly, the first processing unit 602 is further configured to verify the second evidence data based on the certificate chain related data of the second TEE to obtain a second verification result, and encapsulate the second verification result, the second evidence data, and the first related data using the first protocol to obtain sixth data.

[0223] The first sending unit 603 is further configured to send the sixth data to the fourth device.

[0224] In actual application, the first obtaining unit 601 and the first sending unit 603 can be implemented by a communication interface in a confidential computing remote verification device; and the first processing unit 602 can be implemented by a processor in the confidential computing remote verification device.

[0225] In order to implement the method on the first device side according to the embodiments of the present application, the embodiments of the present application further provide a confidential computing remote verification device arranged on a first device, as shown in Figure 7 The device includes:

[0226] The first receiving unit 701 is configured to receive third data sent by a first platform, the third data being data obtained by the first platform by encapsulating a first verification result, first evidence data related to a first TEE of the first device, and first related data of a first TLS certificate of the first TEE by using a first protocol, the first verification result being a result obtained by the first platform by verifying the first evidence data based on certificate chain related data of the first TEE, and the first device being configured to provide a confidential computing service by using the first TEE.

[0227] In an embodiment, the first receiving unit 701 is further configured to receive signed third data sent by the first platform, the signed third data being data obtained by the first platform by signing the third data by using a first private key.

[0228] In an embodiment, the first receiving unit 701 is further configured to receive first information sent by the first platform, the first information being used to request first data, and the first data including the first evidence data and the first related data.

[0229] Correspondingly, as shown in Figure 7 the apparatus can further include:

[0230] The second processing unit 702 is configured to sign the first data by using a second private key to obtain signed first data.

[0231] The second sending unit 703 is configured to send the signed first data to the first platform.

[0232] In an embodiment, as shown in Figure 7 the apparatus can further include:

[0233] The second obtaining unit 704 is configured to, in a case where the confidential computing service includes federated learning and the first device is a coordinator of the federated learning, establish a TLS secure channel with a fourth device, and obtain third related data of a second TLS certificate of a second TEE of the fourth device, the fourth device being a participant of the federated learning.

[0234] Correspondingly, the second sending unit 703 is further configured to send the third data to the fourth device.

[0235] The first receiving unit 701 is further configured to receive sixth data sent by the fourth device, the sixth data being data obtained by the first platform from encapsulating, by using the first protocol, second verification result, second evidence data related to the second TEE, and second related data of the second TLS certificate of the second TEE, the second verification result being result obtained by the first platform from verifying the second evidence data based on the certificate chain related data of the second TEE.

[0236] The second processing unit 702 is further configured to compare the third related data with the second related data, and perform a related operation of the federated learning in a case where the third related data is consistent with the second related data.

[0237] The functions of the first receiving unit 701, the second processing unit 702, the second sending unit 703, and the second obtaining unit 704 can be equivalent to the functions of the confidential computing configuration proxy in the application examples.

[0238] In actual application, the first receiving unit 701, the second sending unit 703, and the second obtaining unit 704 can be implemented by a communication interface in a remote verification device for confidential computing, and the second processing unit 702 can be implemented by a processor in the remote verification device for confidential computing.

[0239] In order to implement the method on the fourth device side in the embodiments of the present application, the embodiments of the present application further provide a remote verification device for confidential computing, which is arranged on the fourth device, as shown in Figure 8 The device comprises:

[0240] The second receiving unit 801 is configured to receive sixth data sent by the first platform, the sixth data being data obtained by the first platform from encapsulating, by using the first protocol, second verification result, second evidence data related to the second TEE of the fourth device, and second related data of the second TLS certificate of the second TEE, the second verification result being result obtained by the first platform from verifying the second evidence data based on the certificate chain related data of the second TEE.

[0241] In an embodiment, as shown in Figure 8 The device can further comprise a third obtaining unit 802, a third sending unit 803, and a third processing unit 804, wherein

[0242] The third obtaining unit 802 is configured to establish a TLS secure channel with a first device, and obtain fourth related data of a first TLE certificate of a first TEE of the first device, the first device being configured to provide a confidential computing service including federated learning, the first device being a coordinator of the federated learning, and the fourth device being a participant of the federated learning;

[0243] The third sending unit 803 is configured to send the sixth data to the first device.

[0244] Correspondingly, the second receiving unit 801 is further configured to receive third data sent by the first device, the third data being data obtained by the first platform by encapsulating a first verification result, first evidence data related to the first TEE, and first related data of a first TLS certificate of the first TEE using the first protocol, the first verification result being a result obtained by the first platform by verifying the first evidence data based on the certificate chain related data of the first TEE.

[0245] The third processing unit 804 is configured to compare the fourth related data with the first related data, and perform a related operation of the federated learning in a case where the fourth related data is consistent with the first related data.

[0246] The functions of the second receiving unit 801, the third obtaining unit 802, the third sending unit 803, and the third processing unit 804 can be equivalent to the functions of the confidential computing configuration proxy in the application examples.

[0247] In actual application, the second receiving unit 801, the third obtaining unit 802, and the third sending unit 803 can be implemented by a communication interface in a remote verification device for confidential computing, and the third processing unit 804 can be implemented by a processor in the remote verification device for confidential computing.

[0248] It should be noted that the remote verification device for confidential computing provided in the above embodiments is only exemplified by the division of the above program modules when performing remote verification for confidential computing. In actual application, the above processing can be completed by different program modules according to needs, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the remote verification device for confidential computing and the remote verification method for confidential computing provided in the above embodiments belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0249] Based on the hardware implementation of the above program modules, and in order to implement the method of the first platform side according to the embodiments of the present application, the embodiments of the present application further provide a first platform, such asFigure 9 As shown, the first platform 900 includes:

[0250] a first communication interface 901, capable of interacting with a provider of confidential computing services (such as the first device, the fourth device, etc.), a user of confidential computing services (such as the second device, the fourth device, etc.), and an infrastructure of a vendor of TEE (such as the third device, the fifth device, etc.);

[0251] a first processor 902, connected with the first communication interface 901, to realize information interaction with the provider of confidential computing services, the user of confidential computing services, and the infrastructure of the vendor of TEE, for running a computer program, to execute the method provided by one or more technical solutions on the first platform side;

[0252] a first memory 903, on which the computer program is stored.

[0253] Specifically, the first processor 902 is configured to:

[0254] obtain first data through the first communication interface 901, and obtain second data through the first communication interface 901, the first data including first evidence data related to a first TEE of a first device and first related data of a first TLS certificate of the first TEE, the first device being configured to provide confidential computing services through the first TEE, and the second data including certificate chain related data of the first TEE;

[0255] verify the first evidence data based on the certificate chain related data of the first TEE to obtain a first verification result, and encapsulate the first verification result, the first evidence data, and the first related data using a first protocol to obtain third data;

[0256] send the third data to the first device and a second device through the first communication interface 901, the second device being a user of the confidential computing services.

[0257] In an embodiment, the first processor 902 is further configured to:

[0258] sign the third data using a first private key to obtain signed third data;

[0259] send the signed third data to the first device and the second device through the first communication interface 901.

[0260] In an embodiment, the first processor 902 is further configured to:

[0261] The first processor 902 is configured to send first information to the first device through the first communication interface 901, where the first information is used to request the first data.

[0262] The first processor 902 is configured to receive signed first data sent by the first device through the first communication interface 901, where the signed first data is data obtained by signing the first data by the first device using a second private key.

[0263] In an embodiment, the first processor 902 is further configured to obtain the second data from a third device through the first communication interface 901, where the third device is infrastructure of a vendor of the first TEE.

[0264] In an embodiment, in a case where the confidential computing service includes federated learning and the first device is a coordinator of the federated learning, the first processor 902 is further configured to:

[0265] The first processor 902 is configured to obtain fourth data and fifth data through the first communication interface 901, where the fourth data includes second evidence data related to a second TEE of a fourth device and second related data of a second TLS certificate of the second TEE, the fourth device is a participant of the federated learning, and the fifth data includes certificate chain related data of the second TEE.

[0266] The first processor 902 is configured to verify the second evidence data based on the certificate chain related data of the second TEE to obtain a second verification result, and encapsulate the second verification result, the second evidence data, and the first related data using the first protocol to obtain sixth data.

[0267] The first processor 902 is configured to send the sixth data to the fourth device through the first communication interface 901.

[0268] It should be noted that the specific processing process of the first processor 902 can be understood with reference to the above method, and will not be described here.

[0269] Of course, in actual application, various components in the first platform 900 are coupled together through the bus system 904. It can be understood that the bus system 904 is used to realize the connection and communication between these components. In addition to including a data bus, the bus system 904 also includes a power bus, a control bus, and a status signal bus. However, in order to clearly illustrate the application, all kinds of buses are marked as the bus system 904 in the Figure 9 .

[0270] The first memory 903 in the embodiment of the application is used to store various types of data to support the operation of the first platform 900. Examples of these data include any computer programs used to operate on the first platform 900.

[0271] The method disclosed in the embodiments of the present application can be applied to the first processor 902 or implemented by the first processor 902. The first processor 902 can be an integrated circuit chip with a signal processing capability. In the implementation process, each step of the method can be completed by integrated logic circuits of hardware in the first processor 902 or instructions in the form of software. The first processor 902 can be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 902 can implement or execute the disclosed methods, steps, and logic block diagrams in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiments of the present application, the hardware decoding processor can be directly implemented or executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the first memory 903, and the first processor 902 reads information in the first memory 903 to combine the hardware to complete the steps of the foregoing method.

[0272] In the exemplary embodiments, the first platform 900 can be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, micro controllers (MCUs), microprocessors (Microprocessors), or other electronic elements, for executing the foregoing method.

[0273] Based on the hardware implementation of the foregoing program module, and in order to implement the method of the first device side in the embodiments of the present application, the embodiments of the present application further provide a first device, as shown in the following. Figure 10 The first device 1000 includes:

[0274] The second communication interface 1001 can interact with the first platform and other devices (such as the fourth device, etc.) to exchange information.

[0275] The second processor 1002 is connected with the second communication interface 1001 to realize information interaction with the first platform and other devices, and is used to run a computer program to execute the method provided by one or more technical solutions of the first device side.

[0276] The second memory 1003 stores the computer program.

[0277] Specifically, the second processor 1002 is configured to receive third data sent by the first platform through the second communication interface 1001, wherein the third data is data obtained by the first platform by encapsulating a first verification result, first evidence data related to a first TEE of the first device 1000, and third related data of a first TLS certificate of the first TEE using a first protocol, the first verification result is a result obtained by the first platform by verifying the first evidence data based on certificate chain related data of the first TEE, and the first device 1000 is configured to provide a confidential computing service through the first TEE.

[0278] In an embodiment, the second processor 1002 is further configured to receive signed third data sent by the first platform through the second communication interface 1001, wherein the signed third data is data obtained by the first platform by signing the third data using a first private key.

[0279] In an embodiment, the second processor 1002 is further configured to:

[0280] receive first information sent by the first platform through the second communication interface 1001, wherein the first information is used to request first data, and the first data includes the first evidence data and the first related data;

[0281] sign the first data using a second private key to obtain signed first data;

[0282] send the signed first data to the first platform through the second communication interface 1001.

[0283] In an embodiment, when the confidential computing service includes federated learning and the first device 1000 is a coordinator of the federated learning, the second processor 1002 is further configured to:

[0284] establish a TLS secure channel with a fourth device through the second communication interface 1001, and obtain third related data of a second TLS certificate of a second TEE of the fourth device through the second communication interface 1001, wherein the fourth device is a participant of the federated learning;

[0285] The third data is sent to the fourth device through the second communication interface 1001, and the sixth data sent by the fourth device is received through the second communication interface 1001, wherein the sixth data is data obtained by the first platform encapsulating second verification result, second evidence data related to the second TEE, and second related data of the second TLS certificate of the second TEE by using the first protocol, and the second verification result is a result obtained by the first platform verifying the second evidence data based on the certificate chain related data of the second TEE.

[0286] The third related data is compared with the second related data, and in the case that the third related data is consistent with the second related data, a related operation of the federated learning is performed.

[0287] It should be noted that the specific processing process of the second processor 1002 can be understood with reference to the above method, which will not be described here.

[0288] Of course, in actual application, various components in the first device 1000 are coupled together through the bus system 1004. It can be understood that the bus system 1004 is used to realize the connection and communication between the components. In addition to including a data bus, the bus system 1004 also includes a power bus, a control bus and a status signal bus. However, in order to clearly illustrate, all kinds of buses are marked as the bus system 1004 in the Figure 10 .

[0289] The second memory 1003 in the embodiment of the application is used to store various types of data to support the operation of the first device 1000. Examples of these data include: any computer programs used to operate on the first device 1000.

[0290] The method disclosed by the embodiments of the present application can be applied to the second processor 1002 or implemented by the second processor 1002. The second processor 1002 can be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above method can be completed by integrated logic circuits of hardware in the second processor 1002 or instructions in the form of software. The second processor 1002 described above can be a general processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 1002 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiments of the present application, the execution can be directly completed by a hardware decoding processor or a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the second memory 1003, and the second processor 1002 reads the information in the second memory 1003 to complete the steps of the above method in combination with the hardware.

[0291] In the exemplary embodiments, the first device 1000 can be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic elements for executing the above method.

[0292] Based on the hardware implementation of the above program module, and in order to implement the method on the fourth device side in the embodiments of the present application, the embodiments of the present application further provide a fourth device, as shown in the following Figure 11 The fourth device 1100 includes:

[0293] The third communication interface 1101 can interact with the first platform and other devices (such as the first device, etc.) to exchange information;

[0294] The third processor 1102 is connected with the third communication interface 1101 to realize information interaction with the first platform and other devices, and is used to run a computer program to execute the method provided by one or more technical solutions on the fourth device side;

[0295] The third memory 1103 stores the computer program.

[0296] Specifically, the third processor 1102 is configured to receive, through the third communication interface 1101, sixth data sent by a first platform, the sixth data being data obtained by the first platform encapsulating second verification result, second evidence data related to a second TEE of the fourth device 1100, and second related data of a second TLS certificate of the second TEE by using a first protocol, the second verification result being a result obtained by the first platform verifying the second evidence data based on certificate chain related data of the second TEE.

[0297] In an embodiment, the third processor 1102 is further configured to:

[0298] establish, through the third communication interface 1101, a TLS secure channel with a first device, and obtain, through the third communication interface 1101, fourth related data of a first TLE certificate of a first TEE of the first device, the first device being configured to provide a confidential computing service by using the first TEE, the confidential computing service including federated learning, the first device being a coordinator of the federated learning, and the fourth device 1100 being a participant of the federated learning.

[0299] send, through the third communication interface 1101, the sixth data to the first device, and receive, through the third communication interface 1101, third data sent by the first device, the third data being data obtained by the first platform encapsulating first verification result, first evidence data related to the first TEE, and first related data of a first TLS certificate of the first TEE by using the first protocol, the first verification result being a result obtained by the first platform verifying the first evidence data based on certificate chain related data of the first TEE.

[0300] compare the fourth related data with the first related data, and perform a related operation of the federated learning in a case where the fourth related data is consistent with the first related data.

[0301] It should be noted that the specific processing process of the third processor 1102 can be understood with reference to the above method, which will not be described here.

[0302] Of course, in actual application, various components in the fourth device 1100 are coupled together through the bus system 1104. It can be understood that the bus system 1104 is used to realize the connection and communication between the components. In addition to including a data bus, the bus system 1104 also includes a power bus, a control bus, and a status signal bus. However, for the purpose of clear illustration, all kinds of buses are marked as the bus system 1104 in the Figure 11 .

[0303] The third memory 1103 in the embodiments of the present application is configured to store various types of data to support the operation of the fourth device 1100. Examples of the data include any computer programs for operating on the fourth device 1100.

[0304] The method disclosed in the embodiments of the present application can be applied to or implemented by the third processor 1102. The third processor 1102 can be an integrated circuit chip with a signal processing capability. In the implementation, each step of the above method can be completed by the integrated logic circuit or the instruction in the form of software of the third processor 1102. The third processor 1102 can be a general processor, a DSP, or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The third processor 1102 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiments of the present application, the hardware decoding processor can be directly implemented or executed by the hardware and software module combination in the decoding processor. The software module can be located in the storage medium, which is located in the third memory 1103. The third processor 1102 reads the information in the third memory 1103 and combines the hardware to complete the steps of the above method.

[0305] In the exemplary embodiments, the fourth device 1100 can be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general processors, controllers, MCUs, microprocessors, or other electronic elements, to execute the above method.

[0306] It can be understood that the memory (the first memory 903, the second memory 1003, and the third memory 1103) of the embodiments of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. The non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a ferromagnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM). The magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM can be used, such as a static random access memory (SRAM), a synchronous static random access memory (SSRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDR SDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a sync link dynamic random access memory (SLDRAM), and a direct rambus random access memory (DRRAM).The memory described in the embodiments of the present application is intended to include, but not limited to, these and any other suitable types of memory.

[0307] To implement the method provided by the embodiments of the present application, the embodiments of the present application further provide a remote verification system for confidential computing, as shown in the following. Figure 12 The system includes a first platform 1201, a first device 1202 and a fourth device 1203.

[0308] In actual application, it can be understood that the first device 1202 is a provider of confidential computing service, and the fourth device 1203 is a user of confidential computing service; the system can further include other providers of confidential computing service, other users of confidential computing service (such as a second device, etc.), and infrastructure of a vendor of TEE (such as a third device, a fifth device, etc.), and the embodiments of the present application do not limit the specific architecture of the system. In addition, it should be noted that the specific processing procedures of the first platform 1201, the first device 1202 and the fourth device 1203 have been described in the foregoing, and will not be described here.

[0309] In the example embodiments, the embodiments of the present application further provide a storage medium, i.e., a computer storage medium, specifically a computer readable storage medium, for example, including a first memory 903 storing a computer program, which can be executed by a first processor 902 of a first platform 900 to complete the steps of any method described above on the first platform side. For another example, including a second memory 1003 storing a computer program, which can be executed by a second processor 1002 of a first device 1000 to complete the steps of any method described above on the first device side. For another example, including a third memory 1103 storing a computer program, which can be executed by a third processor 1102 of a fourth device 1100 to complete the steps of any method described above on the fourth device side. The computer readable storage medium can be FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM, etc.

[0310] In the example embodiments, the embodiments of the present application further provide a computer program product, including a computer program, which can be executed by a first processor 902 of a first platform 900 to complete the steps of any method described above on the first platform side; or, the computer program can be executed by a second processor 1002 of a first device 1000 to complete the steps of any method described above on the first device side; or, the computer program can be executed by a third processor 1102 of a fourth device 1100 to complete the steps of any method described above on the fourth device side.

[0311] It should be noted that "first", "second", and the like are used to distinguish similar objects, and do not necessarily have to be used to describe a particular order or sequence.

[0312] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0313] The above is only a preferred embodiment of the present application, and is not intended to limit the scope of protection of the present application.

Claims

1. A remote verification method for confidential computing, characterized in that, Applied to the first platform, including: Acquire first data and acquire second data. The first data includes first evidence data related to the first Trusted Execution Environment (TEE) of the first device and first related data of the first Transport Layer Security (TLS) certificate of the first TEE. The first device is used to provide confidential computing services through the first TEE. The second data includes certificate chain related data of the first TEE. Based on the certificate chain related data of the first TEE, the first evidence data is verified to obtain a first verification result. The first verification result, the first evidence data, and the first related data are then encapsulated using a first protocol to obtain third data. The third data is sent to the first device and the second device, where the second device is the user of the confidential computing service.

2. The method according to claim 1, characterized in that, Sending the third data to the first device and the second device includes: The third data is signed using the first private key to obtain the signed third data; Send the signed third data to the first device and the second device.

3. The method according to claim 1, characterized in that, The acquisition of the first data includes: Send first information to the first device, the first information being used to request the first data; The device receives first signed data sent by the first device, wherein the first signed data is data obtained by the first device signing the first data using a second private key.

4. The method according to claim 1, characterized in that, The acquisition of the second data includes: The second data is obtained from a third device, which is the infrastructure of the vendor of the first TEE.

5. The method according to claim 1, characterized in that, The first relevant data includes one or more of the following: The identifier of the first TLS certificate; The public key of the first TLS certificate; The hash value corresponding to the first TLS certificate.

6. The method according to claim 1, characterized in that, The first piece of evidence data includes one or more of the following: The identifier of the first TEE; The version of the first TEE; The first check value is used to verify the integrity of the first application, which runs in the first TEE and is used to provide the confidential computing service.

7. The method according to any one of claims 1 to 6, characterized in that, In the case that the confidential computing service includes federated learning, and the first device is the coordinator of the federated learning, the method further includes: Obtain fourth data and fifth data. The fourth data includes second evidence data related to the second TEE of the fourth device and second related data of the second TLS certificate of the second TEE. The fourth device is a participant in the federated learning. The fifth data includes certificate chain related data of the second TEE. Based on the certificate chain related data of the second TEE, the second evidence data is verified to obtain the second verification result. The second verification result, the second evidence data, and the first related data are then encapsulated using the first protocol to obtain the sixth data. The sixth data is sent to the fourth device.

8. A remote verification method for confidential computing, characterized in that, Applied to the first device, including: The device receives third data sent by a first platform. The third data is data obtained by the first platform using a first protocol to encapsulate a first verification result, first evidence data related to the first TEE of the first device, and first related data of the first TLS certificate of the first TEE. The first verification result is the result obtained by the first platform based on the certificate chain related data of the first TEE to verify the first evidence data. The first device is used to provide confidential computing services through the first TEE.

9. The method according to claim 8, characterized in that, The receipt of the third data sent by the first platform includes: The system receives third data after signing from the first platform, wherein the third data after signing is data obtained by the first platform signing the third data using the first private key.

10. The method according to claim 8, characterized in that, The method further includes: Receive first information sent by the first platform, the first information being used to request first data, the first data including the first evidence data and the first related data; The first data is signed using the second private key to obtain the signed first data; Send the first data after signing to the first platform.

11. The method according to claim 8, characterized in that, The first relevant data includes one or more of the following: The identifier of the first TLS certificate; The public key of the first TLS certificate; The hash value corresponding to the first TLS certificate.

12. The method according to claim 8, characterized in that, The first piece of evidence data includes one or more of the following: The identifier of the first TEE; The version of the first TEE; The first check value is used to verify the integrity of the first application, which runs in the first TEE and is used to provide the confidential computing service.

13. The method according to any one of claims 8 to 12, characterized in that, In the case that the confidential computing service includes federated learning, and the first device is the coordinator of the federated learning, the method further includes: Establish a TLS secure channel with the fourth device and obtain the third related data of the second TLS certificate of the second TEE of the fourth device, wherein the fourth device is a participant in the federated learning; The third data is sent to the fourth device, and the sixth data sent by the fourth device is received. The sixth data is data obtained by the first platform using the first protocol to encapsulate the second verification result, the second evidence data related to the second TEE, and the second related data of the second TLS certificate of the second TEE. The second verification result is the result obtained by the first platform to verify the second evidence data based on the certificate chain related data of the second TEE. The third relevant data is compared with the second relevant data. If the third relevant data is consistent with the second relevant data, the relevant operations of federated learning are performed.

14. A remote verification method for confidential computing, characterized in that, Applied to the fourth device, including: The system receives a sixth data sent by the first platform. The sixth data is data obtained by the first platform using the first protocol to encapsulate the second verification result, the second evidence data related to the second TEE of the fourth device, and the second related data of the second TLS certificate of the second TEE. The second verification result is the result obtained by the first platform based on the certificate chain related data of the second TEE to verify the second evidence data.

15. The method according to claim 14, characterized in that, The method further includes: A TLS secure channel is established with the first device, and fourth related data of the first TLE certificate of the first TEE of the first device is obtained. The first device is used to provide confidential computing services through the first TEE. The confidential computing services include federated learning. The first device is the coordinator of the federated learning, and the fourth device is a participant in the federated learning. The platform sends the sixth data to the first device and receives the third data sent by the first device. The third data is data obtained by the first platform using the first protocol to encapsulate the first verification result, the first evidence data related to the first TEE, and the first related data of the first TLS certificate of the first TEE. The first verification result is the result obtained by the first platform verifying the first evidence data based on the certificate chain related data of the first TEE. The fourth relevant data is compared with the first relevant data. If the fourth relevant data is consistent with the first relevant data, the relevant operations of the federated learning are performed.

16. A remote verification device for confidential computing, characterized in that, include: The first acquisition unit is used to acquire first data and second data. The first data includes first evidence data related to the first TEE of the first device and first related data of the first TLS certificate of the first TEE. The first device is used to provide confidential computing services through the first TEE. The second data includes certificate chain related data of the first TEE. The first processing unit is configured to verify the first evidence data based on the certificate chain related data of the first TEE, obtain a first verification result, and encapsulate the first verification result, the first evidence data, and the first related data using a first protocol to obtain third data. A first sending unit is configured to send the third data to the first device and a second device, wherein the second device is a user of the confidential computing service.

17. A remote verification device for confidential computing, characterized in that, include: The first receiving unit is used to receive third data sent by the first platform. The third data is data obtained by the first platform using a first protocol to encapsulate the first verification result, the first evidence data related to the first TEE of the first device, and the first related data of the first TLS certificate of the first TEE. The first verification result is the result obtained by the first platform to verify the first evidence data based on the certificate chain related data of the first TEE. The first device is used to provide confidential computing services through the first TEE.

18. A remote verification device for confidential computing, characterized in that, include: The second receiving unit is used to receive the sixth data sent by the first platform. The sixth data is data obtained by the first platform using the first protocol to encapsulate the second verification result, the second evidence data related to the second TEE of the fourth device, and the second related data of the second TLS certificate of the second TEE. The second verification result is the result obtained by the first platform to verify the second evidence data based on the certificate chain related data of the second TEE.

19. A first platform, characterized in that, include: A first communication interface and a first processor; wherein... The first processor is configured to: First data is obtained through the first communication interface, and second data is obtained through the first communication interface. The first data includes first evidence data related to the first TEE of the first device and first related data of the first TLS certificate of the first TEE. The first device is used to provide confidential computing services through the first TEE. The second data includes certificate chain related data of the first TEE. Based on the certificate chain related data of the first TEE, the first evidence data is verified to obtain a first verification result. The first verification result, the first evidence data, and the first related data are then encapsulated using a first protocol to obtain third data. The third data is sent to the first device and the second device through the first communication interface, wherein the second device is the user of the confidential computing service.

20. A first device, characterized in that, include: The second communication interface and the second processor; wherein... The second processor is configured to receive third data sent by the first platform through the second communication interface. The third data is data obtained by the first platform using a first protocol to encapsulate a first verification result, first evidence data related to the first TEE of the first device, and first related data of the first TLS certificate of the first TEE. The first verification result is the result obtained by the first platform verifying the first evidence data based on the certificate chain related data of the first TEE. The first device is configured to provide confidential computing services through the first TEE.

21. A fourth device, characterized in that, include: A third communication interface and a third processor; wherein... The third processor is used to receive sixth data sent by the first platform through the third communication interface. The sixth data is data obtained by the first platform using the first protocol to encapsulate the second verification result, the second evidence data related to the second TEE of the fourth device, and the second related data of the second TLS certificate of the second TEE. The second verification result is the result obtained by the first platform to verify the second evidence data based on the certificate chain related data of the second TEE.

22. A first platform, characterized in that, include: A first processor and a first memory for storing computer programs capable of running on the processor. Wherein, when the first processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 7.

23. A first device, characterized in that, include: A second processor and a second memory for storing computer programs that can run on the processor. Wherein, when the second processor is used to run the computer program, it performs the steps of the method according to any one of claims 8 to 13.

24. A fourth device, characterized in that, include: A third processor and a third memory for storing computer programs that can run on the processor. When the third processor runs the computer program, it performs the steps of the method described in claim 14 or 15.

25. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7, or the steps of the method according to any one of claims 8 to 13, or the steps of the method according to claim 14 or 15.

26. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7, or the steps of the method according to any one of claims 8 to 13, or the steps of the method according to claim 14 or 15.

Images