A TEE-based ciphertext domain distributed resource scheduling system and method and storage medium

Abstract

The present application relates to the technical field of trusted hardware privacy computing, and particularly relates to a ciphertext domain distributed resource scheduling system based on TEE, which is deployed in a consortium chain network and comprises a TEE hardware carrier, a private ciphertext operation edge processing unit, a private autonomous regulation and control module, an identity and relationship right confirmation module and a double-layer private audit module; the private ciphertext operation edge processing unit is an independent hardware module. Through the TEE hardware isolation and the ciphertext inverse element pre-computation mechanism, when the resource pool is short, the ciphertext division is replaced by homomorphic multiplication, the whole domain compensation scaling can be completed without decryption, the plaintext operation leakage gap is completely eliminated, the single machine full ciphertext closed loop operation does not need node synchronous communication, and the offline settlement voucher with a hardware signature can still be independently generated in a network interruption state, so that the strong dependence of traditional multi-party secure computing on synchronous communication is fundamentally eliminated, the communication cost is greatly reduced, and the applicability in a weak network environment is significantly enhanced.

Description

Technical Field

[0001] This invention relates to the field of trusted hardware privacy computing technology, specifically to a TEE-based encrypted domain distributed resource scheduling system, method, and storage medium. Background Technology

[0002] Many shared service scenarios now use distributed resource allocation and points settlement, such as co-living elderly care, business district profit sharing, and shared workstations. In most of these scenarios, user data is still processed directly in plaintext. The elderly’s physical signs, the business’s operating flow, and the mutual assistance records between residents are all stored and calculated in the open. The data is easily captured and tampered with. There are no means of isolating the sensitive information of different residents in co-living elderly care, which can easily lead to privacy leaks and disputes. The personal information security of users cannot be guaranteed at all.

[0003] Most mainstream privacy computing solutions on the market rely on multi-party synchronous communication to operate. Architectures like SMPC require all nodes in the network to maintain online interaction at all times. Once the number of connected nodes increases, the communication pressure and computing power consumption will rise sharply. However, home-based elderly care and offline shops often encounter network outages or weak networks, and nodes cannot stably synchronize data. This solution is difficult to adapt to such asynchronous online usage environments.

[0004] Currently, conventional TEE hardware devices only encrypt and store data. Core calculation steps such as resource allocation threshold adjustment and integral balancing compensation still need to be decrypted before execution. Hardware isolation has vulnerabilities to plaintext leakage. At the same time, resource allocation parameters are fixed in advance and lack automatic adjustment capabilities. After long-term operation, the resource pool either runs out of reserves or a large amount of idle resources accumulate, making it difficult to maintain a stable system operation. The supporting auditing mechanism is also not perfect. Unified global auditing will leak the privacy of ordinary users, while separate reconciliation cannot complete the overall compliance verification. When accounting contradictions occur, it is difficult to provide complete and credible evidence. Moreover, there is a lack of privacy scheduling backend solutions on the market that can be integrated with elderly care sensing robots and operate completely independently.

[0005] This invention addresses the multiple shortcomings of existing distributed scheduling systems, such as the ease of plaintext data leakage, high overhead of synchronous communication architecture, inability of TEE hardware to achieve a complete encrypted control loop, lack of self-balancing mechanism in resource allocation, and inability of auditing systems to balance regulatory verification and user privacy protection. It also fills the industry gap of lacking a supporting privacy settlement system for elderly care hardware, and creates a distributed resource scheduling architecture that is physically isolated from the front-end perception robot and can complete fully encrypted operations offline on a standalone machine. Summary of the Invention

[0006] The purpose of this invention is to provide a TEE-based encrypted domain distributed resource scheduling system, method, and storage medium to solve the problems mentioned in the background art.

[0007] To address the aforementioned issues, this invention provides a technical solution: a TEE-based encrypted domain distributed resource scheduling system deployed on a consortium blockchain network, comprising a TEE hardware carrier, a privacy-encrypted computation edge processing unit, a privacy autonomous control module, an identity and relationship confirmation module, and a two-layer privacy audit module;

[0008] The privacy-preserving ciphertext operation edge processing unit is an independent hardware module, which is physically isolated and task-decoupled from the motion perception hardware of the front-end care robot. It is only responsible for encryption, homomorphic operation, and resource scheduling, and does not participate in human perception or robotic arm control. All ciphertext operations are completed independently by a single machine without the need for multi-node synchronous interaction.

[0009] The TEE hardware carrier has a built-in encryption key storage area, and hardware isolation constructs a plaintext zero overflow ciphertext running environment.

[0010] The privacy autonomous control module has four built-in encrypted sub-circuits, including a dynamic threshold sub-circuit, a time-series weight linkage sub-circuit, a multi-level water level negative feedback sub-circuit, and a balance compensation sub-circuit. The balance compensation sub-circuit pre-stores the ciphertext inverse of the divisor, and when the resource pool is short, it realizes the ciphertext division through homomorphic multiplication.

[0011] The identity and relationship confirmation module has a built-in zero-knowledge verification unit. After the verification is passed, an on-chain encrypted NFT confirmation certificate with behavior classification identifier is generated.

[0012] The dual-layer privacy audit module includes a global audit proof unit and a single-node privacy reconciliation unit, which generate two types of independent cryptographic proofs respectively.

[0013] A method for ciphertext domain distributed resource scheduling based on TEE, applied to the aforementioned TEE-based ciphertext domain distributed resource scheduling system, includes the following steps:

[0014] S1, TEE hardware internally stores private keys, ciphertext operation parameters, and offline pre-calculated ciphertext inverses, and divides independent hardware storage partitions to isolate ciphertext data of different users;

[0015] S2. Complete the plaintext identity access verification of nodes through zero-knowledge proof, and generate corresponding type of encrypted NFT ownership certificate based on the node's associated behavior.

[0016] S3. Switch between encrypted and plaintext mixed operation modes according to the preset privacy level. Nodes with heavy privacy requirements perform full encrypted operation, while general nodes output de-identified plaintext.

[0017] S4, encrypted domain dynamic threshold, supply and demand weight time-series linkage, multi-level water level negative feedback balance calculation, when the resource pool balance is insufficient, call the pre-stored encrypted inverse to complete the full-domain compensation scaling.

[0018] S5. When the settlement period ends, the TEE hardware generates an offline settlement voucher with a hardware signature, which is output independently when the network is disconnected.

[0019] S6 and the two-layer privacy audit unit respectively generate global compliance audit proof and single-node privacy reconciliation proof, and upload them to the consortium blockchain for evidence storage.

[0020] The TEE-based encrypted domain distributed resource scheduling system can be specifically deployed as a multi-user shared encrypted points settlement model, which is suitable for scenarios such as shared elderly care, cross-store profit sharing among physical merchant alliances, and shared workstation resource allocation, and adopts the aforementioned TEE encrypted hardware architecture.

[0021] The privacy-encrypted text processing edge processing unit is connected to the elderly care robot for data communication. It only receives desensitized vital signs and activity data collected by the robot. All score calculations and user privacy management are performed independently.

[0022] The identity and relationship confirmation module generates three types of NFT credentials: care behavior NFT, resident mutual assistance points NFT, and merchant recommendation customer lock-in NFT. Each type of NFT has built-in encrypted behavior identifiers.

[0023] The privacy self-governance control module automatically matches privacy policies based on the user's disability level: severely disabled users are enabled in a fully encrypted strict mode, while self-reliant users are enabled in a lightweight de-identification mode.

[0024] The system is configured with an offline snapshot storage unit, which persists all encrypted data offline and synchronizes only incremental data after going online; the system outputs offline points settlement vouchers with TEE hardware signatures, supporting trusted verification without network connection.

[0025] Preferably, the dynamic threshold sub-circuit supports two inference modes: homomorphic linear weighted inference and encrypted neural network polynomial approximation inference, and the two modes are automatically switched according to the hardware computing power load;

[0026] The threshold calculation formula for homomorphic linear weighted inference is as follows:

[0027] ;

[0028] in, To pre-store the ciphertext weight, Input ciphertext feature values;

[0029] The threshold calculation formula for polynomial approximation inference in encrypted neural networks is as follows:

[0030] ;

[0031] in, The coefficients of the ciphertext polynomial, For encrypted input, The exponent is an integer, and all operations are performed within the TEE ciphertext field.

[0032] Preferably, the TEE hardware carrier is configured with an offline snapshot storage unit; when a node is offline, a full-text state snapshot is persisted, and when the node recovers the network, only the incremental ciphertext data during the offline period is synchronized; when ciphertext overflow, resource pool zeroing, or inverse element read failure occurs, static backup control parameters are automatically loaded for backup operation;

[0033] The global compensation scaling operation performed by the equalization compensation sub-circuit is as follows:

[0034] ;

[0035] in, This represents the current ciphertext balance in the resource pool. To pre-store the ciphertext inverse of the divisor, satisfying D is the compensation divisor, and q is the modulus of the homomorphic ciphertext.

[0036] Preferably, the TEE hardware carrier is selected from at least one of Intel SGX, AMD SEV, ARM TrustZone, and RISC-V TEE, and the homomorphic encryption algorithm supports at least one of BFV integer homomorphic and CKKS floating-point homomorphic encryption algorithms.

[0037] In the BFV scheme, ciphertext addition and multiplication satisfy the following conditions:

[0038] , ;

[0039] Approximate multiplication under the CKKS scheme satisfies:

[0040] ;

[0041] All calculation results are in ciphertext; only after decryption can an approximate plaintext value be obtained.

[0042] Preferably, the system has built-in privacy policy automatic matching logic, and automatically switches the operation mode when reading the user's disability level label; the vital signs, nursing care and mutual assistance data of severely disabled users are processed in encrypted form within TEE throughout the entire process, and no original sensitive data is output to the outside.

[0043] The mapping relationship between privacy level L and operation mode M is as follows:

[0044] ;

[0045] in, , This sets the preset privacy level threshold.

[0046] Preferably, the identity and relationship confirmation module automatically generates corresponding NFT credentials based on different interaction behaviors. The encrypted fields of the credentials include node number, behavior type, encrypted timestamp, and weight value.

[0047] The formula for verifying the validity of the timestamp during voucher verification is as follows:

[0048] ;

[0049] in, The current time is the encrypted text. The timestamp of the encrypted text within the voucher. To predetermine the maximum effective time window, all comparisons are performed within the homomorphic ciphertext domain.

[0050] The preferred offline settlement voucher verification process is as follows: the verifier extracts the built-in TEE hardware signature of the voucher, calls the manufacturer's remote verification interface to verify the legality of the hardware, and can complete the anti-tampering verification of settlement data without real-time network connection;

[0051] The signature verification equation for offline credentials is:

[0052] ;

[0053] in, To obtain the ciphertext hash value of the settlement transaction, Sign the TEE hardware. If the equation holds true, it proves that the credential has not been tampered with, given that the hardware public key is used.

[0054] A computer-readable storage medium storing a computer program thereon, wherein when the program is executed collaboratively by a processor and TEE hardware, it implements the TEE-based encrypted domain distributed resource scheduling method.

[0055] The resource pool balancing criteria during program execution are as follows:

[0056]

[0057] like This will trigger compensatory scaling: ;

[0058] in, This is the encrypted value of the current total resource pool. The ciphertext for the consumption of the j-th task allocation. The safety water level threshold is encrypted, and the compensation scaling formula is the same as the global compensation scaling operation performed by the equalization compensation sub-circuit described in claim 5.

[0059] The beneficial effects of this invention are reflected in:

[0060] 1. This invention utilizes TEE hardware isolation and ciphertext inverse pre-computation mechanism to replace ciphertext division with homomorphic multiplication when the resource pool is short, achieving full-domain compensation scaling without decryption and completely eliminating the leakage gap in plaintext operations; single-machine fully encrypted closed-loop operation does not require node synchronous communication, and can still independently generate offline settlement vouchers with hardware signatures in the absence of network, fundamentally getting rid of the strong dependence of traditional multi-party secure computation on synchronous communication, greatly reducing communication overhead, and significantly enhancing applicability in weak network environments;

[0061] 2. The present invention incorporates a multi-level water level negative feedback sub-circuit to achieve self-balancing control of the encrypted domain of the resource pool. When the pool balance is lower than the safe water level, it automatically triggers compensation scaling. When it is higher than the overflow water level, it automatically reduces the diversion ratio. The entire process can maintain the long-term steady-state operation of the system without manual intervention, avoiding the resource depletion or redundancy accumulation problems caused by static parameter fixation in traditional solutions. The system stability is substantially improved.

[0062] 3. This invention generates a global compliance audit certificate and a single-node privacy reconciliation certificate through a two-layer privacy audit module. The two types of certificates are independent of each other and do not disclose each other's data. The regulatory body's full-domain verification and the user's personal reconciliation each obtain what they need. The offline settlement certificate is accompanied by a TEE hardware signature. The verifier can complete the tamper-proof verification by calling the manufacturer's remote verification interface without real-time network connection. The evidence for dispute resolution is backed by hardware-level cryptography, ensuring both regulatory compliance and personal privacy protection. Attached Figure Description

[0063] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0064] Figure 1 : A schematic diagram of the overall system layered hardware architecture of this invention;

[0065] Figure 2 : Flowchart of the dual privacy mode switching operation of this invention;

[0066] Figure 3 Schematic diagram of the four-sub-circuit connection structure for encrypted autonomous control;

[0067] Figure 4 Schematic diagram of the multi-level water level cipher negative feedback control logic of the resource pool;

[0068] Figure 5 Flowchart of offline settlement voucher generation and offline verification;

[0069] Figure 6 : Schematic diagram of the overall layout of software and hardware collaboration in a co-living elderly care scenario. Detailed Implementation

[0070] The embodiments of the technical solution of the present invention will now be described in detail with reference to the accompanying drawings. These embodiments are merely illustrative of the technical solution of the present invention and are therefore intended to limit the scope of protection of the present invention.

[0071] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application should have the ordinary meaning as understood by those skilled in the art to which this invention pertains.

[0072] Example 1

[0073] like Figures 1-6 As shown, a TEE-based encrypted domain distributed resource scheduling system is deployed on a consortium blockchain network and includes a TEE hardware carrier, a privacy-encrypted computation edge processing unit, a privacy autonomous control module, an identity and relationship confirmation module, and a two-layer privacy audit module.

[0074] The privacy-preserving encrypted computation edge processing unit is an independent hardware module, physically isolated and task-decoupled from the motion perception hardware of the front-end care robot. It is only responsible for encryption, homomorphic computation, and resource scheduling, and does not participate in human perception or robotic arm control. All encrypted computations are completed independently by a single machine without the need for multi-node synchronous interaction.

[0075] The TEE hardware carrier has a built-in encryption key storage area, and hardware isolation creates a plaintext zero-overflow ciphertext running environment;

[0076] The privacy self-governance control module has four built-in encrypted sub-circuits, including a dynamic threshold sub-circuit, a time-series weight linkage sub-circuit, a multi-level water level negative feedback sub-circuit, and a balance compensation sub-circuit. The balance compensation sub-circuit pre-stores the ciphertext inverse of the divisor, and when the resource pool is short, it realizes the ciphertext division through homomorphic multiplication.

[0077] The identity and relationship confirmation module has a built-in zero-knowledge verification unit. After the verification is passed, an on-chain encrypted NFT confirmation certificate with behavior classification identifier is generated.

[0078] The two-layer privacy audit module includes a global audit proof unit and a single-node privacy reconciliation unit, which generate two independent cryptographic proofs respectively.

[0079] A method for ciphertext-domain distributed resource scheduling based on TEE, applied to a TEE-based ciphertext-domain distributed resource scheduling system, includes the following steps:

[0080] S1, TEE hardware internally stores private keys, ciphertext operation parameters, and offline pre-calculated ciphertext inverses, and divides independent hardware storage partitions to isolate ciphertext data of different users;

[0081] S2. Complete the plaintext identity access verification of nodes through zero-knowledge proof, and generate corresponding type of encrypted NFT ownership certificate based on the node's associated behavior.

[0082] S3. Switch between encrypted and plaintext mixed operation modes according to the preset privacy level. Nodes with heavy privacy requirements perform full encrypted operation, while general nodes output de-identified plaintext.

[0083] S4, encrypted domain dynamic threshold, supply and demand weight time-series linkage, multi-level water level negative feedback balance calculation, when the resource pool balance is insufficient, call the pre-stored encrypted inverse to complete the full-domain compensation scaling.

[0084] S5. When the settlement period ends, the TEE hardware generates an offline settlement voucher with a hardware signature, which is output independently when the network is disconnected.

[0085] S6 and the two-layer privacy audit unit respectively generate global compliance audit proof and single-node privacy reconciliation proof, and upload them to the consortium blockchain for evidence storage.

[0086] The TEE-based encrypted domain distributed resource scheduling system can be specifically deployed as a multi-user shared encrypted points settlement model, which is suitable for scenarios such as shared elderly care, cross-store profit sharing among physical merchant alliances, and shared workstation resource allocation, using the aforementioned TEE encrypted hardware architecture.

[0087] The privacy-encrypted computation edge processing unit is connected to the elderly care robot for data communication. It only receives desensitized vital signs and activity data collected by the robot, and all score calculations and user privacy management are performed independently.

[0088] The identity and relationship confirmation module generates three types of NFT credentials: care behavior NFT, resident mutual assistance points NFT, and merchant referral customer lock-in NFT. Each type of NFT has built-in encrypted behavior identifiers.

[0089] The privacy self-governance control module automatically matches privacy policies based on the user's disability level: severely disabled users are enabled in a fully encrypted strict mode, while self-reliant users are enabled in a lightweight de-identified mode.

[0090] The system is configured with an offline snapshot storage unit, which persists all encrypted transaction records offline on nodes, and only synchronizes incremental data after going online; the system outputs offline points settlement vouchers with TEE hardware signatures, supporting trusted verification without network connection.

[0091] Furthermore, the dynamic threshold sub-circuit supports two inference modes: homomorphic linear weighted inference and encrypted neural network polynomial approximation inference, and the two modes automatically switch according to the hardware computing power load.

[0092] The threshold calculation formula for homomorphic linear weighted inference is as follows:

[0093] ;

[0094] in, To pre-store the ciphertext weight, Input ciphertext feature values;

[0095] The threshold calculation formula for polynomial approximation inference in encrypted neural networks is as follows:

[0096] ;

[0097] in, The coefficients of the ciphertext polynomial, For encrypted input, Let be an integer exponent, and be the non-negative integer exponent of the k-th feature in the j-th term, and satisfy . ≥0, all operations are performed within the TEE ciphertext domain, n is the dimension of the input feature vector, m is the number of terms in the polynomial approximation expansion, and d is the number of nodes in the input layer of the encrypted neural network.

[0098] Furthermore, the TEE hardware carrier is configured with an offline snapshot storage unit; when a node is offline, a full-text state snapshot is persisted, and when the node recovers the network, only the incremental ciphertext data during the offline period is synchronized; when ciphertext overflow, resource pool zeroing, or inverse element read failure occurs, static backup control parameters are automatically loaded for backup operation;

[0099] The global compensation scaling operation performed by the equalization compensation sub-circuit is as follows:

[0100] ;

[0101] in, This represents the current ciphertext balance in the resource pool. To pre-store the ciphertext inverse of the divisor, satisfying D is the compensation divisor, q is the homomorphic encryption ciphertext modulus, q is the homomorphic encryption ciphertext modulus that is fixedly stored in the TEE hardware during system initialization, and D is the compensation divisor determined according to the ratio of the preset target water level of the resource pool to the current water level. Its ciphertext form is dynamically generated by the multi-level water level negative feedback sub-circuit.

[0102] Furthermore, the TEE hardware carrier is selected from at least one of Intel SGX, AMD SEV, ARM TrustZone, and RISC-V TEE, and the homomorphic encryption algorithm supports at least one of BFV integer homomorphic and CKKS floating-point homomorphic.

[0103] In the BFV scheme, ciphertext addition and multiplication satisfy the following conditions:

[0104] , ;

[0105] Approximate multiplication under the CKKS scheme satisfies:

[0106] ;

[0107] All calculation results are in ciphertext; only after decryption can an approximate plaintext value be obtained. , Let q be any two homomorphic ciphertext operands, and let q be the homomorphic ciphertext modulus, which is uniformly fixed in the TEE hardware during system initialization.

[0108] Furthermore, the system has built-in privacy policy automatic matching logic, and automatically switches the operation mode when reading the user's disability level label; the vital signs, nursing care, and mutual assistance data of severely disabled users are processed in encrypted form within the TEE throughout the entire process, and no original sensitive data is output to the outside.

[0109] The mapping relationship between privacy level L and operation mode M is as follows:

[0110] ;

[0111] in, , The preset privacy level threshold is defined, where L is the privacy level value corresponding to the user's disability level, ranging from 1 to 10. The threshold for severe privacy protection is set to 7. The threshold for mild privacy protection is set to 3. The threshold is configured and embedded in the TEE during system deployment based on scenario requirements, and can be adjusted as needed through the management interface.

[0112] Furthermore, the identity and relationship confirmation module automatically generates corresponding NFT credentials based on different interaction behaviors. The encrypted fields of the credentials include node number, behavior type, encrypted timestamp, and weight value.

[0113] The formula for verifying the validity of the timestamp during voucher verification is as follows:

[0114] ;

[0115] in, The current time is the encrypted text. The timestamp of the encrypted text within the voucher. To ensure the maximum effective time window is preset, all comparisons are performed within the homomorphic ciphertext field. This is the preset effective time window threshold during system initialization, in seconds, which can be configured through the TEE management interface according to the application scenario.

[0116] Furthermore, the offline settlement voucher verification process: the verifier extracts the built-in TEE hardware signature of the voucher, calls the manufacturer's remote verification interface to verify the legality of the hardware, and can complete the anti-tampering verification of settlement data without real-time network connection;

[0117] The signature verification equation for offline credentials is:

[0118] ;

[0119] in, To obtain the ciphertext hash value of the settlement transaction, Sign the TEE hardware. If the equation holds true, it proves that the credential has not been tampered with, given that the hardware public key is used.

[0120] A computer-readable storage medium storing a computer program, which, when executed collaboratively by a processor and TEE hardware, implements a TEE-based encrypted domain distributed resource scheduling method.

[0121] The resource pool balancing criteria during program execution are as follows:

[0122]

[0123] like This will trigger compensatory scaling: ;

[0124] in, This is the encrypted value of the current total resource pool. The ciphertext for the consumption of the j-th task allocation. The safety water level threshold is encrypted, and the compensation scaling formula is the same as the global compensation scaling operation performed by the equalization compensation sub-circuit of claim 5. This is the remaining encrypted balance in the resource pool after deducting all assigned tasks.

[0125] Example 2

[0126] This embodiment represents the basic deployment configuration of the system.

[0127] Hardware selection: ARM TrustZone TEE carrier is selected, equipped with a dedicated encrypted computing NPU coprocessor chip, and the consortium blockchain adopts Fabric architecture;

[0128] Initialization configuration: When the system starts, the private key, various divisor ciphertext inverses, high / low water level threshold ciphertext, homomorphic encryption ciphertext modulus q, and static safety control parameters are solidified in the TEE security zone;

[0129] Node access and identity verification: When a new node accesses, it submits a zero-knowledge identity certificate. The TEE internally performs a plaintext verification. After the verification is passed, the identity and relationship verification module generates a corresponding encrypted NFT verification certificate based on the node's interaction behavior. The certificate includes the node number, behavior type, encrypted timestamp, and weight value, and is stored on the blockchain.

[0130] Operation mode: Ordinary commercial nodes adopt a hybrid operation mode, where sensitive values ​​are calculated in encrypted text and statistical data are output in de-identified plaintext;

[0131] Autonomous Regulation Process: The privacy autonomous regulation module executes dynamic threshold inference, supply and demand weight time-series update, and resource pool level monitoring in parallel. When the ciphertext balance in the resource pool falls below the safe level, the balance compensation sub-circuit calls the pre-stored ciphertext inverse to complete global compensation scaling. The scaling operation is as follows:

[0132] ;

[0133] in, This represents the current ciphertext balance in the resource pool. To pre-store the ciphertext inverse of the divisor, satisfying D is the compensation divisor;

[0134] Settlement and Audit: At the end of each monthly settlement cycle, the TEE performs hash calculations on all transactions and generates offline settlement vouchers with hardware signatures. The two-layer privacy audit unit generates global compliance audit certificates and uploads them to the consortium blockchain, while the single-node private reconciliation vouchers are stored locally for users to query.

[0135] Disaster recovery mechanism: When a node goes offline, an encrypted snapshot is automatically generated to persist the full state. After the network is restored, only the incremental encrypted data during the offline period is synchronized. In the event of encrypted overflow, resource pool zeroing, or failure to read inverse data, static backup parameters are automatically loaded to ensure that the system does not crash.

[0136] Example 3

[0137] This embodiment is based on the hardware architecture of Embodiment 2, and performs fine-grained switching control on the dynamic threshold sub-circuit;

[0138] Computing power monitoring: Real-time monitoring of the computing power load rate of the NPU coprocessor chip within the TEE;

[0139] The mode switching logic, when the computing power load is sufficient (default is below 60%), enables CKKS floating-point homomorphic encryption neural network multinomial approximation inference to generate a dynamic threshold. The inference formula is as follows:

[0140] ;

[0141] in, These are the encrypted polynomial coefficients embedded within the TEE. Features for ciphertext input, is a non-negative integer exponent, m is the number of polynomial terms, and d is the input feature dimension;

[0142] When the computing load exceeds the 80% threshold, it automatically switches to BFV integer homomorphic linear weighted inference to reduce computational overhead. The inference formula is as follows:

[0143] ;

[0144] in, The weighting coefficients of the encrypted text embedded within the TEE. The input is the ciphertext feature value, where n is the number of features;

[0145] The system automatically resumes high-precision CKKS inference mode once the load drops below 60%.

[0146] Example 4

[0147] This embodiment further expands the reasoning capability of the dynamic threshold sub-circuit, making it suitable for high-privacy scenarios that require complex behavior analysis;

[0148] Model Deployment: Encrypted weight parameters of a lightweight multilayer perceptron (MLP) are embedded within the TEE isolation zone, using a low-order polynomial approximation activation function, such as... Or the third-order Taylor expansion of the Sigmoid, without decrypting any parameters throughout the process;

[0149] Inference process: The system directly inputs the encrypted data of user behavior into the encrypted neural network inside the TEE. After calculation by the polynomial approximation activation function, it outputs encrypted results such as risk score and resource demand level. The entire process does not transmit any original data or intermediate results to the outside.

[0150] Application scenarios: Suitable for highly sensitive reasoning tasks such as predicting the care needs of severely disabled elderly people and providing early warnings of abnormal behaviors.

[0151] Example 5

[0152] This embodiment verifies the hardware versatility of the system;

[0153] Hardware replacement: Replace the hardware carrier with any one of the three architectures: Intel SGX, AMD SEV, and RISC-V TEE, while fully reusing the encrypted operation logic in the software layer;

[0154] Adaptation layer design: The system sets up a unified hardware adaptation layer interface, encapsulating the low-level operations such as remote authentication, key management, and memory encryption unique to each platform; upper-layer resource scheduling, privacy self-governance control, and two-layer auditing applications can be seamlessly migrated and deployed between different TEE platforms without any modifications.

[0155] Compatibility conclusion: The system does not rely on specific TEE chips for customized functions and can be directly connected to existing elderly care robots, edge gateways and other devices, making mass production and deployment seamless.

[0156] Example 6

[0157] This embodiment demonstrates the complete application of the system in a shared elderly care scenario.

[0158] Collaboration with robots: The privacy-preserving encrypted computing edge processing unit communicates with the patented elderly care robot via a local serial port. The robot only transmits anonymized data on the elderly's activity duration, care records, and vital sign trends; the original high-definition images and complete vital sign plaintext are not output, achieving dual decoupling of physical and data aspects.

[0159] Privacy policy tiered matching: The system automatically matches a privacy policy after reading the elderly person's disability level label. All care and mutual assistance data for severely disabled users is processed in encrypted form within the TEE (Transmission Equipment), with no original sensitive information output; for self-reliant users, only monthly anonymized statistical data is output. The privacy level mapping relationship is as follows:

[0160] ;

[0161] Where L represents the privacy level value (1-10) corresponding to the user's disability level. It is 7. It is 3;

[0162] Three types of NFT credentials are distinguished: The identity and relationship confirmation module identifies different interactive behaviors and automatically generates three types of encrypted NFT credentials: caregiver home care → care behavior NFT;

[0163] Elderly people helping each other → Resident mutual aid points NFT;

[0164] Store recommends new tenants to move in → recommends NFTs for customer retention;

[0165] All NFT encrypted fields include node number, behavior type, ciphertext timestamp, and weight value, and are stored in the consortium blockchain;

[0166] Settlement and audit isolation: The system automatically generates offline points settlement documents with TEE hardware signatures every month. The community civil affairs department can access the overall audit certificate to verify the distribution of pension subsidies; the elderly can only view their own private account statements and have no right to view other residents' data, thus achieving a balance between supervision and privacy;

[0167] Disaster recovery during network outages: When the community experiences a temporary power outage and network disruption, the hardware stores a snapshot locally, while the TEE continues to calculate monthly points and output offline documents. Once the network is restored, the data is automatically synchronized to the blockchain.

[0168] Example 7

[0169] This embodiment is a complete application of the system in a business alliance scenario. The system is deployed on a local business alliance platform server, and the TEE hardware is carried on the alliance chain node.

[0170] Merchant onboarding and customer retention confirmation: Merchant A generates a unique invitation code through the platform. When customers scan the code to register, the system completes the identity verification without plaintext through zero-knowledge proof. After the verification is passed, the identity and relationship confirmation module automatically generates a recommended customer retention NFT for the relationship between Merchant A and the customer and stores it on the blockchain. This NFT serves as the sole cryptographic basis for the confirmation of all subsequent profit sharing, and the platform backend has no right to tamper with it.

[0171] Cross-store consumption and encrypted revenue sharing: When a customer makes a purchase at merchant B within the alliance, merchant B's POS system encrypts sensitive data such as the transaction amount and discount percentage and sends it to the TEE hardware isolation zone. After decryption within the TEE, the revenue sharing is automatically calculated based on Locke NFT: the consumer receives rebate points, Locke merchant A receives referral commission, the platform receives technical management fees, and the remaining portion is allocated to the public dividend pool.

[0172] The entire process is conducted in plaintext without leaving the TEE hardware boundary. The platform backend can only view encrypted garbled text and cannot see any merchant's real transaction history.

[0173] Dynamic encrypted control of dividend pool: The system monitors the encrypted balance of the public dividend pool in real time. With the preset safe water level and overflow water level Homomorphic alignment, when The diversion ratio is automatically increased to replenish the pool reserve when... The system automatically adjusts the diversion ratio to allow more benefits to flow to consumers and merchants who retain customers. All control logic is executed in a closed loop within the TEE encrypted domain, without the need for manual intervention.

[0174] Offline Settlement and Independent Reconciliation: When a merchant loses network access, the system automatically generates an encrypted snapshot and persists it locally. The TEE hardware continues to independently complete settlement and generate an offline certificate with a hardware signature. After network recovery, only incremental data is synchronized to the consortium blockchain. Any merchant can initiate a reconciliation request at any time. The system generates a privacy-preserving reconciliation certificate containing only the merchant's own transaction data, while shielding the encrypted data of other merchants. The offline certificate verification process is as follows:

[0175] ;

[0176] Where H = Hash(transaction data) is the ciphertext hash value of the settlement transaction record. Sign the TEE hardware. The hardware public key proves that the equation is true and the certificate has not been tampered with, allowing offline verification to be completed without an internet connection.

[0177] Example 8

[0178] This embodiment is used for rapid implementation and verification in the early stages of a project;

[0179] Hardware configuration: The Raspberry Pi 4B with OP-TEE open-source trusted execution environment is used as the TEE carrier, and the Microsoft SEAL open-source homomorphic encryption library is used to implement BFV / CKKS encryption operations. The consortium blockchain uses the Ethereum test chain.

[0180] Functional reduction: core essential modules are retained, including fully encrypted computation, offline snapshot storage, basic negative feedback balancing, and offline voucher generation. Advanced AI nonlinear reasoning functions in Example 4 are removed to reduce hardware computing power requirements.

[0181] Deployment cycle: The community prototype deployment can be completed within two weeks for early concept verification and user experience testing of the elderly care project.

[0182] Upgrade path: After verification, the hardware can be seamlessly replaced with any commercial TEE platform in Example 4, and the software program can be mass-produced and deployed without modification.

[0183] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A TEE-based encrypted domain distributed resource scheduling system, characterized in that, Deployed on a consortium blockchain network, it includes a TEE hardware carrier, a privacy-preserving ciphertext operation edge processing unit, a privacy self-governance control module, an identity and relationship confirmation module, and a two-layer privacy audit module; The privacy-preserving ciphertext operation edge processing unit is an independent hardware module, which is physically isolated and task-decoupled from the motion perception hardware of the front-end care robot. It is only responsible for encryption, homomorphic operation, and resource scheduling, and does not participate in human perception or robotic arm control. All ciphertext operations are completed independently by a single machine without the need for multi-node synchronous interaction. The TEE hardware carrier has a built-in encryption key storage area, and hardware isolation constructs a plaintext zero overflow ciphertext running environment. The privacy autonomous control module has four built-in encrypted sub-circuits, including a dynamic threshold sub-circuit, a time-series weight linkage sub-circuit, a multi-level water level negative feedback sub-circuit, and a balance compensation sub-circuit. The balance compensation sub-circuit pre-stores the ciphertext inverse of the divisor, and when the resource pool is short, it realizes the ciphertext division through homomorphic multiplication. The identity and relationship confirmation module has a built-in zero-knowledge verification unit. After the verification is passed, an on-chain encrypted NFT confirmation certificate with behavior classification identifier is generated. The dual-layer privacy audit module includes a global audit proof unit and a single-node privacy reconciliation unit, which generate two types of independent cryptographic proofs respectively.

2. A method for ciphertext-domain distributed resource scheduling based on TEE, characterized in that, The method applied to the TEE-based encrypted domain distributed resource scheduling system as described in claim 1 includes the following steps: S1, TEE hardware internally stores private keys, ciphertext operation parameters, and offline pre-calculated ciphertext inverses, and divides independent hardware storage partitions to isolate ciphertext data of different users; S2. Complete the plaintext identity access verification of nodes through zero-knowledge proof, and generate corresponding type of encrypted NFT ownership certificate based on the node's associated behavior. S3. Switch between encrypted and plaintext mixed operation modes according to the preset privacy level. Nodes with heavy privacy requirements perform full encrypted operation, while general nodes output de-identified plaintext. S4, encrypted domain dynamic threshold, supply and demand weight time-series linkage, multi-level water level negative feedback balance calculation, when the resource pool balance is insufficient, call the pre-stored encrypted inverse to complete the full-domain compensation scaling. S5. When the settlement period ends, the TEE hardware generates an offline settlement voucher with a hardware signature, which is output independently when the network is disconnected. S6 and the two-layer privacy audit unit respectively generate global compliance audit proof and single-node privacy reconciliation proof, and upload them to the consortium blockchain for evidence storage.

3. The encrypted domain distributed resource scheduling system based on TEE according to claim 1, characterized in that, The system is applied to multi-user co-living encrypted points settlement scenarios, including co-living for elderly care, cross-store profit sharing among physical merchant alliances, and shared workstation resource allocation. The privacy-encrypted text processing edge processing unit is connected to the elderly care robot for data communication. It only receives desensitized vital signs and activity data collected by the robot. All score calculations and user privacy management are performed independently. The identity and relationship confirmation module generates three types of NFT credentials: care behavior NFT, resident mutual assistance points NFT, and merchant recommendation customer lock-in NFT. Each type of NFT has built-in encrypted behavior identifiers. The privacy self-governance control module automatically matches privacy policies based on the user's disability level: severely disabled users are enabled in a fully encrypted strict mode, while self-reliant users are enabled in a lightweight de-identification mode. The system is configured with an offline snapshot storage unit, which persists all encrypted data offline and synchronizes only incremental data after going online; the system outputs offline points settlement vouchers with TEE hardware signatures, supporting trusted verification without network connection.

4. The encrypted domain distributed resource scheduling system based on TEE according to claim 1, characterized in that: The dynamic threshold sub-circuit supports two inference modes: homomorphic linear weighted inference and encrypted neural network polynomial approximation inference. The two modes are automatically switched according to the hardware computing power load. The threshold calculation formula for homomorphic linear weighted inference is as follows: ； in, To pre-store the ciphertext weight, Input ciphertext feature values; The threshold calculation formula for polynomial approximation inference in encrypted neural networks is as follows: ； in, The coefficients of the ciphertext polynomial, For encrypted input, The exponent is an integer, and all operations are performed within the TEE ciphertext field.

5. A TEE-based encrypted domain distributed resource scheduling system according to claim 1, characterized in that: The TEE hardware carrier is configured with an offline snapshot storage unit; when a node is offline, a full-text state snapshot is persisted; when a node recovers the network, only the incremental ciphertext data during the offline period is synchronized; when ciphertext overflow, resource pool zeroing, or inverse element read failure occurs, static backup control parameters are automatically loaded for backup operation. The global compensation scaling operation performed by the equalization compensation sub-circuit is as follows: ； in, This represents the current ciphertext balance in the resource pool. To pre-store the ciphertext inverse of the divisor, satisfying D is the compensation divisor, and q is the modulus of the homomorphic ciphertext.

6. A TEE-based encrypted domain distributed resource scheduling system according to claim 1, characterized in that: The TEE hardware carrier is selected from at least one of Intel SGX, AMD SEV, ARM TrustZone, and RISC-V TEE, and the homomorphic encryption algorithm supports at least one of BFV integer homomorphic and CKKS floating-point homomorphic encryption algorithms. In the BFV scheme, ciphertext addition and multiplication satisfy the following conditions: ， ； Approximate multiplication under the CKKS scheme satisfies: ； All calculation results are in ciphertext; only after decryption can an approximate plaintext value be obtained.

7. A multi-user shared encrypted points settlement system based on TEE according to claim 3, characterized in that: The system has built-in privacy policy automatic matching logic, and automatically switches the operation mode when reading the user's disability level label; the vital signs, nursing care and mutual assistance data of severely disabled users are processed in encrypted form within TEE throughout the entire process, and no original sensitive data is output to the outside. The mapping relationship between privacy level L and operation mode M is as follows: ； in, , This sets the preset privacy level threshold.

8. A multi-user shared encrypted points settlement system based on TEE according to claim 3, characterized in that: The identity and relationship confirmation module identifies different interaction behaviors and automatically generates corresponding NFT credentials. The encrypted fields of the credentials include node number, behavior type, encrypted timestamp, and weight value. The formula for verifying the validity of the timestamp during voucher verification is as follows: ； in, The current time is the encrypted text. The timestamp of the encrypted text within the voucher. To predetermine the maximum effective time window, all comparisons are performed within the homomorphic ciphertext domain.

9. A method for distributed resource scheduling in encrypted domains based on TEE according to claim 2, characterized in that: Offline settlement voucher verification process: The verifier extracts the built-in TEE hardware signature of the voucher, calls the manufacturer's remote verification interface to verify the legality of the hardware, and can complete the anti-tampering verification of settlement data without real-time network connection; The signature verification equation for offline credentials is: ； in, To obtain the ciphertext hash value of the settlement transaction, Sign the TEE hardware. If the equation holds true, it proves that the credential has not been tampered with, given that the hardware public key is used.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed collaboratively by the processor and TEE hardware, it implements the TEE-based encrypted domain distributed resource scheduling method as described in claim 2. The resource pool balancing criteria during program execution are as follows: like This will trigger compensatory scaling: ; in, This is the encrypted value of the current total resource pool. The ciphertext for the consumption of the j-th task allocation. The safety water level threshold is encrypted, and the compensation scaling formula is the same as the global compensation scaling operation performed by the equalization compensation sub-circuit described in claim 5.

Images