Data coordination system, computer, key management method, and program

Abstract

In a system in which data processing is performed in mutual cooperation between TEEs, it is desirable to achieve a resume function without a reduction in security. Thus, a data coordination system according to the disclosed technology comprises n computers, wherein each kth computer (k=1, 2, ..., n) comprises a kth application operating in a TEE, and a kth nonvolatile storage. The first application uses secret sharing to divide a shared key and generate a plurality of fragments (kth fragments (k=1, 2, ..., n)). The first application stores the first fragment in the first non-volatile storage, and transmits each jth fragment (j=2, 3, ..., n) to the jth application. Each jth application stores the received jth fragment in the jth nonvolatile storage. When a TEE is restarted, each of the n applications acquires the fragments from the other applications to decrypt the shared key.

Description

Data linkage system, computer, key management method, and program

[0001] The disclosed technology relates to a method for managing a shared key when data is shared between applications running on a TEE.

[0002] [Terminology] <Resume function> A function that allows a TEE to resume processing from where it left off, rather than from the beginning, if the TEE abnormally stops during data processing due to, for example, a loss of power to the server on which the TEE is installed. <Secure matching technology> A technology that uses cryptographic technology to create statistical information by combining data from two parties without disclosing the data to each other. <Data processing> This is intended for data processing such as secure matching technology, but is not limited to this type of processing. <TEE> An abbreviation for Trusted Execution Environment. An execution environment in which secure matching applications run, and can verify the integrity of applications running on the TEE. A key stored in hardware such as a CPU or chip is used as the root of trust. Typical TEEs include Intel SGX and AMD SEV-SNP. This article uses SEV-SNP as an example, but is not limited to this. <Remote attestation> A function that verifies the integrity of applications running on the TEE based on the root of trust by signing the application running on the TEE with a key that serves as the root of trust for the TEE. <TTP> An abbreviation for Trusted Third Party. A third party that behaves correctly. <Secret Sharing> This is a data encryption technique that conceals data by breaking it into fragmented values ​​that have no meaning on their own but can be restored by collecting multiple fragments. For example, the number 3 can be divided into three values: 5, -8, and 6. The data can be restored by collecting and adding all the values ​​together, but cannot be restored if any of the values ​​is missing. <Non-volatile / Volatile> Generally, volatile means that the state is retained only when powered on (memory), while non-volatile means that the state is retained even when powered off (HDD or SSD). When using cloud storage, the actual hardware is volatile, but with redundancy, it can be used in the same way as non-volatile storage. Therefore, in this specification, volatile refers to the general volatile nature of data loss linked to TEE startup and shutdown, and non-volatile refers to the general non-volatile nature of data retention independent of TEE startup and shutdown.<Safety requirements> In this specification, when data is exchanged between multiple TEEs, the safety requirement is that the intermediate data (data in the middle of processing) exchanged can be encrypted and decrypted only within the TEE. <Sealing / Unsealing> A function that allows encryption (sealing) and decryption (unsealing) only on the same TEE.

[0003] Non-Patent Document 1 describes a method for encrypting and decrypting data exchanged between multiple TEEs by mutually verifying their integrity and using a key that can be used only if the integrity verification is successful. This method will be explained using FIG. 1 . TEE-A (103) is a program executed on volatile memory 101 in a cloud environment 100, and TEE-B (113) is a program executed on volatile memory 111 in a cloud environment 110. When exchanging data across TEEs in data processing (e.g., sending data from TEE-A to TEE-B), the data is encrypted in TEE-A before being sent to TEE-B. For this purpose, first, the integrity of the applications is mutually verified using remote attestation, and only if the verification is successful are keys shared (e.g., a common key is obtained by DH key exchange).

[0004] When sending intermediate data (data in the middle of processing) to the TEE-B, the application 104 of the TEE-A encrypts the intermediate data within the TEE-A using the common key 106. Then, the encrypted intermediate data is written to the non-volatile storage 112 of the TEE-B. The TEE-B reads the encrypted intermediate data from the storage and decrypts the encrypted intermediate data within the TEE-B using the common key 106.

[0005] Since it is necessary to restrict the encrypted data so that it cannot be decrypted or encrypted outside the TEE, the key used for encryption and decryption is restricted to be available only within the TEE. Therefore, the common key exists only in volatile memory, and if the TEE stops abnormally, the key will be lost and the encrypted intermediate data will no longer be able to be decrypted.

[0006] Non-Patent Document 1 reports an implementation method using Key Management Service (KMS), a key management service provided by Amazon Web Services (AWS). When managing keys used for encrypting and decrypting data using KMS, the keys are managed independently of the TEE. Therefore, even if the TEE abnormally stops and is restarted, the keys are not lost, and data can be encrypted and decrypted again.

[0007] Keita Hasegawa et al., "Proposal of a Malicious and Secure Inter-Organizational Data Exchange Method Using TEE," Proceedings of the Computer Security Symposium 2022, pp. 341-348, 2022.

[0008] If intermediate data cannot be decrypted, restarting data processing from the beginning increases processing time. Using the cloud also increases computational costs. If key management is performed using a service provided by a cloud service provider (AWS in the case of Non-Patent Document 1), data processing can continue using the original shared key. However, if the cloud service provider cannot be trusted, data decryption and encryption processing can be performed outside the TEE, which does not meet the security requirements.

[0009] To achieve a resume function without compromising security, the following two conditions must be met simultaneously: (1) The common key used to encrypt intermediate data must be reusable even if the TEE memory is volatile. (2) The common key used to encrypt intermediate data must be usable only by TEE applications whose integrity has been verified.

[0010] To achieve (1), it is conceivable to write the key to non-volatile storage. However, if this is simply done, the key will be available outside the TEE, which does not satisfy security requirement (2), which requires that encryption and decryption be possible only within the TEE. The same applies when key management is entrusted to a third party. (2) can be achieved by creating a new key each time the TEE is started up. If a key tied to the TEE chip is used, the same key can be reproduced in the same TEE. However, in a cloud environment, this cannot be applied because there is no guarantee that the TEE will be started up on the same physical chip when it is restarted (this does not satisfy (1)).

[0011] A data linkage system according to the disclosed technology for solving the above-described problems comprises n computers, and the kth computer (k=1, 2, ..., n) comprises a kth application running on a TEE and a kth non-volatile storage. A first application divides a common key using secret sharing to generate multiple fragments (kth fragments (k=1, 2, ..., n)). The first application stores the first fragment in the first non-volatile storage and sends the jth fragment (j=2, 3, ..., n) to the jth application. The jth application stores the received jth fragment in the jth non-volatile storage. When all of the TEEs in the n computers are restarted, each of the n applications obtains fragments from the other applications and decrypts the common key. Another aspect of a data linkage system according to the disclosed technology comprises n computers, and the kth computer (k=1, 2, ..., n) comprises a kth application running on a TEE and a kth non-volatile storage. The k-th application measures the feature of the k-th TEE to generate k-th secret information, encrypts a common key using the k-th secret information to generate a k-th encrypted common key, and stores the k-th encrypted common key in the k-th nonvolatile storage. When all of the n TEEs are restarted, the k-th application reproduces the k-th secret information and decrypts the common key using the k-th secret information and the k-th encrypted common key.

[0012] The disclosed technology enables processing to be restored without compromising the security requirement that data can only be decrypted and encrypted inside a TEE whose integrity has been verified. As a result, even if the TEE abnormally stops, processing time and resource costs when using the cloud can be reduced.

[0013] FIG. 1 is a diagram for explaining data processing between conventional TEEs. Functional block diagram of a data linkage system according to a first embodiment. Flowchart for explaining the flow of processing in the data linkage system according to the first embodiment. Flowchart for explaining the flow of application integrity verification processing. Flowchart for explaining the flow of shared key creation processing. Flowchart for explaining the flow of shared key storage processing. Flowchart for explaining the flow of data linkage processing. Flowchart for explaining the flow of shared key recovery processing. Flowchart for explaining a second flow of shared key storage processing. Flowchart for explaining the second flow of shared key recovery processing. Functional block diagram of a data linkage system according to a third embodiment. A diagram showing an example of the functional configuration of a computer.

[0014] Hereinafter, embodiments of the disclosed technology will be described in detail. Note that components having the same functions are assigned the same numbers, and duplicated descriptions will be omitted.

[0015] [First Embodiment] In the first embodiment, the loss of the created shared key is avoided by storing the created shared key in non-volatile storage outside the TEE. In this case, simply storing the shared key does not satisfy the security requirement (2). Therefore, the shared key is fragmented and stored using a secret sharing scheme so that the key stored outside the TEE cannot be used. When the TEE is restarted, the applications on the TEE mutually verify the integrity of each other using remote attestation again, and only if the verification is successful are the fragment values ​​exchanged and the shared key restored.

[0016] FIG. 2 is a functional block diagram showing an example configuration of a data linkage system 20 according to the first embodiment. A first computer 210 and a second computer 220 perform data processing using TEEs. Both the first computer 210 and the second computer 220 are configured as virtual machines on the cloud. The first computer 210 includes a first TEE 211 running on volatile memory, a first communication unit 212, and a first non-volatile storage 213. The first TEE 211 includes a first TEE control unit 214 and a first application 215. The second computer 220 includes a second TEE 221 running on volatile memory, a second communication unit 222, and a second non-volatile storage 223. The second TEE 221 includes a second TEE control unit 224 and a second application 225. FIG. 3 is a flowchart illustrating an example of the operations of the first TEE control unit, the first application, the second TEE control unit, and the second application.

[0017] The following explains the flow of application integrity verification processing (step S301), shared key creation processing (step S302), shared key storage processing (step S303), data linkage processing (step S304), a failure occurring in the first computer and the second computer and restarting them, application integrity re-verification processing (step S305), shared key recovery processing (step S306), and resumption of data linkage processing (step S307).

[0018] <Application Integrity Verification Process> Step S301 will be described in detail using Figures 2 and 4. The first TEE control unit 214 measures the hash value of the first application (step S401) and creates a first attestation report by signing the hash value with the key of the first TEE. This ensures that the first application is running on the first TEE. The first TEE control unit 214 then presents the first attestation report to the second TEE (step S402). The second TEE control unit verifies the first attestation report (step S403). Specifically, the signature of the first TEE is verified to confirm that the first application is running on the first TEE.

[0019] The second TEE control unit 224 measures the hash value of the second application (step S404) and creates a second attestation report by signing the hash value with the key of the second TEE. This ensures that the second application is running on the second TEE. The second TEE control unit 224 then presents the second attestation report to the first TEE (step S405). The first TEE control unit verifies the second attestation report. Specifically, it verifies the signature of the second TEE to confirm that the second application is running on the second TEE.

[0020] <Shared Key Creation Process> Step S302 will be described in detail with reference to Figures 2 and 5. The first TEE control unit 214 and the second TEE control unit 224 create a shared key by key exchange or the like (steps S501 and S502). The first TEE transmits the shared key to the first application (step S503). The second TEE transmits the shared key to the second application (step S504).

[0021] <Shared Key Storage Process> Step S303 will be described in detail using Figures 2 and 6. The first application 215 fragments the shared key (step S601). Specifically, the first application 215 generates first and second fragment values ​​using a secret sharing scheme in which the shared key is divided into fragment values ​​and stored, and secret information can be restored by collecting the required number of fragment values. The first application 215 then stores the first fragment value in the first non-volatile storage (step S602) and sends the second fragment value to the second application 225 (step S603). The second application 225 stores the second fragment value in the second non-volatile storage (step S604).

[0022] <Data Linkage Processing> Step S304 will be described in detail with reference to Figures 2 and 7. The first application 215 performs data processing (step S701) and creates intermediate data (step S702). The first application 215 then encrypts the intermediate data using a common key (step S703) and transmits it to the second application 225. The second application 225 decrypts the received encrypted intermediate data using the common key (step S704) and performs data processing (step S705).

[0023] Here, it is assumed that a failure occurs in the first TEE and the second TEE and that they are restarted. Note that, for example, if a failure occurs only in the first TEE, the shared key on the second TEE can be provided to the restarted first TEE (after re-verifying the integrity of the application), so in the first embodiment, a case is assumed in which a failure occurs in both the first TEE and the second TEE.

[0024] <Application Integrity Re-Verification Process> The first TEE control unit and the second TEE control unit mutually verify the integrity of the application on the TEE again using remote attestation (step S305). The content of step S305 is the same as step S301. If the verification is successful, proceed to step S306.

[0025] <Shared Key Recovery Process> Step S306 will be described in detail with reference to FIGS. 2 and 8. The first application 215 acquires the first fragment value from the first non-volatile storage 213 (step S801) and sends the first fragment value to the second application (step S803). The second application 225 acquires the second fragment value from the second non-volatile storage 223 (step S802) and sends the second fragment value to the first application (step S804). The first application 215 recovers the shared key using the first fragment value and the received second fragment value (step S805). The second application 225 recovers the shared key using the second fragment value and the received first fragment value (step S806).

[0026] The first application 215 and the second application 225 resume the data linkage process (step S307). The content of the data linkage process is the same as that of step S304.

[0027] The above is the description of the first embodiment.

[0028] [Modification of First Embodiment] <Distributed Location of Fragment Values> In the first embodiment, the fragment values ​​are stored in non-volatile storage on the cloud, but the storage location may be in the user's local environment, or management may be entrusted to a third party. However, the fragment values ​​must not be concentrated in one place.

[0029] <Number of Divided Fragment Values ​​and Threshold for Restoration> In the first embodiment, a case has been described in which there are two data processors and each processor holds two fragments. When there are three or more data processors, threshold secret sharing can be applied, which allows restoration by collecting two or more of the three fragments. Also, even when there are two data processors, if the data is distributed across four environments, for example, cloud environments A and B and local environments A and B, and controlled so that restoration can be performed using three fragments, it is possible to prevent a cloud service provider from decrypting the shared key even with malicious intent (even if the cloud environment is compromised, only two fragments can be obtained).

[0030] <What is to be distributed> In the first embodiment, the common key is fragmented by secret sharing. Instead of making the common key itself into fragment values, the common key may be encrypted with B's public key, with A holding the encrypted common key and B holding the private key. Alternatively, an asymmetric key (public key and private key) may be used for encryption instead of a common key. In this case, the data encrypted with the public key and the private key are distributed and held.

[0031] [Second Embodiment] In the second embodiment, a feature (secret information) is created based on the internal state of the TEE's memory, etc., and a common key is created. For example, when encrypting intermediate data, a key is created using the hash value of a virtual memory dump used by a specific process as the secret information. In this case, the uniqueness of the internal state (the value will be different when different applications are executed) and reproducibility (the value will be the same when the same application is executed) are important.

[0032] A functional block diagram showing an example of the configuration of a data linkage system according to the second embodiment is the same as that shown in FIG. 2. A flowchart illustrating an example of the operations of the first TEE control unit, the first application, the second TEE control unit, and the second application is the same as that shown in FIG. 3, except that the shared key storage process is changed to a second shared key storage process, and the shared key recovery process is changed to a second shared key recovery process. As in the first embodiment, it is also assumed that failures occur in both the first TEE and the second TEE. The following description will focus on the second shared key storage process and the second shared key recovery process.

[0033] <Second Shared Key Storage Process> This will be explained using Figures 2 and 9. The shared key has already been created in step 302. The first TEE control unit 214 measures a feature amount within the first TEE to generate first secret information (step S901). The first TEE control unit 214 then encrypts the shared key with the first secret information to generate a first encrypted shared key (step S902). The first TEE control unit 214 then stores the first encrypted shared key in the first non-volatile storage 213 (step S903).

[0034] Similarly, the second TEE control unit 224 measures the feature quantity in the second TEE and generates second secret information (step S904). The second TEE control unit 224 then encrypts the common key with the second secret information to generate a second encrypted common key (step S905). The second TEE control unit 224 then stores the second encrypted common key in the second non-volatile storage 223 (step S906). The first application and the second application start data linkage processing using the decrypted common key (step S304).

[0035] <Second Common Key Recovery Process> This will be described with reference to FIGS. 2 and 10. In step S305, the integrity of the application has been re-verified. The first TEE control unit 214 acquires the first encrypted common key from the first non-volatile storage 213 (step S1001). The first TEE control unit 214 then measures features within the first TEE and reproduces the first secret information (step S1002). The first TEE control unit 214 then decrypts the first encrypted common key using the first secret information (step S1003).

[0036] Similarly, the second TEE control unit 224 acquires the second encrypted symmetric key from the second non-volatile storage 223 (step S1004). The second TEE control unit 224 then measures the feature amount in the second TEE and reproduces the second secret information (step S1005). The second TEE control unit 224 then decrypts the second encrypted symmetric key using the second secret information (step S1006). The first application and the second application resume the data linkage process using the decrypted symmetric key (step S307).

[0037] The above is the description of the second embodiment.

[0038] [Variation of the Second Embodiment] <TEE Internal Information Used as Confidential Information> In the second embodiment, the hash value of a memory dump of a specific process (e.g., a process used for data processing) is given as an example of a feature of the TEE, but the feature is not limited to this. It may also be a hash value of an executable file of a specific application, a hash value of configuration information of a specific application, or a hash value of the execution environment (software stack that establishes the TEE). One of these values, or a combination of multiple values, may be used as the feature. Furthermore, the feature may be directly used as confidential information, or a random number may be generated using the feature as a seed value and used as the confidential information.

[0039] In on-premises environments where the hardware remains constant, data can be encrypted using a hardware-specific key. For example, Intel SGX has a feature called sealing and unsealing, which allows data to be encrypted in a way that can only be decrypted on the same hardware (even stricter conditions can be imposed). However, this feature cannot be used when encryption and decryption are performed on different TEEs. Furthermore, in cloud environments, there is no guarantee that the TEEs will always run on the same hardware. In some cloud environments (e.g., AWS), if a common key (a common key even when the hardware changes) is available between the same type of TEEs (e.g., AMD SEV-SNP), data can be encrypted using this key. However, in other cloud environments, such as AMD-SEV SNP on the Azure environment (non-AWS, non-Intel SGX), data cannot be encrypted using the above method.

[0040] [Third Embodiment] In the first and second embodiments, data linkage processing is described using two computers, but the data linkage processing can be extended to data linkage processing using any n number of computers. FIG. 11 shows a system 1150 in which a first computer 210 to an nth computer 1100 cooperate via a communication network 1120. Each computer is configured as a virtual machine on the cloud. 1101 is the nth TEE. The kth computer (k=1, 2, ..., n) includes a kth TEE control unit, a kth application running on the TEE, and a kth non-volatile storage.

[0041] In a system in which n TEEs cooperate, the integrity verification process for an application may be performed by performing step S301 between the cooperating computers, or by designating a representative computer and performing step S301 between the representative computer and the other computers. Alternatively, the n computers may be grouped and hierarchically organized, and a primary representative computer that performs integrity verification processing within the group and a secondary representative computer that performs integrity verification processing between the groups may be designated. For example, of computers A1, A2, and A3 in group A, A1 may be designated as the primary representative computer; of computers B1, B2, and B3 in group B, B1 may be designated as the primary representative computer; of computers C1, C2, and C3 in group C, C1 may be designated as the primary representative computer; and of the primary representative computer group A1, B1, and C1, A1 may be designated as the secondary representative computer. A1 performs attestation (step 301) with A2 and A3. The same process is performed for groups B and C. Then, A1 performs attestation with B1 and C1.

[0042] The shared key may be generated by n computers, or step 302 may be performed between TEEs exchanging intermediate data to generate a unique shared key for each pair of TEEs. In the shared key storage process of the first embodiment, the first computer generates n fragments (the first fragment through the nth fragment) and transmits the second fragment through the nth fragment to each of the second computer through the nth computer. The second computer through the nth computer store the received fragments in their respective non-volatile storages. As described in <Dividing Number of Fragment Values ​​and Threshold for Restoration>, the first computer fragments the shared key by determining the number of fragments (threshold) m required for restoration. In the shared key restoration process of the first embodiment, each computer acquires fragments from other computers and collects the number (m) of fragments required for restoring the shared key.

[0043] The second shared key storage process and the second shared key recovery process of the second embodiment may be performed by each of the n computers.

[0044] [Program, Recording Medium] The functions realized by the components described in this specification may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), CPUs (Central Processing Units), conventional circuits, and / or combinations thereof, programmed to realize the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may be a programmed processor that executes a program stored in a memory.

[0045] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0046] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0047] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 12, and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0048] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0049] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0050] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of a server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0051] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0052] 20 Data linkage system 210 First computer 211 First TEE 212 First communication unit 213 First non-volatile storage 214 First TEE control unit 215 First application 220 Second computer 221 Second TEE 222 Second communication unit 223 Second non-volatile storage 224 Second TEE control unit 225 Second application 1100 nth computer 1101 nth TEE 1103 nth non-volatile storage 1104 nth TEE control unit 1105 nth application 1120 Communication network 1150 Data linkage system 2000 Computer 2010 Control unit 2020 Recording unit 2030 Input unit 2040 Output unit 2050 Display unit

Claims

1. A data linkage system consisting of n computers, wherein the kth computer (k=1, 2, ..., n) has the kth application running on the TEE and the kth non-volatile storage, the first application divides a common key using secret sharing to generate multiple fragments (the kth fragment (k=1, 2, ..., n)), the first application stores the first fragment in the first non-volatile storage and sends the jth fragment (j=2, 3, ..., n) to the jth application, the jth application stores the received jth fragment in the jth non-volatile storage, and when all of the TEEs in the n computers are restarted, the n applications each obtain the fragments from the other applications and decrypt the common key.

2. A computer that is part of a data linkage system consisting of n computers and that is equipped with an application running on a TEE and non-volatile storage, wherein the application divides a common key using secret sharing to generate multiple fragments (k-th fragment (k=1, 2, ..., n)), the application stores the first fragment in a first non-volatile storage and stores the j-th fragment (j=2, 3, ..., n) in the j-th non-volatile storage of the j-th computer, and when all of the TEEs in the n computers are restarted, the application retrieves the fragments from one or more of the j-th non-volatile storages and decrypts the common key.

3. A method for managing a shared key used when n applications running on n TEEs cooperate to process data, wherein a first application divides the shared key using secret sharing to generate multiple fragments (k-th fragment (k=1, 2, ..., n)), the first application stores the first fragment in a first non-volatile storage and sends the j-th fragment (j=2, 3, ..., n) to a j-th application, the j-th application stores the received j-th fragment in the j-th non-volatile storage, and when all of the n TEEs are restarted, each of the n applications obtains the fragments from the other applications and decrypts the shared key.

4. A data linkage system consisting of n computers, wherein the kth computer (k=1, 2, ..., n) has the kth application running on the kth TEE and the kth non-volatile storage, the kth application measures features of the kth TEE to generate the kth secret information, encrypts a common key using the kth secret information to generate the kth encrypted common key, and stores the kth encrypted common key in the kth non-volatile storage, and when all of the n TEEs are restarted, the kth application reproduces the kth secret information and decrypts the common key using the kth secret information and the kth encrypted common key.

5. A computer that is part of a data linkage system consisting of n computers, each having an application running on a TEE and non-volatile storage, wherein the application measures features of the TEE to generate secret information, encrypts a common key using the secret information to generate an encrypted common key, and stores the encrypted common key in the non-volatile storage, and when all of the TEEs in the n computers are restarted, the application reproduces the secret information and decrypts the common key using the secret information and the encrypted common key.

6. A method for managing a shared key used when n applications running on n TEEs cooperate to process data, wherein the kth application (k=1, 2, ..., n) measures a feature of the kth TEE to generate kth secret information, encrypts a shared key using the kth secret information to generate the kth encrypted shared key, and stores the kth encrypted shared key in the kth non-volatile storage; and when all of the n TEEs are restarted, the kth application reproduces the kth secret information and decrypts the shared key using the kth secret information and the kth encrypted shared key.

7. A program for causing a computer to function as the calculator according to claim 2 or 5.

Images