Trusted Hardware Data Tracing for Tamper-Resistant Query Results
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data tracing processes are susceptible to attacks that can result in inaccurate or tampered tracing results, compromising the credibility and reliability of data tracing.
Innovation Solution
A data processing method that utilizes a trusted hardware execution environment (TEE) to decrypt tracing clue ciphertexts, ensuring that only the client and TEE share the decryption key, thereby preventing the server from knowing the actual value of the tracing clue, and ensuring the accuracy and credibility of the tracing results by performing decryption and data matching within the TEE.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data tracing is performed using traditional methods, then the process is simple and straightforward, but the tracing results are vulnerable to attacks and manipulation
Solution Approach 1:
The patent introduces a Trusted Execution Environment (TEE) as an intermediary component between the client and the database server. The TEE acts as a mediator that performs decryption and data matching operations in a secure, isolated environment, preventing direct access to plaintext tracing clues and protected data. This intermediary layer ensures tracing credibility while maintaining a manageable system architecture through clear separation of security-critical functions.
Solution Approach 2:
The system is segmented into distinct functional modules: the client application, the Trusted Execution Environment (TEE), the database server, and the database storage. Each component has a specific responsibility, with the TEE handling security-sensitive operations (decryption, matching) in isolation. This segmentation allows the system to achieve high reliability through specialized secure processing while keeping the overall system complexity manageable through modular design.
2Reliability
If encryption is applied to protect tracing clues, then security is improved, but the decryption and processing overhead increases
Solution Approach 1:
The patent implements preliminary action by pre-establishing encryption schemes and preparing cryptographic materials before actual tracing operations. The client encrypts tracing clues beforehand, and the TEE is pre-configured with decryption capabilities and data matching structures. This preparation reduces the time required during actual tracing operations, as the heavy cryptographic work is performed in advance or in optimized secure environments.
Solution Approach 2:
The patent replaces traditional mechanical data processing approaches with cryptographic and hardware-based security mechanisms. Instead of relying on software-based access controls and plaintext processing, the system uses encryption algorithms and TEE hardware enforcement to protect tracing operations. This substitution improves security while the hardware acceleration and optimized cryptographic implementations minimize the time overhead.
3Productivity
If the server can access plaintext data for querying, then query efficiency is high, but the server can deduce and attack the actual data content
Solution Approach 1:
The TEE serves as an intermediary that enables efficient data querying without exposing plaintext data to the server. The TEE receives encrypted queries, performs decryption and data matching operations in a secure environment, and returns results without revealing intermediate plaintext values to the untrusted server. This maintains query efficiency while eliminating the server's ability to attack data content.
Solution Approach 2:
The patent applies local quality by creating a specialized secure processing zone (the TEE) with different security properties than the general server environment. Within the TEE, data is handled in plaintext for efficient processing, but this plaintext access is strictly localized and isolated. The server outside the TEE only interacts with encrypted data, maintaining its inability to attack data content while allowing high-performance querying within the secure boundary.
Data Source
Figure 1~2
Figure 3~4
AI summary
The present disclosure provides a data processing method and apparatus, an electronic device and a storage medium, and the method comprises: receiving a data tracing request sent by a client, wherein the tracing request carries a tracing clue ciphertext which is generated by encrypting a target tracing clue based on a shared key agreed by the client and a trusted hardware execution environment, and wherein the target tracing clue is used for identifying target data; decrypting the tracing clue ciphertext in the trusted hardware execution environment to obtain the target tracing clue ; searching for target data matched with the target tracing clue from a database according to the target tracing clue , and determining a target tracing result according to the target data; wherein the database is used for storing the corresponding relationship between the data identification information and the data and supporting query access of the data; and in response to the data tracing request, feeding back the target tracing result to the client. The tracing credibility is improved by adopting a manner in which encryption is combined with the trusted hardware execution environment.