Data processing method and apparatus

Patent metadata

Field	Value
Publication number	US-11038673-B2
Application number	US-202117159553-A
Country	US
Kind code	B2
Filing date	Jan 27, 2021
Priority date	Dec 12, 2018
Publication date	Jun 15, 2021
Grant date	Jun 15, 2021

Abstract

Implementations of the present specification provide a data processing method and apparatus. A method performed by a data provider includes: obtaining first encrypted data of first plaintext data, a first key used to decrypt the first encrypted data, and authorization information about the first plaintext data; sending a verification request to a data manager, the data manager including a first trusted execution environment; receiving authentication information from the data manager, and performing verification based on the authentication information; when the verification succeeds, securely transmitting the first key and the authorization information to the first trusted execution environment; and providing the first encrypted data to the data manager.

First claim

The invention claimed is:

1. A data processing method, comprising:
obtaining, by a data provider, first encrypted data associated with first plaintext data, a first key used to decrypt the first encrypted data, and authorization information about the first plaintext data, wherein the authorization information includes at least one code hash value corresponding to at least one program allowed to use the first plaintext data and at least one piece of access permission information corresponding to the at least one code hash value, and wherein the access permission information is applicable to a calculation result of a corresponding program;
sending a verification request from the data provider to a data manager, the data manager including a first trusted execution environment;
receiving, by the data provider and from the data manager, authentication information generated by the first trusted execution environment;
performing, by the data provider, verification of the first trusted execution environment based on the authentication information;
responsive to a success of the verification, securely transmitting the first key and the authorization information from the data provider to the first trusted execution environment; and
causing the first encrypted data to be provided to the data manager.

2. The method according to claim 1 , wherein the access permission information is a second key (a) used to encrypt the calculation result and (b) provided by a calculation result user corresponding to the calculation result.

3. The method according to claim 1 , wherein the access permission information is null information.

4. The method according to claim 1 , wherein the performing verification based on the authentication information includes: verifying, based on the authentication information, whether a program for data use authorization is installed and is running in the first trusted execution environment.

5. The method according to claim 1 , wherein the secure transmission is encrypted transmission.

6. A data processing method, comprising:
storing, by a data manager, at least one piece of encrypted data, at least one first key, and at least one piece of authorization information corresponding to the at least one first key in a first trusted execution environment, the at least one first key being used to decrypt the at least one piece of encrypted data to obtain at least one piece of plaintext data, the at least one piece of authorization information corresponding to the at least one piece of plaintext data, and the authorization information being information about at least one program allowed to use corresponding plaintext data;
receiving, by the data manager and from a data user, a data request to use the at least one piece of plaintext data, the data user including a second trusted execution environment;
receiving, by the data manager and from the data user, authentication information generated by the second trusted execution environment;
for each piece of authorization information in the first trusted execution environment:
performing, by the data manager, verification for the authorization information based, at least in part, on the authentication information; and
responsive to a success of the verification, securely transmitting a first key corresponding to the authorization information to the second trusted execution environment by using the first trusted execution environment, and providing corresponding encrypted data to the data user.

7. The method according to claim 6 , wherein the first trusted execution environment and the second trusted execution environment are located on one platform or different platforms.

8. The method according to claim 6 , wherein the receiving the authentication information includes: receiving, by using the first trusted execution environment, the authentication information securely transmitted from the second trusted execution environment.

9. The method according to claim 6 , wherein the authentication information includes a first code hash value corresponding to a first program that is installed and running in the second trusted execution environment, wherein each piece of authorization information includes at least one code hash value corresponding to at least one program; and wherein the performing verification for each piece of authorization information includes: verifying, for each piece of authorization information, whether the first code hash value is a code hash value included in the authorization information.

10. The method according to claim 9 , wherein each piece of authorization information includes a first code hash value and a second key corresponding to the first code hash value, the second key being used to encrypt a calculation result of the first program and being provided by a calculation result user corresponding to the calculation result; and the method further comprises: for each piece of authorization information, responsive to the success of the verification, further securely transmitting the second security key to the second trusted execution environment by using the first trusted execution environment.

11. The method according to claim 6 , wherein the data manager further includes a data storage module, the at least one piece of encrypted data being stored in the data storage module.

12. A data processing method, wherein the method is performed by a data user, the data user including a second trusted execution environment, a first program running in the second trusted execution environment, and the method comprising:
sending, from a data user to a data manager, a data request to use at least one piece of plaintext data corresponding to at least one piece of encrypted data stored in the data manager, the data manager including a first trusted execution environment, at least one first key and at least one piece of authorization information corresponding to the at least one first key being stored in the first trusted execution environment, the at least one first key being used to decrypt the at least one piece of encrypted data to obtain the at least one piece of plaintext data, the at least one piece of authorization information corresponding to the at least one piece of plaintext data, and the authorization information being information about at least one program allowed to use corresponding plaintext data;
sending, from the data user to the data manager, authentication information generated by the second trusted execution environment, so that the first trusted execution environment performs verification for each piece of authorization information based, at least in part, on the authentication information;
for each piece of authorization information, responsive to a success of the verification, receiving, by the data user using the second trusted execution environment, a first key that corresponds to the authorization information and that is securely transmitted from the first trusted execution environment, obtaining encrypted data corresponding to the authorization information from the data manager, and decrypting the encrypted data by using the first key in the second trusted execution environment to obtain corresponding plaintext data; and
performing calculation based on the at least one piece of plaintext data by using the first program in the second trusted execution environment to obtain a calculation result.

13. The method according to claim 12 , wherein the first program has a first code hash value, each piece of authorization information including a first code hash value and a second key corresponding to the first code hash value, and the second key being used to encrypt a calculation result of

Assignees

• Advanced New Technologies Co Ltd

Inventors

• Yu Chaofan
• Huang Qunshan
• Wang Lei

Classifications

• H04W12/03

  Protecting confidentiality, e.g. by encryption · CPC title

• H04L63/0478

  applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14) · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title