WO2021218278A1 - Method for processing data, and computing device - Google Patents

Abstract

A method for processing data, and a computing device. The method comprises: a plurality of trusted applications (TAs) in a trusted execution environment (TEE) respectively acquiring a plurality of data segments of a first user, wherein the plurality of data segments form data of the first user (S310); each TA in the plurality of TAs processing the data segments respectively acquired thereby to obtain a respective result (S320); and the plurality of TAs respectively feeding back the respective results, wherein the results which are fed back by the plurality of TAs are used for determining a result corresponding to the data of the first user (S330). By means of the method, secure isolation of data can be further guaranteed in a TEE.

Description

数据处理的方法以及计算设备Data processing method and computing equipment 技术领域Technical field

本申请涉及数据处理技术领域，更具体地，涉及一种数据处理的方法以及计算设备。This application relates to the field of data processing technology, and more specifically, to a data processing method and computing device.

背景技术Background technique

移动设备上部署有***，该***包含丰富执行环境(rich execution environment，REE)以及可信执行环境(trusted execution environment，TEE)。TEE是在该移动设备(例如，智能手机、平板电脑、智能电视等)内一个独立的隔离的安全运行环境，该环境与REE逻辑隔离。TEE为代码和数据的执行提供了一个更安全的空间，并保证用户的敏感信息(例如，用户的代码和数据)的机密性和安全性。A system is deployed on the mobile device, and the system includes a rich execution environment (REE) and a trusted execution environment (TEE). TEE is an independent and isolated safe operating environment in the mobile device (for example, smart phone, tablet computer, smart TV, etc.), which is logically isolated from REE. TEE provides a more secure space for the execution of code and data, and guarantees the confidentiality and security of the user's sensitive information (for example, the user's code and data).

为了防止不同的TA之间互相随意读取和访问数据，相关的技术方案中，对TA在内存中的数据进行加密。这样，一方面，为了实现对内存中不同的TA数据进行加密，需要多个软硬件协同完成，增加了实现的复杂性，降低了内存和中央处理器(central processing unit，CPU)的利用率。另一方面，即使内存加密了，当数据被调入CPU参与计算的时候还是要先还原成明文，仍然有安全风险，因此，上述相关的技术方案中TEE的数据隔离不完全可靠，一旦隔离失败明文数据就泄露了。In order to prevent different TAs from reading and accessing data at will, in related technical solutions, the data in the memory of the TA is encrypted. In this way, on the one hand, in order to realize the encryption of different TA data in the memory, multiple software and hardware are required to complete the coordination, which increases the complexity of the implementation and reduces the utilization of the memory and the central processing unit (CPU). On the other hand, even if the memory is encrypted, when the data is transferred to the CPU to participate in the calculation, it must be restored to plain text. There is still a security risk. Therefore, the data isolation of the TEE in the above-mentioned related technical solutions is not completely reliable, and once the isolation fails The plaintext data is leaked.

因此，如何在TEE中进一步保证数据的安全隔离成为亟需要解决的问题。Therefore, how to further ensure the security isolation of data in TEE has become a problem that needs to be solved urgently.

发明内容Summary of the invention

本申请提供一种数据处理的方法以及计算设备，可以在TEE中进一步保证数据的安全隔离。This application provides a data processing method and computing device, which can further ensure the safety isolation of data in the TEE.

第一方面，提供了一种数据处理的方法，包括：可信执行环境TEE中的多个可信应用TA分别获取第一用户的多个数据片段，所述多个数据片段组成所述第一用户的数据；所述多个TA中的每个TA对各自获取的数据片段做处理，得到各自的结果；所述多个TA分别反馈各自的结果，所述多个TA反馈的结果用于确定所述第一用户的数据对应的结果。In a first aspect, a data processing method is provided, including: multiple trusted applications TA in a trusted execution environment TEE respectively acquire multiple data fragments of a first user, and the multiple data fragments form the first user. User’s data; each of the multiple TAs processes the data fragments respectively obtained to obtain respective results; the multiple TAs feed back their respective results, and the multiple TA feedback results are used to determine The result corresponding to the data of the first user.

上述技术方案中，用户将自己的任务数据随机分成多个片段，并分别主动分享给多个TA，在TEE环境下运行这些多个TA。该多个TA分布式的计算后，将它们各自的结果进行反馈，以便于根据它们各自的计算结果拼合成自己的数据对应的结果。攻击者即使攻破了TEE的保护窃取了一个TA在内存中的数据，也只是获取到了用户的任务数据的其中一个随机片段，而无法获取用户的任务数据。这样，一方面，通过在TEE中处理碎片化的明文数据，在某个TA的内存暴露后仍然可以保护内存中的数据，简洁高效的同时还可以加强隐私保护的效果。另一方面，多个TA进行分布式的计算还可以提高计算效率。In the above technical solution, the user randomly divides his task data into multiple segments, and actively shares them with multiple TAs respectively, and runs these multiple TAs in a TEE environment. After the multiple TAs are calculated in a distributed manner, their respective results are fed back, so as to combine their own data corresponding results according to their respective calculation results. Even if the attacker breached the protection of the TEE and stole the data of a TA in the memory, he would only obtain a random fragment of the user's task data, and could not obtain the user's task data. In this way, on the one hand, by processing fragmented plaintext data in the TEE, the data in the memory can still be protected after the memory of a certain TA is exposed, which is concise and efficient, and can also enhance the effect of privacy protection. On the other hand, the distributed calculation of multiple TAs can also improve the calculation efficiency.

在一种可能的实现方式中，TEE中的TA1获取第一用户的第一数据片段，并对第一数据片段做处理，得到第一结果；TEE中的TA2获取第一用户的第二数据片段，并对第二数据片段做处理，得到第二结果；TEE中的TA1和TA2分别反馈各自的第一结果和第 二结果，该第一结果和第二结果用于确定所述第一用户的数据对应的结果。In a possible implementation, TA1 in the TEE obtains the first data segment of the first user, and processes the first data segment to obtain the first result; TA2 in the TEE obtains the second data segment of the first user , And process the second data segment to obtain the second result; TA1 and TA2 in the TEE feed back their first and second results respectively, and the first and second results are used to determine the first user’s The result of the data.

在另一种可能的实现方式中，所述多个TA分别通过加密通道获取各自的密文；所述多个TA分别对各自的密文解密，得到各自的数据片段。In another possible implementation manner, the multiple TAs obtain respective ciphertexts respectively through encryption channels; the multiple TAs respectively decrypt the respective ciphertexts to obtain respective data fragments.

上述技术方案中，用户通过客户端将数据导入TEE环境之前对该数据进行加密，可以增强数据的安全性，加强隐私保护的效果。In the above technical solution, the user encrypts the data before importing the data into the TEE environment through the client, which can enhance the security of the data and enhance the effect of privacy protection.

在另一种可能的实现方式中，所述多个TA分别将各自的加密的结果，通过加密通道反馈给所述第一用户的客户端。In another possible implementation manner, the multiple TAs respectively feed back their encryption results to the client of the first user through an encryption channel.

上述技术方案中，多个TA可以将各自的加密结果反馈给用户的客户端，并由用户的客户端对多个TA的加密结果解密，并根据解密后各自的结果得到第一用户的数据对应的结果。这样，多个TA在将结果反馈给用户的过程中，可以增强数据的安全性，加强隐私保护的效果。In the above technical solution, multiple TAs can feed back their encryption results to the user's client, and the user's client decrypts the encryption results of the multiple TAs, and obtains the data corresponding to the first user according to the respective results after decryption. the result of. In this way, multiple TAs can enhance data security and enhance the effect of privacy protection in the process of feeding back the results to the user.

在另一种可能的实现方式中，所述多个TA分别将各自的结果反馈给第一TA；所述第一TA根据所述多个TA反馈的结果确定所述第一用户的数据对应的结果。In another possible implementation manner, the multiple TAs respectively feed back their respective results to the first TA; the first TA determines the data corresponding to the first user according to the feedback results of the multiple TAs result.

上述技术方案中，如果一个用户的客户端的计算功能或安全性能有限，可以由TEE环境中的一个TA完成上述用户的客户端的任务。由于TEE的环境较安全，因此，在TEE的环境中确定所述第一用户的数据对应的结果，使得数据的安全性提高。In the above technical solution, if the computing function or security performance of a user's client is limited, a TA in the TEE environment can complete the tasks of the user's client. Since the environment of the TEE is relatively safe, the result corresponding to the data of the first user is determined in the environment of the TEE, so that the security of the data is improved.

在另一种可能的实现方式中，在所述多个TA包括所述第一TA时，所述多个TA中除了所述第一TA的其它TA将各自的结果通过TEE通道反馈给第一TA。In another possible implementation manner, when the multiple TAs include the first TA, other TAs in the multiple TAs other than the first TA feed back their results to the first TA through the TEE channel. TA.

在另一种可能的实现方式中，在所述多个TA包括所述第一TA时，该第一TA通过本地获取该第一TA的结果。In another possible implementation manner, when the multiple TAs include the first TA, the first TA obtains the result of the first TA locally.

在另一种可能的实现方式中，所述方法还包括：改变所述多个TA的标识ID。In another possible implementation manner, the method further includes: changing the identification IDs of the multiple TAs.

上述技术方案中，增加了混淆机制，可以改变一个用户的多个TA的标识ID，在一个用户的所有TA内存都被攻破，该用户的所有数据片段都被泄露的情况下，还可以进行多种保护，使得攻击者无法判断哪些TA属于同一用户，这样，进一步的增加了数据的安全性。In the above technical solution, an obfuscation mechanism is added, which can change the identification IDs of multiple TAs of a user. In the case that all TA memory of a user is compromised and all data fragments of the user are leaked, multiple TAs can also be changed. This kind of protection makes it impossible for an attacker to determine which TAs belong to the same user, which further increases the security of the data.

在另一种可能的实现方式中，所述方法还包括：同时改变用于处理所述第一用户的多个数据片段的所述多个TA的标识ID和用于处理第二用户的多个数据片段的多个TA的标识ID。In another possible implementation manner, the method further includes: simultaneously changing the identification IDs of the multiple TAs used to process the multiple data fragments of the first user and the multiple TAs used to process the second user. The identification IDs of multiple TAs of the data segment.

上述技术方案中，增加了混淆机制，可以同时改变多个用户的多个TA的标识ID，在一个用户的所有TA内存都被攻破，该用户的所有数据片段都被泄露的情况下，还可以进行多种保护，使得攻击者无法判断哪些TA属于同一用户，这样，进一步的增加了数据的安全性。In the above technical solution, an obfuscation mechanism is added, which can change the identification IDs of multiple TAs of multiple users at the same time. When all TA memory of a user is compromised and all data fragments of the user are leaked, it is also possible A variety of protections make it impossible for an attacker to determine which TAs belong to the same user, which further increases the security of the data.

第二方面，提供了一种数据处理的***，包括：客户端和可信执行环境TEE中的多个可信应用TA，In the second aspect, a data processing system is provided, including: a client and multiple trusted applications TA in a trusted execution environment TEE,

所述多个TA分别从所述客户端获取所述第一用户的多个数据片段，所述多个数据片段组成所述第一用户的数据；The multiple TAs obtain multiple data fragments of the first user from the client respectively, and the multiple data fragments constitute data of the first user;

所述多个TA中的每个TA对各自获取的数据片段做处理，得到各自的结果；Each TA of the plurality of TAs processes the data fragments respectively obtained to obtain respective results;

所述多个TA分别反馈各自的结果，所述多个TA反馈的结果用于确定所述第一用户的数据对应的结果。The multiple TAs respectively feed back their respective results, and the feedback results of the multiple TAs are used to determine a result corresponding to the data of the first user.

在一种可能的实现方式中，所述多个TA具体用于：分别通过加密通道从所述客户端获取各自的密文；分别对各自的密文解密，得到各自的数据片段。In a possible implementation manner, the multiple TAs are specifically configured to: obtain respective ciphertexts from the client through an encrypted channel; respectively decrypt the respective ciphertexts to obtain respective data fragments.

在另一种可能的实现方式中，所述多个TA具体用于：分别将各自的加密的结果，通过加密通道反馈给所述客户端；所述客户端具体用于：根据解密后所述多个TA各自的结果确定所述第一用户的数据对应的结果。In another possible implementation manner, the multiple TAs are specifically used to: respectively feed back the respective encryption results to the client through an encryption channel; the client is specifically used to: according to the decryption The respective results of the multiple TAs determine the results corresponding to the data of the first user.

在另一种可能的实现方式中，所述多个TA具体用于：分别将各自的结果反馈给第一TA；所述第一TA用于根据所述多个TA反馈的结果确定所述第一用户的数据对应的结果。In another possible implementation manner, the multiple TAs are specifically used for: respectively feeding back their respective results to the first TA; the first TA is used for determining the first TA according to the feedback results of the multiple TAs A result corresponding to the user's data.

在另一种可能的实现方式中，在所述多个TA包括所述第一TA时，所述多个TA中除了所述第一TA的其它TA将各自的结果通过TEE通道反馈给第一TA。In another possible implementation manner, when the multiple TAs include the first TA, other TAs in the multiple TAs other than the first TA feed back their results to the first TA through the TEE channel. TA.

在另一种可能的实现方式中，所述***还包括：操作***，用于改变所述多个TA的标识ID。In another possible implementation manner, the system further includes: an operating system for changing the identification IDs of the multiple TAs.

在另一种可能的实现方式中，所述操作***还用于：同时改变用于处理所述第一用户的多个数据片段的所述多个TA的标识ID和用于处理第二用户的多个数据片段的多个TA的标识ID。In another possible implementation manner, the operating system is further used to simultaneously change the identification IDs of the multiple TAs used to process multiple data fragments of the first user and the identification IDs used to process the second user. Identification IDs of multiple TAs of multiple data fragments.

在另一种可能的实现方式中，所述客户端还用于将所述第一用户的数据拆分成所述多个数据片段。In another possible implementation manner, the client terminal is further configured to split the data of the first user into the multiple data fragments.

在上述第一方面中对相关内容的扩展、限定、解释、说明和效果也适用于第三方面中相同的内容。The expansion, limitation, explanation, description and effect of the related content in the above-mentioned first aspect are also applicable to the same content in the third aspect.

第三方面，提供了一种可信应用TA，所述TA为可信执行环境TEE中的多个可信应用TA中的一个，所述TA包括：获取模块，处理模块，反馈模块，In a third aspect, a trusted application TA is provided. The TA is one of multiple trusted application TAs in a trusted execution environment TEE. The TA includes: an acquisition module, a processing module, and a feedback module,

获取模块，用于获取第一用户的多个数据片段中的一个数据片段，所述多个数据片段组成所述第一用户的数据；An obtaining module, configured to obtain one data fragment among a plurality of data fragments of a first user, and the plurality of data fragments constitute data of the first user;

处理模块，用于对获取的所述一个数据片段做处理，得到结果；The processing module is used to process the one piece of acquired data to obtain a result;

反馈模块，用于反馈结果，所述结果用于确定所述第一用户的数据对应的结果。The feedback module is used to feed back results, and the results are used to determine the results corresponding to the data of the first user.

在一种可能的实现方式中，所述获取模块具体用于：通过加密通道获取密文；In a possible implementation manner, the obtaining module is specifically configured to: obtain ciphertext through an encrypted channel;

所述处理模块还用于：对所述密文解密，得到所述一个数据片段。The processing module is also used to: decrypt the ciphertext to obtain the one data segment.

在另一种可能的实现方式中，所述反馈模块具体用于：将加密的所述结果通过加密通道反馈给所述第一用户的客户端。In another possible implementation manner, the feedback module is specifically configured to feed back the encrypted result to the client of the first user through an encrypted channel.

在另一种可能的实现方式中，所述反馈模块具体用于：将所述结果反馈给第一TA，所述第一TA用于根据所述多个TA反馈的结果确定所述第一用户的数据对应的结果。In another possible implementation manner, the feedback module is specifically configured to: feed back the result to a first TA, and the first TA is configured to determine the first user according to the feedback results of the multiple TAs The data corresponds to the result.

在上述第一方面中对相关内容的扩展、限定、解释、说明和效果也适用于第三方面中相同的内容。The expansion, limitation, explanation, description and effect of the related content in the above-mentioned first aspect are also applicable to the same content in the third aspect.

第四方面，提供了一种计算设备，包括：处理器和存储器，所述处理器运行所述存储器中的指令，使得所述计算设备执行如上述第一方面或第一方面的任意一种可能的实现方式中所执行的方法步骤。In a fourth aspect, a computing device is provided, including: a processor and a memory, the processor runs instructions in the memory, so that the computing device executes any one of the above-mentioned first aspect or the first aspect. The method steps performed in the implementation of.

第五方面，提供了一种计算设备，包括处理器和存储器；所述处理器运行所述存储器中的指令，使得所述计算设备部署如上述第三方面或第三方面的任意一种可能的实现方式中的TA。In a fifth aspect, a computing device is provided, including a processor and a memory; the processor runs the instructions in the memory, so that the computing device can be deployed as described in the third aspect or any one of the third aspects. TA in the realization mode.

第六方面，提供了一种计算机可读存储介质，包括指令；所述指令用于实现如第一方面或第一方面的任意一种可能的实现方式中所执行的方法步骤。In a sixth aspect, a computer-readable storage medium is provided, including instructions; the instructions are used to implement the method steps performed in the first aspect or any one of the possible implementation manners of the first aspect.

第七方面，提供了一种计算机可读存储介质，包括指令；所述指令用于实现如上述第三方面或第三方面的任意一种可能的实现方式中的TA。In a seventh aspect, a computer-readable storage medium is provided, including instructions; the instructions are used to implement the TA in the foregoing third aspect or any one of the possible implementation manners of the third aspect.

可选地，作为一种实现方式，上述存储介质具体可以是非易失性存储介质。Optionally, as an implementation manner, the foregoing storage medium may specifically be a non-volatile storage medium.

第八方面，提供一种芯片，该芯片获取指令并执行该指令来实现上述第一方面以及第一方面的任意一种实现方式中数据处理的方法。In an eighth aspect, a chip is provided, which obtains an instruction and executes the instruction to implement the first aspect and the data processing method in any one of the implementation manners of the first aspect.

可选地，作为一种实现方式，该芯片包括处理器与数据接口，该处理器通过该数据接口读取存储器上存储的指令，执行上述第一方面以及第一方面的任意一种实现方式中数据处理的方法。Optionally, as an implementation manner, the chip includes a processor and a data interface, and the processor reads instructions stored in the memory through the data interface, and executes the first aspect and any one of the implementation manners of the first aspect. Methods of data processing.

可选地，作为一种实现方式，该芯片还可以包括存储器，该存储器中存储有指令，该处理器用于执行该存储器上存储的指令，当该指令被执行时，该处理器用于执行第一方面以及第一方面中的任意一种实现方式中数据处理的方法。Optionally, as an implementation manner, the chip may further include a memory in which instructions are stored, and the processor is configured to execute the instructions stored in the memory, and when the instructions are executed, the processor is configured to execute the first Aspect and the method of data processing in any one of the implementation manners in the first aspect.

第九方面，提供一种芯片，该芯片获取指令并执行该指令来实现上述第三方面或第三方面的任意一种可能的实现方式中的TA。In a ninth aspect, a chip is provided, which obtains an instruction and executes the instruction to implement the TA in the third aspect or any one of the possible implementation manners of the third aspect.

可选地，作为一种实现方式，该芯片包括处理器与数据接口，该处理器通过该数据接口读取存储器上存储的指令，实现上述第三方面或第三方面的任意一种可能的实现方式中的TA。Optionally, as an implementation manner, the chip includes a processor and a data interface, and the processor reads instructions stored in the memory through the data interface to implement the third aspect or any one of the possible implementations of the third aspect. TA in the way.

可选地，作为一种实现方式，该芯片还可以包括存储器，该存储器中存储有指令，该处理器用于执行该存储器上存储的指令，当该指令被执行时，该处理器用于实现第三方面或第三方面的任意一种可能的实现方式中的TA。Optionally, as an implementation manner, the chip may further include a memory in which instructions are stored, and the processor is configured to execute the instructions stored in the memory, and when the instructions are executed, the processor is configured to implement the third Aspect or any one of the possible implementation manners of the third aspect.

附图说明Description of the drawings

图1是适用于本申请实施例的一种可能的***架构示意图。FIG. 1 is a schematic diagram of a possible system architecture applicable to an embodiment of the present application.

图2是本申请实施例提供的一种计算设备200的架构示意图。FIG. 2 is a schematic diagram of the architecture of a computing device 200 provided by an embodiment of the present application.

图3是本申请实施例提供的一种数据处理的方法的示意性流程图。FIG. 3 is a schematic flowchart of a data processing method provided by an embodiment of the present application.

图4是本申请实施例提供的另一种数据处理的方法的示意性流程图。FIG. 4 is a schematic flowchart of another data processing method provided by an embodiment of the present application.

图5是本申请实施例提供的一种数据拆分过程的示意性框图。Fig. 5 is a schematic block diagram of a data splitting process provided by an embodiment of the present application.

图6是本申请实施例提供的一种多个TA分别上报中间计算结果的示意性框图。FIG. 6 is a schematic block diagram of a plurality of TAs respectively reporting intermediate calculation results according to an embodiment of the present application.

图7是本申请实施例提供的一种多个子TA之间进行通信的示意性框图。FIG. 7 is a schematic block diagram of communication between multiple sub-TAs according to an embodiment of the present application.

图8是本申请实施例提供的TA 800的示意性框图。FIG. 8 is a schematic block diagram of a TA 800 provided by an embodiment of the present application.

具体实施方式Detailed ways

下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

在本申请的各实施例中，“第一”、“第二”、“第三”、“第四”等仅是为了指代不同的对象，并不表示对指代的对象有其它限定。In the embodiments of the present application, "first", "second", "third", "fourth", etc. are only used to refer to different objects, and do not mean that there are other limitations on the referred objects.

由于本申请实施例涉及大量的专业术语，为了便于理解，下面先对本申请实施例可能涉及的相关术语和概念进行介绍。Since the embodiments of the present application involve a large number of professional terms, in order to facilitate understanding, the following first introduces related terms and concepts that may be involved in the embodiments of the present application.

1、可信执行环境(trusted execution environment，TEE)1. Trusted execution environment (TEE)

移动设备上部署有***，该***包含丰富执行环境(rich execution environment，REE)以及可信执行环境(trusted execution environment，TEE)。TEE是在该移动设备(例如，智能手机、平板电脑、智能电视等)内一个独立的隔离的安全运行环境，该环境与REE逻辑隔离。由于TEE提供了一个与REE隔离的环境保存用户的敏感信息(例如，用户的代码和数据)，TEE可以直接获取REE的信息，而REE不能获取TEE的信息，因此，TEE为代码和数据的执行提供了一个更安全的空间，并保证用户的敏感信息(例如，用户的代码和数据)的机密性和安全性。A system is deployed on the mobile device, and the system includes a rich execution environment (REE) and a trusted execution environment (TEE). TEE is an independent and isolated safe operating environment in the mobile device (for example, smart phone, tablet computer, smart TV, etc.), which is logically isolated from REE. Since TEE provides an environment isolated from REE to store the user’s sensitive information (for example, the user’s code and data), TEE can directly obtain REE information, while REE cannot obtain TEE information. Therefore, TEE is the execution of code and data. Provides a more secure space and guarantees the confidentiality and security of the user's sensitive information (for example, the user's code and data).

可选地，该移动设备可以是台式机、笔记本、手机、平板电脑、智能手表、智能手环等，本申请不做具体限定。Optionally, the mobile device may be a desktop computer, a notebook, a mobile phone, a tablet computer, a smart watch, a smart bracelet, etc., which is not specifically limited in this application.

在TEE上运行的应用叫做可信应用(trusted application，TA)，TEE在处理器(例如，中央处理器(central processing unit，CPU))和内存中划分出独立的可信区，并在处理器和内存中隔离不同的TA，防止不同的TA之间互相随意读取和访问数据。在TEE中运行的TA可以访问设备主处理器和内存的全部功能，而硬件隔离保护这些组件不会受到主操作***中运行的用户安装应用程序的影响。The application running on the TEE is called a trusted application (TA). The TEE divides an independent trusted area between the processor (for example, the central processing unit (CPU)) and the memory, and the processor Separate different TAs from the memory to prevent different TAs from reading and accessing data at will. The TA running in the TEE can access all the functions of the device's main processor and memory, and hardware isolation protects these components from being affected by user-installed applications running in the main operating system.

2、软件防卫指令集扩展(software guard extension，SGX)2. Software defense instruction set extension (software guard extension, SGX)

SGX是Intel架构新的扩展,在原有架构上增加了一组新的指令集和内存访问机制，这些扩展允许应用程序实现一个被称为飞地(enclave)的容器。为了防止不同的TA之间互相随意读取和访问数据，可以通过基本输入输出***(basic input output system，BIOS)在应用程序的地址空间中划分出独立的被保护的区域，该区域作为enclave使用。enclave内的数据是经过加密的，内核和超级监督者(hypervisor)都无法查看。因此，SGX不仅可以将不同TA的数据在内存中分区隔离，还可以将内存enclave中的数据加密。这样，开发者可以把应用程序划分到enclave中或者内存中可执行的保护区域，即使在受攻击的平台中也能提高安全性。使用这种新的应用层可信执行环境，开发者能够启用身份和记录隐私、安全浏览和数字管理保护(digital management protection，DRM)或者任何需要安全存储机密或者保护数据的高保障安全应用场景中。SGX is a new extension of the Intel architecture, adding a new set of instruction sets and memory access mechanisms to the original architecture. These extensions allow applications to implement a container called an enclave. In order to prevent different TAs from reading and accessing data at will, the basic input output system (BIOS) can be used to divide the address space of the application into an independent protected area, which is used as an enclave . The data in the enclave is encrypted, and neither the kernel nor the hypervisor can view it. Therefore, SGX can not only partition the data of different TAs in the memory, but also encrypt the data in the memory enclave. In this way, developers can divide applications into enclaves or executable protected areas in memory, which can improve security even on the attacked platform. Using this new application-layer trusted execution environment, developers can enable identity and record privacy, safe browsing, and digital management protection (digital management protection, DRM), or any high-security application scenarios that require secure storage of secrets or data protection .

SGX的实现需要处理器、内存管理部件、BIOS、驱动程序、运行时环境等软硬件协同完成。The implementation of SGX requires the coordination of software and hardware such as the processor, memory management components, BIOS, drivers, and runtime environment.

3、飞地(enclave)3. Enclave

将合法软件的安全操作封装在一个enclave中，保护其不受恶意软件的攻击，特权或者非特权的软件都无法访问enclave。也就是说，一旦软件和数据位于enclave中，即便操作***或虚拟机管理器程度(virtual machine manager，VMM)也无法影响enclave里面的代码和数据。Encapsulate the security operations of legitimate software in an enclave to protect it from malicious software. Privileged or unprivileged software cannot access the enclave. In other words, once the software and data are in the enclave, even the operating system or virtual machine manager (VMM) cannot affect the code and data in the enclave.

4、安全多方计算(secure multi-party computation，SMC)4. Secure multi-party computation (SMC)

SMC作为密码学的一个子领域，允许多个数据所有者在互不信任的情况下进行协同计算，输出计算结果，并保证任何一方均无法得到除应得的计算结果之外的其他任何信息。As a subfield of cryptography, SMC allows multiple data owners to perform collaborative calculations and output calculation results without mutual trust, and ensure that no one party can obtain any information other than the expected calculation results.

SMC是解决一组互不信任的参与方之间保护隐私的协同计算问题，SMC要确保输入的独立性、计算的正确性、去中心化等特征，同时***露各输入值给参与计算的其他成员。主要是针对无可信第三方的情况下，如何安全地计算一个约定函数的问题，同时要求每个参与主体除了计算结果外不能得到其他实体任何的输入信息。SMC is to solve the problem of collaborative computing that protects privacy between a group of untrusted parties. SMC must ensure the independence of input, the correctness of calculation, decentralization and other characteristics, and at the same time, it does not disclose each input value to others participating in the calculation. member. It is mainly aimed at the problem of how to safely calculate an agreed function without a trusted third party. At the same time, each participant is required to not get any input information from other entities except the calculation result.

SMC中的多个参与方各自持有私密数据，需要在***露各自数据的前提下计算出这些数据的一个函数(比如，百万富翁问题中的大小比较函数)，于是它们进行一个分布式计算。各个模型预测控制(model predictive control，MPC)节点根据计算逻辑，在本地完成数据提取、计算，并将输出计算结果路由到指定节点，从而多方节点完成协同计算任务，输出唯一性结果。整个过程各方数据全部在本地计算，并不提供原始数据给其他节点，在保证数据隐私的情况下，将中间计算结果反馈到整个计算任务***，从而各方得到正确的最终结果。Multiple participants in the SMC each hold private data, and need to calculate a function of these data (for example, the size comparison function in the millionaire problem) without revealing their own data, so they perform a distributed calculation . Each model predictive control (MPC) node completes data extraction and calculation locally according to the calculation logic, and routes the output calculation result to a designated node, so that multiple nodes complete the collaborative calculation task and output unique results. In the whole process, all the data of all parties are calculated locally, and the original data is not provided to other nodes. Under the condition of ensuring data privacy, the intermediate calculation results are fed back to the entire computing task system, so that all parties get the correct final result.

5、门限秘密分享(threshold secret sharing，TSS)5. Threshold secret sharing (TSS)

TSS的目的是不依赖于对单一主体(秘密持有者)的信任，将信任分散化灵活化，以降低秘密滥用和泄露的风险，同时加强秘密的强健容错性。通常采用的是t-out-of-n门限，即一个秘密由n个持有人分享，他们中的任意t个可以恢复秘密，但少于t个持有人则掌握不了秘密的任何信息。The purpose of TSS is not to rely on the trust of a single subject (secret holder), to decentralize and flex the trust to reduce the risk of secret abuse and disclosure, and to strengthen the robust and fault-tolerant of secrets. The t-out-of-n threshold is usually adopted, that is, a secret is shared by n holders, and any t of them can recover the secret, but less than t holders will not be able to grasp any secret information.

6、任务6. Task

在本申请中是一个泛指的概念，计算机需要实现的事情都可以称之为任务，例如进程、线程、子线程、客户端应用(client application，CA)、可信应用(trusted application，TA)、某种服务等。In this application, it is a general concept. Everything that a computer needs to achieve can be called tasks, such as processes, threads, sub-threads, client applications (CA), and trusted applications (TA). , Some kind of service, etc.

下面结合图1，对适用于本申请实施例的***架构进行详细描述。The following describes in detail the system architecture applicable to the embodiment of the present application with reference to FIG. 1.

图1是适用于本申请实施例的一种可能的***架构示意图。FIG. 1 is a schematic diagram of a possible system architecture applicable to an embodiment of the present application.

如图1所示，硬件层的高级精简指令集计算机(advanced RISC machine，ARM)引入了安全扩展(security extension)，其将片上***(system on a chip)的硬件资源和软件资源划分为安全世界(secure world)和非安全世界(non-secure world)。As shown in Figure 1, the advanced RISC machine (ARM) at the hardware layer introduces a security extension, which divides the hardware resources and software resources of the system on a chip into a secure world (secure world) and non-secure world (non-secure world).

所有需要保密的操作在secure world(如指纹识别、密码处理、数据加解密、安全认证等)。其余操作在non-secure world执行(如用户操作***、各种应用程序等)。secure world和non-secure world之间通过一个名为监视器(monitor)的模块进行转换。All operations that require confidentiality are in the secure world (such as fingerprint identification, password processing, data encryption and decryption, security authentication, etc.). The rest of the operations are performed in the non-secure world (such as user operating systems, various applications, etc.). The conversion between secure world and non-secure world is carried out through a module called monitor.

当CPU运行在secure world的时候，它可以访问所有的硬件资源，但当CPU运行在normal world的时候，它只能访问normal world的资源。When the CPU is running in the secure world, it can access all hardware resources, but when the CPU is running in the normal world, it can only access the resources of the normal world.

可选地，non-secure world也可以称为正常模式(normal world)。Optionally, non-secure world may also be referred to as normal mode (normal world).

在non-secure world中，正常操作***(normal OS)可以包括但不限于：Linux，安卓(Android)，normal OS也可以称为丰富操作***(rich OS)。normal OS上运行的应用叫正常应用(normal applications，normal Apps)。In the non-secure world, the normal operating system (normal OS) may include but is not limited to: Linux, Android (Android), and the normal OS may also be called a rich operating system (rich OS). The applications running on normal OS are called normal applications (normal applications, normal Apps).

在secure world中，安全操作***(secure operating system，secure OS)可以包括但不限于：开源可移植可信执行环境操作***(open-source portable trusted execution environment OS，OP-TEE OS)等。secure world是一种可信执行环境TEE，该环境可以保证不被常规操作***干扰的计算，因此称为“可信”。TEE是一个与rich OS并行运行的独立执行环境，为rich OS环境提供安全服务。TEE独立于rich OS和其上的应用，来 访问硬件和软件安全资源。secure OS上运行的应用叫TA。In the secure world, a secure operating system (secure operating system, secure OS) may include, but is not limited to: an open-source portable trusted execution environment operating system (open-source portable trusted execution environment OS, OP-TEE OS), etc. Secure world is a trusted execution environment TEE, which can guarantee calculations that are not interfered by conventional operating systems, so it is called "trusted". TEE is an independent execution environment that runs in parallel with rich OS and provides security services for the rich OS environment. TEE is independent of rich OS and its applications to access hardware and software security resources. The application running on secure OS is called TA.

安全计算和可信计算的核心技术是数据隔离，即保护用户的数据不被其它实体(包括管理员等超级用户)所访问。虽然全密文计算也可以通过全流程全环境加密保护数据隐私，却有实现代价太高的弊端。所以数据隔离仍然是更广泛更实际的数据保护手段。The core technology of secure computing and trusted computing is data isolation, that is, protecting user data from being accessed by other entities (including superusers such as administrators). Although full ciphertext calculation can also protect data privacy through full-process and full-environment encryption, it has the disadvantage of being too expensive to implement. Therefore, data isolation is still a broader and more practical means of data protection.

在TEE中，为了避免不同的TA之间互相随意读取和访问数据，需要对内存中不同的TA数据进行加密。这样，一方面，为了实现对内存中不同的TA数据进行加密，需要多个软硬件协同完成，增加了实现的复杂性，降低了内存和CPU的利用率。另一方面，即使内存加密了，比如在SGX中，当数据被调入CPU参与计算的时候还是要先还原成明文，仍然有安全风险，因此，TEE的数据隔离不完全可靠，一旦隔离失败明文数据就泄露了。In TEE, in order to prevent different TAs from randomly reading and accessing data from each other, different TA data in the memory needs to be encrypted. In this way, on the one hand, in order to realize the encryption of different TA data in the memory, multiple software and hardware are required to complete the coordination, which increases the complexity of the implementation and reduces the utilization of the memory and the CPU. On the other hand, even if the memory is encrypted, such as in SGX, when the data is transferred to the CPU to participate in the calculation, it still needs to be restored to plaintext. There is still a security risk. Therefore, the data isolation of TEE is not completely reliable. Once the isolation fails, the plaintext The data is leaked.

有鉴于此，本申请提出了一种数据处理的方法，在TEE中进一步防止TA随意读取和访问其他TA的数据，在保证数据安全隔离的同时还可以降低实现的复杂度，提高内存和CPU的利用率。In view of this, this application proposes a data processing method to further prevent TAs from reading and accessing other TA's data at will in the TEE. While ensuring data security isolation, it can also reduce implementation complexity and improve memory and CPU. Utilization rate.

例如图1所示的***架构中，CPU在其他控制机制(例如，secure OS、hypervisor)的配合下，给予某个任务多TA支持。也就是说，secure OS上运行的多个TA(例如，TA1、TA2、TA3)为一个任务或一个用户进行分布式地计算。具体的，在CPU、secure OS，有时还有hypervisor的必要支持和配合下，由TEE中的多个TA分别实现上述多个子任务。如图1所示的架构，TEE中的多个TA分布式地运用各个数据片段的明文计算可以视作ARM security的一个功能扩展。For example, in the system architecture shown in FIG. 1, the CPU provides multi-TA support for a certain task with the cooperation of other control mechanisms (for example, secure OS, hypervisor). In other words, multiple TAs (for example, TA1, TA2, TA3) running on the secure OS perform distributed calculations for one task or one user. Specifically, with the necessary support and cooperation of the CPU, secure OS, and sometimes hypervisor, multiple TAs in the TEE respectively implement the multiple subtasks described above. In the architecture shown in Figure 1, multiple TAs in the TEE use the plaintext calculation of each data segment in a distributed manner, which can be regarded as a functional extension of ARM security.

本申请实施例提供的数据处理的方法可应用于计算设备，计算设备也可以被称为计算机***，包括硬件层、运行在硬件层之上的操作***层，以及运行在操作***层上的应用层。该硬件层包括处理单元、内存和内存控制单元等硬件，随后对该硬件的功能和结构进行详细说明。该操作***是任意一种或多种通过进程(process)实现业务处理的计算机操作***，例如，Linux操作***、Unix操作***、Android操作***、iOS操作***或windows操作***等。该应用层包含浏览器、通讯录、文字处理软件、即时通信软件等应用程序。并且，可选地，该计算机***是智能手机等手持设备，或个人计算机等终端设备，本申请并未特别限定，只要能够通过本申请实施例提供的方法即可。本申请实施例提供数据处理的方法的执行主体可以是计算机***，或者，是计算机***中能够调用程序并执行程序的功能模块。The data processing method provided in the embodiments of this application can be applied to computing devices, which can also be referred to as computer systems, including a hardware layer, an operating system layer running on the hardware layer, and applications running on the operating system layer Floor. The hardware layer includes hardware such as processing unit, memory, and memory control unit, and the function and structure of the hardware are described in detail later. The operating system is any one or more computer operating systems that implement business processing through processes, such as a Linux operating system, a Unix operating system, an Android operating system, an iOS operating system, or a windows operating system. The application layer includes applications such as browsers, address books, word processing software, and instant messaging software. In addition, optionally, the computer system is a handheld device such as a smart phone, or a terminal device such as a personal computer, which is not particularly limited in this application, as long as the method provided in the embodiment of the application can be used. The execution subject of the data processing method provided in the embodiments of the present application may be a computer system, or a functional module in the computer system that can call and execute the program.

下面结合图2，对本申请实施例提供的一种计算设备进行详细描述。The following describes in detail a computing device provided by an embodiment of the present application with reference to FIG. 2.

图2是本申请实施例提供的一种计算设备200的架构示意图。该计算设备200可以是服务器或者计算机或者其他具有计算能力的设备。图2所示的计算设备200包括：至少一个处理器110和内存120。FIG. 2 is a schematic diagram of the architecture of a computing device 200 provided by an embodiment of the present application. The computing device 200 may be a server or a computer or other devices with computing capabilities. The computing device 200 shown in FIG. 2 includes: at least one processor 110 and a memory 120.

处理器110执行内存120中的指令，使得计算设备200实现本申请提供的数据处理的方法，例如实现由TA执行的步骤。或者，处理器110执行内存120中的指令，使得计算设备200实现本申请提供的TA，例如实现TA包括的各功能模块。The processor 110 executes the instructions in the memory 120, so that the computing device 200 implements the data processing method provided in the present application, for example, implements the steps executed by the TA. Alternatively, the processor 110 executes instructions in the memory 120, so that the computing device 200 implements the TA provided in the present application, for example, implements various functional modules included in the TA.

可选地，计算设备200还包括***总线，其中，处理器110和内存120分别与***总线连接。处理器110能够通过***总线访问内存120，例如，处理器110能够通过***总线在内存120中进行数据读写或代码执行。该***总线是快捷外设部件互连标准(peripheral  component interconnect express，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。所述***总线分为地址总线、数据总线、控制总线等。为便于表示，图2中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。Optionally, the computing device 200 further includes a system bus, where the processor 110 and the memory 120 are respectively connected to the system bus. The processor 110 can access the memory 120 through the system bus. For example, the processor 110 can perform data reading and writing or code execution in the memory 120 through the system bus. The system bus is a peripheral component interconnect express (PCI) bus or an extended industry standard architecture (EISA) bus. The system bus is divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in FIG. 2, but it does not mean that there is only one bus or one type of bus.

一种可能的实现方式，处理器110的功能主要是解释计算机程序的指令(或者说，代码)以及处理计算机软件中的数据。其中，该计算机程序的指令以及计算机软件中的数据能够保存在内存120或者缓存116中。In a possible implementation manner, the function of the processor 110 is mainly to interpret instructions (or codes) of a computer program and process data in computer software. Wherein, the instructions of the computer program and the data in the computer software can be stored in the memory 120 or the cache 116.

可选地，处理器110可能是集成电路芯片，具有信号的处理能力。作为示例而非限定，处理器110是通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。其中，通用处理器是微处理器等。例如，该处理器110是中央处理单元(central processing unit，CPU)。Optionally, the processor 110 may be an integrated circuit chip with signal processing capability. As an example and not a limitation, the processor 110 is a general-purpose processor, a digital signal processor (digital signal processor, DSP), an application specific integrated circuit (ASIC), and a field programmable gate array (FPGA). ) Or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. Among them, general-purpose processors are microprocessors and so on. For example, the processor 110 is a central processing unit (central processing unit, CPU).

可选地，每个处理器110包括至少一个处理单元112和内存控制单元114。Optionally, each processor 110 includes at least one processing unit 112 and a memory control unit 114.

可选地，处理单元112也称为核心(core)或内核，是处理器最重要的组成部分。处理单元112是由单晶硅以一定的生产工艺制造出来的，处理器所有的计算、接受命令、存储命令、处理数据都由核心执行。处理单元分别独立地运行程序指令，利用并行计算的能力加快程序的运行速度。各种处理单元都具有固定的逻辑结构，例如，处理单元包括例如，一级缓存、二级缓存、执行单元、指令级单元和总线接口等逻辑单元。Optionally, the processing unit 112 is also called a core (core) or a core, which is the most important component of the processor. The processing unit 112 is manufactured by monocrystalline silicon with a certain production process, and all calculations, receiving commands, storing commands, and processing data of the processor are executed by the core. The processing units run program instructions independently, and use parallel computing capabilities to speed up the program's running speed. Various processing units have a fixed logical structure. For example, the processing unit includes, for example, logic units such as a first-level cache, a second-level cache, an execution unit, an instruction-level unit, and a bus interface.

一种实现举例，内存控制单元114用于控制内存120与处理单元112之间的数据交互。具体地说，内存控制单元114从处理单元112接收内存访问请求，并基于该内存访问请求控制针对内存的访问。作为示例而非限定，内存控制单元是内存管理单元(memory management unit，MMU)等器件。In an implementation example, the memory control unit 114 is used to control data interaction between the memory 120 and the processing unit 112. Specifically, the memory control unit 114 receives a memory access request from the processing unit 112, and controls access to the memory based on the memory access request. As an example and not a limitation, the memory control unit is a device such as a memory management unit (MMU).

一种实现举例，各内存控制单元114通过***总线进行针对内存120的寻址。并且在***总线中配置仲裁器(图中未示出)，该仲裁器负责处理和协调多个处理单元112的竞争访问。In an implementation example, each memory control unit 114 performs addressing for the memory 120 through a system bus. In addition, an arbiter (not shown in the figure) is configured in the system bus, and the arbiter is responsible for processing and coordinating the competing access of multiple processing units 112.

一种实现举例，处理单元112和内存控制单元114通过芯片内部的连接线，例如地址线，通信连接，从而实现处理单元112和内存控制单元114之间的通信。In an implementation example, the processing unit 112 and the memory control unit 114 are connected through a communication connection within the chip, such as an address line, so as to realize the communication between the processing unit 112 and the memory control unit 114.

可选地，每个处理器110还包括缓存116，其中，缓存是数据交换的缓冲区(称作cache)。当处理单元112要读取数据时，会首先从缓存中查找需要的数据，如果找到了则直接执行，找不到的话则从内存中找。由于缓存的运行速度比内存快得多，故缓存的作用就是帮助处理单元112更快地运行。Optionally, each processor 110 further includes a cache 116, where the cache is a buffer for data exchange (referred to as a cache). When the processing unit 112 wants to read data, it will first find the required data in the cache, if it finds it, execute it directly, and if it cannot find it, it will find it from the memory. Since the running speed of the cache is much faster than that of the memory, the function of the cache is to help the processing unit 112 run faster.

内存(memory)120能够为计算设备100中的进程提供运行空间，例如，内存120中保存用于生成进程的计算机程序(具体地说，是程序的代码)。计算机程序被处理器运行而生成进程后，处理器在内存120中为该进程分配对应的存储空间。进一步的，上述存储空间进一步包括文本段、初始化数据段、位初始化数据段、栈段、堆段等等。内存120在上述进程对应的存储空间中保存进程运行期间产生的数据，例如，中间数据，或过程数据等等。The memory (memory) 120 can provide a running space for the process in the computing device 100. For example, the memory 120 stores a computer program (specifically, the code of the program) for generating the process. After the computer program is run by the processor to generate a process, the processor allocates a corresponding storage space for the process in the memory 120. Further, the aforementioned storage space further includes a text segment, an initialization data segment, a bit initialization data segment, a stack segment, a heap segment, and so on. The memory 120 stores data generated during the running of the process, such as intermediate data, or process data, in the storage space corresponding to the above process.

可选地，内存也称为内存储器，其作用是用于暂时存放处理器110中的运算数据，以及与硬盘等外部存储器交换的数据。只要计算机在运行中，处理器110就会把需要运 算的数据调到内存中进行运算，当运算完成后处理单元112再将结果传送出来。Optionally, the memory is also referred to as internal memory, and its function is to temporarily store operational data in the processor 110 and data exchanged with an external memory such as a hard disk. As long as the computer is running, the processor 110 transfers the data that needs to be calculated into the memory for calculation, and the processing unit 112 transmits the result after the calculation is completed.

作为示例而非限定，内存120是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的***和方法的内存120旨在包括但不限于这些和任意其它适合类型的存储器。By way of example and not limitation, the memory 120 is a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, non-volatile memory is read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electrically erasable Except for programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory is random access memory (RAM), which is used as an external cache. By way of exemplary but not restrictive description, many forms of RAM are available, such as static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), and synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) ) And direct memory bus random access memory (direct rambus RAM, DR RAM). It should be noted that the memory 120 of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

以上列举的计算设备200的结构仅为示例性说明，本申请并未限定于此，本申请实施例的计算设备200包括现有技术中计算机***中的各种硬件，例如，计算设备200还包括除内存120以外的其他存储器，例如，磁盘存储器等。本领域的技术人员应当理解，计算设备200还可以包括实现正常运行所必须的其他器件。同时，根据具体需要，本领域的技术人员应当理解，上述计算设备200还可包括实现其他附加功能的硬件器件。此外，本领域的技术人员应当理解，上述计算设备200也可仅仅包括实现本申请实施例所必须的器件，而不必包括图2中所示的全部器件。The structure of the computing device 200 listed above is only an exemplary description, and the present application is not limited thereto. The computing device 200 of the embodiment of the present application includes various hardware in a computer system in the prior art. For example, the computing device 200 also includes Other storage than the memory 120, for example, a magnetic disk storage and the like. Those skilled in the art should understand that the computing device 200 may also include other devices necessary for normal operation. At the same time, according to specific needs, those skilled in the art should understand that the foregoing computing device 200 may also include hardware devices that implement other additional functions. In addition, those skilled in the art should understand that the foregoing computing device 200 may also only include the components necessary to implement the embodiments of the present application, and not necessarily include all the components shown in FIG. 2.

下面结合图3，对本申请实施例提供的数据处理的方法进行详细的介绍。该方法可以由图2所示的计算设备200执行，以实现本申请提供的数据处理的方法，例如实现由TA以及客户端执行的步骤。The data processing method provided by the embodiment of the present application will be described in detail below with reference to FIG. 3. The method may be executed by the computing device 200 shown in FIG. 2 to implement the data processing method provided in this application, for example, to implement the steps executed by the TA and the client.

图3是本申请实施例提供的一种数据处理的方法的示意性流程图。如图3所示，该方法可以包括步骤310-330，下面分别对步骤310-330进行详细描述。FIG. 3 is a schematic flowchart of a data processing method provided by an embodiment of the present application. As shown in Fig. 3, the method may include steps 310-330, and steps 310-330 will be described in detail below.

步骤310：可信执行环境TEE中的多个可信应用TA分别从客户端获取第一用户的多个数据片段。Step 310: The multiple trusted applications TA in the trusted execution environment TEE respectively obtain multiple data fragments of the first user from the client.

TEE中运行的多个TA可以分别从客户端获取第一用户的多个数据片段，该多个数据片段可以组成所述第一用户的数据。Multiple TAs running in the TEE may obtain multiple data fragments of the first user from the client, and the multiple data fragments may constitute the data of the first user.

作为示例，客户端可以第一用户的数据拆分成随机的多个数据片段，并分别传输给所述TEE中运行的多个TA。As an example, the client may split the data of the first user into multiple random data fragments, and respectively transmit to multiple TAs running in the TEE.

一种可能的实现中，该多个TA可以分别通过加密通道从客户端处获取各自的密文，并分别对各自的密文解密，得到各自的数据片段。In a possible implementation, the multiple TAs may obtain respective ciphertexts from the client through an encrypted channel, and decrypt the respective ciphertexts to obtain respective data fragments.

步骤320：多个TA中的每个TA对各自获取的数据片段做处理，得到各自的结果。Step 320: Each TA of the plurality of TAs processes the data fragments respectively acquired to obtain respective results.

多个TA中的每个TA可以在从客户端获取到各自的数据片段后，分别对各自的数据片段做处理，并分别得到各自的处理结果。Each TA of the multiple TAs can process respective data fragments after obtaining respective data fragments from the client, and obtain respective processing results respectively.

可选地，每个TA对各自的数据片段做处理的过程也可以理解为每个TA执行各自的计算任务，并分别得到计算结果。Optionally, the process in which each TA processes its own data fragments can also be understood as each TA executes its own calculation task and obtains the calculation results respectively.

多个TA中的每个TA所执行的计算任务可以相同，或者也可以不同，本申请对此不 做具体限定。The calculation tasks performed by each TA of the multiple TAs may be the same or different, which is not specifically limited in this application.

上述TA执行的计算任务可以有多种，本申请不做具体限定。下面列举两个例子来说明TA执行计算任务的具体实现过程。There may be multiple calculation tasks performed by the TA, which is not specifically limited in this application. Here are two examples to illustrate the specific implementation process of TA's computing tasks.

一个示例，假设用户的数据为一个密钥，要用该密钥去解密数据。如果该密钥丢失的话，不仅破坏本次的秘密计算，还会影响到过去和以后用同样密钥加密的数据。因此，可以将该密钥分成多个随机片段，它们的和是一个完整的密钥。每个TA拿到一个随机片段后，根据该随机片段做一部分的解密，并分别得到各自的解密结果。最后各自的解密结果汇集到一起可以得到解密后的明文。As an example, suppose that the user's data is a key, and the key is used to decrypt the data. If the key is lost, it will not only destroy the secret calculation this time, but also affect the data encrypted with the same key in the past and in the future. Therefore, the key can be divided into multiple random segments, and their sum is a complete key. After each TA gets a random segment, it decrypts part of it according to the random segment, and obtains their respective decryption results. Finally, the decrypted results can be gathered together to get the decrypted plaintext.

另一个示例，在金融服务中，一个用户缴纳一个电子货币作为押金。该电子货币不能随便让人看到并把它拿走，但是还需要验证它是一个真实有效的货币。可以假设用户的一个数据为该电子货币，并可以将该电子货币拆分成多个随机片段，它们的和是一个完整的电子货。每个TA拿到一个随机片段后，根据该随机片段做一部分的验证，并分别得到各自的验证结果。最后各自的验证结果汇集到一起可以判断该电子货币的有效性。必要时，该多个TA还可以共同恢复电子货币用于支付罚款等。Another example, in financial services, a user pays an electronic currency as a deposit. The electronic currency cannot be seen and taken away casually, but it is also necessary to verify that it is a real and valid currency. It can be assumed that a piece of data of the user is the electronic currency, and the electronic currency can be split into multiple random fragments, and their sum is a complete electronic currency. After each TA gets a random segment, it performs a part of verification based on the random segment, and obtains their respective verification results. Finally, the respective verification results can be gathered together to determine the validity of the electronic currency. When necessary, the multiple TAs can also jointly restore electronic money for payment of fines and the like.

步骤330：多个TA分别反馈各自的结果。Step 330: multiple TAs feed back their respective results.

多个TA在得到各自的结果后，可以分别反馈各自的结果。其中，多个TA反馈的结果可以用于确定第一用户的数据对应的结果。作为示例，可以对多个TA反馈的结果进行拼凑，得到所述第一用户的数据对应的结果。下面会结合具体的例子进行说明，此处暂不详述。After multiple TAs get their respective results, they can feed back their respective results. Among them, the feedback results of multiple TAs can be used to determine the result corresponding to the data of the first user. As an example, the feedback results of multiple TAs may be pieced together to obtain the result corresponding to the data of the first user. The following will be combined with specific examples for description, and will not be described in detail here.

多个TA分别反馈各自的结果的具体实现方式有多种，下面对两种可能的实现方式进行详细描述。There are many specific implementation ways for multiple TAs to feed back their respective results. Two possible implementation ways are described in detail below.

一种可能的实现方式中，所述多个TA可以分别将各自的加密的结果，通过加密通道反馈给客户端。客户端可以对多个TA各自的加密的结果进行解密后，得到多个TA各自的结果，并基于该多个TA各自的结果确定第一用户的数据对应的结果。In a possible implementation manner, the multiple TAs may respectively feed back their encryption results to the client through an encryption channel. The client may decrypt the respective encrypted results of the multiple TAs to obtain the respective results of the multiple TAs, and determine the result corresponding to the data of the first user based on the respective results of the multiple TAs.

另一种可能的实现方式中，所述多个TA可以分别将各自的结果反馈给第一TA，并由第一TA根据多个TA反馈的结果确定第一用户的数据对应的结果。In another possible implementation manner, the multiple TAs may respectively feed back their respective results to the first TA, and the first TA determines the result corresponding to the data of the first user according to the feedback results of the multiple TAs.

在这种实现方式中，在多个TA包括第一TA时，多个TA中除了第一TA的其它TA将各自的结果通过TEE通道反馈给第一TA，第一TA可以通过本地获取其自己的结果。In this implementation, when the multiple TAs include the first TA, the TAs other than the first TA among the multiple TAs feed back their results to the first TA through the TEE channel, and the first TA can obtain itself locally the result of.

上述技术方案中，用户将自己的任务数据随机分成多个片段，并分别主动分享给多个TA，在TEE环境下运行这些多个TA。该多个TA分布式的计算后，将它们各自的结果进行反馈，以便于根据它们各自的计算结果拼合成自己的数据对应的结果。攻击者即使攻破了TEE的保护窃取了一个TA在内存中的数据，也只是获取到了用户的任务数据的其中一个随机片段，而无法获取用户的任务数据。这样，一方面，通过在TEE中处理碎片化的明文数据，在某个TA的内存暴露后仍然可以保护内存中的数据，简洁高效的同时还可以加强隐私保护的效果。另一方面，多个TA进行分布式的计算还可以提高计算效率。In the above technical solution, the user randomly divides his task data into multiple segments, and actively shares them with multiple TAs respectively, and runs these multiple TAs in a TEE environment. After the multiple TAs are calculated in a distributed manner, their respective results are fed back, so as to combine their own data corresponding results according to their respective calculation results. Even if the attacker breached the protection of the TEE and stole the data of a TA in the memory, he would only obtain a random fragment of the user's task data, and could not obtain the user's task data. In this way, on the one hand, by processing fragmented plaintext data in the TEE, the data in the memory can still be protected after the memory of a certain TA is exposed, which is concise and efficient, and can also enhance the effect of privacy protection. On the other hand, the distributed calculation of multiple TAs can also improve the calculation efficiency.

下面结合图4中具体的例子，对数据处理的方法的一种具体实现方式进行描述。应理解，图4的例子仅仅是为了帮助本领域技术人员理解本申请实施例，而非要将申请实施例限制于图4的具体数值或具体场景。本领域技术人员根据所给出的例子，显然可以 进行各种等价的修改或变化，这样的修改和变化也落入本申请实施例的范围内。The following describes a specific implementation of the data processing method with reference to the specific example in FIG. 4. It should be understood that the example of FIG. 4 is only to help those skilled in the art understand the embodiment of the present application, and is not intended to limit the embodiment of the application to the specific values or specific scenarios in FIG. 4. Those skilled in the art can obviously make various equivalent modifications or changes based on the examples given, and such modifications and changes also fall within the scope of the embodiments of the present application.

图4是本申请实施例提供的另一种数据处理的方法的示意性流程图。如图4所示，该方法可以包括步骤410-430，下面分别对步骤410-430进行详细描述。FIG. 4 is a schematic flowchart of another data processing method provided by an embodiment of the present application. As shown in Fig. 4, the method may include steps 410-430, and steps 410-430 will be described in detail below.

步骤410：用户通过客户端将自己的一个数据分成多份，并分别分给每个TA一个数据片段。Step 410: The user divides one piece of data into multiple pieces through the client, and divides one piece of data into each TA respectively.

假设某用户需要计算一个复杂函数f(x)，其中x是一个长度较大的输入而f()计算量很大。该用户算力不足，需要借助外部算力，同时要保护自己的私密数据x。Suppose a user needs to calculate a complex function f(x), where x is a long input and f() has a large amount of calculation. The user has insufficient computing power and needs to rely on external computing power while protecting his private data x.

可选地，用户的秘密数据也可以理解为用户的数据或一个任务的数据。Optionally, the user's secret data can also be understood as the user's data or the data of a task.

用户可以通过客户端将自己的一个数据随机分成多个数据片段，并通过加密通道将加密的数据片段通过其控制的TA传输至TEE环境。Users can randomly divide their own data into multiple data fragments through the client, and transmit the encrypted data fragments to the TEE environment through the TA controlled by the encrypted channel.

一种实现方式，以图5为例。用户可以通过客户端将每一个数据拆分为多个随机的数据片段，并通过加密通道传输至TEE中的多个TA。例如图5中，用户可以通过客户端将一个数据拆分为随机的3个数据片段，并分别通过密通道传输至TEE中的TA1、TA2、TA3。One way to achieve this is to take Figure 5 as an example. The user can split each piece of data into multiple random pieces of data through the client, and transmit them to multiple TAs in the TEE through an encrypted channel. For example, in Figure 5, a user can split a piece of data into three random data segments through the client, and transmit them to TA1, TA2, and TA3 in the TEE respectively through a dense channel.

用户的数据可以是存储在硬盘上，或者是存储在云服务器上，该数据的数据在导入TEE环境之前，其安全性不能得到保障。因此，用户在通过客户端将数据从硬盘上或者云服务器上导入TEE环境之前，需要对该数据进行加密。The user's data can be stored on the hard disk or on the cloud server. The security of the data cannot be guaranteed before it is imported into the TEE environment. Therefore, the user needs to encrypt the data before importing the data from the hard disk or the cloud server into the TEE environment through the client.

各个TA在计算过程中可能会和用户或其他TA之间进行信息或计算结果的交互，为了避免不必要的TA之间的通信或用户干预，最优选的数据拆分方案是各个TA收到数据片段后不需要彼此交换信息就能计算出各自的结果。During the calculation process, each TA may interact with users or other TAs for information or calculation results. In order to avoid unnecessary communication between TAs or user intervention, the most preferred data splitting scheme is that each TA receives data After the fragments, the results can be calculated without exchanging information with each other.

同时，为了数据的安全，拆分出的数据片段具有随机性，每个单独片段***露原始数据的任何信息。比如，私密数据x通过选择随机数x1拆分成x＝x1+x2，或x＝x1*x2。作为示例，可以根据SMC的方法进行数据的拆分，具体的请参考上文中对SMC的描述，此处暂不详述。At the same time, for data security, the split data fragments are random, and each individual fragment does not leak any information of the original data. For example, the private data x is split into x=x1+x2, or x=x1*x2 by selecting a random number x1. As an example, data can be split according to the SMC method. For details, please refer to the description of SMC above, which will not be detailed here.

步骤420：每个TA获得数据片段后分布式地完成计算任务。Step 420: After each TA obtains the data segment, it completes the calculation task in a distributed manner.

每个TA可以各自从客户端获得一份加密的数据片段，在TEE内各个TA在数据片段解密后，分时占用CPU分布式地完成各自的计算任务，得到中间计算结果。在数据导入TEE环境之后，由于TEE环境可以实现对数据的保护，因此，在TEE环境中不需要对数据片段进行加密。Each TA can obtain an encrypted data segment from the client. After the data segment is decrypted in the TEE, each TA takes up the CPU to complete their respective calculation tasks in a distributed manner and obtain intermediate calculation results. After the data is imported into the TEE environment, since the TEE environment can protect the data, there is no need to encrypt data fragments in the TEE environment.

一种实现方式，以三个TA为例。在步骤410中，用户通过客户端将私密数据x随机拆分为x1、x2、x3，将三个对应的分布式计算函数f1(x1)、f2(x2)、f3(x3)。并将三个对应的分布式计算函数分别实例化为TA1、TA2、TA3。也就是说，将TA1、TA2、TA3可以根据输入信息x1、x2、x3分布式地实现f1(x1)、f2(x2)、f3(x3)的计算任务。One way to achieve this is to take three TAs as an example. In step 410, the user randomly splits the private data x into x1, x2, and x3 through the client, and divides the three corresponding distributed calculation functions f1(x1), f2(x2), f3(x3). The three corresponding distributed computing functions are instantiated as TA1, TA2, and TA3 respectively. In other words, TA1, TA2, and TA3 can realize the calculation tasks of f1(x1), f2(x2), and f3(x3) in a distributed manner according to the input information x1, x2, and x3.

基于多方计算的算法分解和数据拆分技术支持，一个计算任务在软件上就已经被拆分为多个子任务。在CPU、操作***(operating system，OS)、有时还有超级监督者(hypervisor)的必要支持与配合下，由TEE中的多个TA分别实现上述多个子任务。这样，就可以依赖TEE对程序可靠性和数据隐私隔离的支持进行安全计算。Based on the algorithm decomposition and data splitting technical support of multi-party computing, a computing task has been split into multiple sub-tasks in the software. With the necessary support and cooperation of a CPU, an operating system (OS), and sometimes a hypervisor (hypervisor), multiple TAs in the TEE respectively implement the multiple subtasks described above. In this way, it is possible to rely on TEE's support for program reliability and data privacy isolation for secure calculations.

步骤430：根据TEE中的各个TA的中间计算结果得到最终计算结果。Step 430: Obtain the final calculation result according to the intermediate calculation results of each TA in the TEE.

TEE中的各个TA可以根据各自得到的数据片段计算得到中间计算结果f1(x1)、f2(x2)、f3(x3)，并可以根据多个中间计算结果得到最终计算结果。具体的实现方式有多种，下面对几种可能的实现方式进行详细描述。Each TA in the TEE can calculate intermediate calculation results f1(x1), f2(x2), f3(x3) according to the data fragments obtained separately, and can obtain the final calculation result according to multiple intermediate calculation results. There are many specific implementations, and several possible implementations are described in detail below.

一种可能的实现方式中，参见图6，每一个TA对得到的中间计算结果加密后，通过加密通道将加密的中间计算结果反馈给用户的客户端，并由用户的客户端对多个中间计算结果解密后综合得出最终计算结果。作为一个示例，用户的客户端通过一个简单的拼合函数F()得到最终计算结果f(x)。例如，最终计算结果f(x)＝F(f1(x1)，f2(x2)，f3(x3))。In a possible implementation manner, referring to Figure 6, after each TA encrypts the obtained intermediate calculation result, the encrypted intermediate calculation result is fed back to the user's client through the encryption channel, and the user's client performs multiple intermediate calculation results. After decrypting the calculation result, the final calculation result can be synthesized. As an example, the user's client terminal obtains the final calculation result f(x) through a simple flattening function F(). For example, the final calculation result f(x)=F(f1(x1), f2(x2), f3(x3)).

另一种可能的实现方式中，如果用户客户端的计算功能或安全性能有限，也可以在TEE中专门设立一个TA，并通过该TA完成上述用户的任务，根据多个中间计算结果综合得出最终计算结果。具体的，其他的TA(例如，TA1、TA2、TA3)可以将得到的中间计算结果f1(x1)、f2(x2)、f3(x3)通过TEE内部通道传输至TA，并由该TA根据中间计算结果得出最终计算结果f(x)。作为一个示例，该TA通过一个简单的拼合函数F()得到最终计算结果f(x)。例如，最终计算结果f(x)＝F(f1(x1)，f2(x2)，f3(x3))。In another possible implementation, if the computing function or security performance of the user client is limited, a TA can also be specially set up in the TEE, and the task of the user can be completed through the TA, and the final result can be obtained based on multiple intermediate calculation results. Calculation results. Specifically, other TAs (for example, TA1, TA2, TA3) can transmit the obtained intermediate calculation results f1(x1), f2(x2), and f3(x3) to the TA through the TEE internal channel, and the TA will use the intermediate calculation results The calculation result gives the final calculation result f(x). As an example, the TA obtains the final calculation result f(x) through a simple flattening function F(). For example, the final calculation result f(x)=F(f1(x1), f2(x2), f3(x3)).

可选地，在一些实施例中，各个TA在分布式地计算过程中，需要与用户或者其他TA进行信息交互或交换。当各个TA之间的通信(例如，交换必要的中间计算结果)过多的时候，它们可能时常需要挂起等待用户(或他控制的信息交换TA)在各个TA间收集和传送中间计算结果。这时，为了避免无谓的挂起等待，可以考虑在时间轴上将各TA进一步拆分为几个轮次的子TA，它们在轮间通过用户的中心控制交互信息。Optionally, in some embodiments, each TA needs to interact or exchange information with users or other TAs during the distributed computing process. When there are too many communications between TAs (for example, the exchange of necessary intermediate calculation results), they may often need to hang up and wait for the user (or the information exchange TA controlled by him) to collect and transmit the intermediate calculation results between the TAs. At this time, in order to avoid needless waiting, you can consider to further split each TA into several rounds of sub-TAs on the time axis, and they control the interactive information through the user's center between rounds.

作为示例，参见图7，可以将每个TA拆分为3个子TA。例如，TA1拆分为TA1-1、TA1-2、TA1-3；TA2拆分为TA2-1、TA2-2、TA2-3；TA3拆分为TA3-1、TA3-2、TA3-3。每个子TA之间可以通过TEE的内部通道进行通信(例如，交换必要的中间计算结果)。这样，以TA2为例，如果TA2需要获取TA1的中间计算结果，并根据TA1的中间计算结果计算TA2的中间计算结果。如果TA1-1已经得到了TA1的中间计算结果，此时，TA2可以直接从TA1-1处获取TA1的中间计算结果，而不需要等待TA1全部执行完之后再获取TA1的中间计算结果，避免了无谓的挂起等待。As an example, referring to Figure 7, each TA can be split into 3 sub-TAs. For example, TA1 is split into TA1-1, TA1-2, TA1-3; TA2 is split into TA2-1, TA2-2, TA2-3; TA3 is split into TA3-1, TA3-2, TA3-3. Each sub-TA can communicate through the internal channel of the TEE (for example, exchange necessary intermediate calculation results). In this way, taking TA2 as an example, if TA2 needs to obtain the intermediate calculation result of TA1, and calculate the intermediate calculation result of TA2 according to the intermediate calculation result of TA1. If TA1-1 has already obtained the intermediate calculation result of TA1, at this time, TA2 can directly obtain the intermediate calculation result of TA1 from TA1-1, instead of waiting for TA1 to be executed before obtaining the intermediate calculation result of TA1, which avoids Needless to hang up and wait.

可选地，在一些实施例中，如果因为TEE失效造成一个用户的所有TA内存都被攻破，该用户的所有数据片段就都泄露了。为了进行多种保护，增加安全韧性，可以增加混淆机制，计算设备中的OS可以打散多个TA的标识(identification，ID)。在用户的所有数据片段都泄露之后，攻击者无法判断哪些TA属于同一用户，这样，也就无法利用它们的数据片段去恢复原始数据。Optionally, in some embodiments, if all TA memories of a user are compromised due to TEE failure, all data fragments of the user are leaked. In order to perform multiple protections and increase security resilience, an obfuscation mechanism can be added, and the OS in the computing device can break up multiple TA identifications (IDs). After all the user's data fragments are leaked, the attacker cannot determine which TAs belong to the same user, so they cannot use their data fragments to restore the original data.

一种可能的实现方式中，OS可以改变执行一个用户的数据任务的多个TA的标识(identification，ID)，使得旁观者(例如其它TA的所有者)获取到一个用户的所有TA在内存中的数据后，根据改变后多个TA的ID，无法去恢复原始数据。In a possible implementation, the OS can change the identification (ID) of multiple TAs that perform a user's data task, so that bystanders (such as owners of other TAs) can obtain all TAs of a user in memory After the data is changed, it is impossible to restore the original data according to the IDs of multiple TAs after the change.

另一种可能的实现方式中，OS可以同时改变多个用户的多个TA的ID。作为一个示例，OS可以打散多个用户的多个TA的ID，使得旁观者(例如其它TA的所有者)获取到一个用户的所有TA在内存中的数据后，根据改变后多个TA的ID，无法去拼凑出一个用户的原始数据。In another possible implementation manner, the OS can change the IDs of multiple TAs of multiple users at the same time. As an example, the OS can break up the IDs of multiple TAs of multiple users, so that bystanders (such as the owners of other TAs) obtain the data of all TAs of a user in the memory, according to the changed multiple TA IDs. ID, it is impossible to piece together the original data of a user.

假设有三个用户，用户1、用户2，每个用户通过四个TA进行分布式地对各自获取的数据片段做处理。其中，用户1对应的TA分别为TA1、TA2、TA3、TA4，其TA的标识分别为1、2、3、4；用户2对应的TA分别为TA5、TA6、TA7、TA8，其TA的标识分别为5、6、7、8。用户1和用户2的八个TA的ID依次为：1，2，3，4，5，6，7，8。OS可以重置上述TA1-TA6对应的标识，并保存改变后的TA的标识和改变前的TA的标识之间的对应关系。例如，将用户1和用户2的八个TA的ID改变为：1，4，5，7，2，3，6，8。Suppose there are three users, user 1 and user 2, and each user uses four TAs to process the data fragments obtained by each user in a distributed manner. Among them, the TAs corresponding to user 1 are TA1, TA2, TA3, TA4, and their TA identifiers are 1, 2, 3, and 4 respectively; the TAs corresponding to user 2 are TA5, TA6, TA7, TA8, and their TA identifiers They are 5, 6, 7, and 8. The IDs of the eight TAs of user 1 and user 2 are: 1, 2, 3, 4, 5, 6, 7, 8. The OS can reset the identifiers corresponding to the above TA1-TA6, and save the corresponding relationship between the identifier of the TA after the change and the identifier of the TA before the change. For example, change the IDs of the eight TAs of user 1 and user 2 to: 1, 4, 5, 7, 2, 3, 6, 8.

这样，旁观者(例如其它TA的所有者)即使获得了一个用户的所有TA的数据片段，也无法根据这些数据片段去恢复出原始数据。例如，旁观者获得了用户1的TA1、TA2、TA3、TA4在内存中的数据，而TA1、TA2、TA3、TA4的ID分别为：1，4，5，7，旁观者无法根据ID分别为：1，4，5，7的多个TA是属于一个用户的，也就无法利用他们的数据片段去恢复出原始的数据。In this way, even if a bystander (such as the owner of another TA) obtains all TA data fragments of a user, he cannot recover the original data based on these data fragments. For example, the bystander obtains the data in the memory of TA1, TA2, TA3, and TA4 of user 1, and the IDs of TA1, TA2, TA3, and TA4 are 1, 4, 5, and 7, respectively. : Multiple TAs of 1, 4, 5, 7 belong to one user, so they cannot use their data fragments to recover the original data.

在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。In the various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not correspond to the implementation process of the embodiments of the present application. Constitute any limitation.

上文结合图1至图7，详细描述了数据处理的方法，下面将结合图8，详细描述本申请的装置实施例。The data processing method is described in detail above in conjunction with Figs. 1 to 7, and the device embodiment of the present application will be described in detail below in conjunction with Fig. 8.

图8是本申请实施例提供的TA 800的示意性框图。FIG. 8 is a schematic block diagram of a TA 800 provided by an embodiment of the present application.

TA 800能够执行图3至图4所示的数据处理的方法中TA所执行的各个步骤，为了避免重复，此处不再详述。TA 800包括：获取模块810，处理模块820，反馈模块830，The TA 800 can execute the steps performed by the TA in the data processing methods shown in FIG. 3 to FIG. 4. In order to avoid repetition, details are not described herein again. TA 800 includes: acquisition module 810, processing module 820, feedback module 830,

获取模块810，用于获取第一用户的多个数据片段中的一个数据片段，所述多个数据片段组成所述第一用户的数据；The acquiring module 810 is configured to acquire one data segment of a plurality of data segments of the first user, and the multiple data segments constitute data of the first user;

处理模块820，用于对获取的一个数据片段做处理，得到结果；The processing module 820 is configured to process a piece of acquired data to obtain a result;

反馈模块830，用于反馈结果，所述结果用于确定所述第一用户的数据对应的结果。The feedback module 830 is configured to feed back a result, and the result is used to determine a result corresponding to the data of the first user.

可选地，所述获取模块810具体用于：通过加密通道获取密文；Optionally, the obtaining module 810 is specifically configured to: obtain the ciphertext through an encrypted channel;

所述处理模块还用于：对密文解密，得到该一个数据片段。The processing module is also used to: decrypt the ciphertext to obtain the data segment.

可选地，所述反馈模块830具体用于：将加密的结果通过加密通道反馈给所述客户端。Optionally, the feedback module 830 is specifically configured to feed back the encryption result to the client through an encryption channel.

可选地，所述反馈模块830具体用于：将结果反馈给第一TA，所述第一TA用于根据多个TA反馈的结果确定所述第一用户的数据对应的结果。Optionally, the feedback module 830 is specifically configured to feed back a result to a first TA, and the first TA is configured to determine a result corresponding to the data of the first user according to the feedback results of multiple TAs.

这里的TA 800可以以功能模块的形式体现。这里的术语“模块”可以通过软件和/或硬件形式实现，对此不作具体限定。The TA 800 here can be embodied in the form of a functional module. The term "module" herein can be implemented in the form of software and/or hardware, which is not specifically limited.

例如，“模块”可以是实现上述功能的软件程序、硬件电路或二者结合。所述硬件电路可能包括应用特有集成电路(application specific integrated circuit，ASIC)、电子电路、用于执行一个或多个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器等)和存储器、合并逻辑电路和/或其它支持所描述的功能的合适组件。For example, a "module" can be a software program, a hardware circuit, or a combination of the two that realizes the above-mentioned functions. The hardware circuit may include an application specific integrated circuit (ASIC), an electronic circuit, and a processor for executing one or more software or firmware programs (such as a shared processor, a dedicated processor, or a group processor). Etc.) and memory, merged logic circuits and/or other suitable components that support the described functions.

因此，在本申请的实施例中描述的各示例的单元，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来 实现所描述的功能，但是这种实现不应认为超出本申请的范围。Therefore, the units of the examples described in the embodiments of the present application can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

本申请实施例还提供一种芯片，该芯片获取指令并执行该指令来实现上述数据处理的方法，或者该指令用于实现上述的TA。The embodiment of the present application also provides a chip that obtains an instruction and executes the instruction to implement the above-mentioned data processing method, or the instruction is used to implement the above-mentioned TA.

可选地，作为一种实现方式，该芯片包括处理器与数据接口，该处理器通过该数据接口读取存储器上存储的指令，执行上述数据处理的方法。Optionally, as an implementation manner, the chip includes a processor and a data interface, and the processor reads instructions stored on the memory through the data interface, and executes the above-mentioned data processing method.

可选地，作为一种实现方式，该芯片还可以包括存储器，该存储器中存储有指令，该处理器用于执行该存储器上存储的指令，当该指令被执行时，该处理器用于执行上述数据处理的方法。Optionally, as an implementation manner, the chip may further include a memory in which instructions are stored, and the processor is configured to execute the instructions stored in the memory, and when the instructions are executed, the processor is configured to execute the aforementioned data Processing method.

本申请实施例还提供一种计算机可读存储介质，该计算机可读存储介质存储有指令，该指令用于上述方法实施例中的数据处理的方法，或者该指令用于实现上述的TA。An embodiment of the present application also provides a computer-readable storage medium that stores an instruction that is used in the data processing method in the foregoing method embodiment, or the instruction is used to implement the foregoing TA.

本申请实施例还提供一种包含指令的计算机程序产品，该指令用于实现上述方法实施例中的数据处理的方法，或者该指令用于实现上述的TA。The embodiments of the present application also provide a computer program product containing instructions, the instructions are used to implement the data processing method in the foregoing method embodiments, or the instructions are used to implement the foregoing TA.

一种实现举例，处理器可以为中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。For an implementation example, the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processors, DSP), and application specific integrated circuits (application specific integrated circuits). circuit, ASIC), ready-made programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.

一种实现举例，存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的随机存取存储器(random access memory，RAM)可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。As an implementation example, the memory may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electrically available Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory. The volatile memory may be random access memory (RAM), which is used as an external cache. By way of exemplary but not restrictive description, many forms of random access memory (RAM) are available, such as static random access memory (static RAM, SRAM), dynamic random access memory (DRAM), and synchronous dynamic random access memory (DRAM). Access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory Take memory (synchlink DRAM, SLDRAM) and direct memory bus random access memory (direct rambus RAM, DR RAM).

本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系，但也可能表示的是一种“和/或”的关系，具体可参考前后文进行理解。The term "and/or" in this article is only an association relationship describing the associated objects, which means that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, exist alone In the three cases of B, A and B can be singular or plural. In addition, the character "/" in this text generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and/or" relationship, which can be understood with reference to the context.

本申请中，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。In this application, "plurality" means two or more. "The following at least one item (a)" or similar expressions refers to any combination of these items, including any combination of a single item (a) or a plurality of items (a). For example, at least one item (a) of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .

在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。In the various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not correspond to the implementation process of the embodiments of the present application. Constitute any limitation.

所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的***、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。Those skilled in the art can clearly understand that, for the convenience and conciseness of description, the specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of the present application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computing device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disks or optical disks and other media that can store program codes. .

以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application. Should be covered within the scope of protection of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims (23)

1. 一种数据处理的方法，其特征在于，包括：A method of data processing, characterized in that it comprises:

   可信执行环境TEE中的多个可信应用TA分别获取第一用户的多个数据片段，所述多个数据片段组成所述第一用户的数据；The multiple trusted applications TA in the trusted execution environment TEE respectively acquire multiple data fragments of the first user, and the multiple data fragments constitute data of the first user;

   所述多个TA中的每个TA对各自获取的数据片段做处理，得到各自的结果；Each TA of the plurality of TAs processes the data fragments respectively obtained to obtain respective results;

   所述多个TA分别反馈各自的结果，所述多个TA反馈的结果用于确定所述第一用户的数据对应的结果。The multiple TAs respectively feed back their respective results, and the feedback results of the multiple TAs are used to determine a result corresponding to the data of the first user.
2. 根据权利要求1所述的方法，其特征在于，所述可信执行环境TEE中的多个可信应用TA分别获取到多个数据片段，包括：The method according to claim 1, wherein the multiple trusted applications TA in the trusted execution environment TEE respectively acquiring multiple data fragments, comprising:

   所述多个TA分别通过加密通道获取各自的密文；The multiple TAs obtain their respective ciphertexts through encrypted channels;

   所述多个TA分别对各自的密文解密，得到各自的数据片段。The multiple TAs respectively decrypt respective ciphertexts to obtain respective data fragments.
3. 根据权利要求1或2所述的方法，其特征在于，所述多个TA分别反馈各自的结果，包括：The method according to claim 1 or 2, wherein the multiple TAs respectively feeding back their respective results, comprising:

   所述多个TA分别将各自的加密的结果，通过加密通道反馈给所述第一用户的客户端。The multiple TAs respectively feed back their encryption results to the client of the first user through an encryption channel.
4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述多个TA分别反馈所述多个结果，包括：The method according to any one of claims 1 to 3, wherein the multiple TAs respectively feeding back the multiple results, comprising:

   所述多个TA分别将各自的结果反馈给第一TA；The multiple TAs respectively feed back their respective results to the first TA;

   所述第一TA根据所述多个TA反馈的结果确定所述第一用户的数据对应的结果。The first TA determines a result corresponding to the data of the first user according to the feedback results of the multiple TAs.
5. 根据权利要求4所述的方法，其特征在于，所述多个TA分别将各自的结果通过TEE通道反馈给第一TA，包括：The method according to claim 4, wherein the multiple TAs respectively feeding back their respective results to the first TA through a TEE channel, comprising:

   在所述多个TA包括所述第一TA时，所述多个TA中除了所述第一TA的其它TA将各自的结果通过TEE通道反馈给第一TA。When the multiple TAs include the first TA, other TAs in the multiple TAs except for the first TA feed back their results to the first TA through the TEE channel.
6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述方法还包括：The method according to any one of claims 1 to 5, wherein the method further comprises:

   改变所述多个TA的标识ID。Change the identification IDs of the multiple TAs.
7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：The method according to claim 6, wherein the method further comprises:

   同时改变用于处理所述第一用户的多个数据片段的所述多个TA的标识ID和用于处理第二用户的多个数据片段的多个TA的标识ID。The identification IDs of the plurality of TAs used to process the plurality of data fragments of the first user and the identification IDs of the plurality of TAs used to process the plurality of data fragments of the second user are changed at the same time.
8. 一种数据处理的***，其特征在于，包括：客户端和可信执行环境TEE中的多个可信应用TA，A data processing system, which is characterized by comprising: a client and multiple trusted applications TA in a trusted execution environment TEE,

   所述多个TA分别从所述客户端获取所述第一用户的多个数据片段，所述多个数据片段组成所述第一用户的数据；The multiple TAs obtain multiple data fragments of the first user from the client respectively, and the multiple data fragments constitute data of the first user;

   所述多个TA中的每个TA对各自获取的数据片段做处理，得到各自的结果；Each TA of the plurality of TAs processes the data fragments respectively obtained to obtain respective results;

   所述多个TA分别反馈各自的结果，所述多个TA反馈的结果用于确定所述第一用户的数据对应的结果。The multiple TAs respectively feed back their respective results, and the feedback results of the multiple TAs are used to determine a result corresponding to the data of the first user.
9. 根据权利要求8所述的***，其特征在于，所述多个TA具体用于：The system according to claim 8, wherein the multiple TAs are specifically used for:

   分别通过加密通道从所述客户端获取各自的密文；Obtaining respective ciphertexts from the client through encrypted channels;

   分别对各自的密文解密，得到各自的数据片段。Decrypt their respective ciphertexts to obtain their respective data fragments.
10. 根据权利要求8或9所述的***，其特征在于，所述多个TA具体用于：The system according to claim 8 or 9, wherein the multiple TAs are specifically used for:

    分别将各自的加密的结果，通过加密通道反馈给所述客户端；Feedback the respective encryption results to the client through the encryption channel;

    所述客户端具体用于：根据解密后所述多个TA各自的结果确定所述第一用户的数据对应的结果。The client is specifically configured to determine a result corresponding to the data of the first user according to the respective results of the multiple TAs after decryption.
11. 根据权利要求8至10中任一项所述的***，其特征在于，所述多个TA具体用于：分别将各自的结果反馈给第一TA；The system according to any one of claims 8 to 10, wherein the multiple TAs are specifically used for: respectively feeding back respective results to the first TA;

    所述第一TA用于根据所述多个TA反馈的结果确定所述第一用户的数据对应的结果。The first TA is used to determine a result corresponding to the data of the first user according to the feedback results of the multiple TAs.
12. 根据权利要求11所述的***，其特征在于，在所述多个TA包括所述第一TA时，所述多个TA中除了所述第一TA的其它TA将各自的结果通过TEE通道反馈给第一TA。The system according to claim 11, wherein when the plurality of TAs include the first TA, other TAs of the plurality of TAs except for the first TA feed back their results through the TEE channel Give the first TA.
13. 根据权利要求8至12中任一项所述的***，其特征在于，所述***还包括：The system according to any one of claims 8 to 12, wherein the system further comprises:

    操作***，用于改变所述多个TA的标识ID。The operating system is used to change the identification IDs of the multiple TAs.
14. 根据权利要求13所述的***，其特征在于，所述操作***还用于：The system according to claim 13, wherein the operating system is also used for:

    同时改变用于处理所述第一用户的多个数据片段的所述多个TA的标识ID和用于处理第二用户的多个数据片段的多个TA的标识ID。The identification IDs of the plurality of TAs used to process the plurality of data fragments of the first user and the identification IDs of the plurality of TAs used to process the plurality of data fragments of the second user are changed at the same time.
15. 根据权利要求8至14中任一项所述的***，其特征在于，所述客户端还用于将所述第一用户的数据拆分成所述多个数据片段。The system according to any one of claims 8 to 14, wherein the client terminal is further configured to split the data of the first user into the multiple data fragments.
16. 一种可信应用TA，其特征在于，所述TA为可信执行环境TEE中的多个可信应用TA中的一个，所述TA包括：A trusted application TA, characterized in that, the TA is one of multiple trusted application TAs in a trusted execution environment TEE, and the TA includes:

    获取模块，用于获取第一用户的多个数据片段中的一个数据片段，所述多个数据片段组成所述第一用户的数据；An obtaining module, configured to obtain one data fragment among a plurality of data fragments of a first user, and the plurality of data fragments constitute data of the first user;

    处理模块，用于对获取的所述一个数据片段做处理，得到结果；The processing module is used to process the one piece of acquired data to obtain a result;

    反馈模块，用于反馈所述结果，所述结果用于确定所述第一用户的数据对应的结果。The feedback module is used to feed back the result, and the result is used to determine the result corresponding to the data of the first user.
17. 根据权利要求16所述的TA，其特征在于，所述获取模块具体用于：The TA according to claim 16, wherein the acquiring module is specifically configured to:

    通过加密通道获取密文；Obtain ciphertext through encrypted channel;

    所述处理模块还用于：对所述密文解密，得到所述一个数据片段。The processing module is also used to: decrypt the ciphertext to obtain the one data segment.
18. 根据权利要求16或17所述的TA，其特征在于，所述反馈模块具体用于：The TA according to claim 16 or 17, wherein the feedback module is specifically configured to:

    将加密的所述结果通过加密通道反馈给所述第一用户的客户端。The encrypted result is fed back to the client of the first user through an encrypted channel.
19. 根据权利要求16至18中任一项所述的TA，其特征在于，所述反馈模块具体用于：The TA according to any one of claims 16 to 18, wherein the feedback module is specifically configured to:

    将所述结果反馈给第一TA，所述第一TA用于根据多个TA反馈的结果确定所述第一用户的数据对应的结果。The result is fed back to the first TA, and the first TA is used to determine a result corresponding to the data of the first user according to the feedback results of multiple TAs.
20. 一种计算设备，其特征在于，包括处理器和存储器；所述处理器运行所述存储器中的指令，使得所述计算设备执行如权利要求1至7中任一项所述的方法。A computing device, characterized by comprising a processor and a memory; the processor runs the instructions in the memory, so that the computing device executes the method according to any one of claims 1 to 7.
21. 一种计算设备，其特征在于，包括处理器和存储器；所述处理器运行所述存储器中的指令，使得所述计算设备部署权利要求16至19中任一项所述的TA。A computing device, comprising a processor and a memory; the processor runs the instructions in the memory, so that the computing device deploys the TA according to any one of claims 16 to 19.
22. 一种计算机可读存储介质，其特征在于，包括指令；所述指令用于实现如权利要求1至7中任一项所述的方法。A computer-readable storage medium, characterized by comprising instructions; the instructions are used to implement the method according to any one of claims 1 to 7.
23. 一种计算机可读存储介质，其特征在于，包括指令；所述指令用于实现如权利要求16至19中任一项所述的TA。A computer-readable storage medium, characterized by comprising instructions; the instructions are used to implement the TA according to any one of claims 16 to 19.

Images