Abstract: Embodiments of this specification provide multi-party data query methods and apparatuses for data privacy protection. One implementation of the methods includes obtaining, from each of a plurality of data owners, attribute value ciphertexts of N target objects to form a ciphertext table, disordering the ciphertext table in units of rows to obtain a disordered table, sorting, in response to a query instruction of querying sorting-related data for a target attribute item in the plurality of attribute items, attribute value ciphertexts corresponding to the target attribute item in the disordered table to obtain a target sorted table, and obtaining the sorting-related data as a query result based on the target sorted table.

Abstract: Computer-implemented methods, apparatuses and systems for obtaining data authorization are described. In an example method, a first computing node in a trusted computing center receives an authentication request from a first provider. Authentication information is returned to the first provider, where the authentication information comprises a first code hash of a first computing logic running in the first computing node. A channel establishment request sent by the first provider is received after determining that the first computing node passes trusted authentication and the first code hash passes correctness verification. A first trusted channel is established between the first provider and the first computing node according to the channel establishment request. A target encryption key is received through the first trusted channel, thereby authorization to perform computation on a target encrypted shard corresponding to the target encryption key based on the first computing logic is obtained.

Abstract: Embodiments of this specification provide methods and apparatuses for data privacy protection. An embodiment of the methods comprises receiving, by a first party from a second party, an encrypted integrated vector, determining an encrypted result vector based on the original matrix and the encrypted integrated vector, determining a data processing result based on the encrypted result vector, and sending the data processing result to the second party for the second party to obtain a multiplication calculation result of the original matrix and the n original vectors based on the data processing result.

Abstract: A key management method includes: sending, by a security chip of a computer device, a request for obtaining a service key to a key management service; receiving, by the security chip, a service key ciphertext from the key management service, wherein the service key ciphertext is obtained by encrypting the service key by the key management service based on a migration key of the security chip; decrypting, by the security chip, the service key ciphertext based on the migration key to obtain the service key; storing, by the security chip, the service key in the security chip; and providing, by the security chip, the service key to an application program of the computer device when the application program needs to encrypt data based on the service key.

Abstract: A trusted computing method applicable in a computer device, a computer device, and a storage medium are provided. The method comprises: during a startup process of the computer device including first and second trusted computing chips, the first trusted computing chip performing a static measurement on the computer device to obtain a static measurement result, and sending the static measurement result to a verification center; and during operations of the computer device after startup of the computer device, the second trusted computing chip performing a dynamic measurement on the computer device to obtain a dynamic measurement result, and sending the dynamic measurement result and association evidence to the verification center, wherein the association evidence indicates that the first and the second trusted computing chips are disposed in the same computer device, and the verification center associates the two measurement results and verifies the integrity of a software system of the computer device.

Abstract: A key management method includes: sending, by a security chip of a computer device, a request for obtaining a service key to a key management service; receiving, by the security chip, a service key ciphertext from the key management service, wherein the service key ciphertext is obtained by encrypting the service key by the key management service based on a migration key of the security chip; decrypting, by the security chip, the service key ciphertext based on the migration key to obtain the service key; storing, by the security chip, the service key in the security chip; and providing, by the security chip, the service key to an application program of the computer device when the application program needs to encrypt data based on the service key.

Abstract: A trusted computing method applicable in a computer device, a computer device, and a storage medium are provided. The method comprises: during a startup process of the computer device including first and second trusted computing chips, the first trusted computing chip performing a static measurement on the computer device to obtain a static measurement result, and sending the static measurement result to a verification center; and during operations of the computer device after startup of the computer device, the second trusted computing chip performing a dynamic measurement on the computer device to obtain a dynamic measurement result, and sending the dynamic measurement result and association evidence to the verification center, wherein the association evidence indicates that the first and the second trusted computing chips are disposed in the same computer device, and the verification center associates the two measurement results and verifies the integrity of a software system of the computer device.

Abstract: A computer-implemented method includes: verifying, by a trusted server, an identity of a first terminal; determining that the verification is a success; based on determining that the verification is a success, determining, using a remote attestation protocol, that the first terminal is in a trusted state; and based on determining that the first terminal is in the trusted state, issuing a digital certificate including a trusted identifier to the first terminal, in which the digital certificate is usable by a second terminal to verify the identity of the first terminal.

Abstract: A computer-implemented method includes: verifying, by a trusted server, an identity of a first terminal; determining that the verification is a success; based on determining that the verification is a success, determining, using a remote attestation protocol, that the first terminal is in a trusted state; and based on determining that the first terminal is in the trusted state, issuing a digital certificate including a trusted identifier to the first terminal, in which the digital certificate is usable by a second terminal to verify the identity of the first terminal.

Abstract: A system and method for providing cryptographic operation service in a virtualization environment. In the system, a configuration subsystem provides an interface for an administrator and a common user to input information about a virtual cryptographic device. A key file storage subsystem stores a key file and protects it with the protection password. A virtual machine operating subsystem obtains a corresponding key file from the storage subsystem according to the input of the configuration subsystem, creates a virtual device for a guest virtual machine, and finally operates the guest virtual machine to provide cryptographic computing service for the guest virtual machine. Thus the administrator/the common user can specify a key file and input a protection password for a guest virtual machine via the corresponding interface to facilitate the creation of a virtual cryptographic device, and can manage the virtual cryptographic device in a user-friendly and centralized manner.

Abstract: A system and method for providing cryptographic operation service in a virtualization environment. In the system, a configuration subsystem provides an interface for an administrator and a common user to input information about a virtual cryptographic device. A key file storage subsystem stores a key file and protects it with the protection password. A virtual machine operating subsystem obtains a corresponding key file from the storage subsystem according to the input of the configuration subsystem, creates a virtual device for a guest virtual machine, and finally operates the guest virtual machine to provide cryptographic computing service for the guest virtual machine. Thus the administrator/the common user can specify a key file and input a protection password for a guest virtual machine via the corresponding interface to facilitate the creation of a virtual cryptographic device, and can manage the virtual cryptographic device in a user-friendly and centralized manner.

Abstract: The present invention discloses a method and a system for protecting root CA certificates in a virtualization environment. The method installs a root CA certificate security manager on a host computer. The root CA certificate security manager stores the lists of root CA certificates and provides certificate validation service to virtual machines via a read-only interface. When a virtual machine needs the verification of a certificate, it sends a certificate validation service request to the root CA security manager. The root CA certificate security manager provides certificate validation services to the virtual machine in response to the request.

Abstract: The present invention discloses a method and a system for protecting root CA certificates in a virtualization environment. The method installs a root CA certificate security manager on a host computer. The root CA certificate security manager stores the lists of root CA certificates and provides certificate validation service to virtual machines via a read-only interface. When a virtual machine needs the verification of a certificate, it sends a certificate validation service request to the root CA security manager. The root CA certificate security manager provides certificate validation services to the virtual machine in response to the request.