Abstract: This application provides a trusted computing-based local key escrow method, apparatus, device and medium. The method includes: determining an executable file associated with an untrusted environment and a dynamic link file associated with a trusted environment in response to acquiring an enclave interface definition file from a local internal memory; determining an environment access interface based on a container identifier indicated by the trusted environment in response to loading the dynamic link file based on the executable file; reading sealed data file obtained by encrypting serialized data based on a local key in the untrusted environment in response to accessing an enclave container in the trusted environment through the environment access interface; and decrypting the sealed data file using the local key and deserializing the decrypted sealed data file in the enclave container to obtain service data for loading into a trusted internal memory indicated by the enclave container.

Abstract: Improved accuracy of data encryption can be achieved with dynamic expansion according to the traffic volume of a user. A processing server transmits a key identifier to a hardware security module server which obtains a root key corresponding to the key identifier and encrypts the root key to generate a master key. The master key is encrypted to generate a data key, and the to-be-encrypted data is encrypted using the data key to generate encrypted data. The processing server can accurately and effectively encrypt data, improving the accuracy of data encryption and the security of data processing.