Patent ID: 11870904
Assignee: NANHU LABORATORY
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC H

Claim 0:
1. A method for encrypting and decrypting data across domains based on privacy computing, comprising:
S1) deploying, by a data provider, a base key (User_Base_Key) for a user host (Host_User) in a trusted environment in advance, and sealing the base key (User_Base_Key) to a user locally based on trusted sealing technology;
S2) selecting, by the data provider, data (Data_i), and randomly generating a data key (Data_Key_i) corresponding to the data (Data_i) in the trusted environment, wherein the data (Data_i) is encrypted based on the data key (Data_Key_i) to generate encrypted data (Data_Enc_i);
S3) inputting the data key (Data_Key_i) to a key management application (App_Key} running on the data provider, wherein the key management application (App_Key) obtains a data token (User_Data_Token_) based on the data key (Data_Key_i) and the base key (User_Base_Key} by an exclusive OR operation or an encryption operation;
S4) transmitting the data token (User_Data_Token_i) and the encrypted data (Data_Enc_i) to the user;
S5) starting, by the user host (Host_User), a privacy computing-based data user application (App_user}, and loading the base key (User_Base_Key) in a privacy computing security zone based on the trusted sealing technology;
S6) obtaining, by the data user application (App_user), the data key (Data_Key_i) based on the base key (User Base_Key} and the data token (User_Data_Token_i) through an exclusive OR operation or a decryption operation;
S7) decrypting the encrypted data (Data_Enc_i) using the data key (Data_Key_i) to obtain the data (Data_i), computing a result (Result_i) based on the data (Data_i),outputting the result (Result_i), destroying the data (Data_i) and the data key (Data_Key_i) in the trusted environment, and exiting the privacy computing security zone;
wherein, in S1, when the user host (Host_User) is located outside a range of the data provider in a deployment stage, the deploying the base key (User_Base_Key) for the user host (Host_User) comprises:
B1) confirming, by a provider host (Host_Provider), the user host (Host_User);
B2) starting, by the provider host (Host_Provider), a privacy computing-based key management application (App_Key) in advance or at this time, and randomly generating in the trusted environment the base key (User_Base_Key) corresponding to the user host (Host_User) confirmed in B1;
B3) starting, by the user host (Host_User), the privacy computing-based data user application (App_user), and establishing a trusted connection to a privacy computing trusted environment of the privacy computing-based key management application (App_Key) on the provider host (Host_Provider) based on a privacy computing remote authentication mechanism;
B4) sending, by the provider host (Host_Provider), the base key (User_Base_Key) to a privacy computing trusted environment of the data user application (App_user) on the user host (Host_User) based on the trusted connection in B3;
B5) sealing, by the privacy computing trusted environment of the data user application (App_user}, the base key (User_Base_Key) locally based on the trusted sealing technology.