A trusted hardware-based data management method, comprising: obtaining, by trusted hardware, data description information to be published, wherein the data description information is used to describe target data of a data owner that can be provided by a trusted institution, and the trusted hardware has a binding relationship with a decentralized identifier of the data owner, wherein the trusted hardware stores a private key of the data owner, and wherein a public key corresponding to the private key is stored in the decentralized identifier of the data owner; requesting the trusted institution to verify whether the trusted institution stores user service data needed for generating the target data; receiving a verification result fed back by the trusted institution, wherein the trusted institution determines an identity of the data owner based on the decentralized identifier of the data owner and performs signature verification on the data description information signed by using the public key corresponding to the private key stored in the decentralized identifier of the data owner; and publishing the data description information if the verification result indicates that the trusted institution stores the user service data needed for generating the target data, wherein the obtaining comprises: obtaining, by the trusted hardware, the user service data of the data owner from the trusted institution by using an interface predefined in code in a trusted execution environment; processing the user service data by using a target trusted application comprised in the trusted hardware, to obtain the target data; and generating the data description information to be published for the target data, wherein the target trusted application is comprised in the trusted execution environment of the trusted hardware, and the trusted execution environment is isolated from an operating system of the trusted hardware. obtaining, by trusted hardware, data description information to be published, wherein the data description information is used to describe target data of a data owner that can be provided by a trusted institution, and the trusted hardware has a binding relationship with a decentralized identifier of the data owner, wherein the trusted hardware stores a private key of the data owner, and wherein a public key corresponding to the private key is stored in the decentralized identifier of the data owner; requesting the trusted institution to verify whether the trusted institution stores user service data needed for generating the target data; receiving a verification result fed back by the trusted institution, wherein the trusted institution determines an identity of the data owner based on the decentralized identifier of the data owner and performs signature verification on the data description information signed by using the public key corresponding to the private key stored in the decentralized identifier of the data owner; and publishing the data description information if the verification result indicates that the trusted institution stores the user service data needed for generating the target data, wherein the obtaining comprises: obtaining, by the trusted hardware, the user service data of the data owner from the trusted institution by using an interface predefined in code in a trusted execution environment; processing the user service data by using a target trusted application comprised in the trusted hardware, to obtain the target data; and generating the data description information to be published for the target data, wherein the target trusted application is comprised in the trusted execution environment of the trusted hardware, and the trusted execution environment is isolated from an operating system of the trusted hardware. obtaining, by the trusted hardware, the user service data of the data owner from the trusted institution by using an interface predefined in code in a trusted execution environment; processing the user service data by using a target trusted application comprised in the trusted hardware, to obtain the target data; and generating the data description information to be published for the target data, wherein the target trusted application is comprised in the trusted execution environment of the trusted hardware, and the trusted execution environment is isolated from an operating system of the trusted hardware.