Method and system for data security based on quantum communication and trusted computing

A server computer, comprising:

• a processor;
• and
• a storage device coupled to the processor and storing instructions which when executed by the processor cause the processor to perform a method for ensuring data and computation security, wherein the method comprises:
• selecting, by the server computer from of a plurality of trusted control nodes forming a trusted authorization center, a subset of trusted control nodes;
• transmitting, by the server computer, to each selected trusted control node a service request, wherein the service request includes a first certificate that is bound to a first trusted-computing module associated with the server computer;
• receiving, by the server computer from each selected trusted control node a response comprising a second certificate that is bound to a second trusted-computing module associated with the selected trusted control node, thereby facilitating a mutual authentication between the server computer and each selected trusted control node;
• receiving, by the server computer from each selected trusted control node, a subkey, wherein the subkey is generated by the selected trusted control node based on:
• a share of a private key associated with the trusted authorization center, an identity of the server computer, a unique identifier of the first trusted-computing module associated the server computer, and platform configuration register (PCR) values of the first trusted-computing module associated with the server computer;
• and
• generating a server-specific private key based on a set of subkeys received from the selected subset of trusted control nodes of the trusted authorization center.

A computer-implemented method for receiving a trusted certificate, comprising:

• sending, by an entity in a cloud computing environment, a certificate request to a trusted authorization center, wherein the trusted authorization center comprises a set of trusted control nodes that share, using a secret-sharing scheme, a private key associated with the cloud computing environment, wherein each trusted control node is configured to store a share of the private key in a first trusted-computing module associated with the trusted control node, and wherein sending the certificate request comprises selecting a subset of trusted control nodes from the set of trusted control nodes and transmitting a service request to each selected trusted control node, wherein the service request includes a first certificate that is bound to a second trusted-computing module associated with the entity;
• receiving, by the entity from each selected trusted control node, a response comprising a second certificate that is bound to the first trusted-computing module associated with the selected trusted control node, thereby facilitating a mutual authentication between the entity and each selected trusted control node;
• receiving, from each selected trusted control node, a subkey, wherein the subkey is generated by the trusted control node based on:
• identity information associated with the entity, a unique identifier of the second trusted-computing module associated with the entity, platform configuration register (PCR) values of the second trusted-computing module, and the share of the private key stored in the first trusted-computing module;
• generating an entity-specific private key based on a set of subkeys received from the selected subset of trusted control nodes of the trusted authorization center;
• and
• deriving a trusted certificate from the entity-specific private key.