Method and apparatus for establishing trusted channel between user and trusted computing cluster

A method for re-establishing a trusted channel between a user and a trusted computing cluster, the trusted computing cluster having established a first trusted channel with the user, the first trusted channel having a first session key to encrypt transmitted data, the trusted computing cluster including a plurality of trusted computing units each maintaining a first cluster key, a first session identifier corresponding to the first trusted channel, the method comprising:

• at a first trusted computing unit of the plurality of trusted computing units:
• obtaining, through negotiation with the user, a second session key for the first trusted channel, the second session key configured to replace the first session key of the first trusted channel to encrypt transmitted data;
• encrypting the second session key using the first cluster key to obtain a second encrypted key;
• and
• sending a notification to a cluster manager, the notification including the second encrypted key and the first session identifier for the cluster manager to transfer the second encrypted key to a second trusted computing unit related to the first session identifier.

A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium storing computer executable instructions, which when executed by one or more processors, configure the one or more processors to perform acts including:

• at a first trusted computing unit of a trusted computing cluster, the trusted computing cluster including a plurality of trusted computing units each maintaining a first cluster key:
• obtaining a first session key through negotiation with a user, and establishing a first trusted channel with the user, the first session key configured to encrypt data to be transmitted through the first trusted channel;
• encrypting the first session key using the first cluster key to obtain a first encrypted key;
• and
• sending a first notification to a cluster manager, the first notification including the first encrypted key for the cluster manager to transfer the first encrypted key to a second trusted computing unit in the trusted computing cluster.

A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium storing computer executable instructions, which when executed by one or more processors, configure the one or more processors to perform acts including:

• at a first trusted computing unit of a trusted computing cluster, the trusted computing cluster including a plurality of trusted computing units each maintaining a first cluster key, the trusted computing cluster having established a first trusted channel with a user, the first trusted channel having a first session key to encrypt transmitted data, a first session identifier corresponding to the first trusted channel:
• obtaining, through negotiation with the user, a second session key for the first trusted channel, the second session key configured to replace the first session key of the first trusted channel to encrypt transmitted data;
• encrypting the second session key using the first cluster key to obtain a second encrypted key;
• and
• sending a notification to a cluster manager, the notification including the second encrypted key and the first session identifier for the cluster manager to transfer the second encrypted key to a second trusted computing unit related to the first session identifier.