A method for zero-trust fusion computation of multi-party data, comprising:
- upon receiving a fusion computation request, starting up a fusion computation background in a trusted execution environment (TEE) and loading the fusion computation background into an encrypted memory;
- verifying, in the TEE, a unique metric value hash1 of the fusion computation background, in response to the unique metric value hash1 being consistent with a unique metric value hash1 obtained by verification and measurement of the fusion computation background and storage thereof at a deployment stage, starting running a program and acquiring a key key1 derived by the TEE and uniquely bound to the fusion computation background, and in response to the unique metric value hash1 being inconsistent with a unique metric value hash1 obtained by verification and measurement of the fusion computation background and storage thereof at a deployment stage, reporting an error and quitting;
- determining whether the fusion computation background has a self-signed certificate, in response to a determination that the fusion computation background does not have a self-signed certificate, generating a self-signed certificate comprising a root certificate CA1, a back-end server certificate, and a back-end server private key using a self-signed certificate generating tool of the fusion computation background, and encrypting and saving the back-end server private key using the key key1;
- in response to a determination that the fusion computation background has a self-signed certificate, decrypting and loading an encrypted and saved back-end server private key based on the key key1, in response to the decrypting being successful, continuing to run the program, and in response to the decrypting being unsuccessful, determining that the loading an encrypted and saved back-end server private key fails;
- enabling, by the fusion computation background, an Https interface service based on the self-signed certificate for a front-end web service to invoke;
- receiving, by the fusion computation background, in the TEE, database configuration information, and encrypting and saving the database configuration information by the key key1 of the TEE;
- and
- performing a decrypting process, comprising:
- when a start running interface is invoked, decrypting, by the fusion computation background, in the TEE, the corresponding database configuration information and loading the database configuration information into the encrypted memory, establishing a secure link with all parties' databases based on the database configuration information, pulling corresponding data into the encrypted memory for fusion computation according to a data fusion computation logic of the fusion computation background, and returning a result to one or more parties requesting a fusion result after completion of the fusion calculation.