Trusted execution within a distributed computing system

The method according to claim2, wherein the message comprising the job code key encrypted using the symmetric job key further comprises the input data key encrypted using the symmetric job key, and the method further comprises:

• receiving input data encrypted using the input data key;
• decrypting, within the secure sub-system, the input data using the input data key;
• and
• executing the job code on the decrypted input data to generate results data.

A distributed computing system comprising:

• a plurality of input computation nodes wherein each input computation node comprises a secure sub-system arranged to receive encrypted chunks of input data, each chunk comprising an identifier for the chunk, to perform an internal check for duplicate chunks and process the input data to generate intermediate data, and to output encrypted intermediate data and summary data to one or more intermediate computation nodes;
• a plurality of intermediate computation nodes wherein each intermediate computation node comprises a secure sub-system arranged to receive encrypted intermediate data and summaries from one or more input computation nodes, to perform an internal check for duplicate or missing intermediate data and process the intermediate data to generate output data;
• and
• at least one of:
• receiving, at a machine, in response to successful verification of an attestation by a client, a message comprising a job code key encrypted using a symmetric job key, the attestation comprising the symmetric job key generated within the secure sub-system of a first input or intermediate computation node encrypted using a public key of a user, the machine further arranged to decrypt the job code key within the secure sub-system using the symmetric job key and decrypt the job code using the job code key;
• or
• receiving, at the machine, input data from each of multiple users encrypted using an input data key for the user;
• decrypting, within the secure sub-system, the input data using the input data keys for each user;
• executing the job code on the decrypted input data to generate results data;
• and sending at least a subset of the results data to the client associated with each of the users.

A distributed computing system comprising a plurality of machines, each machine comprising:

• a first secure sub-system that is protected from the rest of the machine and is arranged to process input data using job code;
• one or more further secure sub-systems that are protected from the rest of the machine and are arranged to store a key provisioned by a manufacturer of the machine and a key provisioned by an operator of the system;
• wherein the machine is arranged to receive code comprising a public key of a user, loader code and job code from a client, wherein the loader code is unencrypted and the job code is encrypted using a job code key generated by the client and to load at least the loader code into the first secure sub-system;
• the first secure sub-system is arranged to generate an attestation for the client based on the received code and using keys stored in the one or more further secure sub-systems, the attestation confirming an identity of the machine, integrity of the job code and an attribute of the distributed computing system or part thereof;
• and
• at least one of:
• the machine further arranged to receive, in response to successful verification of the attestation by a client, a message comprising the job code key encrypted using a symmetric job key, the attestation comprising the symmetric job key generated within the first secure sub-system encrypted using the public key of the user, the machine further arranged to decrypt the job code key within the secure sub-system using the symmetric job key and decrypt the job code using the job code key;
• or
• receiving, at the machine, input data from each of multiple users encrypted using an input data key for the user;
• decrypting, within the secure sub-system, the input data using the input data keys for each user;
• executing the job code on the decrypted input data to generate results data;
• and sending at least a subset of the results data to the client associated with each of the users.