Introduction
Overview
In alignment with the National Data Bureau's (NDB) initiatives to accelerate the construction of trusted data spaces, three core features have been developed through telecom joint innovation to empower ecosystem partner expansion. Typically, data with medium and low security requirements is managed through usage control solutions, while high-security data relies on privacy-preserving computation. Currently, existing usage control solutions lack robust capabilities. To deliver a more competitive solution, it is essential to leverage Kunpeng's hardware capabilities to enhance both the performance and security of usage control within trusted hardware and confidential computing environments. To address these needs, the Kunpeng Data Control Library (KDCL) leverages Kunpeng trusted hardware and confidential environments to provide trusted identity, trusted environment, trusted time, trusted status, and trusted logging capabilities. This builds hardware-level trust for both connectors and platforms, ensuring that policy enforcement is evidence-based and non-bypassable.
Architecture Description
KDCL provides the shared library kdc_proxy and the trusted attribute process kdc_agent. The interaction workflow for the connector to obtain trusted attributes based on Kunpeng hardware protection is as follows.
- Trusted attribute request (C API call): connector (implemented by the customer) → kdc_proxy
- Request forwarding (HTTPS request): kdc_proxy → kdc_agent
- Task execution (service processing): kdc_agent processes the request.
- Result reporting (HTTPS response): kdc_agent → kdc_proxy
- Result return (function return): kdc_proxy → connector (implemented by the customer)