Privacy-safe edge computing for secure operation authorization

Abstract

Embodiments of the present disclosure relate to privacy-secure edge region computing for security operation authorization. A system includes: a security controller, positioned in a central region, communicating with a provisioned agent operating on an edge region device. The security controller can implement controller-blind security control on edge region devices by making security authorization determinations using a security operation confidence analysis performed by the provisioned agent. The provisioned agent operating in the edge region can access unpurified data that may not be available to the security controller in the central region. The security controller can provide conditional descriptors via a security operation confidence allocation matrix. Using the conditional descriptors, the provisioned agent determines feedback based on the unpurified data that is blind to the security controller, and the feedback may include a security operation confidence coefficient.

Description

[0001] priority

[0002] This application claims priority to U.S. Provisional Patent Application No. 62 / 910,079, filed on October 3, 2019, with attorney docket number 15718-652, entitled “Digital Identity Edge Computing,” which is incorporated herein in its entirety. Technical Field

[0003] The present disclosure relates to edge region computing. Background Art

[0004] The rapid development of electronic and communication technologies, driven by overwhelming customer demand, has led to the widespread adoption of electronic transactions, record keeping, and data sharing. As an example, electronically stored and tracked identity information has provided the foundation for big data technologies and enterprises. Improvements in tracking and / or knowledge management attached to such electronically stored and tracked identity information will continue to increase the features and options available to operators involved in data operations. Summary of the invention

[0005] According to some embodiments, a system is provided, comprising: a network interface circuit device, configured to establish a sanitized uplink between an agent supplied by a privacy-safe edge region and a security controller supplied by a central region, the sanitized uplink being configured to prevent upstream transmission of unsanitized data; and a security control circuit device, configured to perform controller blind security operation (SO) control of edge region devices by: providing an SO confidence allocation matrix from the security controller to the supplied agent, the SO confidence allocation matrix including a plurality of condition descriptors configured to support SO confidence analysis based on unsanitized data, the security controller being blind to the unsanitized data; in response to: the supplied agent performing a predetermined operation in response to a condition descriptor being provided to the supplied agent; Accessing unpurified data while in a privacy-safe edge area; and a supplied agent determining a SO confidence coefficient for the edge area device based on a SO confidence assignment matrix and the unpurified data via a SO confidence analysis: receiving the SO confidence coefficient from the supplied agent while remaining blind to the unpurified data; determining whether the edge area device complies with the SO based on the SO confidence coefficient; providing an SO interface option for a selected security operation when the edge area device complies with the SO; suppressing the SO interface option for the selected security operation when the edge area device does not comply with the SO; and causing execution of the selected security operation in response to selection of the SO interface option via an input interface of the edge area device.

[0006] According to some embodiments, a method is provided, comprising: at a network interface circuit device, establishing a sanitized uplink between an agent supplied by a privacy-secure edge region and a security controller supplied by a central region, the sanitized uplink being configured to prevent upstream transmission of unsanitized data; and at a security control circuit device, performing controller blind security operation (SO) control of edge region devices by: providing an SO confidence allocation matrix from the security controller to the supplied agent, the SO confidence allocation matrix including a plurality of condition descriptors configured to support SO confidence analysis based on unsanitized data, the security controller being blind to the unsanitized data; in response to: the supplied agent being located at Accessing unpurified data in a privacy-safe edge area; and a supplied agent determining a SO confidence coefficient for the edge area device based on a SO confidence assignment matrix and the unpurified data via a SO confidence analysis: receiving the SO confidence coefficient from the supplied agent while remaining blind to the unpurified data; determining whether the edge area device complies with the SO based on the SO confidence coefficient; providing a SO interface option for a selected security operation when the edge area device complies with the SO; suppressing the SO interface option for the selected security operation when the edge area device does not comply with the SO; and causing execution of the selected security operation in response to selection of the SO interface option via an input interface of the edge area device.

[0007] According to some embodiments, a product is provided, comprising: a machine-readable medium other than a transient signal; and instructions stored on the machine-readable medium, the instructions being configured to cause a machine, when executed, to: establish, at a network interface circuit device, a sanitized uplink between an agent supplied by a privacy-secure edge region and a security controller supplied by a central region, the sanitized uplink being configured to prevent upstream transmission of unsanitized data; and, at a security control circuit device, perform controller blind security operation (SO) control of edge region devices by: providing an SO confidence allocation matrix from the security controller to the supplied agent, the SO confidence allocation matrix including a plurality of condition descriptors configured to support SO confidence analysis based on unsanitized data, the security controller performing an unsanitized SO confidence analysis on the agent; the edge area device is blind to the purified data; in response to: the supplied agent accessing the unpurified data when positioned in the privacy-safe edge area; and the supplied agent determining the SO confidence coefficient for the edge area device based on the SO confidence assignment matrix and the unpurified data via a SO confidence analysis: receiving the SO confidence coefficient from the supplied agent while remaining blind to the unpurified data; based on the SO confidence coefficient, determining whether the edge area device complies with the SO; when the edge area device complies with the SO, providing an SO interface option for a selected security operation; when the edge area device does not comply with the SO, suppressing the SO interface option for the selected security operation; and in response to selection of the SO interface option via the input interface of the edge area device, causing execution of the selected security operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 An example secure operations control environment is shown.

[0009] Figure 2 Example security control logic is shown.

[0010] Figure 3 An example security controller execution environment is shown.

[0011] Figure 4 An example edge region device is shown. DETAILED DESCRIPTION

[0012] In electrical and computer systems, a central control system allows operations on target devices. In some cases, authorization decisions can be based on feedback data sent back to the central control system from the target device, thereby allowing security operations to be allowed / denied based on information collected at the target device (e.g., compliance information in view of condition descriptors), such as local sensor data, while the authorization decision is not necessarily locally available (or easily obtained) to the central control system.

[0013] In some cases, data above a security controller may allow / deny security operations based on sensitive data (e.g., un-sanitized data discussed below). Therefore, transferring sensitive data to a security controller may violate privacy and / or security standards. Additionally or alternatively, transferring sensitive information to a security controller in an unencrypted or easily decrypted form may cause onerous data protection requirements to take effect. Therefore, the system may allow central area collection of information in a manner that allows long-term storage of sensitive data but does not provide actual use of the same data. Central area collection may be supplemented by edge area computing. Therefore, even if the collection still occurs in the central area, the use and / or analysis of sensitive data may occur in the edge area.

[0014] As an illustrative scenario, a first set of guidelines may enforce the collection of sensitive data. For example, anti-money laundering / know your customer guidelines may enforce institutions to collect and / or make decisions based on sensitive data. At the same time, data processing guidelines (such as the General Data Protection Regulation) may have onerous standards for maintaining such data. Therefore, a technical problem of having easily accessible data to perform mandatory analysis with impermeable security to comply with privacy laws is generated. The techniques and architectures discussed herein (including edge area implementation, supplied agents, sanitized uplink establishment and / or secure controlled circuit devices) provide a technical solution to this technical problem by transferring sensitive data analysis / review to the edge area. Therefore, in some cases, central area computing is at least partially eliminated. Therefore, in some implementations, central area collection of sensitive data (partially or entirely) is not required to support computing. Therefore, in the case of mandatory central area data collection, the technical solution allows central area collection in a manner that makes it impossible or almost impossible to use such data. Therefore, central area data can be maintained in a very secure form. For example, data can be encrypted with keys that are maintained in a completely different (and potentially porous) location with a security protocol that is independent of the security protocol where the data is stored. As a result, an attacker would be forced to compromise the data through multiple independent security schemes. Without having to enforce such collection, central regional collection of sensitive data can be abandoned entirely.

[0015] In various implementations, securing data within defined edge regions allows access to data (which may include sensitive private data) based on security operation allow / deny decisions. In various systems, similar data may be obtained from available data outside of edge regions using query and / or supervision tools (which may be computationally intensive in some cases). In other words, in some cases, the data used in pixel state calculations may be computationally predicted or derived rather than obtained from the user of its source. However, the accuracy and efficiency of such analytical derivation may be lower than that of directly polling the data source. Therefore, the establishment and implementation of edge regions can improve the accuracy and efficiency of the underlying hardware that performs open-loop pixel state control.

[0016] In various implementations, data sharing control may be implemented by applying homomorphic encryption (e.g., cryptographic techniques) to unpurified data. Homomorphic encryption may allow selected data, data details, metadata, and / or other data features to be shared without having to share unpurified data from which such selected data features may be derived or later recreated. Unpurified data may refer to data in a decrypted / unencrypted form on which security operation authorization determinations may be made. For example, unpurified data may include empirical data, test data, survey data, collected data, historical utilization data, account transaction data (e.g., from other applications running on a device), sales data, environmental data, industrial data, manufacturing specifications, identity data, reputation data, education credential data, government record data, data regarding attempted redirection of a transaction source or target (e.g., in a parallel transaction), or other data on which analysis may be performed.

[0017] Homomorphic encryption schemes can include a class of different encryption schemes. Homomorphic encryption schemes use the homomorphic properties of certain encryption algorithms, such as H m (x), where H m Specifies the homomorphic encryption algorithm. The homomorphic property provides a value where the sum of the encrypted values ​​is equal to the encrypted sum of the values, for example, H m (x)+H m (y) = H m (x+y). Using various known mathematical results from the homomorphic property, the homomorphic property can be used to disclose various characteristics of the underlying data values, such as x and y, without having to disclose x and y. Further, because addition (e.g., ADD operation) and multiplication (e.g., MULT operation) can be performed on the encrypted data without decryption, processing operations such as mathematical or modeling operations can be performed on the data while it is in an encrypted state. Similarly, subtraction operations (e.g., due to: H m (x+y)+-H m (y) = Hm (x), so the inverse is performed). Thus, insights can be gleaned from relevant aggregated data and / or sanitized data (e.g., selected information that preserves privacy) without disclosing the unsanitized data.

[0018] In some cases, homomorphic encryption and / or other encryption schemes may be implemented to implement logical regions, as discussed below. In some cases, the logical region may be implemented as a secure enclave local to a device (such as an edge region device discussed below). The secure enclave may provide controlled access to data for secure operation authorization determination. In some cases, the logical region may not necessarily be implemented using a secure enclave. For example, in some implementations, any memory on an edge region device (and / or memory within a combined container (discussed below)) may be within the logical edge region. Therefore, the implementation may use all, any secure enclaves, physical regions, and / or logical regions, or any combination thereof, to adjust acceptable memory locations for specific data and / or proxy execution.

[0019] A security operation (SO) may include a computer-based or network-based operation, for which a defined security standard may be set. The defined security standard may include hardware and / or software guidelines for edge area devices. The defined security standard may also include an activity guide. In some cases, the defined security standard may include enterprise policies (e.g., security policies (such as those for remote email account access), policies for financial transactions, regulatory framework compliance policies, or other policies). For example, activities that allow obfuscated transaction sources may not be allowed. In an illustrative example, a first application may request a parallel transaction to move credit from a first account to a second account. The second application may attempt to obtain a security operation to move credit from a second account to a third account without properly leaking that the credit originates from the first account and / or the presence of the first application on the edge area device. In another illustrative example, multiple parallel transactions may be used to obfuscate the overall size of the valid transactions that occur. For example, multiple small credit transfers from many accounts to one account may actually be one-to-one account-to-account transfers mediated by many smaller intermediate account transfers. In various implementations, parallel transactions may be transactions used to obfuscate the source and / or target of transactions processed by security operations. In other words, the architecture and techniques described herein can be used to monitor activities on edge region devices that may not be related to SOs on the surface, but can be used to circumvent security standards set for SOs, relatively speaking.

[0020] In some cases, controlled access to the secure enclave may include access to homomorphically encrypted data to allow manipulation and computation without exposing the private data. For example, a secure enclave may provide access to homomorphically encrypted versions of private data, but not the underlying private data. The proxy (discussed below) may perform computations / manipulations on the homomorphically encrypted data while it is encrypted. Secure local logic on the device may cause the enclave to expose the results in unencrypted form after the manipulation (or perform / request the corresponding action without exposing the result). Thus, the underlying data remains protected within the secure enclave (and local to the device) without being exposed to the proxy logic (including some cases where the proxy itself is localized).

[0021] Additionally or alternatively, controlled access to a secure enclave may include access to data of an encryption type that may not necessarily allow operations on the data while in encrypted form. Thus, some enclaves may not necessarily be implemented using a homomorphic encryption scheme. An enclave may be a logical area (which is also physically localized to a specific location on a mobile device) in which private data may be decrypted. Outside the enclave, only data in encrypted form may be allowed. Enclaves may be data-specific, application-specific, or neither. For example, a particular enclave may hold specified private data (photos, contacts, demographic data, financial data, and / or other private data) and mediate access to that data for applications (in some cases all applications) that access that particular data. In some cases, an enclave may hold a variety of unspecified private data for interaction with one or more specific applications. In some cases, an enclave may mediate interactions between unspecified private data and unspecified applications.

[0022] To maintain data privacy and security, edge regions may be defined for an open-loop pixel state control system. The edge regions may be protected such that data traveling from the edge regions (e.g., on an uplink to a display control master) is sanitized. The edge regions may be logically and / or physically localized.

[0023] Logical localization can be defined by logical perimeters that are not necessarily physically localized (e.g., various physical storage locations and processing locations that enforce encryption requirements on a logically localized edge region). In other words, storage locations and processing locations within a logically localized edge region can be physically distributed (in some cases, co-located (at least partially) with security controller hardware), but the edge region is logically maintained through encryption parameters. For example, homomorphic encryption can be used to define an example logically localized edge region (e.g., data within an edge region must be homomorphically encrypted), but the hardware hosting the processing locations and storage locations of the example edge region can be physically distributed.

[0024] Physical localization can be defined by one or more physical perimeters. For example, specific hardware devices may be entirely (or partially) within an edge region. Therefore, processing or storage on those devices will be located in the edge region. Therefore, processing on those devices or storage will be located in the edge region. Therefore, processing physically performed on the device will be within the edge region, but off-device processing can be outside the edge region even if using the same or similar encryption usage or hardware configuration as the edge region.

[0025] In some cases, edge regions may use both physical and logical localization. For example, physical perimeters and logical perimeters may be defined for edge regions. If storage and / or processing occurs within at least one perimeter, then storage and / or processing may be located in an edge region. In some cases, both physical and logical localization may be used in tandem. Thus, if storage and / or processing occurs within two perimeters, then storage and / or processing may be located in an edge region.

[0026] An edge region device may include a device (or portion of a device) that hosts storage and / or processing within an edge region. An edge region device may execute one or more applications that may direct or request participation in a SO.

[0027] The central region may include one or more regions outside of the edge region that include hardware implementing the security controller.

[0028] Figure 1 An example SO control environment 100 is shown. In the example SO control environment 100, a security controller 112 within a central region 110 has established a sanitized uplink 114 with an edge region provisioned agent 134 on an edge region device 132 in a privacy secure edge region 130. In this illustrative example, the security controller 112 has also established an edge support downlink 116. The security controller 112 has provided a confidence assignment matrix 118 to the provisioned agent. The provisioned agent is further located within a portfolio container 140 on the edge region device 132. The portfolio container 140 may include an isolated space for one or more agents (potentially controlled by multiple different security controller systems). The portfolio container 140 may include an unsanitized data import channel 142 for moving unsanitized data from the edge region storage 136 into the portfolio container and then to the agent(s) therein.

[0029] In some cases, pre-provisioned agents may be maintained in an agent repository 150 prior to provisioning. The agent repository 150 may include a plurality of different pre-provisioned agents 152 corresponding to different security controller systems (e.g., and different enterprises). Thus, the agent repository may be maintained by a third party that controls neither the edge region device 132 nor the security controller 112. In some cases, the agent repository may include a search function and / or a virtual "app store" type storefront where users can find and install agents for their edge region devices. In some cases, the repository may be pre-provisioned with agents using a confidence assignment matrix 118.

[0030] Now refer to Figure 2 , while continuing to refer to Figure 1 , Figure 2 Example security control logic (SCL) 200 is shown, which may define the operation of hardware executed as security control circuitry.

[0031] The SCL 200 may provide the SO confidence assignment matrix 118 to the provisioned agent 134 (202). The confidence assignment matrix 118 may include a data structure (such as a table, self-executing code, algorithm, machine learning code, or other data structure) that may accept input data (e.g., unpurified data available within a privacy-safe edge region) to determine compliance with one or more condition descriptors and assign confidence coefficients based on the compliance. The condition descriptors may include definitions of conditions that may increase or decrease confidence in the security of edge region devices. The agent may use the data available within the edge region to determine whether the defined conditions exist to determine the confidence score. The agent may report the confidence coefficient (in some cases, without explanation). For example, a security controller may send condition descriptors in a group in the confidence assignment matrix 118, but the security controller may be blind to the unpurified data on which the determination is based. In some cases, the agent may report whether a separate condition exists (or does not exist), but may forgo further explanation. For example, condition-specific reporting may be used without using confidence scores or in cases where such scores are used in part to make security authorization determinations. For example, in some implementations, some conditions may be required regardless of the number of other conditions that may exist or the scores associated therewith.

[0032] In some implementations, the conditional descriptor may include asserted private data that may be maintained by the central region. For example, the asserted private data may include data previously provided by a user to a security controller (or associated entity), for example, to obtain access to a secure operation (SO). The asserted private data may be packaged in the conditional descriptor to be compared with the captured unpurified data (e.g., captured data) available in the edge region. The comparison may yield insights into whether the user was honest and / or complete when initially providing the asserted data. In an illustrative scenario, consistency (e.g., matching) between the captured data and the asserted data may increase the assigned SO confidence coefficient, while inconsistency (e.g., mismatching) may reduce the assigned SO confidence coefficient (e.g., for a higher SO confidence coefficient indicating a more compliant solution). In some cases, the asserted private data may be hashed before being provided in the conditional descriptor. After capture, the captured data may be hashed similarly. The asserted data and the captured data may be compared in hash form. In some cases, hashing the asserted private data prior to inclusion in a conditional descriptor may protect the asserted data from being corrupted when passed (eg, from the SCL 200 to the provisioned agent logic (PAL) 250).

[0033] In some cases, the context for the captured data can also be analyzed. In some cases, the context of the captured data can indicate whether the captured data is reliable. For example, it is unlikely that a user will provide incorrect data to a bank or other financial institution. Therefore, the data captured from a third-party bank can be a context with relatively high reliability. In some cases, a user is likely to provide inaccurate information to a free online supplier who wishes to collect personal data for marketing. Therefore, the information provided to a third-party online marketing supplier may be a context with relatively low reliability. Therefore, the mismatch between the asserted private data and the data captured from a reliable context (such as a context with higher reliability) may be more likely to indicate a security problem than the mismatch from an unreliable context (such as a context with lower reliability). Therefore, the SO confidence allocation matrix can be configured to force an increase in the penalty for mismatches associated with a reliable context relative to the penalty associated with an unreliable context (or the lack of a penalty associated with an unreliable context).

[0034] In some implementations, the agent may report an explanation of the determination based on the condition descriptor. However, the explanation may be encrypted or otherwise obfuscated so that it may be intended not to be used or reviewed by the security controller. Instead, the interpretation data may be kept for possible (but in some cases, unlikely) future audits (e.g., internal audits, audits of compliance with know your customer or anti-money laundering guidelines, external investigations, certification of collected information, or other audits). Therefore, in the case where a security controller (or an associated enterprise) is forced to record data for security determinations of its authorization of security operations, the security controller may obtain the data in the following form: the data may be robustly included. Therefore, the security liability associated with having such data may be reduced compared to data obtained in a more user-friendly form.

[0035] The SCL 200 may receive cleansing feedback (204) from the provisioned agent 134 on the cleansed uplink. The receipt of this feedback may be dependent on the agent's execution of the PAL 250. Thus, execution of the PAL 250 by the agent may not necessarily be affirmatively executed by the SCL 200 (or any entity controlling the SCL 200). Rather, execution of the PAL 250 by the provisioned agent describes specific conditions under which the SCL 200 may receive cleansing feedback on the cleansed uplink. The feedback may include an SO confidence factor and / or interpretation data regarding the condition descriptor.

[0036] Now refer to Figure 2 The PAL 250 of the SCL 200 can access the unsanitized data while localizing the provisioned agent 134 in the privacy-safe edge region (252) before sending the sanitization feedback to the SCL 200. In some cases, the provisioned agent can be located within the composition container 140. To access the unsanitized data from within the composition container 140, the provisioned agent 134 can request to import the unsanitized data through the import channel 142.

[0037] The composition container 140 can implement import rules. For example, a particular agent within the composition container can have specifically defined access to a particular type of unsanitized data. For example, in some implementations, the composition container can cause the imported data to be homomorphically encrypted prior to import to facilitate performing SO confidence analysis on the data in a homomorphically encrypted state. The composition container 140 (e.g., via the import channel 142) can check the data passed into the composition container (e.g., to ensure that the import rules are followed). For example, an agent reviewing parallel transactions can access data about events within a specific time frame (e.g., the same minute, hour, day, week (or other time period) as the reviewed transaction), but is prohibited from requesting information outside the window.

[0038] In some cases, the provisioned agents may be subject to pre-access conditions to access unsanitized data. For example, the import channel 142 may limit access to certain types of unsanitized data to agents that have implemented a predetermined level of cryptographic protection. In an example, the import channel 142 may enforce sanitization standards on data bound for sanitized uplinks. In an example, the import channel may force agents to comply with a new or more stringent sanitization scheme (e.g., further restricting the types of data that may be sent to the display security controller) before agreeing to send additional unsanitized data.

[0039] The supply agent 134 may perform an SO confidence analysis to determine an SO confidence coefficient and / or other feedback (254). The SO confidence analysis may be based on the condition descriptors in the SO confidence assignment matrix and the unpurified data available in the edge region. The supply agent may scan the data and activity on the edge region device to determine the presence / absence of the conditions defined in the condition descriptors. Based on the confidence analysis, the supply agent 134 may, for example, assign an SO confidence coefficient according to a scoring scheme defined in the SO confidence assignment matrix. The feedback provided by the supply agent may be purified (e.g., by data removal / anonymization and / or encryption according to a purification scheme).

[0040] In some implementations, the SO confidence analysis can be performed while the data is in a homomorphic encrypted state. For example, the unpurified data can be converted into a mathematical representation of the underlying data. For example, specific data and / or conditions can be converted into a score or number assignment. The mathematical representation can then be homomorphically encrypted. The SO confidence analysis can then be performed on the homomorphically encrypted data. The results of the SO confidence analysis can be decrypted (using the same key used to encrypt the input data) to display the SO confidence coefficient.

[0041] After receiving the sanitized feedback, SCL 200 can determine whether the edge area device complies with the SO (206). SO compliance can be specific to an individual SO. For example, the SO compliance standard for a first SO can be different than the SO compliance of a second SO. For example, an edge area device can comply with the SO for credit transfer requests between existing accounts, but not comply with the SO for new account creation (or vice versa).

[0042] In some implementations, SO compliance can be determined based on a SO confidence coefficient. For example, edge area devices with a SO confidence coefficient above (or below, depending on the scheme) a defined threshold can be SO compliant, while edge area devices that do not meet the threshold can be SO non-compliant. In some cases, the SO confidence coefficient determination can use a scheme that forces specific conditions to be met to achieve SO compliance. For example, in a scoring type scheme, the points attributed to certain conditions can be large enough to guarantee failure if not met. In some cases, certain conditions can guarantee success. In some cases, certain conditions can neither guarantee success nor failure, but can affect one of them.

[0043] Where explanation data may be included in the feedback, the explanation data may be used to determine compliance with conditions that are mandatory for success and / or those conditions that may guarantee failure. In some cases, where the provisioning agent 134 does not provide a SO confidence coefficient, the explanation data may be used to determine SO compliance.

[0044] When the SCL 200 determines that the edge area device complies with the SO (e.g., for at least one specific SO), the SCL 200 may cause the edge area device to display options for the specific SO (208), e.g., via the PAL 250. For example, when the edge area device complies with the SO and is viewing a security operation (SO) menu, the SCL 200 may cause the edge area device to display options for the specific SO (and / or other SOs for which the edge area device complies with the SO). Displaying the options may include displaying an interface button for selecting the SO, highlighting to indicate that the SO is available, or other interface elements indicating that the SO can be executed.

[0045] When the SCL 200 determines that the edge area device does not comply with the SO (e.g., for at least one specific SO), the SCL 200 may, for example, via the PAL 250, cause the edge area device to suppress options for the specific SO (210). For example, when the edge area device does not comply with the SO and is viewing a security operation (SO) menu, the SCL 200 may cause the edge area device to omit options for the specific SO (and / or other SOs for which the edge area device complies with the SO). Omitting options may include hiding an interface button for selecting the SO, graying out an interface element to indicate that the SO is available, or otherwise changing / hiding an interface element to indicate that the SO may not be executed.

[0046] When an interface option corresponding to a particular SO is selected (e.g., in a scenario where the edge area device complies with the SO), the SCL 200 may cause execution of the particular SO (212). For example, the SCL 200 may cause creation of an account (e.g., a credit account, a monetary account, or other account). For example, the SCL 200 may cause execution of a transaction (e.g., a credit transfer, a monetary transfer, an exchange, or other transaction). For example, the SCL 200 may allow an account access operation (e.g., when accessing information or controls about an account from the edge area device). In one case, execution may include creating an interactive display on the edge area device to support execution of the particular SO.

[0047] Figure 3 An example security controller execution environment (SCEE) 300 is shown, which may be implemented to control a master circuit device. The SCEE 300 may include system logic 314 to support the tasks described in the present disclosure, such as proxy control and communication. The system logic 314 may include a processor 316, a memory 320, and / or other circuit devices, which may be used to implement the SCL 200, which may provide software support to implement various tasks performed by the SCL 200 (e.g., (at least partially) converting the SCEE 300 into a specialized security controller circuit device). In various implementations, the SCEE 300 may include a mobile device.

[0048] Memory 320 may be used to store parameters 322 and / or model templates 324 used in agent control and communication. Memory 320 may further store rules 321 that may facilitate performance of agent control and communication and / or other tasks.

[0049] The memory 320 may also include applications and structures, such as coded objects, templates, or one or more other data structures, to facilitate the execution of tasks such as agent control and communication and / or other tasks. The SCEE 300 may also include one or more communication interfaces 312, which may support wireless (e.g., Bluetooth, Wi-Fi, WLAN, cellular (3G, 4G, LTE / A)) and / or wired, Ethernet, Gigabit Ethernet, optical networking protocols. The communication interface 312 may support communication with a data source or resource for facilitating the execution of tasks such as agent control and communication and / or other tasks, for example, by serving as a communication layer of a network interface circuit device. Additionally or alternatively, the communication interface 312 may support secure information exchange, such as a secure socket layer (SSL) or a public key cryptography-based protocol for sending and receiving purified and / or unpurified data. The SCEE 300 may include a power management circuit device 334 and one or more input interfaces 328.

[0050] SCEE 300 may also include a user interface 318, which may include a human-machine interface and / or a graphical user interface (GUI). A GUI may be used to present interfaces and / or options to facilitate agent and / or front-end management and / or performance of other tasks.

[0051] Figure 4 An example edge area device 132 is shown. The example edge area device 132 can communicate with a base station 402 via a wireless channel 452. In this example, the example edge area device 132 supports one or more subscriber identity modules (SIMs), such as SIM1 402. An electrical and physical interface 406 connects SIM1 202 to the rest of the user equipment hardware, such as through a system bus 410.

[0052] The example edge area device 132 includes a communication interface 412, a system logic 414, and a user interface 418. The system logic 414 may include circuitry and / or hardware that may host a combination of software, firmware, or other executable code. The system logic 414 may be implemented, for example, using one or more systems on a chip (SoC), application specific integrated circuits (ASICs), discrete analog and digital circuits, and other circuitry. The system logic 414 is part of the implementation of any desired functionality in the example edge area device 132. In this regard, as an example, the system logic 414 may include logic that facilitates the following: decoding and playing music and videos (e.g., MP3, MP4, MPEG, AVI, FLAC, AC3, or WAV decoding and playback); running applications; accepting user input; saving and retrieving application data; as an example, establishing, maintaining, and terminating a cellular phone call or data connection for Internet connectivity; establishing, maintaining, and terminating a wireless network connection, a Bluetooth connection, or other connection; and displaying relevant information on the user interface 418. The user interface 418 and input 428 may include a graphical user interface, a touch-sensitive display, tactile feedback or other tactile output, voice or facial recognition input, buttons, switches, speakers, and other user interface elements. Additional examples of input 428 include microphones, video and still image cameras, temperature sensors, vibration sensors, rotation and orientation sensors, headphone and microphone input / output sockets, universal serial bus (USB) connectors, memory card slots, radiation sensors (e.g., IR sensors), and other types of inputs.

[0053] The system logic 414 may include one or more processors 416 and memory 420. The memory 420 stores, for example, control instructions 422 that the processor 416 executes to perform the desired functionality of the example edge area device 132. Control parameters 424 provide and specify configuration and operating options for the control instructions 422. Further, the memory 420 may include an isolated composition container 470 that may host various provisioned agents 472. The memory 420 may also store any BT, WiFi, 3G, 4G, 5G, or other data that the edge area device 132 will send or has received through the communication interface 412.

[0054] In various implementations, system power may be provided by a power storage device such as battery 482 .

[0055] In the communication interface 412, radio frequency (RF) transmit (Tx) and receive (Rx) circuitry 430 handles the transmission and reception of signals through one or more antennas 432. The communication interface 412 may include one or more transceivers. The transceiver may be a wireless transceiver that includes modulation / demodulation circuitry, digital-to-analog converters (DACs), shaping tables, analog-to-digital converters (ADCs), filters, waveform shapers, filters, preamplifiers, power amplifiers, and / or other logic for transmitting and receiving through one or more antennas or (for some devices) through a physical (e.g., wired) medium.

[0056] The transmitted and received signals may conform to any of a variety of formats, protocols, modulations (e.g., QPSK, 16-QAM, 64-QAM, or 256-QAM), frequency channels, bit rates, and encodings. As a specific example, the communication interface 412 may include a transceiver that supports transmission and reception under 2G, 3G, BT, WiFi, Universal Mobile Telecommunications System (UMTS), High Speed ​​Packet Access (HSPA)+, and 4G / Long Term Evolution (LTE) and 5G standards. However, the techniques described below are applicable to other wireless communication technologies, whether derived from the Third Generation Partnership Project (3GPP), the GSM Association, 3GPP2, IEEE, or other partners or standards bodies.

[0057] The methods, apparatus, processes, and logic described above may be implemented in many different ways and in many different combinations of hardware and software. For example, all or part of the implementation may be a circuit device including an instruction processor such as a central processing unit (CPU), a microcontroller, or a microprocessor; an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field programmable gate array (FPGA); or a circuit device including discrete logic or other circuit components, including analog circuit components, digital circuit components, or both; or any combination thereof. As an example, the circuit device may include discrete interconnected hardware components, and / or may be combined on a single integrated circuit die, distributed among multiple integrated circuit dies, or implemented in a multi-chip module (MCM) of multiple integrated circuit dies in a common package.

[0058] The circuit device may also include or access instructions for execution by the circuit device. The instructions may be implemented as signals and / or data streams and / or may be stored in a tangible storage medium other than a transient signal, such as a flash memory, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM); or stored on a disk or optical disk, such as a compact disk read-only memory (CDROM), a hard disk drive (HDD) or other disk or optical disk; or stored in or on another machine-readable medium. Products such as computer program products may specifically include a storage medium and instructions stored in or on the medium, and the instructions, when executed by a circuit device in a device, may cause the device to implement any of the processes described above or illustrated in the accompanying drawings.

[0059] These implementations can be distributed as circuit devices (e.g., hardware and / or a combination of hardware and software) across multiple system components, such as across multiple processors and memories, optionally including multiple distributed processing systems. Parameters, databases, and other data structures can be stored and managed separately, can be merged into a single memory or database, can be logically and physically organized in many different ways, and can be implemented in many different ways, including as data structures such as linked lists, hash tables, arrays, records, objects, or implicit storage mechanisms. Programs can be multiple parts of a single program (e.g., subroutines), separate programs, distributed across multiple memories and processors, or implemented in many different ways, such as in libraries such as shared libraries (e.g., dynamic link libraries DLLs). For example, when executed by circuit devices, a DLL can store instructions to perform any of the processes described above or illustrated in the accompanying drawings.

[0060] Various implementations may use the techniques and architectures described above.

[0061] E1. In an example, a system includes: a network interface circuit device, configured to establish a sanitized uplink between an agent supplied by a privacy-safe edge region and a security controller supplied by a central region, the sanitized uplink being configured to prevent upstream transmission of unsanitized data; and a security control circuit device, configured to perform controller blind security operation (SO) control of edge region devices by: providing an SO confidence allocation matrix from the security controller to the supplied agent, the SO confidence allocation matrix including a plurality of condition descriptors configured to support SO confidence analysis based on unsanitized data, the security controller being blind to the unsanitized data; in response to: the supplied agent being located Accessing unpurified data while in a privacy-safe edge area; and a supplied agent determining a SO confidence coefficient for an edge area device based on a SO confidence assignment matrix and the unpurified data via a SO confidence analysis: receiving the SO confidence coefficient from the supplied agent while remaining blind to the unpurified data; determining whether the edge area device complies with the SO based on the SO confidence coefficient; providing a SO interface option for a selected security operation when the edge area device complies with the SO; suppressing the SO interface option for the selected security operation when the edge area device does not comply with the SO; and causing execution of the selected security operation in response to selection of the SO interface option via an input interface of the edge area device.

[0062] E2. The system of example E1, wherein: optionally, the selected security operation is configured to generate an interactive interface on a display of an edge area device; optionally, the privacy-safe edge area includes a logical edge area; optionally, the privacy-safe edge area includes a physical edge area; optionally, the SO confidence analysis is configured to be performed when the unpurified data is in a homomorphic encryption state; optionally, the unpurified data is converted into a mathematical representation before being in a homomorphic encryption state; optionally, homomorphic encryption is used to protect the privacy-safe edge area; optionally, a secure enclave is defined within the privacy-safe edge area.

[0063] E3. The system of any of Examples E1 to E2, wherein the selected security operation includes an account access action, an account creation action, or both.

[0064] E4. The system of any of examples E1 to E3, wherein the plurality of conditional descriptors correspond to instructions to comply with enterprise policy constraints.

[0065] E5. The system of example E4 or any of examples E1-E3, wherein the enterprise policy constraints include provisions for complying with a regulatory framework.

[0066] E6. The system of any of Examples E1 to E5, wherein at least one individual conditional descriptor of the plurality of conditional descriptors prevents execution of parallel transactions on the edge area device that, when executed, obscures a source of the parallel transactions.

[0067] E7. The system of any of Examples E1 to E6, wherein the plurality of condition descriptors include asserted private data maintained in the central region for comparison with captured private data from the edge region device.

[0068] E8. The system of Example E7 or any of Examples E1 to E6, wherein the SO confidence assignment matrix is ​​configured to enforce a reduction in the determined SO confidence coefficient when a mismatch between the asserted private data and the captured private data is identified.

[0069] E9. The system of example E8 or any of examples E1 to E7, wherein the plurality of conditional descriptors further supports collection of captured context for the captured private data.

[0070] E10. The system of Example E9 or any one of Examples E1 to E8, wherein the SO confidence assignment matrix is ​​configured to increase forced decreases when the captured context includes reliable context.

[0071] E11. In an example, a method includes: at a network interface circuit device, establishing a sanitized uplink between an agent supplied by a privacy-secure edge region and a security controller supplied by a central region, the sanitized uplink being configured to prevent upstream transmission of unsanitized data; and at a security control circuit device, performing controller blind security operation (SO) control of edge region devices by: providing an SO confidence allocation matrix from the security controller to the supplied agent, the SO confidence allocation matrix including a plurality of condition descriptors configured to support SO confidence analysis based on unsanitized data, the security controller being blind to the unsanitized data; in response to: the supplied agent being positioned at Accessing unpurified data in a privacy-safe edge area; and a supplied agent determining a SO confidence coefficient for the edge area device based on a SO confidence assignment matrix and the unpurified data via a SO confidence analysis: receiving the SO confidence coefficient from the supplied agent while remaining blind to the unpurified data; determining whether the edge area device complies with the SO based on the SO confidence coefficient; providing a SO interface option for a selected security operation when the edge area device complies with the SO; suppressing the SO interface option for the selected security operation when the edge area device does not comply with the SO; and causing execution of the selected security operation in response to selection of the SO interface option via an input interface of the edge area device.

[0072] E12. The method of example E11, wherein: optionally, the selected security operation generates an interactive interface on a display of an edge area device; optionally, the privacy-safe edge area includes a logical edge area; optionally, the privacy-safe edge area includes a physical edge area; optionally, the SO confidence analysis is configured to be performed when the unpurified data is in a homomorphic encryption state; optionally, the unpurified data is converted into a mathematical representation before being in a homomorphic encryption state; optionally, homomorphic encryption is used to protect the privacy-safe edge area; optionally, a secure enclave is defined within the privacy-safe edge area.

[0073] E13. The method of any of Examples E11 to E12, wherein the selected security operation includes an account access action, an account creation action, or both.

[0074] E14. The method of any of Examples E11 to E13, wherein the plurality of conditional descriptors correspond to instructions to comply with enterprise policy constraints.

[0075] E15. The method of Example 14 or any one of Examples E11 to E13, wherein the enterprise policy constraints include provisions for complying with a regulatory framework.

[0076] E16. The method of any of examples E11 to E15, wherein at least one individual conditional descriptor of the plurality of conditional descriptors prevents execution of parallel transactions on the edge area device that, when executed, obscures a source of the parallel transactions.

[0077] E17. In an example, a product includes: a machine-readable medium other than a transient signal; and instructions stored on the machine-readable medium, which are configured to cause the machine to: establish a cleansed uplink between an agent supplied by a privacy-secure edge area and a security controller supplied by a central area at a network interface circuit device, the cleansed uplink being configured to prevent upstream transmission of uncleaned data; and perform controller blind security operation (SO) control of edge area devices at a security control circuit device by: providing an SO confidence allocation matrix from the security controller to the supplied agent, the SO confidence allocation matrix including a plurality of condition descriptors configured to support SO confidence analysis based on uncleaned data, the security controller performing a cleansed uplink control on the uncleaned data. the edge area device is blind to the purified data; in response to: the supplied agent accessing the unpurified data when positioned in the privacy-safe edge area; and the supplied agent determining the SO confidence coefficient for the edge area device based on the SO confidence assignment matrix and the unpurified data via a SO confidence analysis: receiving the SO confidence coefficient from the supplied agent while remaining blind to the unpurified data; based on the SO confidence coefficient, determining whether the edge area device complies with the SO; when the edge area device complies with the SO, providing an SO interface option for a selected security operation; when the edge area device does not comply with the SO, suppressing the SO interface option for the selected security operation; and in response to selection of the SO interface option via the input interface of the edge area device, causing execution of the selected security operation.

[0078] E18. The product of example E17, wherein: optionally, the plurality of conditional descriptors include asserted private data maintained within a central region for comparison with private data captured from an edge region device; optionally, the privacy-safe edge region includes a logical edge region; optionally, the privacy-safe edge region includes a physical edge region; optionally, the SO confidence analysis is configured to be performed while the unpurified data is in a homomorphic encrypted state; optionally, the unpurified data is converted into a mathematical representation before being in a homomorphic encrypted state; optionally, homomorphic encryption is used to protect the privacy-safe edge region; optionally, a secure enclave is defined within the privacy-safe edge region.

[0079] E19. The product of examples E18 or E17, wherein the SO confidence assignment matrix is ​​configured to enforce a reduction in the determined SO confidence coefficient when a mismatch between the asserted private data and the captured private data is identified.

[0080] E20. The product of example E19 or any of examples E17-E18, wherein the plurality of conditional descriptors further supports collection of captured context for the captured private data.

[0081] E21. In an example, a method includes a method performed by operating a system of any one of Examples E1 to E10; or performing any steps or any combination thereof that the system of any one of Examples E1 to E10 is configured to perform.

[0082] E22. In an example, a product includes: a machine-readable medium; and instructions stored on the machine-readable medium, the instructions being configured to cause a machine to implement the method of example E22, wherein: optionally, the machine-readable medium is different from a transient signal and / or is non-transient; and optionally, the instructions are executable.

[0083] Various implementations have been described in detail. However, many other implementations are possible.

[0084] The headings and / or subheadings used herein are intended only to assist the reader in understanding the described implementations.

Claims

1. A computing system comprising: A network interface circuit device configured to establish a sanitized uplink between a privacy-secure edge region provisioned agent and a central region provisioned security controller, the sanitized uplink configured to prevent upstream transmission of unsanitized data; and A safety control circuit device is configured to perform a controller blind safety operation SO control of an edge area device by: providing, from the security controller to the provisioned agent, a SO confidence assignment matrix comprising a plurality of condition descriptors configured to support SO confidence analysis based on unsanitized data, the security controller being blind to the unsanitized data; In response to: The provisioned agent accesses the unsanitized data while being located in the privacy-safe edge region; and The provisioned agent determines, via the SO confidence analysis, a SO confidence coefficient for the edge region device based on the SO confidence assignment matrix and the unsanitized data: receiving the SO confidence coefficient from the provisioned agent while remaining blind to the unsanitized data; Based on the SO confidence coefficient, determining whether the edge area device complies with the SO; When the edge area device complies with the SO, providing an SO interface option for selected security operations; When the edge area device does not comply with the SO, suppressing the SO interface option for the selected security operation; and In response to selection of the SO interface option via an input interface of the edge zone device, execution of the selected security operation is caused. 2 . The system of claim 1 , wherein the selected security operation is configured to generate an interactive interface on a display of the edge area device.

3. The system of claim 1, wherein the selected security operation comprises an account access action, an account creation action, or both. 4 . The system of claim 1 , wherein the plurality of condition descriptors correspond to instructions for compliance with enterprise policy constraints.

5. The system of claim 4, wherein the enterprise policy constraints include clauses for complying with a regulatory framework. 6 . The system of claim 1 , wherein at least one individual conditional descriptor of the plurality of conditional descriptors prevents execution of parallel transactions on the edge area device that, when executed, obscure a source of the parallel transactions. 7 . The system of claim 1 , wherein the plurality of condition descriptors include asserted private data maintained within the central region for comparison with captured private data from the edge region devices.

8. The system of claim 7, wherein the SO confidence assignment matrix is ​​configured to enforce a reduction in the determined SO confidence coefficient when a mismatch between the asserted private data and the captured private data is identified.

9. A computer-implemented method comprising: At the network interface circuit device, establishing a sanitized uplink between the privacy-secure edge region provisioned agent and the central region provisioned security controller, the sanitized uplink being configured to prevent upstream transmission of unsanitized data; as well as At the safety control circuit device, the controller blind safety operation SO control of the edge area device is performed by the following operations: providing, from the security controller to the provisioned agent, a SO confidence assignment matrix comprising a plurality of condition descriptors configured to support SO confidence analysis based on unsanitized data, the security controller being blind to the unsanitized data; In response to: The provisioned agent accesses the unsanitized data while being located in the privacy-safe edge region; and The provisioned agent determines, via the SO confidence analysis, a SO confidence coefficient for the edge region device based on the SO confidence assignment matrix and the unsanitized data: receiving the SO confidence coefficient from the provisioned agent while remaining blind to the unsanitized data; Based on the SO confidence coefficient, determining whether the edge area device complies with the SO; When the edge area device complies with the SO, providing an SO interface option for selected security operations; When the edge area device does not comply with the SO, suppressing the SO interface option for the selected security operation; and In response to selection of the SO interface option via an input interface of the edge zone device, execution of the selected security operation is caused.

10. A computer program product comprising: a machine-readable medium other than a transitory signal; as well as Instructions stored on the machine-readable medium, the instructions being configured, when executed, to cause the machine to: At the network interface circuit device, establishing a sanitized uplink between the privacy-secure edge region provisioned agent and the central region provisioned security controller, the sanitized uplink being configured to prevent upstream transmission of unsanitized data; as well as At the safety control circuit device, the controller blind safety operation SO control of the edge area device is performed by the following operations: providing, from the security controller to the provisioned agent, a SO confidence assignment matrix comprising a plurality of condition descriptors configured to support SO confidence analysis based on unsanitized data, the security controller being blind to the unsanitized data; In response to: The provisioned agent accesses the unsanitized data while being located in the privacy-safe edge region; and The provisioned agent determines, via the SO confidence analysis, a SO confidence coefficient for the edge region device based on the SO confidence assignment matrix and the unsanitized data: receiving the SO confidence coefficient from the provisioned agent while remaining blind to the unsanitized data; Based on the SO confidence coefficient, determining whether the edge area device complies with the SO; When the edge area device complies with the SO, providing an SO interface option for selected security operations; When the edge area device does not comply with the SO, suppressing the SO interface option for the selected security operation; and In response to selection of the SO interface option via an input interface of the edge zone device, execution of the selected security operation is caused.

Images