Confidential Computing Proxy for Verifiable Remote Data Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cross-domain data sharing technologies face challenges in ensuring data control and destruction verification, as data providers cannot guarantee that shared data are destroyed by data consumers and lack verifiable proof of such actions.
Innovation Solution
A method and system utilizing confidential computing to establish a security proxy module in the data consumer's environment, enabling data encryption, sealing, and remote attestation to ensure data control and provide verifiable proof of operations, including data destruction and usage control through a public-secret key pair and trusted signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is shared across domains, then data accessibility and utility are improved, but data control and verification of destruction are lost
Solution Approach 1:
The patent introduces a security proxy module as an intermediary between the data provider and data consumer. This module operates within the consumer's confidential computing environment, acting as a controlled interface that enables data access while maintaining the provider's control rights. The proxy module verifies and executes destruction operations, providing verifiable proof to the provider without requiring direct access to the actual data storage.
2Reliability
If data is encrypted and stored remotely, then data security is improved, but verification of data destruction becomes difficult
Solution Approach 1:
The patent implements a feedback mechanism where the security proxy module provides verifiable proof of destruction operations back to the data provider. When data is destroyed, the proxy module generates cryptographic evidence (such as sealed data deletion proofs or attestation signatures) that confirms the destruction occurred, allowing the provider to verify compliance without accessing the encrypted data directly.
Solution Approach 2:
The patent establishes control mechanisms and verification protocols in advance, before data sharing occurs. The data provider configures destruction policies and the security proxy module is pre-configured with verification capabilities, so that when destruction is needed, the verification process is already in place and can execute immediately without ad-hoc setup.
3Reliability
If confidential computing is used, then data privacy protection is improved, but system complexity increases
Solution Approach 1:
The patent extracts the security management functionality into a separate security proxy module that operates independently from both the data provider and data consumer systems. This modular approach allows confidential computing capabilities to be utilized without requiring either party to implement complex security infrastructure, as the proxy module handles all cryptographic operations and verification processes.
Data Source
AI summary
Provided is a method of controlling remote data based on confidential computing and a system thereof. The method includes: sending, by a data provider, a public key P to a Proxy Module (PM) operating in a confidential computing environment of a data consumer; sharing, by the data provider, shared data D to the PM; creating, by the PM, a secret key K for data D, and carrying out trusted encryption sealing; using, by the data provider, a secret key S to generate a token T for a data control signal, and sending the token to the PM; parsing, by the PM, the data control signal contained in T; carrying out, by the PM, corresponding control on the corresponding data D; using, by the PM, a secret key S′ to carry out trusted signature on an operation result and sending the operation result to the data provider; obtaining the operation result.