Dynamic Policy Enforcement in Trusted Computing for Secure Data Sharing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The challenge of sharing sensitive datasets for algorithm training while maintaining data confidentiality and compliance with regulatory requirements, such as HIPAA and GDPR, is hindered by the large size of datasets and differing privacy needs among data stewards, which complicates data access and output constraints.

Innovation Solution

A system for dynamic policy generation in a zero-trust computing environment that enables secure processing of datasets within sequestered computing nodes, using encryption and public-private key techniques to ensure that only authorized entities can decrypt algorithms and data, with dynamic outbound and inbound policies to manage output compliance.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If datasets are shared with algorithm developers for processing, then algorithm training and analysis can be performed, but data confidentiality and regulatory compliance are compromised

Engineering Contradiction:

Improvealgorithm training capabilityVSAvoiddata confidentiality risk

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a trusted computing environment with secure enclaves as an intermediary between data stewards and algorithm developers. The enclave acts as a mediator that allows algorithm execution on sensitive data without exposing the actual data to the algorithm developer, thus enabling productivity while maintaining confidentiality through hardware-based security boundaries.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system segments the computing environment into isolated secure enclaves that separate data storage, algorithm execution, and result output functions. This segmentation allows different components to operate independently with controlled access, enabling algorithm training while preventing unauthorized data access through spatial and functional isolation.

Inventive Principle:

Principle #1Segmentation

2Productivity

If large datasets are transferred to algorithm developers, then comprehensive algorithm training is enabled, but transfer time and infrastructure requirements increase significantly

Engineering Contradiction:

Improvealgorithm training completenessVSAvoiddata transfer duration

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

The trusted computing environment serves as an intermediary that eliminates the need for large-scale data transfer. By keeping data localized within secure enclaves and allowing algorithm execution in-place, the system enables comprehensive algorithm training without the time-consuming transfer process, reducing infrastructure requirements while maintaining training completeness.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If different data stewards implement their own security policies, then individual privacy needs are met, but system complexity and policy management difficulty increase

Engineering Contradiction:

Improveprivacy policy customizationVSAvoidpolicy management complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system implements a universal trusted computing framework that can accommodate multiple data steward policies through a common architecture. The secure enclave infrastructure provides multi-functional capability to enforce different policy types (HIPAA, GDPR, custom) within the same system, allowing privacy customization without proportionally increasing management complexity through standardized policy interfaces.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Object-affected harmful factors

If data is kept confidential through encryption and access restrictions, then security is improved, but algorithm developers cannot access the data for training

Engineering Contradiction:

Improvedata security protectionVSAvoiddata accessibility for training

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The system performs preliminary actions by pre-configuring secure enclaves with embedded algorithms and access controls before data processing begins. This preliminary setup allows algorithm developers to have their algorithms pre-loaded and configured within the secure environment, making the data accessible for training through the established secure channels without compromising security during the actual processing operation.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20250371185A1Systems and methods for dynamic policy generation and compliance in a trusted computing environment

Publication Date: 2025.12.04 BEEKEEPERAI INC

AI summary

Systems and methods related to the generation and application of dynamic policies in a zero-trust computing environment are provided. In some embodiments, the method of dynamic policy application comprises receiving a query. Data and an algorithm are then processed in response to the query on a runtime server within a trusted computing environment to generate a result. A dynamic outbound policy is generated responsive to a data steward. It is used to validate the result. The result may be shared as output when the result meets the criteria of the dynamic outbound policy, otherwise the result may be rejected when the result fails to meet the criteria of the dynamic outbound policy. In addition to the dynamic outbound policy, the query may also be subjected to an inbound policy. This process may all occur in an iterative way within a Jupyter Notebook environment.