Enclave Cluster for Cloud Data Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing, clients face the challenge of maintaining data privacy as third-party cloud-service providers can view their application data due to ownership of the operating system and hardware, which is undesirable for clients seeking to keep their data private or secret.
Innovation Solution
A nested set of clusters is developed, where an enclave cluster is created within an outer cluster, with each enclave providing an encrypted environment for inner nodes to store private data, preventing the owner of the operating system and hardware from accessing the data or code, and allowing inner nodes to perform operations on the data through an exposed API without direct access by the outer cluster.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored on cloud-service provider's hardware and operating system, then data accessibility and processing capability are improved, but data privacy and security are worsened due to third-party access
Solution Approach 1:
The patent implements a nested cluster architecture where an enclave cluster is created within an outer cluster. The enclave cluster contains inner nodes that execute within hardware security enclaves, creating a nested structure of trust. This allows data to be stored and processed on cloud hardware while maintaining privacy through the nested enclave layer that isolates data from the outer cluster and third-party providers.
Solution Approach 2:
The patent introduces an intermediary layer of hardware security enclaves between the data and the outer cluster nodes. These enclaves act as mediators that allow computation to occur on encrypted data without exposing the plaintext to the operating system or hardware owner. The enclave cluster exposes an API to the outer cluster, enabling interaction while maintaining security boundaries.
2Object-affected harmful factors
If hardware security enclaves are used to protect data, then data privacy is improved, but system complexity increases due to nested cluster structure
Solution Approach 1:
The patent segments the cluster into distinct functional layers: an outer cluster for resource management and an inner enclave cluster for secure computation. Each layer has specific responsibilities, with the enclave cluster handling sensitive operations isolated within hardware enclaves. This segmentation allows complexity to be managed through modular architecture rather than monolithic design.
Solution Approach 2:
The enclave cluster is designed to perform multiple functions: data storage, encrypted computation, and API exposure to the outer cluster. The hardware security enclaves provide universal protection across different workloads and data types. This multi-functionality reduces the need for separate security mechanisms and simplifies the overall system architecture despite the nested structure.
Data Source
AI summary
Systems and methods are disclosed for protecting data. An example method includes creating an outer cluster on one or more host machines coupled to a network. The outer cluster includes a plurality of outer nodes. The method also includes creating an enclave cluster on the outer cluster. The enclave cluster includes a plurality of inner nodes, and each inner node of the plurality of inner nodes executes within an enclave of the one or more host machines. The method further includes exposing an application programming interface (API) to the outer cluster, where invocation of the API causes at least one inner node of the enclave cluster to perform an operation on data. The method also includes performing, by an inner node of the enclave cluster, the operation on the data in response to invocation of the API by an outer node of the outer cluster.