Federated ML Orchestration Using TEEs for Data Confidentiality

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing machine learning systems face challenges in preserving data confidentiality and privacy during collaborative analytics among different entities, especially when sensitive data is involved, leading to regulatory constraints and cybersecurity risks.

Innovation Solution

A federated machine learning orchestration environment with secure enclaves and trusted execution environments (TEEs) is implemented, enabling secure data processing and model training without direct access to sensitive data, using encrypted data embeddings and access control mechanisms to protect data confidentiality.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If centralized machine learning processing is used, then model training and inference can be performed efficiently, but data confidentiality and privacy are compromised

Engineering Contradiction:

Improvemachine learning processing efficiencyVSAvoiddata confidentiality risk

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system divides the machine learning processing into segmented components: local processing at data custodian sites and centralized aggregation at the orchestrator. Local models process data independently within secure enclaves, while only aggregated results are shared centrally, maintaining both efficiency and confidentiality

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Trusted execution environments (TEEs) and secure enclaves act as intermediaries between data custodians and the central orchestrator. These intermediaries enable processing while protecting data, allowing collaborative analytics without direct data exposure

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If data is shared for collaborative analytics, then insights and predictive capabilities improve, but privacy between parties is compromised

Engineering Contradiction:

Improveanalytics accuracyVSAvoiddata privacy

Core Design Contradiction:

Measurement precisionVSLoss of information

Solution Approach 1:

The system extracts only the necessary information for collaborative analytics while leaving sensitive data local. Models process data locally and exchange only aggregated results or embeddings, extracting value from data without transferring the data itself

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Instead of sharing original data, the system uses copies of processed information such as model embeddings, gradients, or aggregated statistics. These copies enable collaborative analytics while the original sensitive data remains localized and protected

Inventive Principle:

Principle #26Copying

3Reliability

If secure enclave processing is implemented, then data protection is enhanced, but system complexity increases

Engineering Contradiction:

Improvedata protectionVSAvoidsystem architecture

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The secure enclave framework provides multi-functional protection: it enables data encryption, model execution, aggregation coordination, and communication security within a single unified system. This universal approach simplifies implementation compared to multiple separate security layers

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS20250363202A1System and method for privacy preserving federated machine learning

Publication Date: 2025.11.27 ROYAL BANK OF CANADA

AI summary

An improved approach for confidential federated machine learning and in particular, federated inference is proposed that is configured for coordinated interoperation of local computing instances that are separate from one another that operate with a model aggregator, and there are separate global and local model data architectures that are being updated periodically. Confidential embeddings in the form of representations of determined gradients determined based on local training using local data, for example, are passed securely between instances.