Secure Cloud Enclave for Confidential Data Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud computing systems face challenges in securely processing sensitive data, as data must be decrypted to be processed, making it inaccessible to external providers while maintaining high security levels, especially when third-party processing is required.
Innovation Solution
A computer-implemented method using enclaves where a client requests and generates an enclave public key, encrypts data, and sends it to a cloud enclave for processing, ensuring the data remains encrypted and secure by using the enclave's private key for decryption within the secure environment, preventing unencrypted data exposure to external parties.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data is decrypted for processing in cloud computing systems, then data processing capability is improved, but data security deteriorates as unencrypted data becomes exposed to external providers
Solution Approach 1:
The system segments the processing environment into isolated enclave regions where data can be decrypted and processed securely. The enclave creates a segregated security domain that separates sensitive data processing from the external cloud environment, allowing productivity improvement without compromising security.
Solution Approach 2:
The enclave acts as an intermediary between the external cloud provider and the sensitive data. It receives encrypted data from external providers, processes it in a secure isolated environment, and returns results without exposing the actual data to external parties. This mediator enables third-party processing while maintaining confidentiality.
2Reliability
If data is kept encrypted to maintain security, then data security is improved, but data processing capability deteriorates as external providers cannot access the data
Solution Approach 1:
Data is encrypted in advance before being sent to external providers. The encryption is performed preliminarily, allowing external providers to receive and process the encrypted data through the enclave without needing access to unencrypted data, thus maintaining security while enabling processing capability.
Solution Approach 2:
The system changes the state parameter of data from encrypted to decrypted only within the secure enclave environment. This parameter change is localized and temporary, occurring only where security conditions are satisfied, thereby enabling processing while maintaining overall security.
3Adaptability or versatility
If data is transferred to third-party external providers for processing, then processing flexibility is improved, but data confidentiality deteriorates as data must be accessible to external parties
Solution Approach 1:
The enclave serves as a confidential intermediary that receives data from external providers for processing. It maintains data confidentiality by ensuring external providers never access unencrypted data, while still allowing them to perform processing operations through secure interfaces.
Solution Approach 2:
The system works with encrypted data copies throughout the external transfer and processing pipeline. Only the enclave possesses and uses the decrypted version, allowing external providers to operate on data representations without exposing the actual confidential information.
Data Source
AI summary
The present invention provides a secure method for outsourcing data analysis to a third party without the third party being able to access the data in clear. In the present invention, the client's data is never written to disk, this feature provides the security. The data is decrypted and processed in the enclave which ensures that the data is secure and hidden at all times when it is visible “in clear”.