Secure Enclave ML Processing for Malware-Resistant Data Confidentiality
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing distributed computing systems face security vulnerabilities due to malware and unauthorized access, which can compromise encrypted data and computational operations, especially in environments where secure communication is required.
Innovation Solution
Implementing secure enclaves within server hosts to perform computational operations, where encrypted service requests are decrypted and processed within a protected environment, ensuring that only authorized parties can access the shared secret and data, and results are encrypted before transmission, thereby preventing unauthorized access and data leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If encryption is used to protect data in transit and at rest, then data confidentiality is improved, but the system becomes vulnerable when malware compromises the server and accesses plaintext data and encryption keys
Solution Approach 1:
The patent divides the server memory into separate regions: a secure enclave region for storing encryption keys and sensitive data, and a non-secure region for other operations. This segmentation ensures that even if malware compromises the general server system, it cannot access the isolated secure enclave memory region where plaintext data and encryption keys are stored.
Solution Approach 2:
The patent introduces a secure enclave as an intermediary layer between the malware-prone server environment and the sensitive cryptographic operations. The secure enclave acts as a protected intermediary that performs encryption and decryption operations while maintaining strict isolation from other server processes, preventing malware from accessing plaintext data or compromising encryption keys.
2Reliability
If a secure enclave is implemented to prevent unauthorized access, then security against malware is improved, but the system complexity increases due to enclave establishment and management
Solution Approach 1:
The patent combines the secure enclave functionality with the existing server architecture by establishing the enclave within the server's memory space and using the server's existing cryptographic algorithms. This merging approach allows the secure enclave to leverage the server's existing resources while maintaining security isolation, reducing the need for completely separate hardware or software systems.
Solution Approach 2:
The secure enclave is designed to autonomously manage its own security operations, including self-attestation to prove its integrity to client devices, automatic key management within its isolated memory region, and autonomous execution of cryptographic operations. This self-service capability reduces the burden on external systems to manage the enclave's security complexity.
Data Source
AI summary
Methods and systems for performing a machine learning operation on a server host using a secure enclave are provided. Exemplary methods include: receiving an encrypted service request from a client host, the client host encrypting a service request to produce the encrypted service request using a shared secret, the service request specifying the machine learning operation; decrypting, in a secure enclave that is established by a secure environment, the encrypted service request using the shared secret to produce a decrypted service request; performing the machine learning operation, in the secure enclave, using the decrypted service request to generate a service result; encrypting, in the secure enclave, the service result using the shared secret to create an encrypted service result; and providing the encrypted service result to the client host, the client host decrypting the encrypted service result using the shared secret.