Secure Processing Environment for Trusted Cloud Computation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current delegated computing systems face challenges in ensuring the secure sharing of sensitive and proprietary parameters due to trustworthiness concerns, accidental breaches, and the risk of data leakage, particularly in high-value computations like health and finance, where guarantees of privacy are essential to maintain control over data access.

Innovation Solution

Implementing a Secure Processing Environment (SPE) with secure enclave computing devices that employ attestation reports and cryptographic techniques to establish a root of trust among parties, ensuring the confidentiality and integrity of proprietary data, and using virtual machines to prevent unauthorized disclosure or damage to computing resources.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If delegated computing is implemented to enable cloud-based computational services, then computational resources and services become more accessible and scalable, but trustworthiness concerns and data leakage risks increase

Engineering Contradiction:

Improvecomputational service accessibilityVSAvoiddata security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system segments computational resources into isolated virtual machine instances, each with its own secure processing environment. This segmentation allows multiple computational services to run concurrently while maintaining strict isolation boundaries that prevent data leakage between tenants, thus enabling service accessibility while preserving data security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a trusted execution environment (TEE) as an intermediary layer between the cloud infrastructure and client data. This intermediary provides cryptographic guarantees and attestation mechanisms that enable cloud providers to process sensitive data without being able to access or leak it, resolving the trustworthiness concern while maintaining computational service accessibility.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Power

If sensitive data is shared with cloud hosts for processing, then computational capabilities are enhanced, but privacy guarantees and control over data access are compromised

Engineering Contradiction:

Improvecomputational capabilityVSAvoidprivacy control

Core Design Contradiction:

PowerVSLoss of information

Solution Approach 1:

The system implements local quality by providing customized security guarantees to each client based on their specific privacy requirements. Different virtual machine instances can enforce different access control policies, encryption schemes, and attestation levels tailored to each client's sensitivity needs, thus enhancing computational capability while maintaining granular privacy control.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent applies preliminary action by establishing cryptographic trust relationships and security policies before data is transmitted to the cloud. Clients can verify the identity and security posture of cloud hosts through attestation protocols prior to sharing data, ensuring privacy guarantees are in place before computational capabilities are utilized.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If virtual machines are used to isolate computational environments, then data confidentiality and integrity are improved, but system complexity and overhead increase

Engineering Contradiction:

Improvedata confidentialityVSAvoidsystem architecture

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements a universal virtual machine architecture that provides multiple security functions through a single standardized platform. The same virtualization infrastructure supports encryption, isolation, attestation, and resource management simultaneously, reducing overall system complexity while maintaining strong data confidentiality guarantees through multi-functional security mechanisms.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Reliability

If cryptographic techniques and attestation reports are implemented to establish trust, then security guarantees are strengthened, but computational overhead and processing time increase

Engineering Contradiction:

Improvesecurity guaranteeVSAvoidcomputational efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system applies partial action by implementing cryptographic attestation and verification only where and when needed, rather than applying full cryptographic protocols to all computational operations. Low-risk operations can proceed with minimal verification, while high-risk operations trigger comprehensive attestation, thus strengthening security guarantees where necessary while maintaining computational efficiency for routine tasks.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11698980B2System, devices and/or processes for secure computation on a virtual machine

Publication Date: 2023.07.11 ARM IP

AI summary

Briefly, example methods, apparatuses, and/or articles of manufacture are disclosed that may be implemented, in whole or in part, using one or more processing devices to facilitate and/or support participation in computing activities by multiple parties having limited mutual trust. In one embodiment, computation may occur in a secure processing environment (SPE) while one or more untrusted parties reside outside of the SPE.