Program Execution in a Secure Region for Cross-Party Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional confidential computing techniques do not prevent data leakage to the program provider and program leakage to the data holder when different users hold the data and programs.

Innovation Solution

A program execution system with a data holding apparatus, program providing apparatus, and data processing apparatus that uses encrypted data and programs, processed in a secure region with common and public keys to ensure confidentiality, preventing data and program leakage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional confidential computing techniques are used to process data in a cloud, then data confidentiality is improved, but program confidentiality and data leakage prevention to program provider are worsened

Engineering Contradiction:

Improvedata confidentialityVSAvoidprogram leakage to data holder

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The system segments the computing process into distinct confidential regions: one for data processing and another for program execution. By separating the data holder's confidential data from the program provider's confidential program into different secure enclaves, the system prevents cross-contamination and information leakage while maintaining data confidentiality.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a trusted execution environment as an intermediary between the data holder and program provider. This mediator enables secure collaboration by providing controlled access mechanisms where neither party can directly access the other's confidential information, thus preventing program leakage while maintaining data security.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If data and program are kept secret in separate confidential computing systems, then individual confidentiality is improved, but collaborative processing capability is worsened

Engineering Contradiction:

Improveprogram confidentialityVSAvoidcollaborative processing capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The trusted execution environment provides universal security mechanisms that support multiple collaborative scenarios. The same secure enclave infrastructure can handle various types of confidential computations involving different data and program combinations, enabling versatile collaborative processing while maintaining individual confidentiality for each participant.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The trusted execution environment acts as a universal intermediary that enables different confidential computing systems to collaborate. It provides standardized interfaces and protocols that allow separate confidential systems to work together on joint computations without compromising their individual security boundaries.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Loss of information

If encrypted data and programs are transmitted to data processing apparatus, then confidentiality during transmission is improved, but decryption and execution security are worsened

Engineering Contradiction:

Improvedata leakage during transmissionVSAvoidexecution security in secure region

Core Design Contradiction:

Loss of informationVSReliability

Solution Approach 1:

The system performs preliminary encryption of data and programs before transmission using recipient-specific keys. The encrypted forms are transmitted securely, and decryption occurs only within the trusted execution environment after authentication, ensuring that sensitive information remains protected during transmission and only becomes accessible in the secure execution region.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent applies different security measures to different parts of the system: strong encryption during transmission, authenticated decryption at the boundary, and isolated execution within secure enclaves. Each region has tailored security properties appropriate to its function, with the secure region providing enhanced protection for the actual computation.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS12407496B2Program execution system, data processing apparatus, program execution method and program

Publication Date: 2025.09.02 NT T INC

AI summary

A program execution system includes a data holding apparatus, a program providing apparatus, and a data processing apparatus that performs computing in a secure region. The data holding apparatus transmits encrypted data, encrypted with a first common key, to the data processing apparatus, and the program providing apparatus transmits an encrypted program, encrypted with a second common key, to the data processing apparatus. In the secure region, the data processing apparatus acquires data by decrypting the encrypted data with the first common key, acquires a program by decrypting the encrypted program with the second common key, executes the program for the data, and encrypts a result of the execution with a public key of the data holding apparatus or the first common key. The data holding apparatus acquires the result of the execution by decrypting the encrypted result of the execution with a secret key or the first common key.