Trusted Execution Environment for Neural Network Training

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing machine learning technologies face challenges in protecting sensitive training data from unauthorized access and ensuring data privacy, particularly in applications like medical imaging and biometrics, where sensitive information is shared for neural network training.

Innovation Solution

A trusted execution environment (TEE) is established to store and process training data, where neural network parameters are optimized and then obscured with random noise before being shared, ensuring privacy through differential privacy mechanisms and remote attestation for verification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If training data is shared for neural network training, then model accuracy is improved, but data privacy and security are compromised

Engineering Contradiction:
Improvemodel accuracyVSAvoiddata privacy risk
Core Design Contradiction:
Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

A trusted execution environment (TEE) acts as an intermediary between data providers and the neural network training system. The TEE securely stores training data and performs training operations without exposing the raw data to external parties. The system generates trained model parameters within the TEE and exports only the processed results, not the underlying sensitive data, thus maintaining privacy while enabling accurate training.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The invention extracts only the necessary trained parameters from the training process while leaving the sensitive training data contained within the trusted execution environment. By exporting only the finalized model parameters and not the intermediate or raw training data, the system achieves the goal of sharing training outcomes without compromising data privacy.

Inventive Principle:
Principle #2Taking out (Extraction)

2Object-affected harmful factors

If training data is stored securely in isolation, then data privacy is improved, but access for training purposes is restricted

Engineering Contradiction:
Improvedata privacy protectionVSAvoiddata accessibility
Core Design Contradiction:
Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The trusted execution environment serves as a controlled intermediary that manages data access. It allows the neural network training process to access training data within the secure boundary while preventing external access to the raw data. The system provides controlled access through standardized interfaces that enable training operations without compromising security.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The training data is nested within the trusted execution environment, which itself is nested within the broader system architecture. This nested structure allows the data to be accessible to specific authorized processes (the training algorithm running within the TEE) while remaining protected from external access, effectively creating a secure container that enables controlled access.

Inventive Principle:
Principle #7Nested doll (Nesting)

3Adaptability or versatility

If trained model parameters are shared, then model utility is improved, but sensitivity to training data leakage increases

Engineering Contradiction:
Improvemodel utilityVSAvoidtraining data leakage risk
Core Design Contradiction:
Adaptability or versatilityVSLoss of information

Solution Approach 1:

The system extracts only the finalized trained parameters from the trusted execution environment after the training process is complete. By exporting only the necessary model parameters and not the training data or intermediate training states, the system enables model utility while minimizing the risk of training data leakage. The extracted parameters are sufficient for inference but do not directly reveal sensitive training information.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The training process is completed entirely within the trusted execution environment before any parameters are exported. This preliminary completion of training ensures that all sensitive data processing occurs within the secure boundary, and only the finalized, processed parameters leave the secure environment, reducing the window of opportunity for data leakage.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3471005B1Artificial neural network
Publication Date: 2021.11.03 NOKIA TECHNOLOGIES OY
  • EP3471005B1 patent drawingFigure 1
  • EP3471005B1 patent drawingFigure 2
  • EP3471005B1 patent drawingFigure 3

AI summary

According to an example aspect of the present invention, there is provided an apparatus comprising a memory configured to store training data, at least one processor configured to provide a trusted execution environment, wherein the apparatus is configured to run, in the trusted execution environment, a training process configured to obtain parameters of a neural network, using the training data.