TLS-Backed Attestation of Private Web-Service Data Properties
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in providing a verified attestation of private data properties from web services without modifying the web services or exposing the private data, as TLS protocols do not provide sufficient artifacts for third-party verification.
Innovation Solution
A system and method utilizing a secure enclave module to retrieve and process private data, combining TLS artifacts with secure enclave-generated attestation, ensuring the enclave's security and computation integrity without revealing the data, and using a verification server to validate the attestation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If TLS protocol is used to encrypt web service communication, then data confidentiality is improved, but third-party verification capability deteriorates
Solution Approach 1:
The patent segments the verification process by extracting specific artifacts (TLS certificates, MAC signatures, encrypted data metadata) from the complete TLS communication stream. This segmentation allows third parties to verify specific properties of the communication without accessing the encrypted payload, thus maintaining confidentiality while enabling verification.
Solution Approach 2:
The patent introduces an intermediary verification mechanism where TLS artifacts serve as mediators between the encrypted communication and third-party verifiers. These artifacts (certificates, signatures) act as trusted intermediaries that prove data properties without revealing the actual encrypted content, resolving the contradiction between confidentiality and verifiability.
2Reliability
If web service is modified to digitally sign responses, then verification capability is improved, but system complexity and deployment difficulty increase
Solution Approach 1:
The patent applies self-service by utilizing the existing TLS infrastructure to automatically generate verification artifacts. The web service itself creates the certificates and signatures as part of the normal TLS handshake process, without requiring additional signing services or complex external verification systems. This self-service approach maintains verification capability while minimizing added complexity.
Solution Approach 2:
The patent makes the TLS protocol multi-functional by enabling it to serve both its traditional encryption/authentication purpose and an additional verification purpose. The same TLS artifacts that provide secure communication also serve as verification proofs, eliminating the need for separate signing mechanisms and reducing overall system complexity.
3Measurement precision
If private data is revealed to third parties for verification, then verification accuracy is improved, but data privacy is worsened
Solution Approach 1:
The patent extracts only the necessary verification artifacts (TLS certificates, MAC signatures, metadata) from the complete data communication, separating these verification elements from the private encrypted payload. This extraction allows third parties to verify data properties with high accuracy using only the public artifacts, while the private data remains completely hidden and unreadable.
Data Source
AI summary
A system and method for providing verified privacy-preserving attestations of requisite properties of private data stored on a web server is disclosed. An untrusted host mediates secure communication for a secure enclave with a data owner device and the web server. A secure enclave verification server provides an attestation to the data owner device that the secure enclave module is secure and has a valid trusted computing base (TCB). The data owner module provides credentials to access the private data to the secure enclave, which retrieves the data and calculates the requisite properties. The secure enclave produces an attestation envelope, which is verified by an attestation envelope verification module. Combining the certificates and keys generated during a TLS handshake between the secure enclave and the web server enables a proof that the data coming into the enclave was from a standard (unmodified) web server API provided by the web server.