Trusted Application Segmentation for Multi-User Secure Computation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Trusted computing nodes struggle to perform computation tasks involving data from multiple users due to the inability to implement data isolation between users when using a single trusted application, leading to reduced reliability and potential data leakage.
Innovation Solution
A method where a trusted computing node determines multiple trusted applications (TAs) for a computation task, each receiving a data fragment from each user, allowing them to perform computations independently within the node's secure environment, with the node controlling the computation process and using a trusted operator for intermediate results, ensuring data isolation and high efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a trusted computing node uses a single trusted application (TA) to perform computation on data from multiple users, then computing efficiency is improved, but data isolation between users cannot be implemented leading to data leakage
Solution Approach 1:
The patent divides user data into multiple data fragments and assigns each fragment to a separate trusted application (TA). Each TA processes only its assigned data fragment, ensuring that no single TA has access to complete user data. This segmentation enables both parallel processing (improving efficiency) and data isolation (maintaining security), as each TA operates independently on its designated fragment within the trusted execution environment.
2Reliability
If a trusted computing node generates a separate TA for each user to ensure data isolation, then data security is improved, but computing efficiency deteriorates due to the need to generate multiple TAs for the same computation task
Solution Approach 1:
Instead of creating one TA per user, the patent segments data into fragments and creates one TA per fragment type. Multiple users' data fragments of the same type are processed by the same TA instance, allowing the system to reuse TAs across users for identical computation tasks. This approach maintains data isolation through fragment separation while improving efficiency through TA reuse.
Solution Approach 2:
The patent makes TAs universal by designing them to handle multiple users' data fragments of the same type. A single TA can process data fragments from any number of users as long as they require the same computation operation. This multi-functionality eliminates the need to create dedicated TAs for each user, reducing overhead while maintaining security through the fragment isolation mechanism.
3Reliability
If data is split into multiple fragments and processed by multiple TAs, then data leakage is prevented, but system complexity increases due to coordinating multiple TAs and data fragments
Solution Approach 1:
The patent introduces a trusted operator as an intermediary component that coordinates between multiple TAs and manages data fragment routing. The trusted operator receives computation requests, determines the appropriate TAs based on data fragment types, and orchestrates the computation workflow. This intermediary simplifies the system architecture by centralizing coordination logic, making the multi-TA system more manageable while maintaining data leakage prevention through controlled fragment distribution.
Data Source
AI summary
Example data security processing methods and systems are disclosed. One example data security processing method includes determining n trusted applications (TAs) for a same computation task of m pieces of user equipment. Data sent by each of the m pieces of user equipment is received, where the data sent by each user equipment is used for performing the same computation task. A data fragment set of each TA of the n TAs participating in the computation is determined, where the data fragment set of each TA includes one data fragment in the data sent by each user equipment. Each TA is controlled to perform computation based on the data fragment set of each TA. A computation result of the same computation task is determined based on a computation result of each TA.