Trusted Hardware Isolating Sensitive Data Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional encryption schemes in cloud computing environments make it difficult to perform computations on sensitive data without decrypting it, leading to inefficient use of secure computational power and bandwidth, and pose challenges in providing a secure database-as-a-service paradigm.
Innovation Solution
The implementation of trusted hardware with dedicated secure processing units that simulate homomorphic encryption by migrating expression evaluation away from untrusted components, using custom-designed or reconfigured hardware to enhance security and resource utilization, and implementing data-centric primitives for secure data processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption schemes are used to protect sensitive data in cloud computing environments, then data security is improved, but computation performance deteriorates because data must be decrypted to perform computations
Solution Approach 1:
The patent introduces a trusted hardware device as an intermediary between the cloud database management system and the client. This device contains secure processing units that can evaluate expressions on encrypted data without full decryption, acting as a mediator that enables computation while maintaining encryption. The trusted hardware receives encrypted data from the cloud, performs secure expression evaluation, and returns results without exposing plaintext data to untrusted components.
2Reliability
If resource-limited devices are used for security processing, then security is maintained, but computational capacity and storage capacity are insufficient leading to overload
Solution Approach 1:
The patent segments the processing architecture into multiple components: untrusted cloud database management system components for general data operations, and dedicated secure processing units within trusted hardware for security-critical expression evaluation. This segmentation allows the secure processing units to be specifically optimized for security functions while the broader system maintains high computational capacity through commodity hardware.
3Reliability
If dedicated secure processing units are implemented in trusted hardware, then secure data processing is improved, but device complexity increases
Solution Approach 1:
The patent extracts the security-critical expression evaluation functionality from the general-purpose cloud database management system and places it in dedicated secure processing units within trusted hardware. This extraction isolates the complex security processing in specialized units while the main system remains simpler and more versatile. The secure processing units handle only the specific task of evaluating expressions on encrypted data, reducing overall system complexity.
Data Source
AI summary
Methods, systems, and computer-readable media are directed towards receiving, at an untrusted component, a query for a data store. The query includes a plurality of data operations. The data store is accessible by the untrusted component. A first proper subset of data operations is determined from the plurality of data operations that do not access sensitive data within the data store. A second proper subset of data operations is determined from the plurality of data operations that access sensitive data within the data store. The first proper subset of data operations is executed, at the untrusted component, to create first results. The second proper subset of data operations is sent to a trusted component for execution. Second results based on the sending the second proper subset of data operations are received from the trusted component. Results to the query are returned based on the first results and the second results.