Verified social media content
There is disclosed in one example a social media server, including: a processor; a trusted input/output (IO) interface to communicatively couple to a consumer device; a network interface to communicatively couple to an enterprise; and a memory having stored thereon executable instructions to instruct the processor to provide a data loss prevention (DLP) engine to: receive via the trusted IO interface a signed and encrypted user posting for the social media service, the user posting including a signed user state report verifying that the user has passed a biometric screening; transmit content of the user posting to the enterprise via the network interface for DLP analysis; receive from the enterprise a notification that the user posting has passed DLP analysis; and accept the user posting.
1. A social media server, comprising:
a processor;
a trusted input/output (IO) interface to communicatively couple to a consumer device;
a network interface to communicatively couple to an enterprise; and
a memory having stored thereon executable instructions to instruct the processor to provide a data loss prevention (DLP) engine to:
receive via the trusted IO interface a signed and encrypted user posting for the social media service, the user posting including a signed user state report verifying that the user has passed a biometric screening;
transmit content of the user posting to the enterprise via the network interface for DLP analysis;
receive from the enterprise a notification that the user posting has passed DLP analysis; and
accept the user posting.
2. The social media server of claim 1 , wherein the DLP engine is further to receive from the enterprise a notification that the user posting has failed DLP analysis and to reject the user posting.
3. The social media server of claim 1 , wherein the DLP engine is further to determine that the user posting does not include a signed user state report, and to reject the user posting.
4. The social media server of claim 1 , wherein the trusted IO interface includes a protected audio video path (PAVP).
5. The social media server of claim 1 , further comprising a trusted execution environment (TEE).
6. The social media server of claim 5 , wherein the DLP engine is further to perform direct anonymous attestation (DAA) with the user device to authenticate the user device.
7. The social media server of claim 6 , wherein the DAA comprises an exchange of endorsement keys.
8. The social media server of claim 7 , wherein the TEE comprises a zero-knowledge proof engine to authenticate the user device without compromising privacy of the user device.
9. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions to provide a data loss prevention (DLP) engine configured to:
receive via a trusted input/output (IO) channel a secured user posting for a social media service, the user posting including a user state report verifying that the user meets a minimum biometric profile;
transmit content of the user posting to an enterprise for DLP analysis;
receive from the enterprise a notification that the user posting has passed DLP analysis; and
accept the user posting.
10. The one or more tangible, non-transitory computer-readable mediums of claim 9 , wherein the DLP engine is further configured to receive from the enterprise a notification that the user posting has failed DLP analysis and to reject the user posting.
11. The one or more tangible, non-transitory computer-readable mediums of claim 9 , wherein the DLP engine is further configured to determine that the user posting does not include a signed user state report, and to reject the user posting.
12. The one or more tangible, non-transitory computer-readable mediums of claim 9 , wherein the trusted IO channel includes a protected audio video path (PAVP).
13. The one or more tangible, non-transitory computer-readable mediums of claim 9 , wherein the instructions are further to provision a trusted execution environment (TEE).
14. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the DLP engine is further configured to perform direct anonymous attestation (DAA) with a user device to authenticate the user device.
15. The one or more tangible, non-transitory computer-readable mediums of claim 14 , wherein the DAA comprises an exchange of endorsement keys.
16. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the TEE comprises a zero-knowledge proof engine to authenticate the user device without compromising privacy of a user providing the posting.
17. A computer-implemented method of providing enterprise data loss prevention (DLP) for a social media service, comprising:
receiving via a trusted input/output (IO) path a posting for the social media service, the user posting accompanied by a state report verifying that the user has passed a non-authentication biometric screening;
extracting content from the posting;
transmitting the content to an enterprise for DLP analysis;
receiving from the enterprise a certification that the user posting has passed DLP analysis; and
providing the user posting to the social media service.
18. The method of claim 17 , further comprising receiving from the enterprise a notification that the user posting has failed DLP analysis and to reject the user posting.
19. The method of claim 17 , further comprising determining that the user posting does not include a state report, and to reject the user posting.
20. The method of claim 19 , wherein the state report is signed and encrypted.