Technologies for privacy-preserving security policy evaluation
Technologies for privacy-safe security policy evaluation are disclosed herein. An example apparatus includes at least one processor, and memory including instructions that, when executed, cause the at least one processor to curry a security policy function to generate a privacy-safe curried function set, the security policy function to generate a security policy as a function of a plurality of policy parameters, the privacy-safe curried function set including a non-sensitive function that receives a non-sensitive parameter of the plurality of policy parameters as an argument, the privacy-safe curried function set further including a sensitive function that receives a sensitive parameter of the plurality of policy parameters as an argument; access unencrypted parameter data corresponding to the non-sensitive parameter of the plurality of policy parameters; evaluate the non-sensitive function of the privacy-safe curried function set to generate the sensitive function; and provide the sensitive function to a client computing device.
1. An apparatus for performing privacy-safe cloud threat analysis, the apparatus comprising:
at least one processor; and
memory including instructions that, when executed, cause the at least one processor to:
curry a security policy function to generate a privacy-safe curried function set, the security policy function to generate a security policy based on a plurality of policy parameters, the privacy-safe curried function set including one or more first functions having a respective non-sensitive parameter of the plurality of policy parameters as respective first arguments, and the privacy-safe curried function set further including one or more second functions having a respective sensitive parameter of the plurality of policy parameters as respective second arguments;
access unencrypted parameter data corresponding to one or more of the non-sensitive parameters;
evaluate the one or more first functions with the unencrypted parameter data to generate the one or more second functions; and
provide the one or more second functions to a client computing device.
2. The apparatus of claim 1 , wherein the at least one processor is to access a client data classification policy, the client data classification policy to identify the one or more of the non-sensitive parameters and one or more of the sensitive parameters.
3. The apparatus of claim 1 , wherein the at least one processor is to determine the security policy function.
4. The apparatus of claim 1 , wherein the at least one processor is to:
access encrypted parameter data corresponding to one or more of the sensitive parameters; and
provide the encrypted parameter data to the client computing device.
5. The apparatus of claim 1 , wherein the at least one processor is to access the unencrypted parameter data from a trusted mediator device.
6. The apparatus of claim 1 , wherein the at least one processor is to access the unencrypted parameter data from an external data source.
7. The apparatus of claim 1 , wherein the at least one processor is to provide the one or more second functions to the client computing device via a trusted mediator device.
8. The apparatus of claim 1 , wherein the at least one processor is to negotiate the security policy with the client computing device in response to providing the one or more second functions to the client computing device.
9. The apparatus of claim 1 , wherein the at least one processor is to:
curry the security policy function at a trusted execution environment of the apparatus;
access the unencrypted parameter data at the trusted execution environment;
evaluate the one or more first functions at the trusted execution environment; and
provide the one or more second functions from the trusted execution environment.
10. The apparatus of claim 9 , wherein the trusted execution environment includes a secure enclave established by secure enclave support of the apparatus.
11. At least one machine readable storage medium comprising instructions that, when executed, cause at least one processor to at least:
curry a security policy function to generate a privacy-safe curried function set, the security policy function to generate a security policy as a function of a plurality of policy parameters, the privacy-safe curried function set including one or more first functions that receive a respective non-sensitive parameter of the plurality of policy parameters as an argument, and the privacy-safe curried function set further including one or more second functions that receive a respective sensitive parameter of the plurality of policy parameters as a different argument;
access unencrypted parameter data corresponding to one or more of the non-sensitive parameters of the plurality of policy parameters;
evaluate the one or more first functions of the privacy-safe curried function set with the unencrypted parameter data to generate the one or more second functions; and
provide the one or more second functions of the privacy-safe curried function set to a client computing device.
12. The at least one machine readable storage medium of claim 11 , wherein the instructions, when executed, cause the at least one processor to access a client data classification policy, the client data classification policy is to identify the one or more of the non-sensitive parameters and one or more of the sensitive parameters of the plurality of policy parameters.
13. The at least one machine readable storage medium of claim 11 , wherein the instructions, when executed, cause the at least one processor to determine the security policy function.
14. The at least one machine readable storage medium of claim 11 , wherein the instructions, when executed, cause the at least one processor to at least:
access encrypted parameter data corresponding to one or more of the sensitive parameters; and
provide the encrypted parameter data to the client computing device.
15. The at least one machine readable storage medium of claim 11 , wherein the instructions, when executed, cause the at least one processor to access the unencrypted parameter data from a trusted mediator device.
16. The at least one machine readable storage medium of claim 11 , wherein the instructions, when executed, cause the at least one processor to access the unencrypted parameter data from an external data source.
17. The at least one machine readable storage medium of claim 11 , wherein the instructions, when executed, cause the at least one processor to provide the one or more second functions to the client computing device via a trusted mediator device.
18. The at least one machine readable storage medium of claim 11 , wherein the instructions, when executed, cause the at least one processor to negotiate the security policy with the client computing device in response to providing the one or more second functions to the client computing device.
19. The at least one machine readable storage medium of claim 11 , wherein the instructions, when executed, cause the at least one processor to at least:
curry the security policy function at a trusted execution environment associated with the at least one processor;
access the unencrypted parameter data at the trusted execution environment;
evaluate the one or more first functions of the privacy-safe curried function set at the trusted execution environment; and
provide the one or more second functions from the trusted execution environment.
20. A method for privacy-safe cloud threat analysis, the method comprising:
currying, by executing an instruction with at least one processor, a security policy function to generate a privacy-safe curried function set, the security policy function to generate a security policy as a function of a plurality of policy parameters, the privacy-safe curried function set including one or more non-sensitive functions that receive a respective non-sensitive parameter of the plurality of policy parameters as respective first arguments, and the privacy-safe curried function set further including one or more sensitive functions that receive a respective sensitive parameter of the plurality of policy parameters as respective second arguments;
accessing, by executing an instruction with the at least one processor, parameter data corresponding to one or more of the non-sensitive parameters of the plurality of policy parameters, the parameter data being unencrypted;
evaluating, by executing an instruction with the at least one processor, the one or more non-sensitive functions of the privacy-safe curried function set with the parameter data to generate the one or more sensitive functions; and
transmitting, by executing an instruction with the at least one processor, the one or more sensitive functions of the privacy-safe curried function set to a client computing device.