Techniques for shared private data objects in a trusted execution environment
Techniques for sharing private data objects in a trusted execution environment using a distributed ledger are described. The techniques described herein may enable sharing of data objects, referred to herein as private data objects (PDOs), between individuals and organizations with access and update policies mediated by execution of code (referred to herein as a “smart contract”) carried with the PDO in a secure enclave. A distributed ledger may serve as a “public commit log” to ensure that there is a single, authoritative instance of the object and provide a means of guaranteeing atomicity of updates across interacting objects.
1. A computer-implemented method for sharing private data objects, comprising:
requesting a private data object (PDO) from a distributed ledger;
receiving the PDO from the distributed ledger;
selecting a contract enclave configured to interact with the PDO; and
submitting the PDO to the contract enclave.
2. The computer-implemented method of claim 1 , comprising:
submitting a method invocation to the contract enclave;
receiving, from the contract enclave, a new iteration of the PDO, one or more signed state transitions, and one or more method parameters; and
submitting, to the distributed ledger, the new iteration of the PDO, the one or more signed state transitions, and the one or more method parameters.
3. The computer-implemented method of claim 1 , comprising provisioning the contract enclave.
4. The computer-implemented method of claim 1 , wherein the PDO includes one or more rights managed within a contract manager.
5. The computer-implemented method of claim 4 , wherein the contract manager executes exclusively within the contract enclave.
6. The computer-implemented method of claim 4 , wherein the one or more rights includes a limitation on data visibility.
7. The computer-implemented method of claim 1 , wherein the distributed ledger is used as a data commit log and is configured to allow, at most, a single authoritative instance of the PDO.
8. The computer-implemented method of claim 1 , wherein the PDO includes a non-deterministic smart contract.
9. An apparatus for sharing private data objects, comprising:
memory comprising instructions; and
circuitry coupled to the memory, wherein the instructions when executed by the circuitry cause the circuitry to:
request a private data object (PDO) from a distributed ledger;
receive the PDO from the distributed ledger;
select a contract enclave configured to interact with the PDO; and
submit the PDO to the contract enclave.
10. The apparatus of claim 9 , wherein the instructions when executed by the circuitry further cause the circuitry to:
submit a method invocation to the contract enclave;
receive, from the contract enclave, a new iteration of the PDO, one or more signed state transitions, and one or more method parameters; and
submit, to the distributed ledger, the new iteration of the PDO, the one or more signed state transitions, and the one or more method parameters.
11. The apparatus of claim 9 , wherein the instructions when executed by the circuitry further cause the circuitry to provision the contract enclave.
12. The apparatus of claim 9 , wherein the PDO includes one or more rights managed within a contract manager.
13. The apparatus of claim 12 , wherein the contract manager executes exclusively within the contract enclave.
14. The apparatus of claim 12 , wherein the one or more rights includes a limitation on data visibility.
15. The apparatus of claim 9 , wherein the distributed ledger is used as a data commit log and is configured to allow, at most, a single authoritative instance of the PDO.
16. The apparatus of claim 9 , wherein the PDO includes a non-deterministic smart contract.
17. At least one non-transitory computer-readable storage medium that stores instructions for execution by processing circuitry of a client device, the instructions to cause the client device to:
request a private data object (PDO) from a distributed ledger;
receive the PDO from the distributed ledger;
select a contract enclave configured to interact with the PDO; and
submit the PDO to the contract enclave.
18. The at least one non-transitory computer-readable storage medium of claim 17 , further comprising instructions to cause the client device to:
submit a method invocation to the contract enclave;
receive, from the contract enclave, a new iteration of the PDO, one or more signed state transitions, and one or more method parameters; and
submit, to the distributed ledger, the new iteration of the PDO, the one or more signed state transitions, and the one or more method parameters.
19. The at least one non-transitory computer-readable storage medium of claim 17 , further comprising instructions to cause the client device to provision the contract enclave.
20. The at least one non-transitory computer-readable storage medium of claim 17 , wherein the PDO includes one or more rights managed within a contract manager.
21. The at least one non-transitory computer-readable storage medium of claim 20 , wherein the contract manager executes exclusively within the contract enclave.
22. The at least one non-transitory computer-readable storage medium of claim 20 , wherein the one or more rights includes a limitation on data visibility.
23. The at least one non-transitory computer-readable storage medium of claim 17 , wherein the distributed ledger is used as a data commit log and is configured to allow, at most, a single authoritative instance of the PDO.
24. The at least one non-transitory computer-readable storage medium of claim 17 , wherein the PDO includes a non-deterministic smart contract.