Secure computation of multiparty data

1. A method comprising:

receiving encrypted first data and encrypted second data, each data being received from a different client server;

receiving a request to perform an operation with the first data and the second data;

verifying, by a processing device, whether the operation is authorized to be performed with the first data and the second data at a first enclave, wherein the verifying comprises:

receiving verification data of attestation data associated with the operation from a second enclave, and

determining, based on the verification data, that the operation is authorized to be performed with the first data and the second data at the first enclave;

in response to verifying that the operation is authorized to be performed with the first data and the second data at the first enclave, decrypting the encrypted first data and the encrypted second data to obtain the first data and the second data, respectively; and

performing, at the first enclave, the operation with the first data and the second data.

2. The method of claim 1 , wherein the decrypting of the encrypted first data and the encrypted second data comprises:

requesting a first encryption key for the encrypted first data and a second encryption key for the encrypted second data by providing the received verification data to a system securely storing the first encryption key and the second encryption key;

receiving the first encryption key and the second encryption key from the system; and

decrypting the encrypted first data and the encrypted second data based on the first encryption key and the second encryption key, respectively.

3. The method of claim 1 , wherein the attestation data is further associated with a hash value of an execution code of the operation.

4. The method of claim 1 , wherein the determining, based on the verification data, that the operation is authorized to be performed with the first data and the second data at the first enclave comprises:

determining a second attestation data of the received request;

determining a third attestation data of the verification data; and

determining whether the second attestation data matches the third attestation data.

5. The method of claim 1 , wherein the receiving of the encrypted first data and the encrypted second data comprises:

receiving the encrypted first data from a first client server, wherein the first client server has a restricted access to the second data; and

receiving the encrypted second data from a second client server, wherein the second client server has a restricted access to the first data.

6. The method of claim 1 , wherein the verifying of whether the operation is authorized to be performed with the first data and the second data at the first enclave comprises:

determining a data policy defining an authorized use of the operation; and

determining whether the operation is authorized to be performed with the first data and the second data based on the data policy.

7. A system comprising:

a memory; and

a processing device, operatively coupled with the memory, to:

receive encrypted first data and encrypted second data, each data being received from different client server;

receive a request to perform an operation with the first data and the second data;

verify whether the operation is authorized to be performed with the first data and the second data at a first enclave, wherein the verifying comprises:

receiving verification data of attestation data associated with the operation from a second enclave, and

determining, based on the verification data, that the operation is authorized to be performed with the first data and the second data at the first enclave;

in response to verifying that the operation is authorized to be performed with the first data and the second data at the first enclave, decrypt the encrypted first data and the encrypted second data to obtain the first data and the second data, respectively; and

perform, at the first enclave, the operation with the first data and the second data.

8. The system of claim 7 , wherein to decrypt the encrypted first data and the encrypted second data, the processing device is to:

request a first encryption key for the encrypted first data and a second encryption key for the encrypted second data by providing the received verification data to another system securely storing the first encryption key and the second encryption key;

receive the first encryption key and the second encryption key from the another system; and

decrypt the encrypted first data and the encrypted second data based on the first encryption key and the second encryption key, respectively.

9. The system of claim 7 , wherein the attestation data is further associated with a hash value of an execution code of the operation.

10. The system of claim 7 , wherein to determine, based on the verification data, that the operation is authorized to be performed with the first data and the second data at the first enclave, the processing device is to:

determine a second attestation data of the received request;

determine a third attestation data of the verification data; and

determine whether the second attestation data matches the third attestation data.

11. The system of claim 7 , wherein to receive the encrypted first data and the encrypted second data, the processing device is to:

receive the encrypted first data from a first client server, wherein the first client server has a restricted access to the second data; and

receive the encrypted second data from a second client server, wherein the second client server has a restricted access to the first data.

12. The system of claim 7 , wherein to verify whether the operation is authorized to be performed with the first data and the second data at the second enclave, the processing device is to:

determine a data policy defining an authorized use of the operation; and

determine whether the operation is authorized to be performed with the first data and the second data based on the data policy.

13. A non-transitory computer readable medium comprising data that, when accessed by a processing device, cause the processing device to perform operations comprising:

receiving encrypted first data and encrypted second data, each data being received from different client server;

receiving a request to perform an operation with the first data and the second data;

verifying whether the operation is authorized to be performed with the first data and the second data at a first enclave, wherein the verifying comprises:

receiving verification data of attestation data associated with the operation from a second enclave, and

determining, based on the verification data, that the operation is authorized to be performed with the first data and the second data at the first enclave;

in response to verifying that the operation is authorized to be performed with the first data and the second data at the first enclave, decrypting the encrypted first data and the encrypted second data to obtain the first data and the second data, respectively; and

performing, at the first enclave, the operation with the first data and the second data.

14. The non-transitory computer readable medium of claim 13 , wherein the decrypting of the encrypted first data and the encrypted second data comprises:

requesting a first encryption key for the encrypted first data and a second encryption key for the encrypted second data by providing the received verification data to a system securely storing the first encryption key and the second encryption key;

receiving the first encryption key and the second encryption key from the system; and

decrypting the encrypted first data and the encrypted second data based on the first encryption key and the second encryption key, respectively.

15. The non-transitory computer readable medium of claim 13 , wherein the attestation data is further associated with a hash value of an execution code of the operation.

16. The non-transitory computer readable medium of claim 13 , wherein the determining, based on the verification data, that the operation is authorized to be performed with the first data and the second data at the first enclave comprises:

determining a second attestation data of the received request;

determining a third attestation data of the verification data; and

determining whether the second attestation data matches the third attestation data.

17. The non-transitory computer readable medium of claim 13 , wherein the receiving of the encrypted first data and the encrypted second data comprises:

receiving the encrypted first data from a first client server, wherein the first client server has a restricted access to the second data; and

receiving the encrypted second data from a second client server, wherein the second client server has a restricted access to the first data.