Secure computing systems and methods
The present disclosure relates to systems and methods for facilitating trusted handling of genomic and/or other sensitive information. Certain embodiments may use a virtualized execution environment to execute code and/or programs that wish to access and/or otherwise use genomic and/or other sensitive information. In some embodiments, data requests from the code and/or programs may be routed through a transparent data access proxy configured to transform requests and/or associated responses to protect the integrity of the genomic and/or other sensitive information.
1. A method for performing trusted computations on sensitive data performed by a first system comprising a processor and a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the first system to perform the method, the method comprising:
receiving, from an application executing on a remote system different than the first system by an interface of the first system, a request to access a genomic data set stored within a protected execution environment of the first system;
transforming the request using execution context information associated with the application to generate a secure request to access the genomic data set;
sending the generated secure request to access the genomic data set to a data store storing the genomic data set associated with the protected execution environment;
receiving a secure response to the secure request from the data store associated with the protected execution environment;
transforming the secure response using the execution context information to generate a response to the request to access the genomic data set; and
transmitting the generated response to the remote system.
2. The method of claim 1 , wherein the request identifies the genomic data set and transforming the request to generate the secure request comprises identifying at least a subset of the genomic data set in the secure request.
3. The method of claim 2 , wherein the at least a subset of the genomic data set in the secure request is identified based, at least in part, on one or more identities associated with the genomic data set.
4. The method of claim 1 , wherein transforming the secure response to generate the response to the request to access the genomic data set comprises removing at least a portion of the secure response when generating the response to the request to access the genomic data set.
5. The method of claim 4 , wherein the at least a portion of the secure response is based, at least in part, on one or more identities associated with the genomic data set.
6. The method of claim 1 , wherein the transforming the request to generate the secure request is based, at least in part, on information associated with a user of the application executing on the remote system.
7. The method of claim 1 , wherein transforming the secure response to generate the response is based, at least in part, on information associated with a user of the application executing on the remote system.
8. The method of claim 1 , wherein transforming the secure response to generate the response comprises transforming the secure response using transformation data to generate the response.
9. The method of claim 1 , wherein the interface comprises an application programming interface.
10. The method of claim 1 , wherein the method further comprises accessing the execution context information associated with the application from the protected execution environment.
11. The method of claim 1 , wherein the method further comprises:
identifying a policy associated with the request to access the genomic data set; and
wherein generating the secure request is further based on the identified policy.
12. The method of claim 11 , wherein the policy is identified based on the genomic data set.
13. The method of claim 11 , wherein the policy is identified based on a user of the application executing on the remote system.
14. The method of claim 1 , wherein the data store comprises a local data store.
15. The method of claim 1 , wherein the data store comprises a distributed data store.
16. The method of claim 1 , wherein the request to access the genomic data set comprises a request for a result to be generated based on the genomic data set.
17. The method of claim 1 , wherein the request to access the genomic data set comprises a request for a determination of whether the genomic data set comprises a specified variant.
18. The method of claim 1 , wherein the response comprises a Boolean response.
19. The method of claim 1 , wherein the method further comprises storing an audit information record associated with the request to access the genomic data set.
20. The method of claim 1 , wherein the method further comprises storing an audit information record associated with the response.