Data security
A data processing system is provided, which comprises receiving circuitry for receiving, from a requester, a request to use decrypted data obtained by decrypting encrypted data. Trusted execution circuitry provides a trusted execution environment. The trusted execution circuitry is configured to: securely store a policy, acquire a key within the trusted execution environment, where the key is associated with the decrypted or encrypted data, and respond to the request based on the policy and one or more characteristics of the requester.
1. A data processing system comprising:
receiving circuitry configured to receive, from a requester, a request for the requester to use decrypted data obtained by decrypting encrypted data;
trusted execution circuitry configured to provide a trusted execution environment, wherein the trusted execution circuitry is configured to:
securely store a policy;
acquire a key within the trusted execution environment, wherein the key is associated with the decrypted or encrypted data; and
in response to the request and based on one or more characteristics of the requester and the policy, performing decryption on the encrypted data and transmitting the decrypted data to the requester.
2. The data processing system according to claim 1 , comprising:
storage circuitry configured to store the encrypted data.
3. The data processing system according to claim 1 , wherein
the trusted execution environment is immutable.
4. The data processing system according to claim 1 , wherein
the policy is stored securely by storing the policy within the trusted execution environment.
5. The data processing system according to claim 1 , wherein
the trusted execution circuitry is configured to obtain attestation of the trusted execution environment.
6. The data processing system according to claim 5 , wherein
the trusted execution circuitry is configured to obtain the attestation by providing a digitally signed checksum or hash that corresponds with the trusted execution environment to a provider of the data.
7. The data processing system according to claim 5 , wherein
in response to a failure to obtain the attestation of the trusted execution environment, the trusted execution circuitry is configured to perform an error action.
8. The data processing system according to claim 7 , wherein
the error action is to inhibit execution of the trusted execution environment.
9. The data processing system according to claim 6 , wherein
the checksum or hash corresponds with the trusted execution environment and a challenge received from the provider of the data; and
the digitally signed checksum or hash is signed such that an origin of the checksum or hash can be authenticated.
10. The data processing system according to claim 1 , wherein
the request identifies a function to be performed on the decrypted data by the trusted execution circuitry to produce a result; and
the trusted execution circuitry configured to respond to the request by providing the result based on the policy and one or more characteristics of the requester.
11. The data processing system according to claim 10 , wherein
the trusted execution circuitry configured to respond to the request by providing the result without providing the decrypted data based on the policy and the one or more characteristics of the requester.
12. The data processing system according to claim 1 , wherein
the trusted execution circuitry is configured to accept and respond to the request when the one or more characteristics of the requester correspond with one or more required characteristics specified by the policy.
13. The data processing system according to claim 12 , wherein
the one or more required characteristics comprise that the requester is a further trusted execution environment.
14. The data processing system according to claim 13 , wherein
the one or more required characteristics comprise that attestation of the further trusted execution environment has been performed by the trusted execution environment.
15. A computer-implemented data processing method comprising:
receiving from a requester, a request for the requester to use decrypted data obtained by decrypting encrypted data;
providing a trusted execution environment, wherein the trusted execution environment:
securely stores a policy;
acquires a key, wherein the key is associated with the decrypted or encrypted data; and
in response to the request and based on one or more characteristics of the requester and the policy, performing decryption on the encrypted data and transmitting the decrypted data to the requester.
16. A data processing system comprising:
means for receiving from a requester, a request for the requester to use decrypted data obtained by decrypting encrypted data;
means for providing a trusted execution environment;
means for securely storing a policy;
means for acquiring a key within the trusted execution environment, wherein the key is associated with the decrypted or encrypted data; and
means for, in response to the request and based on one or more characteristics of the requester and the policy, performing decryption on the encrypted data and transmitting the decrypted data to the requester.