Granted Patent B2

US 12,511,435 · App. 17/243,963 · Granted Dec 30, 2025

Inventors: Dan Touitou (Munich, DE); Avigail Oron (Hod Hasharon, IL)

Assignee: HUAWEI CLOUD COMPUTING TECHNOLOGIES CO., LTD.

G06F21/6254G06F21/44G06F21/53G06F21/602G06F2221/2149

Abstract

Claims (54)

1 . A data access device for enforcing a data policy, comprising a processor configured to implement a trusted execution environment (TEE) in a secure area of the processor, and a memory comprising computer program code that, when executed by the processor, configures the processor to implement, in the TEE, steps of:

receiving a first data comprising a request for handling data, and a target identification (ID);

processing the first data to attain a second data comprising the target ID and a data structure according to requirements of an application running in the data access device;

manipulating, by a data exposure enforcement (DEE) process operating on the processor in the TEE, the second data according to a data exposure policy (DEP) to attain a third data, comprising sanitizing the second data by identifying one or more fields in the second data that are affected by the DEP and performing one or more of: dropping, masking, or encrypting the one or more fields based on identification of the one or more fields as being affected by the DEP, wherein said one or more fields constitute less than all of the second data and wherein performing the one or more of: dropping, masking, or encrypting the one or more fields is applied to less than all of the second data; and

outputting the third data, wherein

the request for handling data comprises the request to provide data to the application or to retrieve data from the application,

the DEP is a set of instructions to control the processor, and the instructions comprise:

anonymization instructions to identify data in the second data to be anonymized by identifying the according identification fields in the data structure;

exposure instructions to identify other data in the second data meant to be exposed and to instruct to which target IDs and how the identified other data is to be exposed; and

an aggregation policy to control the aggregation of data of a specific data type in the second content data before further processing is performed, and

wherein any instruction in the set of instructions is executed depending on any of the target IDs, and

the processor is further configured to:

calculate a permitted amount of aggregations of the second data, wherein aggregation comprises an accumulation of the second data due to repeated data input; and

buffer the aggregating subset of the second data, which is affected by the aggregation policy, until a condition of the aggregation policy is met.

2 . The data access device according to claim 1 , wherein

the data fields comprise identification fields and other data fields; and

the processor is configured to manipulate the second data by dropping, masking or encrypting the identification fields if the DEP requires anonymization, and/or to manipulate the second data by dropping, masking or encrypting any data field, which the DEP requires to manipulate.

3 . The data access device according to claim 1 , wherein the DEP is stored in the DEE within the TEE.

4 . The data access device according to claim 1 , wherein the DEP is disclosed to all target IDs.

5 . A system, comprising:

a data access device comprising a processor configured to implement a trusted execution environment (TEE) in a secure area of the processor, and a memory comprising computer program code that, when executed by the processor, configures the processor to implement, in the TEE, steps of:

receiving a first data comprising a request for handling data, and a target identification (ID);

processing the first data to attain a second data comprising the target ID and a data structure according to requirements of an application running in the data access device;

manipulating, by a data exposure enforcement (DEE) process operating on the processor in the TEE, the second data according to a data exposure policy (DEP) to attain a third data; and

outputting the third data,

wherein the request for handling data comprises the request to provide data to the application or to retrieve data from the application,

the DEP is a set of instructions to control the processor, and the instructions comprise:

anonymization instructions to identify data in the second data to be anonymized by identifying the according identification fields in the data structure;

exposure instructions to identify other data in the second data meant to be exposed and to instruct to which target IDs and how the identified other data is to be exposed; and

an aggregation policy to control the aggregation of data of a specific data type in the second content data before further processing is performed, and

wherein any instruction in the set of instructions is executed depending on any of the target IDs, and

wherein the processor is further configured to:

calculate a permitted amount of aggregations of the second data, wherein aggregation comprises an accumulation of the second data due to repeated data input; and

buffer the aggregating subset of the second data, which is affected by the aggregation policy, until a condition of the aggregation policy is met, and

wherein the memory further comprises an encryption storage and an extraction storage, wherein

the encryption storage is configured to buffer data by encrypting and storing the aggregating subset of the second data; and

the extraction storage is configured to store data by decrypting and storing the aggregated subset of the second data as the third data, when the condition of the aggregation policy is met.

6 . The data access device according to claim 1 , wherein the aggregation policy comprises an instruction to the processor that no field is to be exposed unless at least a certain amount of distinct first data entries has been provided to the data access device.

7 . The data access device according to claim 1 , wherein the aggregation policy comprises another instruction to the processor that a calculated field in the aggregated subset of the second data is only exposed if more than a certain amount of distinct first data entries identified has been provided to the data access device.

8 . A method for enforcing a data policy, comprising:

running a data access device in a trusted execution environment;

receiving, by an input unit, a first data comprising a request for handling data and a target ID;

processing, by a processing unit, the first data to attain a second data comprising the target ID and a data structure data according to requirements of an application running in the data access device;

manipulating, by a data exposure enforcement unit, the second data according to a data exposure policy to attain a third data, comprising sanitizing the second data by identifying one or more fields in the second data that are affected by the data exposure policy and performing one or more of: dropping, masking, or encrypting the one or more fields based on identification of the one or more fields as being affected by the DEP, wherein said one or more fields constitute less than all of the second data and wherein performing the one or more of: dropping, masking, or encrypting the one or more fields is applied to less than all of the second data; and

outputting, by an output unit, the third data, wherein

the request for handling data comprises the request to provide data to the application or to retrieve data from the application,

the DEP is a set of instructions to control the processor, and the instructions comprise:

anonymization instructions to identify data in the second data to be anonymized by identifying the according identification fields in the data structure;

exposure instructions to identify other data in the second data meant to be exposed and to instruct to which target IDs and how the identified other data is to be exposed; and

an aggregation policy to control the aggregation of data of a specific data type in the second content data before further processing is performed, and

wherein any instruction in the set of instructions is executed depending on any of the target IDs, and

the processor is further configured to:

calculate a permitted amount of aggregations of the second data, wherein aggregation comprises an accumulation of the second data due to repeated data input; and

buffer the aggregating subset of the second data, which is affected by the aggregation policy, until a condition of the aggregation policy is met.

Assignments (2)

Continuity (2)

References Cited (52)