Confidential automated speech recognition
The present invention provides a secure method for outsourcing data analysis to a third party without the third party being able to access the data in clear. In the present invention, the client's data is never written to disk, this feature provides the security. The data is decrypted and processed in the enclave which ensures that the data is secure and hidden at all times when it is visible “in clear”.
1. A computer implemented method for confidential data processing, the method comprising:
requesting, by a client computer, an enclave public key from an Application Programming
Interface, API;
requesting, by the API, the enclave public key from an enclave;
generating, by the enclave, the enclave public key;
wherein the enclave public key is stored in an encrypted memory of the enclave along with a corresponding enclave private key;
returning, by the confidential enclave, the enclave public key to the API;
returning, by the API, the enclave public key to the client computer;
encrypting, by the client computer, one or more files using the enclave public key;
sending, by the client computer;
the one or more encrypted files and a client public key to the API;
sending, by the API, the one or more encrypted file and the client public key to the enclave;
decrypting, by the enclave, the one or more encrypted files, using the enclave private key;
wherein the decrypted one or more files are kept in the encrypted memory of the confidential enclave;
processing, by the enclave, the one or more files to produce one or more result files;
encrypting, by the enclave, the one or more result files using the client public key;
sending by the enclave, the one or more result files to the API;
sending by the API, the one or more audio files to the client computer;
decrypting, by the client computer, one or more result files using a client private key.
2. The computer implemented method of claim 1 wherein the enclave is a cloud enclave.
3. The computer implemented method of claim 1 wherein the enclave public key is ephemeral.
4. The computer implemented method of claim 1 wherein the enclave is one of a plurality of enclaves; and
the API selects one of the plurality of enclaves for requesting the enclave public key dependent on one or both of size of enclave memory, enclave processing speed.
5. The computer implemented method of claim 4 wherein, following the step of requesting, by a client computer, an enclave public key from an Application Programming Interface, API, the method further includes: requesting, by the API, one or more of a total file size, security level and speed.
6. The computer implemented method of claim 5 wherein the method further comprises returning by the client computer, the one or more of the total file size, security level and speed to the API and in response to receiving the one or more of the total file size, security level and speed to the API, the API then selects an enclave of the plurality of enclaves to request the enclave public key from, wherein the selection is based on the returned one or more of the total file size, security level and speed.
7. The computer implemented method of claim 6 wherein the processing carried out by the enclave is automatic speech recognition.
8. The computer implemented method of claim 1 wherein the one or more files are audio files.
9. The computer implemented method of claim 1 wherein the API provides one or more data processing services.
10. The computer implemented method of claim 9 wherein following the step of requesting, by a client computer, an enclave public key from an Application Programming Interface, API, the method further includes:
requesting, by the API, a selection of data processing service;
returning, by the client computer, the selection of data processing service; wherein in response to receiving the selection of data processing service, the API moves onto the step of requesting the enclave public key from the enclave.
11. The computer implemented method of claim 10 wherein API has access to a plurality of enclaves, each enclave set up to process data according to one of the one or more data processing services; wherein the API requests the enclave public key from the enclave that is set up to process data in the way that the client computer selected.
12. The computer implemented method of claim 9 wherein the API provides an interface for the user to select from the one or more data processing services.
13. A data processing system comprising means for carrying out the method of claim 1 .
14. A server configured to transmit a computer program containing instructions for performing a method as claimed in claim 1 .