System and method for secure electronic transaction platform
A system for processing data within a Trusted Execution Environment (TEE) of a processor is provided. The system may include: a trust manager unit for verifying identity of a partner and issuing a communication key to the partner upon said verification of identity; at least one interface for receiving encrypted data from the partner encrypted using the communication key; a secure database within the TEE for storing the encrypted data with a storage key and for preventing unauthorized access of the encrypted data within the TEE; and a recommendation engine for decrypting and analyzing the encrypted data to generate recommendations based on the decrypted data.
1. A computer implemented system for maintaining a segregated data processing subsystem, the system comprising:
a computer readable memory having a protected memory region that is encrypted by a storage key such that the protected memory region is segregated relative to at least one of an operating system or a kernel system, the protected memory region including at least a data storage region and a data processing subsystem storage region;
a secure processor configured to provide:
a data receiver configured to separately receive, from each partner system of a plurality of partner systems, a data set corresponding to the partner system encrypted by a key corresponding to the partner system;
the data receiver configured to securely store, using the storage key, the encrypted data sets received from the plurality of partner systems within the data storage region of the protected memory region;
responsive to receiving a query data message relating to the encrypted data sets in the protected memory region, decrypt and store, the encrypted data sets within the data processing subsystem storage region of the protected memory region;
execute the query against the decrypted data sets, and
generate an output data structure generated based on the execution of the query against the decrypted data sets stored in the protected memory region.
2. The system of claim 1 , wherein the segregated data processing subsystem maintains a segregated machine learning data model architecture comprising interconnected computing nodes that operate in concert to generate the output data structure using at least a portion of the one or more data sets in the data storage region in the protected memory region as training sets or validation sets representing data from at least two computing devices of the plurality of computing devices.
3. The system of claim 2 , wherein the secure processor is configured to:
transmit to one or more sub processors a partition of the protected memory region;
and wherein the one or more sub processors are configured to process the corresponding partition of the protected memory region using a local copy of the machine learning data model architecture to generate one or more parameter update data structures, the one or more parameter update data structures are aggregated such that they can be used to refine at least one parameter of the machine learning data model architecture.
4. The system of claim 3 , wherein there are at least two sub processors, including a first sub processor and a second sub processor that are configured to transmit one or more parameter update data structures directly between one another to update the corresponding local copy of the machine learning data model architecture.
5. The system of claim 1 , wherein the data receiver is further configured to generate public/private key pairs each corresponding to a computing device of the one or more corresponding computing devices, and wherein the corresponding key is a private key corresponding to the corresponding computing device.
6. The system of claim 1 , wherein the protected memory region is encrypted using the storage key that is only accessible by a trusted execution environment operating on the secure processor during execution of a query as instructed in the query data message, the storage key not accessible by computing processes corresponding to the operating system or the kernel system.
7. The system of claim 1 , wherein the protected memory region is encrypted with the storage key that is only accessible to the secure processor and is inaccessible to administrator accounts of a system upon which the secure processor resides.
8. The system of claim 7 , wherein the storage key uses a unique endorsement key generated during manufacturing that is not accessible outside the secure processor.
9. The system of claim 1 , wherein a remote attestation process is periodically conducted by a secure processor, the remote attestation process including transmitting a remote attestation payload to the secure processor.
10. The system of claim 1 , wherein a remote attestation process is periodically conducted by the secure processor, and the remote attestation process including the secure processor generating a remote attestation transcript data structure.
11. A computer implemented method for a trusted execution environment maintaining a segregated data processing subsystem, the method operating on a computer readable memory having a protected memory region that is encrypted by a storage key such that it is segregated relative to at least one of an operating system or kernel system of a computing device implementing the trusted execution environment, the protected memory region including at least a data storage region and a data processing subsystem storage region, the method comprising:
receiving, from each partner system of a plurality of partner systems, a data set corresponding to the partner system encrypted by a key corresponding to the partner system;
securely storing, using the storage key, the encrypted data sets received from the plurality of partner systems within the data region of the protected memory region;
responsive to receiving a query data message relating to the encrypted data sets in the protected memory region, decrypting and storing, the encrypted data sets within the data processing subsystem storage region of the protected memory region;
executing the query against the decrypted data sets; and
generating, using processes running within the protected memory region, an output data structure based on the execution of the query against the decrypted data sets stored in the protected memory region.
12. The method of claim 11 , wherein the segregated data processing subsystem maintains a segregated machine learning data model architecture comprising a series of interconnected computing nodes that operate in concert to generate the output data structure responsive to the query data message using at least a portion of the one or more data sets into data storage region in the protected memory region as training sets or validation sets.
13. The method of claim 12 , comprising transmitting to one or more sub processors a partition of the protected memory region;
processing the corresponding partition of the protected memory region using a local copy of the machine learning data model architecture to generate one or more parameter update data structures used to refine at least one parameter of the machine learning data model architecture that are distributed to the one or more sub processors to update the corresponding local copy of the machine learning data model architecture.
14. The method of claim 11 , wherein the data receiver is further configured to generate public/private key pairs each corresponding to a computing device of the one or more corresponding computing devices; and wherein the corresponding key is the private key corresponding to the corresponding computing device.
15. The method of claim 11 , wherein the protected memory region is encrypted using the storage key that is only accessible by a trusted execution environment operating on the secure processor during execution of a query as instructed in the query data message, the storage key not accessible by computing processes corresponding to the operating system or the kernel system.
16. The method of claim 11 , wherein the protected memory region is encrypted with the storage key that is only accessible to the secure processor and is inaccessible to the administrator accounts of a system upon which the secure processor resides.
17. The method of claim 16 , wherein the storage key uses a unique endorsement key generated during manufacturing that is not accessible outside the secure processor.
18. The method of claim 11 , comprising periodically conducting a remote attestation, the remote attestation process including transmitting a remote attestation payload to the secure processor.
19. The method of claim 11 , comprising periodically conducting a remote attestation process, the remote attestation process including generating, by the secure processor, a remote attestation transcript data structure.
20. A non-transitory computer readable medium, storing machine interpretable instructions which when executed by a processor, cause the processor to perform a computer implemented method for a trusted execution environment maintaining a segregated data processing subsystem, the method operating on a computer readable memory having a protected memory region that is encrypted by a storage key such that it is segregated relative to at least one of an operating system or a kernel system of a computing device implementing the trusted execution environment, the protected memory region including at least a data storage region and a data processing subsystem storage region, the method comprising:
receiving, from each partner system of a plurality of partner systems, a data set corresponding to the partner system encrypted using a key corresponding to the partner system;
securely storing, using the storage key, the encrypted data sets received from the plurality of partner systems within the data region of the protected memory region;
responsive to receiving a query data message relating to the encrypted data sets in the protected memory region, decrypting and storing, the encrypted data sets within the data processing subsystem storage region of the protected memory region;
executing the query against the decrypted data sets; and
generating, using processes running within the protected memory region, an output data structure based on the execution of the query against the decrypted data sets stored in the protected memory region.