Methods, systems, and devices for trusted execution environments and secure data processing and storage environments
View Patent ↗Disclosed herein are methods, systems, and devices for implementing trusted execution environments in the context of data security and data storage. Systems may include a login node comprising one or more processors configured to receive a request from a user, and a secure access port communicatively coupled to the login node and configured to process the request in accordance with one or more data access policies. Systems may further include a secure processing device communicatively coupled to the secure access port and comprising an encrypted portion configured to implement one or more data processing operations associated with the request. The systems may also include an encrypted data repository communicatively coupled to the secure processing device, the encrypted data repository comprising one or more storage devices, and being configured to encrypt and store data in the one or more storage devices.
1 . A system comprising:
a login node comprising one or more processors configured to receive, from a user separate from the login node, a request associated with target data;
a secure access port, communicatively coupled to the login node, configured to process the request in accordance with one or more data access policies by identifying one or more data processing operations from a set of data processing operations based on both a time associated with the request and a pattern associated with different requests submitted prior to the request, wherein the secure access port comprises a container execution environment in which the one or more data access policies are applied to the request;
a secure processing hardware communicatively coupled to the secure access port to receive the request provided by the login node and comprising an encrypted portion configured to implement the one or more data processing operations and directly provide a response to the user without communicating through the login node that provided the request to the secure processing hardware, wherein the encrypted portion comprises a trusted execution environment configured to apply, to the response, one or more output policies configured to permit output of statistical results derived from the target data after randomized noise from within a bounded range is added to the statistical results to obfuscate the target data and wherein the one or more data processing operations are executed within the trusted execution environment, wherein the secure processing hardware corresponds to one or more central processing units (CPUs); and
an encrypted data repository communicatively coupled to the secure processing hardware, the encrypted data repository comprising one or more storage devices, and being configured to encrypt and store data in the one or more storage devices, and wherein the trusted execution environment brokers access to the one or more storage devices.
2 . The system of claim 1 , wherein the container execution environment is configured to implement a sandbox layer.
3 . The system of claim 2 , wherein the container execution environment is configured to implement a virtual environment.
4 . The system of claim 1 , wherein the secure processing hardware is configured to implement hardware encryption.
5 . The system of claim 4 , wherein the hardware encryption of the secure processing hardware is implemented via a secure portion of a main processor.
6 . The system of claim 1 , wherein the secure processing hardware is configured to implement software encryption.
7 . The system of claim 1 further comprising:
an additional secure access port communicatively coupled to the login node and configured to process the response to the request in accordance with one or more data access policies.
8 . The system of claim 1 , wherein the login node is one of a plurality of nodes in cluster of nodes.
9 . A method comprising:
receiving, at a secure access port of a secure environment from a user via a login node, a request associated with target data;
processing the request in accordance with one or more data access policies to provide a response by identifying one or more data processing operations from a set of data processing operations based on both a time associated with the request and a pattern associated with different requests submitted prior to the request;
determining, using a secure processing hardware of the secure environment, if the one or more data processing operations should be implemented based on the received request, wherein the secure access port comprises a container execution environment in which the one or more data access policies are applied to the request to determine if the processing operations should be implemented, and wherein the processing device comprises a trusted execution environment and in which the one or more data processing operations implemented, wherein the secure processing hardware corresponds to one or more central processing units (CPUs), wherein the trusted execution environment configured to apply, to the response, one or more output policies configured to permit output of statistical results derived from the target data after randomized noise from within a bounded range is added to the statistical results to obfuscate the target data; and
initiating, by the trusted execution environment, communication with an encrypted data repository responsive to the determining, the encrypted data repository being communicatively coupled to the secure environment.
10 . The method of claim 9 , wherein the authenticating further comprises:
authenticating a key included in the request.
11 . The method of claim 9 , wherein the determining further comprises:
identifying the one or more data access policy based, at least in part, on the received request.
12 . The method of claim 11 further comprising:
instantiating the container execution environment based, at least in part, on the identified one or more data access policies.
13 . The method of claim 12 , wherein the instantiating of the container execution environment further comprises:
implementing a sandbox layer.
14 . The method of claim 9 , wherein the request is a data access request.
15 . A device comprising:
a secure access port communicatively coupled to a login node and configured to receive, from a user separate from the login node, a request associated with target data, the secure access port comprising a container execution environment configured to process the request in accordance with one or more data access policies by identifying one or more data processing operations from a set of data processing operations based on both a time associated with the request and a pattern associated with different requests submitted prior to the request; and
a secure processing hardware communicatively coupled to the secure access port and comprising an encrypted portion configured to implement the one or more data processing operations and directly provide a response to the user without communicating through the login node, the secure processing hardware being communicatively coupled to an encrypted data repository, wherein the encrypted portion of the secure processing hardware comprises a trusted execution environment and wherein the one or more data processing operations are executed within the trusted execution environment configured to apply, to the response, one or more output policies configured to permit output of statistical results derived from the target data after randomized noise from within a bounded range is added to the statistical results to obfuscate the target data, and wherein the trusted execution environment brokers access to the encrypted data repository, wherein the secure processing hardware corresponds to one or more central processing units (CPUs).
16 . The device of claim 15 , wherein the container execution environment is configured to implement a sandbox layer.
17 . The device of claim 16 , wherein the container execution environment is configured to implement a virtual environment.
18 . The device of claim 15 , wherein the secure processing hardware is configured to implement hardware encryption.
19 . The device of claim 18 , wherein the secure processing hardware comprises a main processor, and wherein the main processor comprises a secure portion encrypted at a hardware level.
20 . The device of claim 15 , wherein the device further comprises:
an additional secure access port communicatively coupled to the login node and configured to process the response to the request in accordance with one or more data access policies.