Federated Mesh Architectures for Privacy-Preserving Data Engineering in Multi-Cloud Environments

Abstract

In contrast to traditional cloud computing, which relies on ensured, often vendor lock-in, centralized service orchestration and trade-offs between costs and confidentiality, a radical departure is emerging in a federated mesh composed of resource-rich mobile devices, decentralized Trusted Execution Environments, privacy-preserving protocols, and multi-cloud service storage and delivery. As a foundation, privacy-preserving Secure Multi-Party Computation achieves, through a combination of cryptography and coding theory, arbitrary yet intensive computations remotely on sensitive data without access by either users or provider servers. But, although Multi-Party Computation protects user privacy during processing, it does not address privacy in delivery of processed data. In contrast, Trusted Execution Environments located in mobile devices securely store encryption keys that allow data retrieval upon piecemeal authorization. By integrating Multi-Party Computation and Trusted Execution Environments in a federated mesh globally orchestrated through a Trusted Execution Environment-enabled surrogate, together with external data storage in Trusted Execution Environments and multi-cloud object stores, privacy-preserving infrastructures emerge for data engineering within and across organizations. Compared to traditional models, this Multi-Party Computation/Trusted Execution Environments approach reduces user burdens, both up front and at processing time, expands federated mesh utilization, particularly for enterprises, and broadens multi-clouds’ capabilities.

These advantages not only facilitate secure data engineering in low-trust environments, such as supply chain and health or business data aggregation, analysis, and sharing but also enable many other scenarios requiring decisional privacy. Key features include support for non-colluding distributors; privacy-preserving oracles; accounting for demand-side guide resources and action authorization; and privacy-preserving bulk content sharing by resource-rich devices. After describing Multi-Party Computation and Trusted Execution Environments, we illustrate these data engineering building blocks and capabilities with scenarios and examples. We close with a discussion of future research directions in deploying Multi-Party Computation/Trusted Execution Environments infrastructures and services.