System and methods for providing data analytics for secure cloud compute data

Patent metadata

Field	Value
Publication number	US-11354437-B2
Application number	US-201916537832-A
Country	US
Kind code	B2
Filing date	Aug 12, 2019
Priority date	Aug 12, 2019
Publication date	Jun 7, 2022
Grant date	Jun 7, 2022

Abstract

Systems and methods described herein enable data analytics for secure cloud compute data that protects the integrity and confidentiality of the underlying data. A network device in a network creates an instance of a Trusted Execution Environment (TEE). The network device generates, in the TEE instance, transactional data that includes private information and removes the private information from the transactional data to generate extracted data. The network device encrypts, within the TEE instance, the extracted data and exports the encrypted extracted data to a memory outside of the TEE instance.

First claim

What is claimed is:

1. A method, comprising:
generating, by a trusted execution environment (TEE) instance of a network device, transactional data that includes private information;
removing, by the TEE instance, the private information from the transactional data to generate extracted data;
collecting, by the TEE instance, records of the extracted data until an anonymity threshold is met;
encrypting, by the TEE instance, the extracted data; and
exporting, by the TEE instance, the extracted data to a memory outside of the TEE instance when the anonymity threshold is met.

2. The method of claim 1 , wherein generating the transactional data includes:
receiving, by the TEE instance and from a customer device, customer identifiable data; and
adding, by the TEE instance, service data associated with the customer identifiable data, to generate the transactional data.

3. The method of claim 1 , wherein removing the private information from the transactional data further comprises:
obtaining, by the TEE instance, a definition of private data; and
applying, by the TEE instance, the definition to the transactional data.

4. The method of claim 1 , wherein exporting the extracted data comprises:
sending the extracted data to an anonymizing platform that generates anonymized extracted data, and
storing the anonymized extracted data in the memory outside of the TEE instance, wherein the extracted data is available for analytics without revealing the private information.

5. The method of claim 4 , wherein storing the anonymized extracted data includes storing the anonymized extracted data in an unencrypted format.

6. The method of claim 1 , wherein exporting the extracted data comprises:
storing the collected records in the memory outside of the TEE instance, wherein the extracted data is available for analytics without revealing the private information.

7. The method of claim 6 , wherein storing the collected records includes storing the collected records in an encrypted format.

8. The method of claim 1 , wherein the private information includes customer proprietary network information (CPNI).

9. The method of claim 1 , further comprising:
generating a first hash value from the extracted data;
receiving a second hash value of the extracted data; and
validating the extracted data based on a comparison of the first and second hash values.

10. The method of claim 1 , further comprising:
receiving the extracted data from the TEE instance;
decrypting the extracted data to form unencrypted extracted data; and
anonymizing the unencrypted extracted data to form anonymized unencrypted extracted data.

11. A network device, comprising:
a communication interface;
a memory configured to store an instance of a Trusted Execution Environment (TEE); and
a processor configured to execute instructions stored in the memory to:
generate, in the TEE instance, transactional data that includes private information,
remove, within the TEE instance, the private information from the transactional data to form extracted data,
collect, within the TEE instance, records of the extracted data until an anonymity threshold is met;
encrypt, within the TEE instance, the extracted data, and
export the encrypted extracted data to a memory outside of the TEE instance after the anonymity threshold is met.

12. The network device of claim 11 , wherein the processor is further configured to execute the instructions stored in the memory to:
receive, from a customer device and within the TEE instance, customer identifiable data; and
add, within the TEE instance, service data associated with the customer identifiable data, to generate the transactional data.

13. The network device of claim 11 , wherein, when removing the private information from the transactional data, the processor is further configured to execute the instructions stored in the memory to:
obtain a definition of private data as configured by a customer; and
apply the definition to the transactional data.

14. The network device of claim 11 , wherein, when exporting the encrypted extracted data, the processor is further configured to execute the instructions stored in the memory to:
send the extracted data to an anonymizing platform that generates anonymized extracted data.

15. The network device of claim 11 , wherein, when exporting the encrypted extracted data, the processor is further configured to execute the instructions stored in the memory to:
store the collected records as the extracted data outside of the TEE instance, wherein the extracted data is available for analytics without revealing the private information.

16. The network device of claim 11 , wherein the processor is further configured to execute the instructions stored in the memory to:
generate a first hash value from the extracted data;
receive, from another network device, a second hash value of the extracted data; and
validate the extracted data based on a comparison of the first and second hash values.

17. The network device of claim 11 , wherein the processor is further configured to execute the instructions stored in the memory to:
anonymize the extracted data to form anonymized unencrypted extracted data.

18. A non-transitory computer-readable medium storing instructions executable by a computational device to:
create an instance of a Trusted Execution Environment (TEE) in a network device;
generate, in the TEE instance, transactional data that includes private information;
remove, within the TEE instance, the private information from the transactional data to generate extracted data;
collect, within the TEE instance, records of the extracted data until an anonymity threshold is met;
encrypt, within the TEE instance, the extracted data; and
export the encrypted extracted data to a memory outside of the TEE instance when the anonymity threshold is met.

19. The non-transitory computer-readable medium of claim 18 , wherein the instructions are further executable by a computational device to:
send the extracted data to an anonymizing platform that generates anonymized extracted data from the extracted data, and
store the anonymized extracted data in a memory outside of the TEE instance, wherein the extracted data is available for analytics without revealing the private information.

20. The non-transitory computer-readable medium of claim 18 , wherein the instructions are further executable by a computational device to:
store the collected records in a memory outside of the TEE instance.

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Pacella Dante J
• Karpoor Deepak
• Tyagi Paritosh
• Sardesai Ashish
• Mallesan Saravanan
• Tadayon Mani

Classifications

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F21/6254 Primary

  by anonymising data, e.g. decorrelating personal data from the owner's identification · CPC title

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title