Technologies for privacy-preserving security policy evaluation

Patent metadata

Field	Value
Publication number	US-11909769-B2
Application number	US-202117153708-A
Country	US
Kind code	B2
Filing date	Jan 20, 2021
Priority date	Dec 29, 2016
Publication date	Feb 20, 2024
Grant date	Feb 20, 2024

Abstract

Technologies for privacy-safe security policy evaluation are disclosed herein. An example apparatus includes at least one memory, and at least one processor to execute instructions to at least identify one or more non-sensitive parameters of a plurality of policy parameters and one or more sensitive parameters of the plurality of the policy parameters, the plurality of the policy parameters obtained from a computing device in response to a request from a cloud analytics server for the plurality of the policy parameters, encrypt the one or more sensitive parameters to generate encrypted parameter data in response to the identification of the one or more sensitive parameters, and transmit the encrypted parameter data to the cloud analytics server, the cloud analytics server to curry a security policy function based on one or more of the plurality of the policy parameters.

First claim

What is claimed is:

1. An apparatus for performing privacy-safe cloud threat analysis, the apparatus comprising:
at least one memory; and
at least one processor to execute instructions to at least:
identify one or more non-sensitive parameters of a plurality of policy parameters and one or more sensitive parameters of the plurality of the policy parameters, the plurality of the policy parameters obtained from a computing device in response to a request from a cloud analytics server for the plurality of the policy parameters;
encrypt the one or more sensitive parameters to generate encrypted parameter data in response to the identification of the one or more sensitive parameters;
analyze the encrypted parameter data to determine whether to apply a security policy to the encrypted parameter data;
select a security policy from one or more security policies based on whether to apply the security policy to the encrypted parameter data, the selection of the security policy further based on whether the security policy meets an acceptance threshold;
transmit the encrypted parameter data to the cloud analytics server, the cloud analytics server to curry a security policy function based on one or more of the plurality of the policy parameters; and
request use of the security policy by the cloud analytics server subsequent to the transmission of the encrypted parameter data to the cloud analytics server.

2. The apparatus of claim 1 , wherein the at least one processor is to execute ones of the instructions in a trusted execution environment, the trusted execution environment including a secure enclave established by secure enclave support of the at least one processor.

3. The apparatus of claim 1 , wherein the at least one processor is to transmit the one or more non-sensitive parameters to the cloud analytics server in response to the identification of the one or more non-sensitive parameters.

4. The apparatus of claim 1 , wherein the at least one processor is to generate the one or more security policies for which to select the security policy.

5. The apparatus of claim 1 , wherein the cloud analytics server is a virtual server.

6. The apparatus of claim 1 , wherein the one or more sensitive parameters include data associated with at least one of financial information, protected health information, or individually identifiable information, the individually identifiable information including at least one of a user name or an Internet Protocol address, and the at least one processor is to:
determine a data classification policy based on at least one of the financial information, the protected health information, or the individually identifiable information; and
identify at least one of (i) the one or more non-sensitive parameters or (ii) the one or more sensitive parameters based on the data classification policy.

7. The apparatus of claim 1 , wherein the at least one processor is to:
obtain a privacy-safe curried function set from the cloud analytics server, the privacy-safe curried function set including one or more first functions and one or more second functions, the one or more first functions having a respective non-sensitive parameter of the one or more non-sensitive parameters as respective first arguments, the one or more second functions having a respective sensitive parameter of the one or more sensitive parameters as respective second arguments; and
provide at least one of (i) the one or more first functions or (ii) the one or more second functions to the computing device.

8. The apparatus of claim 7 , wherein the privacy-safe curried function is generated in response to the cloud analytics server currying the security policy function, the cloud analytics server to curry the security policy function in response to obtaining the encrypted parameter data from the at least one processor.

9. A machine readable storage medium comprising instructions that, when executed, cause at least one processor to at least:
identify one or more non-sensitive parameters of a plurality of policy parameters and one or more sensitive parameters of the plurality of the policy parameters, the plurality of the policy parameters obtained from a computing device in response to a request from a cloud analytics server for the plurality of the policy parameters;
encrypt the one or more sensitive parameters to generate encrypted parameter data in response to the identification of the one or more sensitive parameters;
analyze the encrypted parameter data to determine whether to apply a security policy to the encrypted parameter data;
select a security policy from one or more security policies based on whether to apply the security policy to the encrypted parameter data, the selection of the security policy further based on whether the security policy meets an acceptance threshold;
transmit the encrypted parameter data to the cloud analytics server, the cloud analytics server to curry a security policy function based on one or more of the plurality of the policy parameters; and
request use of the security policy by the cloud analytics server subsequent to the transmission of the encrypted parameter data to the cloud analytics server.

10. The machine readable storage medium of claim 9 , wherein the instructions, when executed, cause the at least one processor to execute ones of the instructions in a trusted execution environment, the trusted execution environment including a secure enclave established by secure enclave support of the at least one processor.

11. The machine readable storage medium of claim 9 , wherein the instructions, when executed, cause the at least one processor to transmit the one or more non-sensitive parameters to the cloud analytics server in response to the identification of the one or more non-sensitive parameters.

12. The machine readable storage medium of claim 9 , wherein the instructions, when executed, cause the at least one processor to generate the one or more security policies for which to select the security policy.

13. The machine readable storage medium of claim 9 , wherein the one or more sensitive parameters include data associated with at least one of financial information, protected health information, or individually identifiable information, the individually identifiable information including at least one of a user name or an Internet Protocol address, and the instructions, when executed, cause the at least one processor to:
determine a data classification policy based on at least one of the financial information, the protected health information, or the individually identifiable information; and
identify at least one of (i) the one or more non-sensitive parameters or (ii) the one or more sensitive parameters based on the data classification policy.

14. The machine readable storage medium of claim 9 , wherein the instructions, when executed, cause the at least one processor to:
obtain a privacy-safe curried function set from the cloud analytics server, the privacy-safe curried function set including one or more first functions and one or more second functions, the one or more first functions having a respective non-sensitive parameter of the one or more non-sensitive parameters as respective first arguments, the one or more second functions having a respective sensitive parameter of the one or more sensitive parameters as respective second arguments; and
provide at least one of (i) the one or more first functions or (ii) the one or more second functions to the computing device.

15. The machine readable storage medium of claim 14 , wherein the privacy-safe curried function is generated in

Assignees

• Mcafee Llc
• Musarubra Us Llc

Inventors

• Das Sudeep
• Poornachandran Rajesh
• Smith Ned M
• Zimmer Vincent J
• Sharma Pramod
• Zeigler Arthur
• Vashisth Sumant
• Hunt Simon

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F2221/21

  Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title