Hosting Data Connectors

TEE Node Operators host and provide confidential compute for Data Connectors, enabling secure data retrieval and processing while preserving user privacy.

​

Core functions

These functions ensure that sensitive data remains protected throughout its lifecycle:

• Secure data fetching: Implements end-to-end encrypted data retrieval from various sources.
• Privacy-preserving processing: Ensures data processing occurs entirely within TEE.
• Access control: Manages fine-grained permissions and audit logging.

​

Key components

The following components enable secure data ingestion, processing, and privacy protection within the TEE environment:

​

Data ingestion layer:

Manages the secure retrieval of external data while ensuring authenticity, integrity, and controlled access.

• Encrypted Data Transport: Utilizes TLS, end-to-end encryption, and cryptographic signatures to prevent data leaks.
• Source Authentication: Verifies data provenance to prevent unauthorized sources from injecting malicious data.
• Rate Limiting & Quota Management: Ensures controlled data access to prevent abuse and maintain system efficiency.

​

Processing pipeline:

Handles data transformation and secure computation within the enclave to maintain confidentiality.

• Data validation & sanitization: Filters and normalizes incoming data to prevent injection attacks.
• Format conversion & normalization: Converts data into a standardized format for secure processing.
• TEE-Based secure computation: Executes privacy-preserving algorithms within the enclave.

​

Privacy protection measures:

Implements security mechanisms to minimize data exposure and enforce privacy features.

• Data minimization: Limits the amount of data stored or processed.
• Attribute-based encryption (ABE): Restricts access based on predefined policies.
• Secure multi-party computation (MPC) Support: Enables privacy-preserving collaboration without revealing raw data.

The following Go structs define the TEE-based Data Connector architecture, ensuring secure data retrieval, processing, and privacy enforcement.

type DataConnector struct {
    ID          string
    Source      DataSource
    Permissions AccessControl
    Encryption  EncryptionConfig
}

type DataSource interface {
    // Fetches data securely from source
    FetchData(ctx context.Context) ([]byte, error)
    // Validates data integrity
    ValidateData(data []byte) error
    // Processes data within TEE
    ProcessInTEE(data []byte) ([]byte, error)
}

type PrivacyConfig struct {
    // Defines what data can be accessed
    AllowedAttributes []string
    // Defines data retention policy
    RetentionPeriod time.Duration
    // Defines data usage policies
    UsagePolicy Policy
}