TEE Node Operators host and provide confidential compute for Data Connectors, enabling secure data retrieval and processing while preserving user privacy.

​
Core functions

These functions ensure that sensitive data remains protected throughout its lifecycle:
  • Secure data fetching: Implements end-to-end encrypted data retrieval from various sources.
  • Privacy-preserving processing: Ensures data processing occurs entirely within TEE.
  • Access control: Manages fine-grained permissions and audit logging.

​
Key components

The following components enable secure data ingestion, processing, and privacy protection within the TEE environment:

​
Data ingestion layer:

Manages the secure retrieval of external data while ensuring authenticity, integrity, and controlled access.
  • Encrypted Data Transport: Utilizes TLS, end-to-end encryption, and cryptographic signatures to prevent data leaks.
  • Source Authentication: Verifies data provenance to prevent unauthorized sources from injecting malicious data.
  • Rate Limiting & Quota Management: Ensures controlled data access to prevent abuse and maintain system efficiency.

​
Processing pipeline:

Handles data transformation and secure computation within the enclave to maintain confidentiality.
  • Data validation & sanitization: Filters and normalizes incoming data to prevent injection attacks.
  • Format conversion & normalization: Converts data into a standardized format for secure processing.
  • TEE-Based secure computation: Executes privacy-preserving algorithms within the enclave.

​
Privacy protection measures:

Implements security mechanisms to minimize data exposure and enforce privacy features.
  • Data minimization: Limits the amount of data stored or processed.
  • Attribute-based encryption (ABE): Restricts access based on predefined policies.
  • Secure multi-party computation (MPC) Support: Enables privacy-preserving collaboration without revealing raw data.
The following Go structs define the TEE-based Data Connector architecture, ensuring secure data retrieval, processing, and privacy enforcement. 
type DataConnector struct {
    ID          string
    Source      DataSource
    Permissions AccessControl
    Encryption  EncryptionConfig
}

type DataSource interface {
    // Fetches data securely from source
    FetchData(ctx context.Context) ([]byte, error)
    // Validates data integrity
    ValidateData(data []byte) error
    // Processes data within TEE
    ProcessInTEE(data []byte) ([]byte, error)
}

type PrivacyConfig struct {
    // Defines what data can be accessed
    AllowedAttributes []string
    // Defines data retention policy
    RetentionPeriod time.Duration
    // Defines data usage policies
    UsagePolicy Policy
}