Technologies for privacy-preserving security policy evaluation

One or more computer-readable storage media, excluding propagating signals, comprising instructions that, when executed, cause a processor to:

• curry a security policy function to generate a privacy-safe curried function set, the security policy function to generate a security policy as a function of a plurality of policy parameters, the privacy-safe curried function set including one or more first functions taking a respective non-sensitive parameter of the plurality of policy parameters as an argument, and one or more second functions having a respective sensitive parameter of the plurality of policy parameters as an argument the parameter data being unencrypted;
• evaluate the one or more first functions of the privacy-safe curried function set with the parameter data corresponding to the non-sensitive parameters to generate the one or more second functions;
• and
• transmit the one or more second functions of the privacy-safe curried function set to a client computing device.

A client computing device for privacy-safe cloud threat analysis, the client computing device comprising:

• communication circuitry;
• a communication engine to access, from a cloud analytics server via the communication circuitry, one or more functions of a privacy-safe curried function set, the one or more functions to take a respective sensitive parameter of a plurality of policy parameters as an argument, and access encrypted parameter data that corresponds to the one or more sensitive parameters of the plurality of policy parameters;
• and
• a client policy evaluation engine to decrypt the encrypted parameter data to generate the one or more sensitive parameters, and evaluate the one or more functions with the one or more sensitive parameters to generate a security policy.

One or more computer-readable storage disks or storage devices comprising instructions that, when executed, cause a processor to at least:

• access, from a cloud analytics server, one or more functions of a privacy-safe curried function set, the one or more functions including a respective sensitive parameter of a plurality of policy parameters as an argument;
• access encrypted parameter data corresponding to the one or more sensitive parameters of the plurality of policy parameters;
• decrypt the encrypted parameter data to generate the one or more sensitive parameters;
• and
• evaluate the one or more sensitive functions with the one or more sensitive parameters to generate a security policy.