Systems and methods for securely handling private data in a cloud environment

A network device, comprising:

• a first memory to store instructions for an application server;
• a second memory to store instructions for a trusted execution environment (TEE) instance;
• a first processor configured to execute instructions stored in the first memory to:
• obtain a product or service description from a first user, wherein the product or service description includes a combination of public data and encrypted private data based on a first encryption key,
• receive a query from an end device of a second user,
• retrieve, based on the query, the product or service description, and
• forward the product or service description to the TEE instance;
• and
• a second processor configured to execute instructions stored in a second memory to:
• decrypt the encrypted private data of the product or service description,
• process the private data of the product or service description,
• re-encrypt, after the processing, the private data with a second encryption key, and
• send, to the application, the re-encrypted private data,
• wherein the first processor is further configured to execute instructions stored in the first memory to:
• assemble the re-encrypted private data and the public data into a query response for presentation on the end device, and
• send, to the end device, the query response including the re-encrypted private data and the public data.

One or more non-transitory computer-readable medium storing instructions executable by a computational device to:

• obtain, by an application, a product or service description from a first user, wherein the product or service description includes a combination of public data and encrypted private data based on a first encryption key;
• receive, by the application, a query from an end device of a second user;
• retrieve, by the application and based on the query, the product or service description;
• forward the product or service description to a TEE instance for decryption of the encrypted private data, processing of the private data, and re-encryption of the private data with a second encryption key;
• receive, by the application, the re-encrypted private data from the TEE instance;
• assemble, by the application, the re-encrypted private data and the public data into a query response for presentation on the end device;
• and
• send, by the application and to the end device, the query response including the re-encrypted private data and the public data.