# US 11,909,769 B2 · Technologies for privacy-preserving security policy evaluation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,769 B2 - Document ID: US11909769B2 - Status: Granted - Kind: B2 - Application number: 17/153,708 - Filed: 2021-01-20 - Published: 2021-06-03 - Granted: 2024-02-20 - Earliest claimed: 2016-12-29 - Assignees: Musarubra US LLC - Applicants: McAfee, LLC - Inventors: Sudeep Das; Rajesh Poornachandran; Ned M. Smith; Vincent J. Zimmer; Pramod Sharma; Arthur Zeigler; Sumant Vashisth; Simon Hunt - Web page: https://patentgrep.com/patent/US11909769B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 2221/21: Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Technologies for privacy-safe security policy evaluation are disclosed herein. An example apparatus includes at least one memory, and at least one processor to execute instructions to at least identify one or more non-sensitive parameters of a plurality of policy parameters and one or more sensitive parameters of the plurality of the policy parameters, the plurality of the policy parameters obtained from a computing device in response to a request from a cloud analytics server for the plurality of the policy parameters, encrypt the one or more sensitive parameters to generate encrypted parameter data in response to the identification of the one or more sensitive parameters, and transmit the encrypted parameter data to the cloud analytics server, the cloud analytics server to curry a security policy function based on one or more of the plurality of the policy parameters. ## Claims ### Claim 1 An apparatus for performing privacy-safe cloud threat analysis, the apparatus comprising: at least one memory; and at least one processor to execute instructions to at least: identify one or more non-sensitive parameters of a plurality of policy parameters and one or more sensitive parameters of the plurality of the policy parameters, the plurality of the policy parameters obtained from a computing device in response to a request from a cloud analytics server for the plurality of the policy parameters; encrypt the one or more sensitive parameters to generate encrypted parameter data in response to the identification of the one or more sensitive parameters; analyze the encrypted parameter data to determine whether to apply a security policy to the encrypted parameter data; select a security policy from one or more security policies based on whether to apply the security policy to the encrypted parameter data, the selection of the security policy further based on whether the security policy meets an acceptance threshold; transmit the encrypted parameter data to the cloud analytics server, the cloud analytics server to curry a security policy function based on one or more of the plurality of the policy parameters; and request use of the security policy by the cloud analytics server subsequent to the transmission of the encrypted parameter data to the cloud analytics server. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the at least one processor is to execute ones of the instructions in a trusted execution environment, the trusted execution environment including a secure enclave established by secure enclave support of the at least one processor. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the at least one processor is to transmit the one or more non-sensitive parameters to the cloud analytics server in response to the identification of the one or more non-sensitive parameters. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the at least one processor is to generate the one or more security policies for which to select the security policy. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the cloud analytics server is a virtual server. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the one or more sensitive parameters include data associated with at least one of financial information, protected health information, or individually identifiable information, the individually identifiable information including at least one of a user name or an Internet Protocol address, and the at least one processor is to: determine a data classification policy based on at least one of the financial information, the protected health information, or the individually identifiable information; and identify at least one of (i) the one or more non-sensitive parameters or (ii) the one or more sensitive parameters based on the data classification policy. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the at least one processor is to: obtain a privacy-safe curried function set from the cloud analytics server, the privacy-safe curried function set including one or more first functions and one or more second functions, the one or more first functions having a respective non-sensitive parameter of the one or more non-sensitive parameters as respective first arguments, the one or more second functions having a respective sensitive parameter of the one or more sensitive parameters as respective second arguments; and provide at least one of (i) the one or more first functions or (ii) the one or more second functions to the computing device. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the privacy-safe curried function is generated in response to the cloud analytics server currying the security policy function, the cloud analytics server to curry the security policy function in response to obtaining the encrypted parameter data from the at least one processor. ### Claim 9 A machine readable storage medium comprising instructions that, when executed, cause at least one processor to at least: identify one or more non-sensitive parameters of a plurality of policy parameters and one or more sensitive parameters of the plurality of the policy parameters, the plurality of the policy parameters obtained from a computing device in response to a request from a cloud analytics server for the plurality of the policy parameters; encrypt the one or more sensitive parameters to generate encrypted parameter data in response to the identification of the one or more sensitive parameters; analyze the encrypted parameter data to determine whether to apply a security policy to the encrypted parameter data; select a security policy from one or more security policies based on whether to apply the security policy to the encrypted parameter data, the selection of the security policy further based on whether the security policy meets an acceptance threshold; transmit the encrypted parameter data to the cloud analytics server, the cloud analytics server to curry a security policy function based on one or more of the plurality of the policy parameters; and request use of the security policy by the cloud analytics server subsequent to the transmission of the encrypted parameter data to the cloud analytics server. ### Claim 10 (depends on 9) The machine readable storage medium of claim 9, wherein the instructions, when executed, cause the at least one processor to execute ones of the instructions in a trusted execution environment, the trusted execution environment including a secure enclave established by secure enclave support of the at least one processor. ### Claim 11 (depends on 9) The machine readable storage medium of claim 9, wherein the instructions, when executed, cause the at least one processor to transmit the one or more non-sensitive parameters to the cloud analytics server in response to the identification of the one or more non-sensitive parameters. ### Claim 12 (depends on 9) The machine readable storage medium of claim 9, wherein the instructions, when executed, cause the at least one processor to generate the one or more security policies for which to select the security policy. ### Claim 13 (depends on 9) The machine readable storage medium of claim 9, wherein the one or more sensitive parameters include data associated with at least one of financial information, protected health information, or individually identifiable information, the individually identifiable information including at least one of a user name or an Internet Protocol address, and the instructions, when executed, cause the at least one processor to: determine a data classification policy based on at least one of the financial information, the protected health information, or the individually identifiable information; and identify at least one of (i) the one or more non-sensitive parameters or (ii) the one or more sensitive parameters based on the data classification policy. ### Claim 14 (depends on 9) The machine readable storage medium of claim 9, wherein the instructions, when executed, cause the at least one processor to: obtain a privacy-safe curried function set from the cloud analytics server, the privacy-safe curried function set including one or more first functions and one or more second functions, the one or more first functions having a respective non-sensitive parameter of the one or more non-sensitive parameters as respective first arguments, the one or more second functions having a respective sensitive parameter of the one or more sensitive parameters as respective second arguments; and provide at least one of (i) the one or more first functions or (ii) the one or more second functions to the computing device. ### Claim 15 (depends on 14) The machine readable storage medium of claim 14, wherein the privacy-safe curried function is generated in response to the cloud analytics server currying the security policy function, the cloud analytics server to curry the security policy function in response to obtaining the encrypted parameter data from the at least one processor. ### Claim 16 A method for privacy-safe cloud threat analysis, the method comprising: accessing one or more functions of a privacy-safe curried function set, the one or more functions to take a respective sensitive parameter of a plurality of policy parameters as an argument; accessing encrypted parameter data that corresponds to one or more sensitive parameters of the plurality of policy parameters; decrypting the encrypted parameter data to generate the one or more sensitive parameters; analyzing the encrypted parameter data to determine whether to apply a security policy to the encrypted parameter data; selecting a security policy from one or more security policies based on whether to apply the security policy to the encrypted parameter data, the selection of the security policy further based on whether the security policy meets an acceptance threshold; and requesting use of the security policy by a cloud analytics server subsequent to a transmission of the encrypted parameter data to the cloud analytics server. ### Claim 17 (depends on 16) The method of claim 16, wherein the encrypted parameter data is accessed from at least one of a cloud analytics server or a trusted data access mediator device. ### Claim 18 (depends on 16) The method of claim 16, further including: generating the one or more security policies for which to select the security policy; and enforcing the security policy. ### Claim 19 (depends on 16) The method of claim 16, wherein at least one of the accessing of the one or more functions, the accessing of the encrypted parameter data, the decrypting of the encrypted parameter data, or evaluating of the one or more functions is executed in a trusted execution environment. ### Claim 20 (depends on 19) The method of claim 19, wherein the trusted execution environment includes a secure enclave established by secure enclave support of at least one processor.