Mechanisms to reduce exposure of sensitive telemetry data in computing networks

An apparatus of a computing node of a network, the apparatus including a memory storing logic to implement a trusted telemetry governor (TTG) inside a trusted execution environment, and one or more processors coupled to the memory and to execute the logic to:

• determine security policy to be applied to telemetry data corresponding to a component of a computing infrastructure, the security policy to indicate a correlation between, on one hand, a type of telemetry data consumer, and on another hand, at least one of a type or a form of telemetry data to be made accessible to the telemetry data consumer;
• receive the telemetry data in encrypted format;
• based on the security policy:
• process the telemetry data including at least one of generating transformed telemetry data or analyzing the telemetry data to generate a report therefrom;
• and
• generate telemetry information from the telemetry data, the telemetry information including at least one of processed telemetry data, a report or a recommendation based on an analysis of the telemetry data;
• and
• send the telemetry information outside of the trusted execution environment.

A method to be performed by an apparatus of a computing node of a network to implement a trusted telemetry governor (TTG) inside a trusted execution environment, the method including:

• determining security policy to be applied to telemetry data corresponding to a component of a computing infrastructure, the security policy to indicate a correlation between, on one hand, a type of telemetry data consumer, and on another hand, at least one of a type or a form of telemetry data to be made accessible to the telemetry data consumer;
• receiving the telemetry data in encrypted format;
• based on the security policy:
• processing the telemetry data including at least one of generating transformed telemetry data or analyzing the telemetry data to generate a report therefrom;
• and
• generating telemetry information from the telemetry data, the telemetry information including at least one of processed telemetry data, a report or a recommendation based on an analysis of the telemetry data;
• and
• sending the telemetry information outside of the trusted execution environment.