Abstract: Encrypted first data and encrypted second data may be received, where each data is from different client servers. A request to perform an operation with the first data and the second data may be received. Whether the operation is authorized to be performed with the first data and the second data at an enclave may be verified. In response to verifying that the operation is authorized to be performed with the first data and the second data at the enclave, the encrypted first data and the encrypted second data may be decrypted to the first data and the second data, respectively. Furthermore, the operation may be performed with the first data and the second data at the enclave.

Abstract: An encrypted search query may be received from a requesting client system at a secure enclave of a processing device. The encrypted search query may be decrypted to form a decrypted search query. One or more index entries of a metadata index that correspond to the decrypted search query may be identified, such that each identified index entry is associated with a content reference that identifies a content item located outside the secure enclave. The index entries that correspond to the decrypted search query may include one or more index entries having one or more associated index metadata items that correspond to the decrypted search query. One or more secure search results may be generated, such that each secure search result corresponds to one of the index entries and comprises the content reference associated with the corresponding index entry. The secure search results may be sent to the requesting client system.

Abstract: An application may perform operations within a first secure enclave of a processing device. The application may provide secure monitoring data, such as secure heartbeat information. The monitoring data and an application identity may be verified at a second secure enclave of the processing device using local attestation operations. A remote attestation signature may be generated at the second secure enclave based on the monitoring data, the application identity, and a node private key. A monitoring message signature may be generated at the first secure enclave based on an application private key and a message payload that includes the monitoring data, the application identity, and the remote attestation signature. A monitoring message that includes the payload and monitoring message signature may be sent from the first secure enclave to a monitoring system, which may verify the message to detect unauthorized changes to the monitoring data or the application identity.

Abstract: A request to perform an operation associated with a service instance may be received by a processing device. The service instance may have an associated service instance identifier. A proxy instance associated with the service instance may be identified. The proxy instance may perform operations within a secure enclave associated with the processing device. The proxy instance within the secure enclave associated with the processing device may be used to verify that the secure enclave associated with the processing device contains the service instance associated with the service instance identifier. When the verification is successful, the proxy instance within the secure enclave associated with the processing device may be used to send a request to the service instance to perform the operation.

Abstract: An encrypted search query may be received from a requesting client system at a secure enclave of a processing device. The encrypted search query may be decrypted to form a decrypted search query. One or more index entries of a metadata index that correspond to the decrypted search query may be identified, such that each identified index entry is associated with a content reference that identifies a content item located outside the secure enclave. The index entries that correspond to the decrypted search query may include one or more index entries having one or more associated index metadata items that correspond to the decrypted search query. One or more secure search results may be generated, such that each secure search result corresponds to one of the index entries and comprises the content reference associated with the corresponding index entry. The secure search results may be sent to the requesting client system.

Abstract: A request to provide an application at a secure enclave of a server may be received. A hash value of the application may be generated. Application data that is to be used with the application at the secure enclave of the server may be identified. Another hash value of the application data that is to be used with the application at the secure enclave of the server may be generated. The hash value of the application and the other hash value of the application data may be signed where the signed hash value and other hash are being used to execute the application with the application data at the secure enclave of the server.

Abstract: An application may perform operations within a first secure enclave of a processing device. The application may provide secure monitoring data, such as secure heartbeat information. The monitoring data and an application identity may be verified at a second secure enclave of the processing device using local attestation operations. A remote attestation signature may be generated at the second secure enclave based on the monitoring data, the application identity, and a node private key. A monitoring message signature may be generated at the first secure enclave based on an application private key and a message payload that includes the monitoring data, the application identity, and the remote attestation signature. A monitoring message that includes the payload and monitoring message signature may be sent from the first secure enclave to a monitoring system, which may verify the message to detect unauthorized changes to the monitoring data or the application identity.

Abstract: A request to perform an operation associated with a service instance may be received by a processing device. The service instance may have an associated service instance identifier. A proxy instance associated with the service instance may be identified. The proxy instance may perform operations within a secure enclave associated with the processing device. The proxy instance within the secure enclave associated with the processing device may be used to verify that the secure enclave associated with the processing device contains the service instance associated with the service instance identifier. When the verification is successful, the proxy instance within the secure enclave associated with the processing device may be used to send a request to the service instance to perform the operation.

Abstract: Encrypted first data and encrypted second data may be received, where each data is from different client servers. A request to perform an operation with the first data and the second data may be received. Whether the operation is authorized to be performed with the first data and the second data at an enclave may be verified. In response to verifying that the operation is authorized to be performed with the first data and the second data at the enclave, the encrypted first data and the encrypted second data may be decrypted to the first data and the second data, respectively. Furthermore, the operation may be performed with the first data and the second data at the enclave.

Abstract: A request to provide an application at a secure enclave of a server may be received. A hash value of the application may be generated. Application data that is to be used with the application at the secure enclave of the server may be identified. Another hash value of the application data that is to be used with the application at the secure enclave of the server may be generated. The hash value of the application and the other hash value of the application data may be signed where the signed hash value and other hash are being used to execute the application with the application data at the secure enclave of the server.