A TEE-based Approach for Security and Privacy in Decision Support

Decision Support Systems are increasingly adopted to automate decision-making processes across industries, organizations and governments. However, decision support requires maintaining data privacy, integrity, and availability while ensuring customization, security, and verifiability of the decision process. Existing solutions fail to guarantee those properties altogether. Most commercial tools cater for data integrity and process customization but are centralized. This centralization potentially compromises data privacy and availability, as well as process security and verifiability. To overcome these limitations, we propose SPARTA, an approach based on Trusted Execution Environments (TEEs) that automates decision processes. To maintain data privacy, integrity, and availability, SPARTA employs efficient cryptographic techniques on notarized data with access mediated through user-defined access policies. Our solution also allows users to define decision rules, which are translated to certified software objects deployed within TEEs, thereby guaranteeing customization, verifiability, and security of the process. Based on experiments conducted on public benchmarks and synthetic data, we show that our approach is scalable and adds limited overhead compared to non-cryptographically secured solutions.