Privacy-Enhancing Technologies for Information Security in Edge-Cloud Applications

Abstract

Edge-cloud systems enable applications that create economic value and address societal challenges based on data from intelligent objects and infrastructures. This often requires the sharing of data with partners in established value networks or along the edge-cloud continuum. A fundamental requirement in data sharing is to ensure the protection of sensitive company and personal information. While local data processing at the edge enables a basic level of data protection and information security, relying exclusively on this measure is often not sufficient to meet these requirements while simultaneously achieving the envisioned value of data-driven applications. For example, there is often a need to aggregate sensitive data in a central location, such as the cloud, to gain rich insights or ensure the integrity of the data used. This is where privacy-enhancing technologies (PETs) come into focus. PETs include mechanisms for integrating data protection, information security, and data sovereignty "by design" into system architectures. PETs are a class of individual tools that can address specific information security requirements and risks in edge-cloud systems. Practitioners face the challenge of developing suitable PET strategies based on the specific needs of their application domain and the available PET tools to enable edge-cloud applications that comply to existing requirements for information security and deliver business value alike. This study supports practitioners in developing their own PET strategies for edge-cloud Applications. It provides assistance in identifying information security requirements and risks, selecting suitable PET tools, and seamlessly integrating them into the application design. A core element of this study is the analysis of PET tools in real-world edge-cloud applications. The study shows how PET tools can contribute to the implementation of information security, what prerequisites must be created for their use in specific scenarios, and what implications arise from their practical implementation. To this end, the guidance draws on the findings of early adopters of edge-cloud systems and PETs. The early adopters stem from projects part of the technology program "Edge Data Economy" commissioned by the German Federal Ministry of Research, Technology, and Space (BMFTR). This study’s guidance is particularly aimed at system architects and data protection officers who are required to design data processing processes in edge-cloud systems in compliance with data protection regulations. Based on the presentation of possible risks such as physical and cyber attacks, uncertain data sovereignty, insider threats, and misconfigurations, as well as requirements such as data minimization, data integrity, purpose limitation, and the prevention of data leaks "by design" in edge-cloud applications, this study analyzes five PET-tools in practical application scenarios: § Hardware keys for secure authentication without personal data disclosure in the food industry. § Federated learning for collaborative AI training without raw data transfer in industrial manufacturing. § Compute-to-data for performing analyses in the data owner's environment in industrial manufacturing. § Zero-knowledge proofs for data-based verification without disclosure of sensitive data in the energy industry. § Trusted execution environments for confidential calculations in isolated hardware environments in the energy industry. The study additionally presents four areas of action and associated recommendations for the successful use of PETs in edge-cloud applications: 1) Establishing a trustworthy partner ecosystem and creating necessary incentive mechanisms. 2) Creating the operational prerequisites needed for PET use, including training and awareness. 3) Ensuring the technical validity and integrability of PETs in the application context. 4) Ensuring the regulatory compliance of the PET-supported edge-cloud application. Edge-cloud systems and data sharing become increasingly relevant for data value creation. At the same time, the requirements for the protection of sensitive company and personal data remain challenging. In this context, implementing PET-based data processing becomes an important success factor. PETs not only enable compliance with regulatory requirements but also create the basis for trust-based cooperation in complex edge cloud ecosystems. Companies that want to jointly pursue data-driven value creation in the future should actively engage with PET.