Introduction to TripleBlind

Computers 101: Traditional Operation

Virtually every computer operation can be described as feeding data into an algorithm to get output. The "algorithm" can be simple or complex, but that is fundamentally how computers have operated since they were conceived.

The introduction of networks and the internet didn't fundamentally change this basic formula, it just allowed the input data to reside further away from the CPU running the algorithm and the output to be sent to different locations. With today's network speeds, the physical storage device holding data is less and less important and often unknown to ordinary users.

But what about security and privacy?

While the internet didn't change the conceptual operation of computers, it did introduce new security and legal challenges. With data being transmitted over an unknown sequence of physical links and intermediate storage devices, the chances of data being intercepted or leaked have increased. Trusting other parties to protect your interests has proven inadequate. Bad actors have acted badly, trusted partners have create security holes and data has been leaked.

As a result, organizations must abide by complex regulations to operate even on "internal" data when dealing with multinational scenarios. Collaboration with others has become expensive and difficult, and in some cases virtually impossible.

TripleBlind Architecture: The Router and Access Points

The TripleBlind Router fundamentally changes the architecture of collaboration. It acts as the coordinator between the different parties, indexing datasets and algorithms but never the actual data or code to be executed. These indexes can be searched and the Router verifies security and authentication before a calculation begins.

An Access Point is run by each organization which wishes to participate in the TripleBlind ecosystem. The Access Point runs on a computer or cloud instance that is completely controlled by the participant. It has two primary duties:

  1. Provide computational resources for joint operations
  2. Act as the encryption gatekeeper to the organization's data

Each Access Point is registered with the Router and only individuals from that organization are able to manage the assets it protects. However, with permission an Access Point can establish a connection with another Access Point to execute a single operation. Each operation requires explicit permission, and once it completes the connection is closed.

Joint Operations: Two basic techniques

Regardless of the operation or technique used, an Access Point will never send an organization's data to anyone else, guaranteeing privacy and data residency is fully upheld. Instead joint operations are achieved in one of two ways:

  • Federated (FED) Operation You can think of these operations as "bringing the program to the data". The Access Point executes the training or analysis in place against their own data. For certain operations intermediate data will be passed between Access Points, but no raw or un-aggregated data is ever shared. All data transmission uses industry standard SSL technologies, requiring TLS 1.3+ using SHA-256 or better cryptographic hashes, AES encryption and 2048 bit RSA keys.
  • SMPC Operation SMPC (Secure Multi-Party Computation) is a true joint operation. Neither data nor the operation is fully held by either party, resulting in mathematically guaranteed privacy of both parties.
Security and privacy advantages

With this architecture data never leaves from the protected environment of the owner. Data residency is fully satisfied, auditability and retractability is easy, and security can be guaranteed by the data owner.