ABSTRACT
Abstract
A homomorphic encryption algorithm is performed that encrypts at least a portion of a plurality of plaintext data items at a client computing device into homomorphic queries, each query including a cryptographically safe representation of one of the data items. The queries are transmitted to at least one discrete homomorphic encryption (DHE) server. An identifier is received from each query from the DHE server. The identifiers are transmitted to at least one computing server that maintains a database including data structures. The computing server is requested to requesting the computing server to insert the received identifiers into the database. At least one of the identifiers is processed: the computing server is requested to find the identifiers in the data structures that match the at least one identifiers and to perform at least one equality-based operation on the matching identifiers. A result of the at least one operation is received.
Description
CROSS-REFERENCE TO RELATED APPLICATION
This non-provisional patent application claims priority under 35 U.S.C. §119(e) to U.S. Provisional Patent Application Ser. No. 61/615,835, filed Mar. 26, 2012, the disclosure of which is incorporated by reference.
FIELD
This application relates in general homomorphic encryption, and, in particular, to a computer-implemented system and method for providing data privacy in a cloud using discrete homomorphic encryption.
BACKGROUND
Homomorphic encryption is a form of encryption where a specific algebraic operation performed on the plaintext is equivalent to another (possibly different) algebraic operation performed on the ciphertext. Homomorphic encryption can be defined for both public-key (asymmetric) and private-key (symmetric) encryption. The original concept, called privacy homomorphism, was introduced by Rivest et al. in âOn data banks and privacy homomorphisms,â Foundations of Secure Computation, pages 169-180 (1978), shortly after the invention of RSA, the public-key encryption algorithm. While encryption used in a number of industries, some unresolved difficulties in use of homomorphic encryption remain. In particular, the immediate downside aspect of encrypted data is that the data cannot be further processed (e.g. added, multiplied, searched), thus severely limiting any post-encryption computing of the ciphertext, especially by an external processing entity such as a cloud computing service.
Processing of this encrypted data has long been a problem without a practical and secure solution. While homomorphic encryption schemes are being developed to address this situation, aside from a few homomorphic encryption schemes involving almost exclusively asymmetric-key algorithms, there are no practical symmetric-key encryption solutions for the cloud today.
Gentry in âFully homomorphic encryption using ideal lattices,â 41st ACM Symposium on Theory of Computing (STOC) (2009), used latticed-based cryptography to show the first fully homomorphic encryption (FHE) scheme for public-key cryptography. While this method creates an FHE scheme, the method remains impractical due to the complexity and large amount of computing involved. This complexity and the large amount of computing involved make the scheme's application, such as to a homomorphic search, not likely for the next 40 years, at least based on Moore's law. The scheme's applicability in the cloud storage and computing is also limited because the cloud uses prevalently private-key cryptography to store encrypted data.
Thus, existing technologies fail to provide an adequate solution to processing homomorphically-encrypted data in a cloud-computing environment, especially for data that is in motion. With the continual expansion of cloud computing, storing encrypted data using mostly symmetric-key encryption algorithms, having a practical homomorphic encryption method is critical in taking the cloud from a simple storage stage to having a real computing component that can process encrypted data and enable a series of cloud applications while retaining complete data privacy.
Therefore, there is a need for a way to provide data privacy in a cloud using homomorphic encryption while allowing the processing of such data.
SUMMARY
An application of homomorphic encryption, called discrete homomorphic encryption (DHE), allows querying, reading and writing encrypted data to and from any external data store without the data store ever decrypting the data.
The implementation of DHE can be used in conjunction with already established symmetric-key encryption algorithms, with intrinsic support for block ciphers. Data that is already encrypted with a key and stored in the cloud can also benefit from DHE. The use of DHE enables comparing two pieces of encrypted data and determine if they are the same, without decryption, thus enabling applications and services to find, retrieve and perform equality-based set and hierarchy operations on encrypted data located in the cloud without the cloud ever decrypting the data. Furthermore, using DHE can enable sharing of encrypted data between applications while having the encryption keys only on the client computing device and never in the cloud. The immediate practical implementation refers to applications in the cloud-computing environment where the external data source is a cloud web service. By using DHE, these applications can provide a series of cloud services (backup & restore, address books, database, collaboration & sharing) while having the data encrypted entirely.
A computer-implemented method for providing data privacy in a cloud using discrete homomorphic encryption is provided. A homomorphic encryption algorithm is performed that encrypts at least a portion of a plurality of plaintext data items at a client computing device into homomorphic queries, each query including a cryptographically safe representation of one of the data items. The queries are transmitted to at least one discrete homomorphic encryption (DHE) server in a cloud-computing environment. An identifier is received from each query from the DHE server. The received identifiers are transmitted to at least one computing server in the cloud-computing environment that maintains a database including data structures. The computing server is requested to insert the received identifiers into the database, which can include at least one of: requesting the computing server to substitute existing data in the data structures with the identifiers; and requesting the computing server to create one or more additional data structures in the database and inserting the identifiers into the additional data structures. At least one of the identifiers is processed, including: the computing server is requested to find the identifiers in the data structures, both original and new, in the database that match the at least one identifiers; the computing server is requested to perform at least one equality-based operation on the matching identifiers; and a result of the at least one operation is received from the computing service.
In one embodiment, a computer-implemented method for providing data privacy in a cloud during data structure retrieval using discrete homomorphic encryption is provided. A homomorphic encryption algorithm is performed that encrypts at least a portion of a plurality of plaintext data items at a client computing device into homomorphic queries, each query including a cryptographically safe representation of one of the data items. The queries are transmitted to at least one discrete homomorphic encryption (DHE) server in a cloud-computing environment. An identifier is received from each query from the DHE server. The received identifiers are transmitted to at least one computing server in the cloud-computing environment that maintains a database including data structures. The computing server is requested to insert the received identifiers into the database, which can include at least one of: requesting the computing server to substitute existing data in the data structures with the identifiers; and requesting the computing server to create one or more additional data structures in the database and inserting the identifiers into the additional data structures. Processing of at least one of the identifiers occurs, which includes: requesting the computing server to find the identifiers in the data structures that match the at least one identifier; requesting the computing server to perform at least one equality-based operation on the matching identifiers; receiving from computing server at least one of the data structures with one of the matching identifiers as a result of the equality-based operation. The plaintext data item from which was encrypted the query associated with at least one of the identifiers populating the received data structure is obtained.
In a further embodiment, a computer-implemented method for providing data privacy in a cloud during data processing using discrete homomorphic encryption is provided. A homomorphic encryption algorithm is performed that encrypts at least a portion of a plurality of plaintext data items at a client computing device into homomorphic queries, each query including a cryptographically safe representation of one of the data items. The queries are transmitted to at least one discrete homomorphic encryption (DHE) server in a cloud-computing environment. An identifier is received from each query from the DHE server. The received identifiers are transmitted to at least one computing server in the cloud-computing environment that maintains a database including data structures. The computing server is requested to insert the received identifiers into the database, which can include at least one of: requesting the computing server to substitute existing data in the data structures with the identifiers; and requesting the computing server to create one or more additional data structures in the database and inserting the identifiers into the additional data structures. Processing at least one of the identifiers occurs, which includes: requesting the computing server to find the identifiers in the data structures that match the at least one identifier; requesting the computing server to perform at least one equality-based operation on the matching identifiers; and receiving from the computing server a result of the equality-based operation that includes a statistic associated with at least one of the identifiers in the data structures.
Still other embodiments of the present invention will become readily apparent to those skilled in the art from the following detailed description, wherein are described embodiments by way of illustrating the best mode contemplated for carrying out the invention. As will be realized, the invention is capable of other and different embodiments and its several details are capable of modifications in various obvious respects, all without departing from the spirit and the scope of the present invention. Accordingly, the drawings and detailed description are to be regarded as illustrative in nature and not as restrictive.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a block diagram showing a high-level structural overview of a system for providing data privacy in a cloud using discrete homomorphic encryption in accordance with one embodiment.
FIG. 2 is a block diagram showing a functional architecture of the system of FIG. 1 in accordance with one embodiment.
FIG. 3 is a block diagram showing populating a data record with Ids in accordance with one embodiment.
FIG. 4 is a flow diagram illustrating a performance of the Cryptographically Secure Semantic Reduction Algorithm in accordance with one embodiment.
FIG. 5 is a flow diagram illustrating a method for providing data privacy in a cloud using discrete homomorphic encryption in accordance with one embodiment.
FIG. 6 is a flow diagram illustrating a routine for generating homomorphic queries for the method of FIG. 5 in accordance with one embodiment.
FIG. 7 is a flow diagram illustrating a routine for processing at least one identifier for the method of FIG. 5 in accordance with one embodiment.
FIG. 8 is a flow diagram illustrating a routine for obtaining plaintext data items from which queries associated with at least one of identifiers received from the computing service were generated.
DETAILED DESCRIPTION
The disclosed system and method define an application of the homomorphic encryption, called discrete homomorphic encryption (DHE) that enables applications and services to find, retrieve and perform equality-based set and hierarchy operations on encrypted data located in a cloud-computing environment without the cloud ever decrypting the data. Additionally, encrypted data can be shared across applications.
As discussed below, the disclosed system and method involve homomorphic encryption algorithm called cryptographically secure semantic reduction (CSSR). This algorithm creates cryptographically safe representations of data, called homomorphic queries that are answered by a service with a semantic-less identity (DHE Id), usually a number. This Id further enables a variety of equality-based set and hierarchy operations. These Ids are further used by cloud applications to replace all encrypted sensitive data that requires processing.
Structural Overview of the System for Providing Data Privacy Using Discrete Homomorphic Encryption
FIG. 1 is a block diagram showing a high-level structural overview of a system 10 for providing data privacy in a cloud using discrete homomorphic encryption in accordance with one embodiment. The system 10 includes at least one software application 11 running on a client computing device 12 . While shown as a desktop computer, the computing device 12 can include any other computing devices capable of running software, including mobile phones, tablets, and laptops. The computing device 12 includes components commonly-present in computing devices such as a central processing unit (CPU), random access memory (RAM), non-volatile secondary storage, such as a hard drive or CD ROM drive, network interfaces, and peripheral devices, including user interfacing means, such as a keyboard and display. The device 12 is configured to execute code of the application 11 , which can be implemented as modules.
The application 11 is connected over a network 13 , such as the Internet or a cellular network, to components in a cloud-computing environment (not shown), and transmits encrypted data items into the cloud-computing environment. While the described embodiment refers to the application 11 as a single application, multiple applications on the client computing device 12 can interact with the cloud-computing environment as described below. As described below with reference to FIGS. 2 , 4 , and 6 , the application 11 performs the CSSR homomorphic encryption algorithm to encrypt plaintext data items (not shown) present on the <figure-callout id="12" label="computing device" filenames="US09031229-20150512-D0000
CROSS-REFERENCE TO RELATED APPLICATION
This non-provisional patent application claims priority under 35 U.S.C. §119(e) to U.S. Provisional Patent Application Ser. No. 61/615,835, filed Mar. 26, 2012, the disclosure of which is incorporated by reference.
FIELD
This application relates in general homomorphic encryption, and, in particular, to a computer-implemented system and method for providing data privacy in a cloud using discrete homomorphic encryption.
BACKGROUND
Homomorphic encryption is a form of encryption where a specific algebraic operation performed on the plaintext is equivalent to another (possibly different) algebraic operation performed on the ciphertext. Homomorphic encryption can be defined for both public-key (asymmetric) and private-key (symmetric) encryption. The original concept, called privacy homomorphism, was introduced by Rivest et al. in âOn data banks and privacy homomorphisms,â Foundations of Secure Computation, pages 169-180 (1978), shortly after the invention of RSA, the public-key encryption algorithm. While encryption used in a number of industries, some unresolved difficulties in use of homomorphic encryption remain. In particular, the immediate downside aspect of encrypted data is that the data cannot be further processed (e.g. added, multiplied, searched), thus severely limiting any post-encryption computing of the ciphertext, especially by an external processing entity such as a cloud computing service.
Processing of this encrypted data has long been a problem without a practical and secure solution. While homomorphic encryption schemes are being developed to address this situation, aside from a few homomorphic encryption schemes involving almost exclusively asymmetric-key algorithms, there are no practical symmetric-key encryption solutions for the cloud today.
Gentry in âFully homomorphic encryption using ideal lattices,â 41st ACM Symposium on Theory of Computing (STOC) (2009), used latticed-based cryptography to show the first fully homomorphic encryption (FHE) scheme for public-key cryptography. While this method creates an FHE scheme, the method remains impractical due to the complexity and large amount of computing involved. This complexity and the large amount of computing involved make the scheme's application, such as to a homomorphic search, not likely for the next 40 years, at least based on Moore's law. The scheme's applicability in the cloud storage and computing is also limited because the cloud uses prevalently private-key cryptography to store encrypted data.
Thus, existing technologies fail to provide an adequate solution to processing homomorphically-encrypted data in a cloud-computing environment, especially for data that is in motion. With the continual expansion of cloud computing, storing encrypted data using mostly symmetric-key encryption algorithms, having a practical homomorphic encryption method is critical in taking the cloud from a simple storage stage to having a real computing component that can process encrypted data and enable a series of cloud applications while retaining complete data privacy.
Therefore, there is a need for a way to provide data privacy in a cloud using homomorphic encryption while allowing the processing of such data.
SUMMARY
An application of homomorphic encryption, called discrete homomorphic encryption (DHE), allows querying, reading and writing encrypted data to and from any external data store without the data store ever decrypting the data.
The implementation of DHE can be used in conjunction with already established symmetric-key encryption algorithms, with intrinsic support for block ciphers. Data that is already encrypted with a key and stored in the cloud can also benefit from DHE. The use of DHE enables comparing two pieces of encrypted data and determine if they are the same, without decryption, thus enabling applications and services to find, retrieve and perform equality-based set and hierarchy operations on encrypted data located in the cloud without the cloud ever decrypting the data. Furthermore, using DHE can enable sharing of encrypted data between applications while having the encryption keys only on the client computing device and never in the cloud. The immediate practical implementation refers to applications in the cloud-computing environment where the external data source is a cloud web service. By using DHE, these applications can provide a series of cloud services (backup & restore, address books, database, collaboration & sharing) while having the data encrypted entirely.
A computer-implemented method for providing data privacy in a cloud using discrete homomorphic encryption is provided. A homomorphic encryption algorithm is performed that encrypts at least a portion of a plurality of plaintext data items at a client computing device into homomorphic queries, each query including a cryptographically safe representation of one of the data items. The queries are transmitted to at least one discrete homomorphic encryption (DHE) server in a cloud-computing environment. An identifier is received from each query from the DHE server. The received identifiers are transmitted to at least one computing server in the cloud-computing environment that maintains a database including data structures. The computing server is requested to insert the received identifiers into the database, which can include at least one of: requesting the computing server to substitute existing data in the data structures with the identifiers; and requesting the computing server to create one or more additional data structures in the database and inserting the identifiers into the additional data structures. At least one of the identifiers is processed, including: the computing server is requested to find the identifiers in the data structures, both original and new, in the database that match the at least one identifiers; the computing server is requested to perform at least one equality-based operation on the matching identifiers; and a result of the at least one operation is received from the computing service.
In one embodiment, a computer-implemented method for providing data privacy in a cloud during data structure retrieval using discrete homomorphic encryption is provided. A homomorphic encryption algorithm is performed that encrypts at least a portion of a plurality of plaintext data items at a client computing device into homomorphic queries, each query including a cryptographically safe representation of one of the data items. The queries are transmitted to at least one discrete homomorphic encryption (DHE) server in a cloud-computing environment. An identifier is received from each query from the DHE server. The received identifiers are transmitted to at least one computing server in the cloud-computing environment that maintains a database including data structures. The computing server is requested to insert the received identifiers into the database, which can include at least one of: requesting the computing server to substitute existing data in the data structures with the identifiers; and requesting the computing server to create one or more additional data structures in the database and inserting the identifiers into the additional data structures. Processing of at least one of the identifiers occurs, which includes: requesting the computing server to find the identifiers in the data structures that match the at least one identifier; requesting the computing server to perform at least one equality-based operation on the matching identifiers; receiving from computing server at least one of the data structures with one of the matching identifiers as a result of the equality-based operation. The plaintext data item from which was encrypted the query associated with at least one of the identifiers populating the received data structure is obtained.
In a further embodiment, a computer-implemented method for providing data privacy in a cloud during data processing using discrete homomorphic encryption is provided. A homomorphic encryption algorithm is performed that encrypts at least a portion of a plurality of plaintext data items at a client computing device into homomorphic queries, each query including a cryptographically safe representation of one of the data items. The queries are transmitted to at least one discrete homomorphic encryption (DHE) server in a cloud-computing environment. An identifier is received from each query from the DHE server. The received identifiers are transmitted to at least one computing server in the cloud-computing environment that maintains a database including data structures. The computing server is requested to insert the received identifiers into the database, which can include at least one of: requesting the computing server to substitute existing data in the data structures with the identifiers; and requesting the computing server to create one or more additional data structures in the database and inserting the identifiers into the additional data structures. Processing at least one of the identifiers occurs, which includes: requesting the computing server to find the identifiers in the data structures that match the at least one identifier; requesting the computing server to perform at least one equality-based operation on the matching identifiers; and receiving from the computing server a result of the equality-based operation that includes a statistic associated with at least one of the identifiers in the data structures.
Still other embodiments of the present invention will become readily apparent to those skilled in the art from the following detailed description, wherein are described embodiments by way of illustrating the best mode contemplated for carrying out the invention. As will be realized, the invention is capable of other and different embodiments and its several details are capable of modifications in various obvious respects, all without departing from the spirit and the scope of the present invention. Accordingly, the drawings and detailed description are to be regarded as illustrative in nature and not as restrictive.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a block diagram showing a high-level structural overview of a system for providing data privacy in a cloud using discrete homomorphic encryption in accordance with one embodiment.
FIG. 2 is a block diagram showing a functional architecture of the system of FIG. 1 in accordance with one embodiment.
FIG. 3 is a block diagram showing populating a data record with Ids in accordance with one embodiment.
FIG. 4 is a flow diagram illustrating a performance of the Cryptographically Secure Semantic Reduction Algorithm in accordance with one embodiment.
FIG. 5 is a flow diagram illustrating a method for providing data privacy in a cloud using discrete homomorphic encryption in accordance with one embodiment.
FIG. 6 is a flow diagram illustrating a routine for generating homomorphic queries for the method of FIG. 5 in accordance with one embodiment.
FIG. 7 is a flow diagram illustrating a routine for processing at least one identifier for the method of FIG. 5 in accordance with one embodiment.
FIG. 8 is a flow diagram illustrating a routine for obtaining plaintext data items from which queries associated with at least one of identifiers received from the computing service were generated.
DETAILED DESCRIPTION
The disclosed system and method define an application of the homomorphic encryption, called discrete homomorphic encryption (DHE) that enables applications and services to find, retrieve and perform equality-based set and hierarchy operations on encrypted data located in a cloud-computing environment without the cloud ever decrypting the data. Additionally, encrypted data can be shared across applications.
As discussed below, the disclosed system and method involve homomorphic encryption algorithm called cryptographically secure semantic reduction (CSSR). This algorithm creates cryptographically safe representations of data, called homomorphic queries that are answered by a service with a semantic-less identity (DHE Id), usually a number. This Id further enables a variety of equality-based set and hierarchy operations. These Ids are further used by cloud applications to replace all encrypted sensitive data that requires processing.
Structural Overview of the System for Providing Data Privacy Using Discrete Homomorphic Encryption
FIG. 1 is a block diagram showing a high-level structural overview of a system 10 for providing data privacy in a cloud using discrete homomorphic encryption in accordance with one embodiment. The system 10 includes at least one software application 11 running on a client computing device 12 . While shown as a desktop computer, the computing device 12 can include any other computing devices capable of running software, including mobile phones, tablets, and laptops. The computing device 12 includes components commonly-present in computing devices such as a central processing unit (CPU), random access memory (RAM), non-volatile secondary storage, such as a hard drive or CD ROM drive, network interfaces, and peripheral devices, including user interfacing means, such as a keyboard and display. The device 12 is configured to execute code of the application 11 , which can be implemented as modules.
The application 11 is connected over a network 13 , such as the Internet or a cellular network, to components in a cloud-computing environment (not shown), and transmits encrypted data items into the cloud-computing environment. While the described embodiment refers to the application 11 as a single application, multiple applications on the client computing device 12 can interact with the cloud-computing environment as described below. As described below with reference to FIGS. 2 , 4 , and 6 , the application 11 performs the CSSR homomorphic encryption algorithm to encrypt plaintext data items (not shown) present on the computing device 12 into homomorphic queries, with each query being a cryptographically safe representation of one of the plaintext data items. The application 11 transmits the queries to the cloud-computing environment.
The cloud-computing environment includes one or more servers 14 , called DHE servers 14 for the purposes of this application, which receive the queries and implement a DHE service 15 that generates an identifier (not shown), known as âIdâ or âDHE Idâ below, for each query. The DHE servers 14 , which can be dedicated or shared servers, provide the generated Ids to the application, as further described below with reference to FIG. 2 . The Ids completely lack any semantic relationship to the queries for which they were created.
The cloud-computing environment further includes one or more computing servers 17 connected to a database 18 . These computing servers 17 implement a computing service 19 capable of performing equality-based operations on data in data structures 20 stored in the database 18 . In one embodiment, the service 19 can be the Amazon Elastic Compute Cloud (EC2®) offered by Amazon.com Inc. of Seattle, Wash. or Windows Azure service offered by Microsoft Corporation of Redmond, Wash. The servers 17 can further substitute data in the data structures 20 with the Ids generated by the DHE service 15 when requested by the application 11 .
The application 11 further encrypts plaintext data items into ciphertext data items 21 , and transmits the ciphertext data items 21 to be stored in a cloud- computing storage 22 . The storage 22 , which in one embodiment can be the S3 storage maintained by Amazon.com Inc. of Seattle, Wash., is connected to one or more storage servers 23 . The storage servers 23 implement a storage service 24 , which receives the ciphertext data items 21 from the application 11 , stores the ciphertext data items 21 in a location in the storage 22 , and returns a reference (not shown) to the location of a stored ciphertext data item 21 to the application 11 . As described below with reference to FIG. 8 , the application 11 can associate a reference with an Id corresponding to the query generated from the same plaintext data item as the ciphertext data item whose location is identified by the reference, and to provide the association to the DHE service 15 . The application 11 can also retrieve the reference associated with one of the Ids from the DHE service 15 . The application 11 can further retrieve the ciphertext data item 21 stored at the location identified by the reference, and decrypt the retrieved ciphertext data items 21 into plaintext.
In the system 10 described above, the data and the keys are always encrypted while in transit or processed by the
services
15 , 19 , or 24 while these services never have access to the encryption keys. As described below, the application 11 includes a DHE Client Application Programming Interface (âAPIâ), as well as other APIs to the other services
19 , 24 , which are implemented on the client computing device 12 .
Functional Overview of the System for Providing Data Privacy Using Discrete Homomorphic Encryption
The operations called by the application 11 at the client computing device 12 drive the functionality of the system 10 . FIG. 2 is a block diagram showing a functional architecture of the system of FIG. 1 in accordance with one embodiment. The system 10 is separated by a trust/no- trust line 31 . The trust/no- trust line 31 conceptually divides the system 10 into two realms or zones: the trusted zone and the non-trusted zone. In FIG. 2 , operations {0}, {2}, {3}, {4}, {5}, {6}, {7}, {8}, {9}, and {10}, involve calling one of the
services
15 , 19 , and 24 , to request the
services
15 , 19 , and 24 to perform at least a part of the operation.
In the trusted zone, data is available as plaintext 33 (unencrypted). This zone is usually a secure private client application space, not on the Internet, but connected to the Internet. Only the owner of the data has access to the data in both encrypted and unencrypted form through the trusted client application 11 . In the non-trusted zone, data must be available as ciphertext 21 only (encrypted). This zone is the cloud-computing environment located on the Internet. The most important aspect of this zone is that the cloud-computing environment components never interact directly but only through the trusted client application 11 .
Four entities interact in the system 10 : the client application 11 , the DHE service 15 , the cloud computing service 19 , and the cloud storage service 24 . The application 11 includes the DHE Client API 32, as well as APIs to the other services (not shown). In one embodiment, the application 11 and the different services 11 have different ownership and are implemented by different entities, as described below with reference to Table 1. The ownership of implementation and operation (hosting) can belong to one of the following entities:
Customer: a user of the system, typically a company or user owning the data.
Cloud Provider: a provider of cloud services such as processing or storage.
DHE Provider: the provider of the DHE service 15 .
TABLE 1
Category
Implementation
Operation
Client Application
11
Customer
Customer
DHE Client API 32 at client
DHE Provider
Customer
DHE Service
15
DHE Provider
DHE Provider
Object Model (sets, hierarchies)
Customer
Cloud Provider
Processing in computing service 19
Customer
Cloud Provider
Storage service
24
Cloud Provider
Cloud Provider
Returning to FIG. 2 , the application 11 is main driver of the system 10 , orchestrating all of the system's 10 operations. The application has access to and uses at least the following entities: plaintext data 33 , an encryption key (K) 34 and an encryption algorithm (E K ) 35 . The plaintext data 33 needs to be encrypted, stored, and homomorphically processed in the cloud. When grouped together in data structures (e.g. sets, hierarchies), these form an object model. The encryption key (K) 34 is used to encrypt the plaintext data 33 . The encryption algorithm (E K ) 35 encrypts the plaintext data 33 with the encryption key (K) 34 .
Operations Performed by DHE Client API
The DHE Client API 32 is the client-side API of the DHE service 15 and is responsible for following operations:
Identity and access: Operation {0} is an operation that ensures that all calls to the DHE service 15 are authenticated, authorized and audited (AAA protocol 36 ). A user name, which can be an e-mail address, and a hashed password are provided to the DHE service 15 that returns a user id enclosed securely in a security token (not shown). This function means that all secure calls to the service 15 must be accompanied by the security token. This requirement is assumed to be the case for all calls below. The implementation of the AAA protocol 36 is orthogonal to the DHE Client API.
{0} Security Token (User)=AAA(email, password)
Initialization: Initialization ensures that the CSSR algorithm is properly initialized with the encryption key K 34 and encryption algorithm E
K 35 . If an encryption key is not available, a keyphrase, provided by the user or obtained from another source, can be used to generate the encryption key K 34 . The operation {1} stores a portion of the internal state of the CSRR and associates a public key with the user when sharing-mode is used, as further described below with reference to FIG. 4 . In one embodiment, the operation {1} transmits the encrypted CSSR algorithm to the DHE servers 14 for storage in the cloud-computing environment, as further described with reference to FIG. 4 .
CSSR=Init(K, E K ) or CSSR=Init (keyphrase, E K ) {1} Init (CSSR)
Query generation: using the CSSR algorithm a cryptographically safe representation of data called homomorphic query 37 is created.
Query=CSSR(Plaintext)
Unique key generation: using the CSSR algorithm a unique encryption key (K H ) is generated, when the sharing-mode is used.
K H =CSSR(Plaintext)
Query: In operation {2}, the DHE service 15 is queried using the homomorphic query and it responds with an Id 38 , which lacks any semantic relationship to the query 37 . This Id 38 can be a sequential, random or global number based purely on the private internal state of the service DHE Service 15 . Other Ids 38 are possible.
{2} Id=Query
Set reference: Operation {3} associates an Uri (absolute or partial) with the Id. The Uri is a complete or partial reference 39 to the location of the encrypted data with the storage service 22 .
{3} Set(Id, Uri)
Get reference: Operation {4} retrieves the Uri associated with the Id 38 . This function is also called a reverse query.
{4} Uri=Get(Id)
Get info: Operation {5} retrieves all information and statistics associated with a specific DHE Id 38 .
{5} Info=Info(Id)
Unique key sharing: Operation {6} enables sharing of the unique encryption key (K H ) between two users (U 1 , U 2 ). The superscript notation in the command below refers to operation at user (U 1 ) or (U 2 ). The CSSR uses public-key encryption with the key-pair of (K P /K V ) where the (K P ) is the public key and (K V ) is the private key.
{6} Share=CSSR 1 (K 1 H , K 2 P )
K 1 H =CSSR 2 (Share, K 2 V )
Other services: Operation {x} provides support for extra services such as signup, account management, key grouping, billing, expiration, deletion, status and troubleshooting.
Operations Performed by Computing and Storage Service APIs
The application 11 further includes a computing service API (not shown) and the storage service API (not shown). The computing service API makes application-specific calls to the application's 11 own object model stored in the cloud computing service 19 . These calls are always implemented by the direct consumer of the DHE service 15 , making the following operations possible:
Substitution: Operation {7} ensures that all encrypted sensitive data items that requires processing in the computing service 19 is replaced with Ids 38 produced by the Operation {2} call for the data items. In a further embodiment, the operation can create new data structures and insert the identifiers into the new data structures.
{7} Id=Substitution(CSSR, Plaintext)
The operations {2} and {7} allow the client- side application 11 to substitute the fields in a data structure 20 with the corresponding Ids 38 , as further described with reference to FIG. 3 . Then the application 11 can find the data structure by secure queries by the DHE Ids 38 instead of the plaintext of its fields. When a data structure is retrieved from the computing service 19 and is available at the application 11 , using operation {4} the Uri for each DHE Id 38 is retrieved; then the encrypted data is retrieved from the storage service 24 and decrypted locally, thus making the data structure available in the plaintext format to the application 11 .
Equality-based operations: calls made to the object model exposed by the computing service 19 , using the discrete homomorphic operations enabled by the Ids 38 :
{8} Set operations: query, enumerate, union, intersection, difference, subset and count {9} Hierarchy operations: enumerate, traverse, and count
Operations {8} and {9} are possible because the service 19 can find data organized in the data structures 20 by comparing and matching (an equality test) Ids 38 and then returning data structures (sets, hierarchies) 20 for these Ids.
Encrypt/Decrypt: encrypting of the plaintext 33 using the key (K) 34 , an initialization vector described below with reference to FIG. 4 , and encryption algorithm (E K ) 35 . The corresponding decryption algorithm is D K (not shown) is used to decrypt ciphertext 21 into plaintext. If sharing-mode is used the encryption key used is (K H ).
Ciphertext=E K (Plaintext, [K|K H , IV]) Plaintext=D K (Ciphertext, [K|K H ])
Read/Write: storing and retrieving of the ciphertext 21 to and from the storage 22 accessible to the storage service 24 . The location of the ciphertext in the service 24 is used as the reference 39 for the DHE Client API 32 when associating the reference 39 with the DHE Id 38 .
{10} Reference=Write(Ciphertext)
Ciphertext=Read(Reference)
The DHE, Computing, and Storage Services
As described above, three other entities interact in the system 10 in addition to the client application: the DHE service 15 , the cloud computing service 19 , and the cloud storage service 24 .
The DHE service 15 is the server-side complement of the client-side <figure-callout id="32" label="DHE Client API" filenames="US09031229-20150512-D00000.png,US09031229-
CLAIMS
Claims ( 17 )
What is claimed:
1. A computer-implemented method for providing data privacy in a cloud using discrete homomorphic encryption, comprising the steps of:
performing a homomorphic encryption algorithm that encrypts at least a portion of a plurality of plaintext data items at a client computing device into homomorphic queries, each query comprising a cryptographically safe representation of one of the data items;
transmitting the queries to at least one discrete homomorphic encryption (DHE) server and receiving from the DHE server an identifier associated with each query;
transmitting the received identifiers to at least one computing server in a cloud-computing environment that maintains a database comprising data structures;
requesting the computing server to insert the received identifiers into the database comprising at least one of:
requesting the computing server to substitute existing data in the data structures with the identifiers; and
requesting the computing server to create one or more additional data structures in the database and inserting the identifiers into the additional data structures;
processing at least one of the identifiers, comprising:
requesting the computing server to find the identifiers in the data structures in the database that match the at least one identifier;
requesting the computing server to perform at least one equality-based operation on the matching identifiers; and
receiving from the computing server a result of the at least one operation;
performing the homomorphic encryption algorithm to encrypt at least the portion of the plaintext data items into ciphertext data items;
transmitting the ciphertext data items to at least one storage server in the cloud-computing environment and requesting the storage server to store the ciphertext data items in the storage in the cloud-computing environment;
receiving a reference from the storage server to a location of each ciphertext data item in the storage;
obtaining an association between the at least one identifier comprised in the result and one of the references for the location of the ciphertext data item generated from the same plaintext data item as the query identified by the at least one identifier;
retrieving the ciphertext data item from the storage using the one reference; and
decrypting the retrieved ciphertext data item into the corresponding plaintext data item.
2. A method according to claim 1 , further comprising:
transmitting to the DHE server the association between the at least one identifier and the one reference;
requesting the reference associated with the at least one identifier comprised in the result from the DHE server; and
receiving the associated reference from the DHE server.
3. A method according to claim 1 , further comprising:
encrypting at least one encryption key for use in a sharing mode of the homomorphic encryption algorithm;
transmitting at least one encrypted encryption key to the DHE server; and
requesting the DHE server to transmit the at least one encrypted encryption key to a computing device associated with a different user than the user of the client computing device.
4. A method according to claim 1 , wherein the identifier for each query lacks a semantic relationship to the query.
5. A method according to claim 1 , wherein the at least one equality-based operation comprises at least one of:
equality-based set operations comprising at least one of query, enumerate, union, intersection, difference, subset, and count; and
equality-based hierarchy operations comprising at least one of enumerate, traverse, and count.
6. A method according to claim 1 , further comprising at least one of:
creating a stream of bytes sufficient for an operation of the homomorphic encryption algorithm; and
generating one or more encryption keys for the homomorphic encryption algorithm.
7. A method according to claim 6 , wherein at least one of the encryption keys is generated using a key phrase.
8. A method according to claim 6 , further comprising:
transforming at least the portion of the plaintext data items into vectors using a cryptographically secure one-way compression function;
transforming the vectors into queries using a length-preserving encryption algorithm; and
transforming the vectors into initialization vectors using a one-way compression function.
9. A method according to claim 8 , wherein the cryptographically secure one-way compression function is a Merkle-Damgård construction.
10. A method according to claim 1 , further comprising:
encrypting the homomorphic encryption algorithm; and
preserving the encrypted algorithm comprising at least one of:
storing the encrypted algorithm at the client computing device; and
transmitting the encrypted algorithm to the DHE server.
11. A computer-implemented method for providing data privacy in a cloud during data structure retrieval using discrete homomorphic encryption, comprising the steps of:
performing a homomorphic encryption algorithm that encrypts at least a portion of a plurality of plaintext data items at a client computing device into homomorphic queries, each query comprising a cryptographically safe representation of one of the data items;
transmitting the queries to at least one discrete homomorphic encryption (DHE) server in a cloud-computing environment and receiving from the DHE server an identifier associated with each query;
transmitting the received identifiers to at least one computing server in the cloud-computing environment and that maintains a database that comprises data structures;
requesting the computing server to insert the received identifiers into the database comprising at least one of:
requesting the computing server to substitute existing data in the data structures with the identifiers; and
requesting the computing server to create one or more additional data structures in the database and inserting the identifiers into the additional data structures;
processing at least one of the identifiers, comprising:
requesting the computing server to find the identifiers in the data structures in the database that match the at least one identifier;
requesting the computing server to perform at least one equality-based operation on the matching identifiers; and
receiving from computing server at least one of the data structures with one of the matching identifiers as a result of the equality-based operation; and
obtaining the plaintext data item from which the query associated with at least one of the identifiers in the received data structure was generated, comprising:
performing the homomorphic encryption algorithm to encrypt at least the portion of the plaintext data items into ciphertext data items;
transmitting the ciphertext data items to at least one storage server in the cloud-computing environment and requesting the storage server to store the ciphertext data items in a storage in the cloud-computing environment;
receiving a reference from the storage server to a location of each ciphertext data item in the storage;
obtaining an association between the at least one identifier in the received data structure and the reference for the location of the ciphertext data item generated from the same plaintext data item as the query identified by the at least one identifier;
retrieving the ciphertext data item from the storage using the one reference; and
decrypting the retrieved ciphertext data item into the corresponding plaintext data item.
12. A method according to claim 11 , further comprising:
transmitting to the DHE server the association between the at least one identifier and the one reference;
requesting the one reference associated with the at least one identifier; and
receiving the associated reference from the DHE server.
13. A computer-implemented method for providing data privacy in a cloud during data processing using discrete homomorphic encryption, comprising the steps of:
performing a homomorphic encryption algorithm that encrypts at least a portion of a plurality of plaintext data items at a client computing device into homomorphic queries, each query comprising a cryptographically safe representation of one of the data items;
transmitting the queries to at least one discrete homomorphic encryption (DHE) server in a cloud-computing environment and receiving from the DHE server an identifier associated with each query;
transmitting the received identifiers to at least one computing server in the cloud-computing environment and that maintains a database that comprises data structures;
requesting the computing server to insert the received identifiers into the database comprising at least one of:
requesting the computing server to substitute existing data in the data structures with the identifiers; and
requesting the computing server to create one or more additional data structures in the database and inserting the identifiers into the additional data structures;
processing at least one of the identifiers, comprising:
requesting the computing server to find the identifiers in the data structures in the database that match the at least one identifier;
requesting the computing server to perform at least one equality-based operation on the matching identifiers; and
receiving from the computing server a result of the equality-based operation comprising a statistic associated with at least one of the identifiers populating the data structures;
performing the homomorphic encryption algorithm to encrypt at least the portion of the plaintext data items into ciphertext data items;
transmitting the ciphertext data items to at least one storage server in the cloud-computing environment and requesting the storage server to store the ciphertext data items in a storage in the cloud-computing environment;
receiving a reference from the storage server to a location of each ciphertext data item in the storage;
obtaining an association between the at least one identifier associated with the statistic and the reference for the location of the ciphertext data item generated from the same plaintext data item as the query identified by the at least one identifier;
retrieving the ciphertext data item from the storage using the one reference; and
decrypting the retrieved ciphertext data item into the corresponding plaintext data item.
14. A method according to claim 13 , further comprising at least one of:
creating a stream of bytes sufficient for an operation of the homomorphic encryption algorithm; and
generating one or more encryption keys for the homomorphic encryption algorithm.
15. A method according to claim 14 , wherein at least one of the encryption keys is generated using a key phrase.
16. A method according to claim 14 , further comprising:
transforming at least the portion of the plaintext data items into vectors using a cryptographically secure one-way compression function;
transforming the vectors into queries using a length-preserving encryption algorithm; and
transforming the vectors into initialization vectors using a one-way compression function.
17. A method according to claim 16 , wherein the cryptographically secure one-way compression function is a Merkle-Damgård construction.
US13/831,904
2012-03-26
2013-03-15
Computer-implemented system and method for providing data privacy in a cloud using discrete homomorphic encryption
Active
2033-12-13
US9031229B1
( en )
Priority Applications (2)
Application Number
Priority Date
Filing Date
Title
US13/831,904
US9031229B1
( en )
2012-03-26
2013-03-15
Computer-implemented system and method for providing data privacy in a cloud using discrete homomorphic encryption
US14/709,282
US9509494B2
( en )
2012-03-26
2015-05-11
Computer-implemented system and method for providing secure data processing in a cloud using discrete homomorphic encryption
Applications Claiming Priority (2)
Application Number
Priority Date
Filing Date
Title
US201261615835P
2012-03-26
2012-03-26
US13/831,904
US9031229B1
( en )
2012-03-26
2013-03-15
Computer-implemented system and method for providing data privacy in a cloud using discrete homomorphic encryption
Related Child Applications (1)
Application Number
Title
Priority Date
Filing Date
US14/709,282
Continuation
US9509494B2
( en )
2012-03-26
2015-05-11
Computer-implemented system and method for providing secure data processing in a cloud using discrete homomorphic encryption
Publications (1)
Publication Number
Publication Date
US9031229B1
true
US9031229B1 ( en )
2015-05-12
Family
ID=53038270
Family Applications (2)
Application Number
Title
Priority Date
Filing Date
US13/831,904
Active
2033-12-13
US9031229B1
( en )
2012-03-26
2013-03-15
Computer-implemented system and method for providing data privacy in a cloud using discrete homomorphic encryption
US14/709,282
Active
US9509494B2
( en )
2012-03-26
2015-05-11
Computer-implemented system and method for providing secure data processing in a cloud using discrete homomorphic encryption
Family Applications After (1)
Application Number
Title
Priority Date
Filing Date
US14/709,282
Active
US9509494B2
( en )
2012-03-26
2015-05-11
Computer-implemented system and method for providing secure data processing in a cloud using discrete homomorphic encryption
Country Status (1)
Country
Link
US
( 2 )
US9031229B1
( en )
Cited By (25)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
CN105610910A
( en )
*
2015-12-18
2016-05-25
ä¸åæ°æ大å¦
Cloud storage oriented ciphertext full-text search method and system based on full homomorphic ciphers
US9438412B2
( en )
*
2014-12-23
2016-09-06
Palo Alto Research Center Incorporated
Computer-implemented system and method for multi-party data function computing using discriminative dimensionality-reducing mappings
US9529733B1
( en )
*
2014-09-18
2016-12-27
Symantec Corporation
Systems and methods for securely accessing encrypted data stores
CN106326360A
( en )
*
2016-08-10
2017-01-11
æ¦æ±ç§æ大å¦
Fuzzy multi-keyword retrieval method of encrypted data in cloud environment
US20170147835A1
( en )
*
2015-11-25
2017-05-25
International Business Machines Corporation
Efficient two party oblivious transfer using a leveled fully homomorphic encryption
US10095880B2
( en )
2016-09-01
2018-10-09
International Business Machines Corporation
Performing secure queries from a higher security domain of information in a lower security domain
US10241930B2
( en )
*
2014-12-08
2019-03-26
eperi GmbH
Storing data in a server computer with deployable encryption/decryption infrastructure
US20190171847A1
( en )
*
2016-08-03
2019-06-06
Abb Schweiz Ag
Method for storing data blocks from client devices to a cloud storage system
US10333715B2
( en )
*
2016-11-14
2019-06-25
International Business Machines Corporation
Providing computation services with privacy
WO2019148335A1
( en )
*
2018-01-30
2019-08-08
Nokia Technologies Oy
Secure data processing
US20190325082A1
( en )
*
2018-04-19
2019-10-24
Microsoft Technology Licensing, Llc
Private information retrieval with probabilistic batch codes
CN111464282A
( en )
*
2019-01-18
2020-07-28
ç¾åº¦å¨çº¿ç½ç»ææ¯ï¼å京ï¼æéå ¬å¸
Data processing method and device based on homomorphic encryption
CN111832044A
( en )
*
2020-06-30
2020-10-27
ä¸å½è¹è¶éå·¥éå¢å ¬å¸ç¬¬ä¸ä¸å ç 究æ
Safe collaborative computing processing method and system
CN112215158A
( en )
*
2020-10-13
2021-01-12
ä¸å±±å¤§å¦
Face recognition method fusing fully homomorphic encryption and discrete wavelet transform in cloud environment
CN112347391A
( en )
*
2020-09-28
2021-02-09
æå·å®æä¿¡æ¯å®å ¨ææ¯æéå ¬å¸
A method and device for protecting API privacy parameters
EP3449414B1
( en )
*
2016-04-29
2021-12-08
Privitar Limited
Computer-implemented privacy engineering system and method
CN114021006A
( en )
*
2021-10-29
2022-02-08
æµå浪潮æ°æ®ææ¯æéå ¬å¸
Multi-dimensional data security query method and device
CN114490728A
( en )
*
2022-01-20
2022-05-13
æ·±å³å¸çµååå¡å®å ¨è¯ä¹¦ç®¡çæéå ¬å¸
Data query method, device, system, equipment and medium
US20220166849A1
( en )
*
2020-11-25
2022-05-26
Beijing Xiaomi Mobile Software Co., Ltd.
Information processing method and apparatus, communication device and storage medium
US11502820B2
( en )
2020-05-27
2022-11-15
International Business Machines Corporation
Privacy-enhanced decision tree-based inference on homomorphically-encrypted data
CN115664723A
( en )
*
2022-09-30
2023-01-31
èèåºåé¾ç§æ(ä¸æµ·)æéå ¬å¸
Method, system, server and client for realizing private information retrieval
CN116305229A
( en )
*
2022-09-09
2023-06-23
æ·±å³è´æç§ææéå ¬å¸
Privacy computing, privacy data and anonymous query method and device for federated learning
CN116488851A
( en )
*
2023-03-08
2023-07-25
å京é®çµå¤§å¦
Privacy computing method and related equipment
CN117424757A
( en )
*
2023-12-18
2024-01-19
ä½³çç§ææéå ¬å¸
A data encryption method and encryption device based on cloud database storage
JP2024541996A
( en )
*
2021-11-02
2024-11-13
ããããã£ãã§ã³ãã¼ ã¢ã¤ãã¼ã¢ã¼ã« ããã¸ã¡ã³ã ãªãããã
Privacy-preserving Domain Name Service (DNS)
Families Citing this family (35)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US10171230B2
( en )
*
2014-02-28
2019-01-01
Empire Technology Development Llc
Homomorphic encryption scheme
US9729525B1
( en )
2015-06-29
2017-08-08
EMC IP Holding Company LLC
Secure data analytics
US9906511B1
( en )
2015-06-29
2018-02-27
Bar-Ilan University
Secure impersonation detection
US9917820B1
( en )
2015-06-29
2018-03-13
EMC IP Holding Company LLC
Secure information sharing
WO2017096590A1
( en )
2015-12-10
2017-06-15
Nokia Technologies Oy
Schemes of homomorphic re-encryption
US10210266B2
( en )
2016-05-25
2019-02-19
Microsoft Technology Licensing, Llc
Database query processing on encrypted data
WO2018080857A1
( en )
*
2016-10-28
2018-05-03
Panoptex Technologies, Inc.
Systems and methods for creating, storing, and analyzing secure data
US10887291B2
( en )
2016-12-16
2021-01-05
Amazon Technologies, Inc.
Secure data distribution of sensitive data across content delivery networks
US10972251B2
( en )
2017-01-20
2021-04-06
Enveil, Inc.
Secure web browsing via homomorphic encryption
US11777729B2
( en )
2017-01-20
2023-10-03
Enveil, Inc.
Secure analytics using term generation and homomorphic encryption
US10873568B2
( en )
2017-01-20
2020-12-22
Enveil, Inc.
Secure analytics using homomorphic and injective format-preserving encryption and an encrypted analytics matrix
US11196541B2
( en )
2017-01-20
2021-12-07
Enveil, Inc.
Secure machine learning analytics using homomorphic encryption
US10903976B2
( en )
2017-01-20
2021-01-26
Enveil, Inc.
End-to-end secure operations using a query matrix
US11507683B2
( en )
2017-01-20
2022-11-22
Enveil, Inc.
Query processing with adaptive risk decisioning
US10439799B2
( en )
*
2017-02-27
2019-10-08
United States Of America As Represented By Secretary Of The Navy
System and method for automating indirect fire protocol using fully homomorphic encryption
US11159498B1
( en )
2018-03-21
2021-10-26
Amazon Technologies, Inc.
Information security proxy service
US10979403B1
( en )
*
2018-06-08
2021-04-13
Amazon Technologies, Inc.
Cryptographic configuration enforcement
US10902133B2
( en )
2018-10-25
2021-01-26
Enveil, Inc.
Computational operations in enclave computing environments
US10817262B2
( en )
2018-11-08
2020-10-27
Enveil, Inc.
Reduced and pipelined hardware architecture for Montgomery Modular Multiplication
US11101987B2
( en )
*
2019-06-10
2021-08-24
International Business Machines Corporation
Adaptive encryption for entity resolution
CN110677411B
( en )
*
2019-09-27
2022-07-19
æµæ±å®è§ç§ææéå ¬å¸
Data sharing method and system based on cloud storage
US12099997B1
( en )
2020-01-31
2024-09-24
Steven Mark Hoffberg
Tokenized fungible liabilities
US11515997B2
( en )
*
2020-06-19
2022-11-29
Duality Technologies, Inc.
Privacy enhanced proximity tracker
US11601258B2
( en )
2020-10-08
2023-03-07
Enveil, Inc.
Selector derived encryption systems and methods
US12250291B2
( en )
2020-11-10
2025-03-11
Evernorth Strategic Development, Inc.
Encrypted database systems including homomorphic encryption
US12386785B2
( en )
*
2021-10-15
2025-08-12
Lognovations Holdings, Llc
Encoding / decoding system and method
US12081647B2
( en )
2021-11-30
2024-09-03
Bank Of America Corporation
Using automatic homomorphic encryption in a multi-cloud environment to support translytical data computation using an elastic hybrid memory cube
US12197615B2
( en )
2022-07-19
2025-01-14
IronCore Labs, Inc.
Secured search for ready-made search software
CN116991864B
( en )
*
2022-09-21
2025-12-05
è ¾è®¯ç§æï¼æ·±å³ï¼æéå ¬å¸
Hidden query methods, devices, equipment and storage media
US20240104224A1
( en )
*
2022-09-27
2024-03-28
Intel Corporation
Privacy-preserving search using homomorphic encryption
CN116702215B
( en )
*
2023-08-07
2023-12-08
è ¾è®¯ç§æï¼æ·±å³ï¼æéå ¬å¸
Query processing method, device, equipment and medium
CN116708040B
( en )
*
2023-08-07
2023-10-24
æé½å¢¨ç²ä¿¡æ¯ç§ææéå ¬å¸
Data security management and control method and system based on symmetric homomorphic encryption
CN117151349B
( en )
*
2023-10-31
2024-02-23
广ä¸çµå交æä¸å¿æéè´£ä»»å ¬å¸
Tax and electric power data joint analysis system with privacy protection function
CN117951173A
( en )
*
2023-12-26
2024-04-30
ä¸å½é¶èè¡ä»½æéå ¬å¸
Account query method, system and equipment
CN119323056B
( en )
*
2024-10-30
2025-10-14
çµåç§æ大å¦
A private information retrieval method based on NTRU homomorphic outer product
Citations (6)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US20110110525A1
( en )
*
2009-11-10
2011-05-12
International Business Machines Corporation
Fully homomorphic encryption method based on a bootstrappable encryption scheme, computer program and apparatus
US20120278622A1
( en )
*
2011-04-29
2012-11-01
Stephen Lesavich
Method and system for electronic content storage and retrieval with galois fields on cloud computing networks
US8635465B1
( en )
*
2012-03-28
2014-01-21
Emc Corporation
Counter-based encryption of stored data blocks
US8681973B2
( en )
*
2010-09-15
2014-03-25
At&T Intellectual Property I, L.P.
Methods, systems, and computer program products for performing homomorphic encryption and decryption on individual operations
US8874930B2
( en )
*
2009-12-09
2014-10-28
Microsoft Corporation
Graph encryption
US8925075B2
( en )
*
2011-11-07
2014-12-30
Parallels IP Holdings GmbH
Method for protecting data used in cloud computing with homomorphic encryption
Family Cites Families (2)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US9183407B2
( en )
*
2011-10-28
2015-11-10
Microsoft Technology Licensing Llc
Permission based query processing
WO2013188929A1
( en )
*
2012-06-22
2013-12-27
Commonwealth Scientific And Industrial Research Organisation
Homomorphic encryption for database querying
2013
2013-03-15
US
US13/831,904
patent/US9031229B1/en
active
Active
2015
2015-05-11
US
US14/709,282
patent/US9509494B2/en
active
Active
Patent Citations (6)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US20110110525A1
( en )
*
2009-11-10
2011-05-12
International Business Machines Corporation
Fully homomorphic encryption method based on a bootstrappable encryption scheme, computer program and apparatus
US8874930B2
( en )
*
2009-12-09
2014-10-28
Microsoft Corporation
Graph encryption
US8681973B2
( en )
*
2010-09-15
2014-03-25
At&T Intellectual Property I, L.P.
Methods, systems, and computer program products for performing homomorphic encryption and decryption on individual operations
US20120278622A1
( en )
*
2011-04-29
2012-11-01
Stephen Lesavich
Method and system for electronic content storage and retrieval with galois fields on cloud computing networks
US8925075B2
( en )
*
2011-11-07
2014-12-30
Parallels IP Holdings GmbH
Method for protecting data used in cloud computing with homomorphic encryption
US8635465B1
( en )
*
2012-03-28
2014-01-21
Emc Corporation
Counter-based encryption of stored data blocks
Non-Patent Citations (22)
* Cited by examiner, â Cited by third party
Title
Gentry., " Fully Homomorphic Encryption Using Ideal Lattices. " In the 41st ACM Symposium on Theory of Computing. (STOC), (2009).
Rivest et al., " On Data Banks and Privacy Homomorphisms " In Foundations of Secure Computation, pp. 169-180, (1978).
Schneier., " Schneier on Security, Data at Rest vs. Data in Motion. " Retrieved from Internet: URL:http://www.schneier.com/blog/archives/2010/06/data-at-rest-vs.html, (Jun. 30, 2010).
Schneier., " Schneier on Security, Data at Rest vs. Data in Motion. " Retrieved from Internet: URL:http://www.schneier.com/blog/archives/2010/06/dataâatârestâvs.html, (Jun. 30, 2010).
Schneier., " Schneier on Security, Homomorphic Encryption Breakthrough. " Retrieved from Internet: URL:http://www.schneier.com/blog/archives/2009/07/homomorphic-enc.html, (Jul. 9, 2009).
Schneier., " Schneier on Security, Homomorphic Encryption Breakthrough. " Retrieved from Internet: URL:http://www.schneier.com/blog/archives/2009/07/homomorphicâenc.html, (Jul. 9, 2009).
Wikipedia., " AAA Protocol " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/AAA-protocol, [Cached on Jan. 10, 2012].
Wikipedia., " AAA Protocol " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/AAAâprotocol, [Cached on Jan. 10, 2012].
Wikipedia., " Birthday Paradox " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Birthday-paradox, [Cached on Dec. 14, 2011].
Wikipedia., " Birthday Paradox " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Birthdayâparadox, [Cached on Dec. 14, 2011].
Wikipedia., " Homomorphic Encryption. " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Homomorphic-encryption, [Cached on Feb. 10, 2012].
Wikipedia., " Homomorphic Encryption. " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Homomorphicâencryption, [Cached on Feb. 10, 2012].
Wikipedia., " Key Derivation Function " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Key-derivation-function, [Cached on Jan. 31, 2012].
Wikipedia., " Key Derivation Function " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Keyâderivationâfunction, [Cached on Jan. 31, 2012].
Wikipedia., " Merkle-Damgård Construction " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Merkle%E2%80%93Damg%C3%A5rd-construction, [Cached on Jan. 27, 2012].
Wikipedia., " MerkleâDamgÃ¥rd Construction " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Merkle%E2%80%93Damg%C3%A5rdâconstruction, [Cached on Jan. 27, 2012].
Wikipedia., " Object Model " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Object-model, [Cached on Jan. 21, 2012].
Wikipedia., " Object Model " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Objectâmodel, [Cached on Jan. 21, 2012].
Wikipedia., " Public-Key Cryptography " Retrieved from Internet: URL:http://en.wikipedia.org/wikiPublic-key-encryption, [Cached on Mar. 12, 2010].
Wikipedia., " Public-Key Cryptography " Retrieved from Internet: URL:http://en.wikipedia.org/wikiPublicâkeyâencryption, [Cached on Mar. 12, 2010].
Wikipedia., " Record (Computer Science). " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Record-(computer-science), [Cached on Jan. 13, 2012].
Wikipedia., " Record (Computer Science). " Retrieved from Internet: URL:http://en.wikipedia.org/wiki/Recordâ(computerâscience), [Cached on Jan. 13, 2012].
Cited By (37)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US9529733B1
( en )
*
2014-09-18
2016-12-27
Symantec Corporation
Systems and methods for securely accessing encrypted data stores
US10241930B2
( en )
*
2014-12-08
2019-03-26
eperi GmbH
Storing data in a server computer with deployable encryption/decryption infrastructure
US9438412B2
( en )
*
2014-12-23
2016-09-06
Palo Alto Research Center Incorporated
Computer-implemented system and method for multi-party data function computing using discriminative dimensionality-reducing mappings
US20170147835A1
( en )
*
2015-11-25
2017-05-25
International Business Machines Corporation
Efficient two party oblivious transfer using a leveled fully homomorphic encryption
US9846785B2
( en )
*
2015-11-25
2017-12-19
International Business Machines Corporation
Efficient two party oblivious transfer using a leveled fully homomorphic encryption
CN105610910B
( en )
*
2015-12-18
2018-08-31
ä¸åæ°æ大å¦
Towards cloud storage and based on the ciphertext full-text search method and system of full homomorphism password
CN105610910A
( en )
*
2015-12-18
2016-05-25
ä¸åæ°æ大å¦
Cloud storage oriented ciphertext full-text search method and system based on full homomorphic ciphers
EP3449414B1
( en )
*
2016-04-29
2021-12-08
Privitar Limited
Computer-implemented privacy engineering system and method
US10685141B2
( en )
*
2016-08-03
2020-06-16
Abb Scheiz Ag
Method for storing data blocks from client devices to a cloud storage system
US20190171847A1
( en )
*
2016-08-03
2019-06-06
Abb Schweiz Ag
Method for storing data blocks from client devices to a cloud storage system
CN106326360A
( en )
*
2016-08-10
2017-01-11
æ¦æ±ç§æ大å¦
Fuzzy multi-keyword retrieval method of encrypted data in cloud environment
CN106326360B
( en )
*
2016-08-10
2019-04-09
æ¦æ±ç§æ大å¦
A fuzzy multi-keyword retrieval method for ciphertext data in cloud environment
US10095880B2
( en )
2016-09-01
2018-10-09
International Business Machines Corporation
Performing secure queries from a higher security domain of information in a lower security domain
US11487894B2
( en )
2016-09-01
2022-11-01
International Business Machines Corporation
Performing secure queries from a higher security domain of information in a lower security domain
US10572677B2
( en )
2016-09-01
2020-02-25
International Business Machines Corporation
Performing secure queries from a higher security domain of information in a lower security domain
US10333715B2
( en )
*
2016-11-14
2019-06-25
International Business Machines Corporation
Providing computation services with privacy
WO2019148335A1
( en )
*
2018-01-30
2019-08-08
Nokia Technologies Oy
Secure data processing
US10853422B2
( en )
*
2018-04-19
2020-12-01
Microsoft Technology Licensing, Llc
Private information retrieval with probabilistic batch codes
US20190325082A1
( en )
*
2018-04-19
2019-10-24
<span