Welcome!

Blog Feed Post

Homomorphic Encryption and Cloud Security: The Practicalities

homomorphic encryption data security in the cloud Cloud Security  homomorphic encryption and cloud security Homomorphic Encryption and Cloud Security: The PracticalitiesThis article focuses on homomorphic encryption techniques and what they can mean in practice for cloud computing in the next few years; it is not a mathematical primer.

Suppose you want to hire someone to do a job for you, but you suspect she might leak sensitive details of your business to your enemies. The immediate solution: don’t hire her. But real life is often not so clear cut. Your prospective employee may be very good at a particular job, and you don’t want to lose her skills; while the risk that she turns bad may be low and you need the job done.

This general real life problem has had many solutions over the centuries. People have written contracts with confidentiality clauses, threatened court action, come up with rules for the workplace, tried to instill pride in their workforce, and sometimes they’ve even begged for good behavior.

One particularly nice concept: suppose you could give the job to the talented lady, but seal it in an opaque black sack. She wouldn’t be able to see inside, but would manipulate pieces by putting her hands into the dark sack to get the job done. This way, she would use her talents without discovering your secrets.

The disadvantage is obvious: very few jobs can actually be done blindly, without knowledge and mutual trust. But there are real life examples of the black bag approach. For example, spies work in “cells” designed so that they know as little as possible about other “cells.”

Cloud computing and homomorphic encryption

Cloud computing can suffer from some of the problems we described above. Suppose you have sensitive data information:  health data, financial data, or military secrets. And imagine you need to use a cloud “as a service” solution that takes your data and produces a report. The goal is to compare all the pieces of data and find the “important flukes.” In healthcare, an important fluke could be overpayment for a patient’s treatment. In finance, it could be a credit card fraud event. In the military, it could be data about a cyber-attack hiding between normal pieces of data.

In each of these cases, the “normal” data is sensitive: health, money, “normal” military activity. Still, for valid reason, you cannot do the analysis yourself in your own “secure” space. Somebody else has the expertise to do this particular analysis for you, and is using cloud computing because the job involves massive amounts of computational power.

 

Your find yourself with sensitive data in a cloud, on servers you do not own, and a programs running there which you may not own either.

Cloud encryption is always about hiding secrets.

You take a bunch of readable data and make it unreadable by scrambling the characters and numbers in the data so they don’t make sense. Only someone who has the “encryption key” can reverse the process, decrypt the data, and make it readable again. A typical decryption key could be 64 random characters long, yet by using known encryption techniques (like AES, “Advanced Encryption Standard”), that key can make terabytes completely scrambled and unreadable. Only if you have those 64 characters, the key, can you reverse the process and make the terabytes readable again.

In our case, however, there is a twist.  We want the data to be completely unreadable, but we want the program mentioned before (the one running on servers you do not own and doing a job that requires expertise and computing power the cloud provides) to be able to do its job.

Ideally, we want the program to do its job on data that is always encrypted (and remains encrypted) and successfully come up with a useful result.

Homomorphic encryption makes this possible.  Homomorphic encryption is a set of encryption techniques that will scramble the data based on a key, but allow a program to do some useful work on the unreadable encrypted data. The program cannot understand the data, but it can do something useful on it, without giving it away: an opaque black sack for cloud computing.

Steps to homomorphic encryption: examples of “something useful”

People have started figuring out useful things that can be done to encrypted data by taking a practical approach. Instead of saying that anything can be done in the black sack, people are starting out by saying that something can be done. Here are some examples of “something:”

  • A specific statistical function, perhaps taking the average of two numbers.

Both numbers are encrypted and the result is also encrypted. Only the holder of the encryption key can know the real values of the numbers and the result. However, a machine in the cloud can take the encrypted values and average them, sending an encrypted result back to the “owner.” The owner can then decrypt that result back at home.

  • Searching a person’s genome data to find whether that person has a specific gene that is especially harmful to health while protecting privacy.

The data that describes the genome is encrypted as is the description of the specific gene being searched. Both are uploaded to the cloud servers and the result comes back: the gene is either found or not. But only the person who owns the encryption key knows the genome (and the identity of the human being with that genome); and only they know what they were looking for. Was it a gene that may signal cancer? Or perhaps a gene that may signal high blood pressure? Only they know.

Techniques like these have been described in academic literature. They have not yet been commercialized, but they can really work. You’ll notice that the researchers have been smart.  They focused on a useful and specific problem that can most likely be solved. This is sometimes called “partially homomorphic encryption” and sometimes called “somewhat homomorphic encryption” because the scheme is constructed with one focused goal in mind. It doesn’t try to solve everything.

Fully homomorphic encryption

A more ambitious approach is fully homomorphic encryption (FHE). The Holy Grail is to encrypt any data for any purpose, so that a program running on cloud servers could do almost anything to the data and generate useful results. But only the owner of the data could actually understand the data and understand the result, because only the owner has the key. The running cloud servers would run on encrypted data and produce an encrypted result.

This would be great to have. Recently, Gentry made progress in this field by showing that any function that is made up of additions and multiplications can be computed on homomorphically encrypted data, using what has naturally become called the Gentry scheme.

“Any combination of additions and multiplications” really is quite a lot – in fact almost any math function can be broken down into additions and multiplications, so Gentry’s result is quite strong.

However, there are some practical limitations that have thus far, stopped us from using FHE. One is performance; which can be billions of times slower than the “somewhat” or “partial” approach. Though it is currently being worked on, a big gap persists.

Another limitation to FHE is the kind of problem it can solve. Suppose you wanted to use FHE with a medical expert system. Such systems work more with questions and answers then with addition and multiplication. They try to diagnose a disease based on gathering patient information, applying some logical rules and then asking more questions. This is a logical process and a major part of it is interactive – asking questions and learning. The best of these systems also constantly change their rules, as they learn more about how patients and diseases really work. Is a learning system based on rules and interactive back-and-forth questions and reasoning – easily broken down into addition and multiplication?

So FHE has limitations based on performance and limitations based on type of problem it might solve.

Are there any commercial implementations of homomorphic encryption?

The world’s first commercial implementation is Homomorphic Key Management, a “partially homomorphic” approach. Homomorphic Key Management is focused on the specific problem of encrypting the encryption keys themselves and keeping them safe and secret in the cloud, while still being able to use them for encrypting data. This work was done by Porticor in 2011-2012 and a commercial product entered the market at the end of 2012.

Several academic teams are now working on bringing additional “somewhat homomorphic” approaches to market, though as far as we know, none other has yet been commercialized. We hopefully look toward the coming years to produce commercial results relevant to the study of many fields, such as genomics and specific computations within databases.

In parallel, Academia continues to work hard on making FHE more efficient.

The post Homomorphic Encryption and Cloud Security: The Practicalities appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

Latest Stories
Regardless of what business you’re in, it’s increasingly a software-driven business. Consumers’ rising expectations for connected digital and physical experiences are driving what some are calling the "Customer Experience Challenge.” In his session at @DevOpsSummit at 20th Cloud Expo, Marco Morales, Director of Global Solutions at CollabNet, will discuss how organizations are increasingly adopting a discipline of Value Stream Mapping to ensure that the software they are producing is poised to o...
SYS-CON Events announced today that delaPlex will exhibit at SYS-CON's @CloudExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. delaPlex pioneered Software Development as a Service (SDaaS), which provides scalable resources to build, test, and deploy software. It’s a fast and more reliable way to develop a new product or expand your in-house team.
For financial firms, the cloud is going to increasingly become a crucial part of dealing with customers over the next five years and beyond, particularly with the growing use and acceptance of virtual currencies. There are new data storage paradigms on the horizon that will deliver secure solutions for storing and moving sensitive financial data around the world without touching terrestrial networks. In his session at 20th Cloud Expo, Cliff Beek, President of Cloud Constellation Corporation, w...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend @CloudExpo | @ThingsExpo, June 6-8, 2017, at the Javits Center in New York City, NY and October 31 - November 2, 2017, Santa Clara Convention Center, CA. Learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.
SYS-CON Events announced today that EARP Integration will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. EARP Integration is a passionate software house. Since its inception in 2009 the company successfully delivers smart solutions for cities and factories that start their digital transformation. EARP provides bespoke solutions like, for example, advanced enterprise portals, business intelligence systems an...
IBM helps FinTechs and financial services companies build and monetize cognitive-enabled financial services apps quickly and at scale. Hosted on IBM Bluemix, IBM’s platform builds in customer insights, regulatory compliance analytics and security to help reduce development time and testing. In his session at 20th Cloud Expo, Tom Eck, Industry Platforms CTO at IBM Cloud, will discuss how these tools simplify the time-consuming tasks of selection, mapping and data integration, allowing developers ...
SYS-CON Events announced today that Outscale, a global pure play Infrastructure as a Service provider and strategic partner of Dassault Systèmes, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 2010, Outscale simplifies infrastructure complexities and boosts the business agility of its customers. Outscale delivers a secure, reliable and industrial strength solution for its customers, which in...
SYS-CON Events announced today that Progress, a global leader in application development, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Enterprises today are rapidly adopting the cloud, while continuing to retain business-critical/sensitive data inside the firewall. This is creating two separate data silos – one inside the firewall and the other outside the firewall. Cloud ISVs oft...
Interested in leveling up on your Cloud Foundry skills? Join IBM for Cloud Foundry Days on June 7 at Cloud Expo New York at the Javits Center in New York City. Cloud Foundry Days is a free half day educational conference and networking event. Come find out why Cloud Foundry is the industry's fastest-growing and most adopted cloud application platform.
In order to meet the rapidly changing demands of today’s customers, companies are continually forced to redefine their business strategies in order to meet these needs, stay relevant and continue to see profitable growth. IoT deployment and development is integral in this transformation, and today businesses are increasingly seeing the value of investing their resources into IoT deployments. These technologies are able increase ROI through projects such as connecting supply chains or enabling sm...
Most DevOps journeys involve several phases of maturity. Research shows that the inflection point where organizations begin to see maximum value is when they implement tight integration deploying their code to their infrastructure. Success at this level is the last barrier to at-will deployment. Storage, for instance, is more capable than where we read and write data. In his session at @DevOpsSummit at 20th Cloud Expo, Josh Atwell, a Developer Advocate for NetApp, will discuss the role and value...
SYS-CON Events announced today that Cloud Academy will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Cloud Academy is the industry’s most innovative, vendor-neutral cloud technology training platform. Cloud Academy provides continuous learning solutions for individuals and enterprise teams for Amazon Web Services, Microsoft Azure, Google Cloud Platform, and the most popular cloud computing technologies. Ge...
When NSA's digital armory was leaked, it was only a matter of time before the code was morphed into a ransom seeking worm. This talk, designed for C-level attendees, demonstrates a Live Hack of a virtual environment to show the ease in which any average user can leverage these tools and infiltrate their network environment. This session will include an overview of the Shadbrokers NSA leak situation.
As cloud adoption continues to transform business, today's global enterprises are challenged with managing a growing amount of information living outside of the data center. The rapid adoption of IoT and increasingly mobile workforce are exacerbating the problem. Ensuring secure data sharing and efficient backup poses capacity and bandwidth considerations as well as policy and regulatory compliance issues.
SYS-CON Events announced today that Interoute has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Interoute is the owner operator of Europe's largest network and a global cloud services platform, which encompasses over 70,000 km of lit fiber, 15 data centers, 17 virtual data centers and 33 colocation centers, with connections to 195 additional partner data centers. Our full-service Unifie...