Click here to close now.


@CloudExpo Authors: Mehdi Daoudi, Pat Romanski, Jennifer Gill, Elizabeth White, Flint Brenton

Blog Feed Post

Homomorphic Encryption and Cloud Security: The Practicalities

homomorphic encryption data security in the cloud Cloud Security  homomorphic encryption and cloud security Homomorphic Encryption and Cloud Security: The PracticalitiesThis article focuses on homomorphic encryption techniques and what they can mean in practice for cloud computing in the next few years; it is not a mathematical primer.

Suppose you want to hire someone to do a job for you, but you suspect she might leak sensitive details of your business to your enemies. The immediate solution: don’t hire her. But real life is often not so clear cut. Your prospective employee may be very good at a particular job, and you don’t want to lose her skills; while the risk that she turns bad may be low and you need the job done.

This general real life problem has had many solutions over the centuries. People have written contracts with confidentiality clauses, threatened court action, come up with rules for the workplace, tried to instill pride in their workforce, and sometimes they’ve even begged for good behavior.

One particularly nice concept: suppose you could give the job to the talented lady, but seal it in an opaque black sack. She wouldn’t be able to see inside, but would manipulate pieces by putting her hands into the dark sack to get the job done. This way, she would use her talents without discovering your secrets.

The disadvantage is obvious: very few jobs can actually be done blindly, without knowledge and mutual trust. But there are real life examples of the black bag approach. For example, spies work in “cells” designed so that they know as little as possible about other “cells.”

Cloud computing and homomorphic encryption

Cloud computing can suffer from some of the problems we described above. Suppose you have sensitive data information:  health data, financial data, or military secrets. And imagine you need to use a cloud “as a service” solution that takes your data and produces a report. The goal is to compare all the pieces of data and find the “important flukes.” In healthcare, an important fluke could be overpayment for a patient’s treatment. In finance, it could be a credit card fraud event. In the military, it could be data about a cyber-attack hiding between normal pieces of data.

In each of these cases, the “normal” data is sensitive: health, money, “normal” military activity. Still, for valid reason, you cannot do the analysis yourself in your own “secure” space. Somebody else has the expertise to do this particular analysis for you, and is using cloud computing because the job involves massive amounts of computational power.


Your find yourself with sensitive data in a cloud, on servers you do not own, and a programs running there which you may not own either.

Cloud encryption is always about hiding secrets.

You take a bunch of readable data and make it unreadable by scrambling the characters and numbers in the data so they don’t make sense. Only someone who has the “encryption key” can reverse the process, decrypt the data, and make it readable again. A typical decryption key could be 64 random characters long, yet by using known encryption techniques (like AES, “Advanced Encryption Standard”), that key can make terabytes completely scrambled and unreadable. Only if you have those 64 characters, the key, can you reverse the process and make the terabytes readable again.

In our case, however, there is a twist.  We want the data to be completely unreadable, but we want the program mentioned before (the one running on servers you do not own and doing a job that requires expertise and computing power the cloud provides) to be able to do its job.

Ideally, we want the program to do its job on data that is always encrypted (and remains encrypted) and successfully come up with a useful result.

Homomorphic encryption makes this possible.  Homomorphic encryption is a set of encryption techniques that will scramble the data based on a key, but allow a program to do some useful work on the unreadable encrypted data. The program cannot understand the data, but it can do something useful on it, without giving it away: an opaque black sack for cloud computing.

Steps to homomorphic encryption: examples of “something useful”

People have started figuring out useful things that can be done to encrypted data by taking a practical approach. Instead of saying that anything can be done in the black sack, people are starting out by saying that something can be done. Here are some examples of “something:”

  • A specific statistical function, perhaps taking the average of two numbers.

Both numbers are encrypted and the result is also encrypted. Only the holder of the encryption key can know the real values of the numbers and the result. However, a machine in the cloud can take the encrypted values and average them, sending an encrypted result back to the “owner.” The owner can then decrypt that result back at home.

  • Searching a person’s genome data to find whether that person has a specific gene that is especially harmful to health while protecting privacy.

The data that describes the genome is encrypted as is the description of the specific gene being searched. Both are uploaded to the cloud servers and the result comes back: the gene is either found or not. But only the person who owns the encryption key knows the genome (and the identity of the human being with that genome); and only they know what they were looking for. Was it a gene that may signal cancer? Or perhaps a gene that may signal high blood pressure? Only they know.

Techniques like these have been described in academic literature. They have not yet been commercialized, but they can really work. You’ll notice that the researchers have been smart.  They focused on a useful and specific problem that can most likely be solved. This is sometimes called “partially homomorphic encryption” and sometimes called “somewhat homomorphic encryption” because the scheme is constructed with one focused goal in mind. It doesn’t try to solve everything.

Fully homomorphic encryption

A more ambitious approach is fully homomorphic encryption (FHE). The Holy Grail is to encrypt any data for any purpose, so that a program running on cloud servers could do almost anything to the data and generate useful results. But only the owner of the data could actually understand the data and understand the result, because only the owner has the key. The running cloud servers would run on encrypted data and produce an encrypted result.

This would be great to have. Recently, Gentry made progress in this field by showing that any function that is made up of additions and multiplications can be computed on homomorphically encrypted data, using what has naturally become called the Gentry scheme.

“Any combination of additions and multiplications” really is quite a lot – in fact almost any math function can be broken down into additions and multiplications, so Gentry’s result is quite strong.

However, there are some practical limitations that have thus far, stopped us from using FHE. One is performance; which can be billions of times slower than the “somewhat” or “partial” approach. Though it is currently being worked on, a big gap persists.

Another limitation to FHE is the kind of problem it can solve. Suppose you wanted to use FHE with a medical expert system. Such systems work more with questions and answers then with addition and multiplication. They try to diagnose a disease based on gathering patient information, applying some logical rules and then asking more questions. This is a logical process and a major part of it is interactive – asking questions and learning. The best of these systems also constantly change their rules, as they learn more about how patients and diseases really work. Is a learning system based on rules and interactive back-and-forth questions and reasoning – easily broken down into addition and multiplication?

So FHE has limitations based on performance and limitations based on type of problem it might solve.

Are there any commercial implementations of homomorphic encryption?

The world’s first commercial implementation is Homomorphic Key Management, a “partially homomorphic” approach. Homomorphic Key Management is focused on the specific problem of encrypting the encryption keys themselves and keeping them safe and secret in the cloud, while still being able to use them for encrypting data. This work was done by Porticor in 2011-2012 and a commercial product entered the market at the end of 2012.

Several academic teams are now working on bringing additional “somewhat homomorphic” approaches to market, though as far as we know, none other has yet been commercialized. We hopefully look toward the coming years to produce commercial results relevant to the study of many fields, such as genomics and specific computations within databases.

In parallel, Academia continues to work hard on making FHE more efficient.

The post Homomorphic Encryption and Cloud Security: The Practicalities appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@CloudExpo Stories
Most of the IoT Gateway scenarios involve collecting data from machines/processing and pushing data upstream to cloud for further analytics. The gateway hardware varies from Raspberry Pi to Industrial PCs. The document states the process of allowing deploying polyglot data pipelining software with the clear notion of supporting immutability. In his session at @ThingsExpo, Shashank Jain, a development architect for SAP Labs, discussed the objective, which is to automate the IoT deployment proces...
Countless business models have spawned from the IaaS industry – resell Web hosting, blogs, public cloud, and on and on. With the overwhelming amount of tools available to us, it's sometimes easy to overlook that many of them are just new skins of resources we've had for a long time. In his general session at 17th Cloud Expo, Harold Hannon, Sr. Software Architect at SoftLayer, an IBM Company, broke down what we have to work with, discussed the benefits and pitfalls and how we can best use them ...
In demand-intensive mobile and web applications, an emerging pattern is to host the Systems of Engagement in the cloud (for maximum responsiveness) but keep the Systems of Record with the other important business systems in the company datacenter, often on a tightly secured mainframe. But what about the space in between? In this IBM Redpaper publication, we show that the IBM Bluemix cloud platform offers technologies that make it easy for cloud-based SoEs to securely connect to on-premises IBM...
Discussions of cloud computing have evolved in recent years from a focus on specific types of cloud, to a world of hybrid cloud, and to a world dominated by the APIs that make today's multi-cloud environments and hybrid clouds possible. In this Power Panel at 17th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists addressed the importance of customers being able to use the specific technologies they need, through environments and ecosystems that expose their APIs to make true ...
Microservices are a very exciting architectural approach that many organizations are looking to as a way to accelerate innovation. Microservices promise to allow teams to move away from monolithic "ball of mud" systems, but the reality is that, in the vast majority of organizations, different projects and technologies will continue to be developed at different speeds. How to handle the dependencies between these disparate systems with different iteration cycles? Consider the "canoncial problem"...
We all know that data growth is exploding and storage budgets are shrinking. Instead of showing you charts on about how much data there is, in his General Session at 17th Cloud Expo, Scott Cleland, Senior Director of Product Marketing at HGST, showed how to capture all of your data in one place. After you have your data under control, you can then analyze it in one place, saving time and resources.
Too often with compelling new technologies market participants become overly enamored with that attractiveness of the technology and neglect underlying business drivers. This tendency, what some call the “newest shiny object syndrome” is understandable given that virtually all of us are heavily engaged in technology. But it is also mistaken. Without concrete business cases driving its deployment, IoT, like many other technologies before it, will fade into obscurity.
The Internet of Things is clearly many things: data collection and analytics, wearables, Smart Grids and Smart Cities, the Industrial Internet, and more. Cool platforms like Arduino, Raspberry Pi, Intel's Galileo and Edison, and a diverse world of sensors are making the IoT a great toy box for developers in all these areas. In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists discussed what things are the most important, which will have the most profound...
As organizations shift towards IT-as-a-service models, the need for managing & protecting data residing across physical, virtual, and now cloud environments grows with it. CommVault can ensure protection & E-Discovery of your data - whether in a private cloud, a Service Provider delivered public cloud, or a hybrid cloud environment – across the heterogeneous enterprise.
Growth hacking is common for startups to make unheard-of progress in building their business. Career Hacks can help Geek Girls and those who support them (yes, that's you too, Dad!) to excel in this typically male-dominated world. Get ready to learn the facts: Is there a bias against women in the tech / developer communities? Why are women 50% of the workforce, but hold only 24% of the STEM or IT positions? Some beginnings of what to do about it! In her Day 2 Keynote at 17th Cloud Expo, San...
Apps and devices shouldn't stop working when there's limited or no network connectivity. Learn how to bring data stored in a cloud database to the edge of the network (and back again) whenever an Internet connection is available. In his session at 17th Cloud Expo, Ben Perlmutter, a Sales Engineer with IBM Cloudant, demonstrated techniques for replicating cloud databases with devices in order to build offline-first mobile or Internet of Things (IoT) apps that can provide a better, faster user e...
SYS-CON Events announced today that Catchpoint, a global leader in monitoring, and testing the performance of online applications, has been named "Silver Sponsor" of DevOps Summit New York, which will take place on June 7-9, 2016 at the Javits Center in New York City. Catchpoint radically transforms the way businesses manage, monitor, and test the performance of online applications. Truly understand and improve user experience with clear visibility into complex, distributed online systems.Founde...
In today's enterprise, digital transformation represents organizational change even more so than technology change, as customer preferences and behavior drive end-to-end transformation across lines of business as well as IT. To capitalize on the ubiquitous disruption driving this transformation, companies must be able to innovate at an increasingly rapid pace. Traditional approaches for driving innovation are now woefully inadequate for keeping up with the breadth of disruption and change facin...
I recently attended and was a speaker at the 4th International Internet of @ThingsExpo at the Santa Clara Convention Center. I also had the opportunity to attend this event last year and I wrote a blog from that show talking about how the “Enterprise Impact of IoT” was a key theme of last year’s show. I was curious to see if the same theme would still resonate 365 days later and what, if any, changes I would see in the content presented.
The revocation of Safe Harbor has radically affected data sovereignty strategy in the cloud. In his session at 17th Cloud Expo, Jeff Miller, Product Management at Cavirin Systems, discussed how to assess these changes across your own cloud strategy, and how you can mitigate risks previously covered under the agreement.
Cloud computing delivers on-demand resources that provide businesses with flexibility and cost-savings. The challenge in moving workloads to the cloud has been the cost and complexity of ensuring the initial and ongoing security and regulatory (PCI, HIPAA, FFIEC) compliance across private and public clouds. Manual security compliance is slow, prone to human error, and represents over 50% of the cost of managing cloud applications. Determining how to automate cloud security compliance is critical...
Culture is the most important ingredient of DevOps. The challenge for most organizations is defining and communicating a vision of beneficial DevOps culture for their organizations, and then facilitating the changes needed to achieve that. Often this comes down to an ability to provide true leadership. As a CIO, are your direct reports IT managers or are they IT leaders? The hard truth is that many IT managers have risen through the ranks based on their technical skills, not their leadership ab...
In his General Session at DevOps Summit, Asaf Yigal, Co-Founder & VP of Product at, explored the value of Kibana 4 for log analysis and provided a hands-on tutorial on how to set up Kibana 4 and get the most out of Apache log files. He examined three use cases: IT operations, business intelligence, and security and compliance. Asaf Yigal is co-founder and VP of Product at log analytics software company In the past, he was co-founder of social-trading platform Currensee, which...
The Internet of Things (IoT) is growing rapidly by extending current technologies, products and networks. By 2020, Cisco estimates there will be 50 billion connected devices. Gartner has forecast revenues of over $300 billion, just to IoT suppliers. Now is the time to figure out how you’ll make money – not just create innovative products. With hundreds of new products and companies jumping into the IoT fray every month, there’s no shortage of innovation. Despite this, McKinsey/VisionMobile data...
Just over a week ago I received a long and loud sustained applause for a presentation I delivered at this year’s Cloud Expo in Santa Clara. I was extremely pleased with the turnout and had some very good conversations with many of the attendees. Over the next few days I had many more meaningful conversations and was not only happy with the results but also learned a few new things. Here is everything I learned in those three days distilled into three short points.