Welcome!

Cloud Expo Authors: Pat Romanski, Elizabeth White, Liz McMillan, Kira Makagon, Sematext Blog

Blog Feed Post

Homomorphic Encryption and Cloud Security: The Practicalities

homomorphic encryption data security in the cloud Cloud Security  homomorphic encryption and cloud security Homomorphic Encryption and Cloud Security: The PracticalitiesThis article focuses on homomorphic encryption techniques and what they can mean in practice for cloud computing in the next few years; it is not a mathematical primer.

Suppose you want to hire someone to do a job for you, but you suspect she might leak sensitive details of your business to your enemies. The immediate solution: don’t hire her. But real life is often not so clear cut. Your prospective employee may be very good at a particular job, and you don’t want to lose her skills; while the risk that she turns bad may be low and you need the job done.

This general real life problem has had many solutions over the centuries. People have written contracts with confidentiality clauses, threatened court action, come up with rules for the workplace, tried to instill pride in their workforce, and sometimes they’ve even begged for good behavior.

One particularly nice concept: suppose you could give the job to the talented lady, but seal it in an opaque black sack. She wouldn’t be able to see inside, but would manipulate pieces by putting her hands into the dark sack to get the job done. This way, she would use her talents without discovering your secrets.

The disadvantage is obvious: very few jobs can actually be done blindly, without knowledge and mutual trust. But there are real life examples of the black bag approach. For example, spies work in “cells” designed so that they know as little as possible about other “cells.”

Cloud computing and homomorphic encryption

Cloud computing can suffer from some of the problems we described above. Suppose you have sensitive data information:  health data, financial data, or military secrets. And imagine you need to use a cloud “as a service” solution that takes your data and produces a report. The goal is to compare all the pieces of data and find the “important flukes.” In healthcare, an important fluke could be overpayment for a patient’s treatment. In finance, it could be a credit card fraud event. In the military, it could be data about a cyber-attack hiding between normal pieces of data.

In each of these cases, the “normal” data is sensitive: health, money, “normal” military activity. Still, for valid reason, you cannot do the analysis yourself in your own “secure” space. Somebody else has the expertise to do this particular analysis for you, and is using cloud computing because the job involves massive amounts of computational power.

 

Your find yourself with sensitive data in a cloud, on servers you do not own, and a programs running there which you may not own either.

Cloud encryption is always about hiding secrets.

You take a bunch of readable data and make it unreadable by scrambling the characters and numbers in the data so they don’t make sense. Only someone who has the “encryption key” can reverse the process, decrypt the data, and make it readable again. A typical decryption key could be 64 random characters long, yet by using known encryption techniques (like AES, “Advanced Encryption Standard”), that key can make terabytes completely scrambled and unreadable. Only if you have those 64 characters, the key, can you reverse the process and make the terabytes readable again.

In our case, however, there is a twist.  We want the data to be completely unreadable, but we want the program mentioned before (the one running on servers you do not own and doing a job that requires expertise and computing power the cloud provides) to be able to do its job.

Ideally, we want the program to do its job on data that is always encrypted (and remains encrypted) and successfully come up with a useful result.

Homomorphic encryption makes this possible.  Homomorphic encryption is a set of encryption techniques that will scramble the data based on a key, but allow a program to do some useful work on the unreadable encrypted data. The program cannot understand the data, but it can do something useful on it, without giving it away: an opaque black sack for cloud computing.

Steps to homomorphic encryption: examples of “something useful”

People have started figuring out useful things that can be done to encrypted data by taking a practical approach. Instead of saying that anything can be done in the black sack, people are starting out by saying that something can be done. Here are some examples of “something:”

  • A specific statistical function, perhaps taking the average of two numbers.

Both numbers are encrypted and the result is also encrypted. Only the holder of the encryption key can know the real values of the numbers and the result. However, a machine in the cloud can take the encrypted values and average them, sending an encrypted result back to the “owner.” The owner can then decrypt that result back at home.

  • Searching a person’s genome data to find whether that person has a specific gene that is especially harmful to health while protecting privacy.

The data that describes the genome is encrypted as is the description of the specific gene being searched. Both are uploaded to the cloud servers and the result comes back: the gene is either found or not. But only the person who owns the encryption key knows the genome (and the identity of the human being with that genome); and only they know what they were looking for. Was it a gene that may signal cancer? Or perhaps a gene that may signal high blood pressure? Only they know.

Techniques like these have been described in academic literature. They have not yet been commercialized, but they can really work. You’ll notice that the researchers have been smart.  They focused on a useful and specific problem that can most likely be solved. This is sometimes called “partially homomorphic encryption” and sometimes called “somewhat homomorphic encryption” because the scheme is constructed with one focused goal in mind. It doesn’t try to solve everything.

Fully homomorphic encryption

A more ambitious approach is fully homomorphic encryption (FHE). The Holy Grail is to encrypt any data for any purpose, so that a program running on cloud servers could do almost anything to the data and generate useful results. But only the owner of the data could actually understand the data and understand the result, because only the owner has the key. The running cloud servers would run on encrypted data and produce an encrypted result.

This would be great to have. Recently, Gentry made progress in this field by showing that any function that is made up of additions and multiplications can be computed on homomorphically encrypted data, using what has naturally become called the Gentry scheme.

“Any combination of additions and multiplications” really is quite a lot – in fact almost any math function can be broken down into additions and multiplications, so Gentry’s result is quite strong.

However, there are some practical limitations that have thus far, stopped us from using FHE. One is performance; which can be billions of times slower than the “somewhat” or “partial” approach. Though it is currently being worked on, a big gap persists.

Another limitation to FHE is the kind of problem it can solve. Suppose you wanted to use FHE with a medical expert system. Such systems work more with questions and answers then with addition and multiplication. They try to diagnose a disease based on gathering patient information, applying some logical rules and then asking more questions. This is a logical process and a major part of it is interactive – asking questions and learning. The best of these systems also constantly change their rules, as they learn more about how patients and diseases really work. Is a learning system based on rules and interactive back-and-forth questions and reasoning – easily broken down into addition and multiplication?

So FHE has limitations based on performance and limitations based on type of problem it might solve.

Are there any commercial implementations of homomorphic encryption?

The world’s first commercial implementation is Homomorphic Key Management, a “partially homomorphic” approach. Homomorphic Key Management is focused on the specific problem of encrypting the encryption keys themselves and keeping them safe and secret in the cloud, while still being able to use them for encrypting data. This work was done by Porticor in 2011-2012 and a commercial product entered the market at the end of 2012.

Several academic teams are now working on bringing additional “somewhat homomorphic” approaches to market, though as far as we know, none other has yet been commercialized. We hopefully look toward the coming years to produce commercial results relevant to the study of many fields, such as genomics and specific computations within databases.

In parallel, Academia continues to work hard on making FHE more efficient.

The post Homomorphic Encryption and Cloud Security: The Practicalities appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@CloudExpo Stories
In her General Session at 15th Cloud Expo, Anne Plese, Senior Consultant, Cloud Product Marketing, at Verizon Enterprise, focused on finding the right mix of renting vs. buying Oracle capacity to scale to meet business demands, and offer validated Oracle database TCO models for Oracle development and testing environments. Anne Plese is a marketing and technology enthusiast/realist with over 19+ years in high tech. At Verizon Enterprise, she focuses on driving growth for the Verizon Cloud platfo...
Between the compelling mockups and specs produced by your analysts and designers, and the resulting application built by your developers, there is a gulf where projects fail, costs spiral out of control, and applications fall short of requirements. In his session at DevOps Summit, Charles Kendrick, CTO and Chief Architect at Isomorphic Software, will present a new approach where business and development users collaborate – each using tools appropriate to their goals and expertise – to build mo...
There is no doubt that Big Data is here and getting bigger every day. Building a Big Data infrastructure today is no easy task. There are an enormous number of choices for database engines and technologies. To make things even more challenging, requirements are getting more sophisticated, and the standard paradigm of supporting historical analytics queries is often just one facet of what is needed. As Big Data growth continues, organizations are demanding real-time access to data, allowing immed...
Scott Jenson leads a project called The Physical Web within the Chrome team at Google. Project members are working to take the scalability and openness of the web and use it to talk to the exponentially exploding range of smart devices. Nearly every company today working on the IoT comes up with the same basic solution: use my server and you'll be fine. But if we really believe there will be trillions of these devices, that just can't scale. We need a system that is open a scalable and by using ...
15th Cloud Expo, which took place Nov. 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA, expanded the conference content of @ThingsExpo, Big Data Expo, and DevOps Summit to include two developer events. IBM held a Bluemix Developer Playground on November 5 and ElasticBox held a Hackathon on November 6. Both events took place on the expo floor. The Bluemix Developer Playground, for developers of all levels, highlighted the ease of use of Bluemix, its services and functionalit...
"ElasticBox is an enterprise company that makes it very easy for developers and IT ops to collaborate to develop, build and deploy applications on any cloud - private, public or hybrid," stated Monish Sharma, VP of Customer Success at ElasticBox, in this SYS-CON.tv interview at DevOps Summit, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
"For the past 4 years we have been working mainly to export. For the last 3 or 4 years the main market was Russia. In the past year we have been working to expand our footprint in Europe and the United States," explained Andris Gailitis, CEO of DEAC, in this SYS-CON.tv interview at Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, discussed how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will need to convince a skeptical public to participate. Get ready to show them the money!
The Industrial Internet revolution is now underway, enabled by connected machines and billions of devices that communicate and collaborate. The massive amounts of Big Data requiring real-time analysis is flooding legacy IT systems and giving way to cloud environments that can handle the unpredictable workloads. Yet many barriers remain until we can fully realize the opportunities and benefits from the convergence of machines and devices with Big Data and the cloud, including interoperability, ...
At 15th Cloud Expo, Shrikant Pattathil, Executive Vice President at Harbinger Systems, demos a video delivery platform that helps you do interactive videos. He discusses how Harbinger is accomplishing it in the cloud world, the problems they faced and the choices they made to get around these problems.
“DevOps is really about the business. The business is under pressure today, competitively in the marketplace to respond to the expectations of the customer. The business is driving IT and the problem is that IT isn't responding fast enough," explained Mark Levy, Senior Product Marketing Manager at Serena Software, in this SYS-CON.tv interview at DevOps Summit, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
“The year of the cloud – we have no idea when it's really happening but we think it's happening now. For those technology providers like Zentera that are helping enterprises move to the cloud - it's been fun to watch," noted Mike Loftus, VP Product Management and Marketing at Zentera Systems, in this SYS-CON.tv interview at Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
Want to enable self-service provisioning of application environments in minutes that mirror production? Can you automatically provide rich data with code-level detail back to the developers when issues occur in production? In his session at DevOps Summit, David Tesar, Microsoft Technical Evangelist on Microsoft Azure and DevOps, will discuss how to accomplish this and more utilizing technologies such as Microsoft Azure, Visual Studio online, and Application Insights in this demo-heavy session.
Entuity®, a provider of enterprise-class network management solutions, today announced that it solidifies its position as a market leader through global enterprise customer acquisitions and a refined channel strategy. In 2014, Entuity increased new license revenues in EMEA by over 75 percent, and LATAM by over 125 percent as customers embraced Entuity for its highly automated solution and unified architecture. Entuity’s refined channel strategy focuses on even deeper strategic alignment with ke...
We are all here because we are sold on the transformative promise of The Cloud. But what good is all of this ephemeral, on-demand infrastructure if your usage doesn't actually improve the agility and speed of your business? How must Operations adapt in order to avoid stifling your Cloud initiative? In his session at DevOps Summit, Damon Edwards, co-founder and managing partner of the DTO Solutions, will highlight the successful organizational, process, and tooling patterns of high-performing c...
Cloud Expo 2014 TV commercials will feature @ThingsExpo, which was launched in June, 2014 at New York City's Javits Center as the largest 'Internet of Things' event in the world.
The 4th International DevOps Summit, co-located with16th International Cloud Expo – being held June 9-11, 2015, at the Javits Center in New York City, NY – announces that its Call for Papers is now open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's large...
“We help people build clusters, in the classical sense of the cluster. We help people put a full stack on top of every single one of those machines. We do the full bare metal install," explained Greg Bruno, Vice President of Engineering and co-founder of StackIQ, in this SYS-CON.tv interview at 15th Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
"Blue Box has been around for 10-11 years, and last year we launched Blue Box Cloud. We like the term 'Private Cloud as a Service' because we think that embodies what we are launching as a product - it's a managed hosted private cloud," explained Giles Frith, Vice President of Customer Operations at Blue Box, in this SYS-CON.tv interview at DevOps Summit, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.