Welcome!

@CloudExpo Authors: Pat Romanski, Yeshim Deniz, Elizabeth White, Liz McMillan, Matt Brickey

Blog Feed Post

Homomorphic Encryption and Cloud Security: The Practicalities

homomorphic encryption data security in the cloud Cloud Security  homomorphic encryption and cloud security Homomorphic Encryption and Cloud Security: The PracticalitiesThis article focuses on homomorphic encryption techniques and what they can mean in practice for cloud computing in the next few years; it is not a mathematical primer.

Suppose you want to hire someone to do a job for you, but you suspect she might leak sensitive details of your business to your enemies. The immediate solution: don’t hire her. But real life is often not so clear cut. Your prospective employee may be very good at a particular job, and you don’t want to lose her skills; while the risk that she turns bad may be low and you need the job done.

This general real life problem has had many solutions over the centuries. People have written contracts with confidentiality clauses, threatened court action, come up with rules for the workplace, tried to instill pride in their workforce, and sometimes they’ve even begged for good behavior.

One particularly nice concept: suppose you could give the job to the talented lady, but seal it in an opaque black sack. She wouldn’t be able to see inside, but would manipulate pieces by putting her hands into the dark sack to get the job done. This way, she would use her talents without discovering your secrets.

The disadvantage is obvious: very few jobs can actually be done blindly, without knowledge and mutual trust. But there are real life examples of the black bag approach. For example, spies work in “cells” designed so that they know as little as possible about other “cells.”

Cloud computing and homomorphic encryption

Cloud computing can suffer from some of the problems we described above. Suppose you have sensitive data information:  health data, financial data, or military secrets. And imagine you need to use a cloud “as a service” solution that takes your data and produces a report. The goal is to compare all the pieces of data and find the “important flukes.” In healthcare, an important fluke could be overpayment for a patient’s treatment. In finance, it could be a credit card fraud event. In the military, it could be data about a cyber-attack hiding between normal pieces of data.

In each of these cases, the “normal” data is sensitive: health, money, “normal” military activity. Still, for valid reason, you cannot do the analysis yourself in your own “secure” space. Somebody else has the expertise to do this particular analysis for you, and is using cloud computing because the job involves massive amounts of computational power.

 

Your find yourself with sensitive data in a cloud, on servers you do not own, and a programs running there which you may not own either.

Cloud encryption is always about hiding secrets.

You take a bunch of readable data and make it unreadable by scrambling the characters and numbers in the data so they don’t make sense. Only someone who has the “encryption key” can reverse the process, decrypt the data, and make it readable again. A typical decryption key could be 64 random characters long, yet by using known encryption techniques (like AES, “Advanced Encryption Standard”), that key can make terabytes completely scrambled and unreadable. Only if you have those 64 characters, the key, can you reverse the process and make the terabytes readable again.

In our case, however, there is a twist.  We want the data to be completely unreadable, but we want the program mentioned before (the one running on servers you do not own and doing a job that requires expertise and computing power the cloud provides) to be able to do its job.

Ideally, we want the program to do its job on data that is always encrypted (and remains encrypted) and successfully come up with a useful result.

Homomorphic encryption makes this possible.  Homomorphic encryption is a set of encryption techniques that will scramble the data based on a key, but allow a program to do some useful work on the unreadable encrypted data. The program cannot understand the data, but it can do something useful on it, without giving it away: an opaque black sack for cloud computing.

Steps to homomorphic encryption: examples of “something useful”

People have started figuring out useful things that can be done to encrypted data by taking a practical approach. Instead of saying that anything can be done in the black sack, people are starting out by saying that something can be done. Here are some examples of “something:”

  • A specific statistical function, perhaps taking the average of two numbers.

Both numbers are encrypted and the result is also encrypted. Only the holder of the encryption key can know the real values of the numbers and the result. However, a machine in the cloud can take the encrypted values and average them, sending an encrypted result back to the “owner.” The owner can then decrypt that result back at home.

  • Searching a person’s genome data to find whether that person has a specific gene that is especially harmful to health while protecting privacy.

The data that describes the genome is encrypted as is the description of the specific gene being searched. Both are uploaded to the cloud servers and the result comes back: the gene is either found or not. But only the person who owns the encryption key knows the genome (and the identity of the human being with that genome); and only they know what they were looking for. Was it a gene that may signal cancer? Or perhaps a gene that may signal high blood pressure? Only they know.

Techniques like these have been described in academic literature. They have not yet been commercialized, but they can really work. You’ll notice that the researchers have been smart.  They focused on a useful and specific problem that can most likely be solved. This is sometimes called “partially homomorphic encryption” and sometimes called “somewhat homomorphic encryption” because the scheme is constructed with one focused goal in mind. It doesn’t try to solve everything.

Fully homomorphic encryption

A more ambitious approach is fully homomorphic encryption (FHE). The Holy Grail is to encrypt any data for any purpose, so that a program running on cloud servers could do almost anything to the data and generate useful results. But only the owner of the data could actually understand the data and understand the result, because only the owner has the key. The running cloud servers would run on encrypted data and produce an encrypted result.

This would be great to have. Recently, Gentry made progress in this field by showing that any function that is made up of additions and multiplications can be computed on homomorphically encrypted data, using what has naturally become called the Gentry scheme.

“Any combination of additions and multiplications” really is quite a lot – in fact almost any math function can be broken down into additions and multiplications, so Gentry’s result is quite strong.

However, there are some practical limitations that have thus far, stopped us from using FHE. One is performance; which can be billions of times slower than the “somewhat” or “partial” approach. Though it is currently being worked on, a big gap persists.

Another limitation to FHE is the kind of problem it can solve. Suppose you wanted to use FHE with a medical expert system. Such systems work more with questions and answers then with addition and multiplication. They try to diagnose a disease based on gathering patient information, applying some logical rules and then asking more questions. This is a logical process and a major part of it is interactive – asking questions and learning. The best of these systems also constantly change their rules, as they learn more about how patients and diseases really work. Is a learning system based on rules and interactive back-and-forth questions and reasoning – easily broken down into addition and multiplication?

So FHE has limitations based on performance and limitations based on type of problem it might solve.

Are there any commercial implementations of homomorphic encryption?

The world’s first commercial implementation is Homomorphic Key Management, a “partially homomorphic” approach. Homomorphic Key Management is focused on the specific problem of encrypting the encryption keys themselves and keeping them safe and secret in the cloud, while still being able to use them for encrypting data. This work was done by Porticor in 2011-2012 and a commercial product entered the market at the end of 2012.

Several academic teams are now working on bringing additional “somewhat homomorphic” approaches to market, though as far as we know, none other has yet been commercialized. We hopefully look toward the coming years to produce commercial results relevant to the study of many fields, such as genomics and specific computations within databases.

In parallel, Academia continues to work hard on making FHE more efficient.

The post Homomorphic Encryption and Cloud Security: The Practicalities appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@CloudExpo Stories
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devic...
"The Striim platform is a full end-to-end streaming integration and analytics platform that is middleware that covers a lot of different use cases," explained Steve Wilkes, Founder and CTO at Striim, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
SYS-CON Events announced today that Calligo, an innovative cloud service provider offering mid-sized companies the highest levels of data privacy and security, has been named "Bronze Sponsor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Calligo offers unparalleled application performance guarantees, commercial flexibility and a personalised support service from its globally located cloud plat...
"With Digital Experience Monitoring what used to be a simple visit to a web page has exploded into app on phones, data from social media feeds, competitive benchmarking - these are all components that are only available because of some type of digital asset," explained Leo Vasiliou, Director of Web Performance Engineering at Catchpoint Systems, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
21st International Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Me...
SYS-CON Events announced today that DXWorldExpo has been named “Global Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Digital Transformation is the key issue driving the global enterprise IT business. Digital Transformation is most prominent among Global 2000 enterprises and government institutions.
SYS-CON Events announced today that Datera, that offers a radically new data management architecture, has been named "Exhibitor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Datera is transforming the traditional datacenter model through modern cloud simplicity. The technology industry is at another major inflection point. The rise of mobile, the Internet of Things, data storage and Big...
Kubernetes is an open source system for automating deployment, scaling, and management of containerized applications. Kubernetes was originally built by Google, leveraging years of experience with managing container workloads, and is now a Cloud Native Compute Foundation (CNCF) project. Kubernetes has been widely adopted by the community, supported on all major public and private cloud providers, and is gaining rapid adoption in enterprises. However, Kubernetes may seem intimidating and complex ...
"Outscale was founded in 2010, is based in France, is a strategic partner to Dassault Systémes and has done quite a bit of work with divisions of Dassault," explained Jackie Funk, Digital Marketing exec at Outscale, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We focus on SAP workloads because they are among the most powerful but somewhat challenging workloads out there to take into public cloud," explained Swen Conrad, CEO of Ocean9, Inc., in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"DivvyCloud as a company set out to help customers automate solutions to the most common cloud problems," noted Jeremy Snyder, VP of Business Development at DivvyCloud, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"I think DevOps is now a rambunctious teenager – it’s starting to get a mind of its own, wanting to get its own things but it still needs some adult supervision," explained Thomas Hooker, VP of marketing at CollabNet, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We are still a relatively small software house and we are focusing on certain industries like FinTech, med tech, energy and utilities. We help our customers with their digital transformation," noted Piotr Stawinski, Founder and CEO of EARP Integration, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We've been engaging with a lot of customers including Panasonic, we've been involved with Cisco and now we're working with the U.S. government - the Department of Homeland Security," explained Peter Jung, Chief Product Officer at Pulzze Systems, in this SYS-CON.tv interview at @ThingsExpo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We're here to tell the world about our cloud-scale infrastructure that we have at Juniper combined with the world-class security that we put into the cloud," explained Lisa Guess, VP of Systems Engineering at Juniper Networks, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Your homes and cars can be automated and self-serviced. Why can't your storage? From simply asking questions to analyze and troubleshoot your infrastructure, to provisioning storage with snapshots, recovery and replication, your wildest sci-fi dream has come true. In his session at @DevOpsSummit at 20th Cloud Expo, Dan Florea, Director of Product Management at Tintri, provided a ChatOps demo where you can talk to your storage and manage it from anywhere, through Slack and similar services with...
"We were founded in 2003 and the way we were founded was about good backup and good disaster recovery for our clients, and for the last 20 years we've been pretty consistent with that," noted Marc Malafronte, Territory Manager at StorageCraft, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We are an IT services solution provider and we sell software to support those solutions. Our focus and key areas are around security, enterprise monitoring, and continuous delivery optimization," noted John Balsavage, President of A&I Solutions, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We want to show that our solution is far less expensive with a much better total cost of ownership so we announced several key features. One is called geo-distributed erasure coding, another is support for KVM and we introduced a new capability called Multi-Part," explained Tim Desai, Senior Product Marketing Manager at Hitachi Data Systems, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
There is a huge demand for responsive, real-time mobile and web experiences, but current architectural patterns do not easily accommodate applications that respond to events in real time. Common solutions using message queues or HTTP long-polling quickly lead to resiliency, scalability and development velocity challenges. In his session at 21st Cloud Expo, Ryland Degnan, a Senior Software Engineer on the Netflix Edge Platform team, will discuss how by leveraging a reactive stream-based protocol,...