System and method for adding and comparing integers encrypted with quasigroup arithmetic in AES counter mode encryption

Abstract

An encryption system and method is provided that accommodates private computing in the public cloud and provides the ability to perform operations on encrypted data.

Description

[Technical field]

[0001] This disclosure relates generally to cryptography, and specifically to cryptography used for computer data confidentiality. [Background technology]

[0002] When data is encrypted with the current NIST standard AES Counter Mode (CTR-XOR) symmetric key encryption scheme, the only operation that can be performed on the encrypted data is decryption. In particular, it is not possible to add or compare (for Less Than) two encrypted integers without first decrypting both ciphertexts. Because standard CTR-XOR encryption prevents useful operations on encrypted data, such as addition and less than operations, it is desirable to provide an encryption technique that provides security for the data while still allowing useful operations on encrypted data.

[0003] The above problems are particularly acute in the context of private computing in the public cloud, but exist in other areas as well. Today, there are four solutions to the above problems, each with its own limitations and / or shortcomings. The current solutions are: a. Secure Hardware Extensions such as Intel Software Guard Extensions (SGX). b. Fully homomorphic encryption (FHE) schemes such as Microsoft's Simple Encryption Arithmetic Library (SEAL). c. Secure Multi-Party Computation (SMPC) schemes such as Cybernetica's Sharemind. dQGroups (QGoups) have been proposed previously in cryptography research for generating ad-hoc stream ciphers, asymmetric key cryptosystems, and message digests.

[0004] While hardware extension solutions such as SGX have superior performance, they require the use of Intel's dedicated hardware and software authentication infrastructure. Furthermore, SGX in particular is vulnerable to side-channel attacks such as Spectra, Meltdown, and Foreshadow that can compromise confidentiality, and therefore mitigation techniques are under active development for new processors.

[0005] FHE techniques promise superior security, but are impractical due to their slow speed. For example, traditional FHE implementations require several seconds to evaluate a single AES encryption operation, compared to nanoseconds for AES in hardware. Current research is exploring ways to speed up these calculations, but does not currently provide a commercially viable solution to the above problems.

[0006] Known SMPC techniques have a good balance between performance and security. However, current solutions such as Sharemind are too slow because they use more complex protocols to guarantee stricter security.

[0007] Ad-hoc stream ciphers built using Q-groups are fast, but they solve a different problem: encrypting large messages. Public key cryptosystems and message digests based on Q-groups also target different problems, not the one described above.

[0008] It is therefore desirable, and an object of the present disclosure, to provide an encryption system and method that accommodates private computation in the public cloud and provides the ability to perform operations on encrypted data. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 illustrates an example embodiment of a system for performing encryption and facilitating operations on encrypted data. [Diagram 2] FIG. 2 illustrates an encryption process that can be performed using the system of FIG. 1. [Diagram 3] FIG. 2 illustrates an encryption operation process that can be performed using the system of FIG. 1. [Figure 4] FIG. 2 illustrates a decoding process that can be performed using the system of FIG. [Diagram 5] FIG. 3 shows further details of the encryption process shown in FIG. [Figure 6] FIG. 5 shows further details of the decoding process shown in FIG. [Figure 7] FIG. 2 illustrates an encryption process for an encrypted addition process that can be performed using the system of FIG. 1. [Figure 8] FIG. 2 illustrates a cryptographic addition process that can be performed using the system of FIG. 1. [Figure 9] FIG. 13 illustrates the decryption process of the encrypted addition process. [Figure 10] FIG. 2 illustrates an encryption process under encryption that can be performed using the system of FIG. 1. [Figure 11] FIG. 2 illustrates a sub-cryptographic process that can be performed using the system of FIG. 1. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] The present disclosure is particularly applicable to systems that outsource private computations to a public cloud such that confidentiality of data is maintained during operations on data in the public cloud, and will be described in this context. However, it will be appreciated that the system and method are highly useful as they can be used for / with any system where it is desirable to provide encryption for security while also allowing operations to be performed on encrypted data. The system and method replaces the Xor function of traditional CTR-XOR with quasigroup (abbreviated as Q-group) operations to allow computations that can be performed without decryption to maintain confidentiality in the public cloud. The system and method can also leverage SMPC systems.

[0011] FIG. 1 illustrates an example embodiment of a system 100 for performing encryption and facilitating operations on encrypted data. Although the example embodiment shows a client 102 and a server 104 in communication with each other, the system may be implemented using multiple clients and multiple servers in communication with each other. Each client 102 may be a computing device having a processor, memory, I / O devices, and a display, and may execute multiple lines of instructions / computer code (applications, portions of code, mobile applications, etc.) requesting one or more operations, such as an add or less than operation, to be performed on the encrypted data. For example, each client 102 computing device may be a personal computer, a laptop computer, a tablet computer, a terminal, etc. Each server 104 may be a computer having a processor, memory, I / O devices, and a display, and may execute multiple lines of instructions / computer code (applications, portions of code, mobile applications, etc.) that manage one or more operations requested by the client to facilitate operations on the encrypted data. For example, each server 104 computer may be a server computer, one or more cloud computing resources, one or more virtual computing resources, one or more blade servers, etc.

[0012] The system 100 may further include a Q-group encryption / decryption unit 106 coupled between each client and each server for managing encryption and decryption operations as described below. The Q-group encryption / decryption unit 106 may be implemented as one or more computer systems having at least one processor, memory, I / O devices, and may execute multiple lines of instructions / computer code (one or more applications, portions of code, mobile applications, etc.) for performing encryption and decryption operations between each client 102 and server 104 as described below.

[0013] The system may further include a known secure multi-party computation (SMPC) cluster 108 connected to the server 104 that assists in performing requested operations on the encrypted data as described in more detail below. The SMPC cluster 108 may be implemented as one or more computer systems having at least one processor, memory, I / O devices, and may execute multiple lines of instructions / computer code (one or more applications, portions of code, mobile applications, etc.) that assist in performing requested operations on the encrypted data as described in more detail below. The Q-group encryptor / decryptor 106 and the SMPC cluster 108 may each be implemented on the same or different computers as each other. More specifically, the Q-group encryptor 106 may be implemented on the same system as the client 102 or on a different system, but never on the same system as the server 104 because the encryption key is made available on the server 104. Furthermore, each of the Q-group encryptor / decryptor 106 and the SMPC cluster 108 may also be implemented on the same or different computers as the server 104. 1, each of the Q-group encryptor / decryptor 106 and the SMPC cluster 108 may be provided with an encryption key 110 from time to time to perform encryption / decryption and operations on the encrypted data. Each client may generate one or more operations 112 on the encrypted data, and the server 104 returns the results 114 of these operations to the client, as described below.

[0014] FIG 2 illustrates an encryption process 200, FIG 3 illustrates an encryption operation process 300, and FIG 4 illustrates a decryption process 400 that can be performed using the system of FIG 1. Each of these processes can be performed using one or more of the system elements 100-110 shown in FIG 1. In the SMPC cluster 108 protocol, the client 102 generates plain data items and the server 104 stores cipher data items (encrypted data) as shown in FIG 2. For example, the overall operation of performing an operation on encrypted data using the system of FIG 1 can include three phases: encryption 200, encryption operation 300, and decryption 400.

[0015] The first phase 200 encrypts the plaintext data from the client with the Q-group computing element 106 using a secret key (either pre-generated using an encryption scheme or generated at the time of encryption using an encryption scheme such as the Q-group encryption scheme) which is then stored on the server 104. The second phase 300 executes the operations 112 initiated by the client 102 using the SMPC protocol between the server 104 and the SMPC 108 cluster of machines that have access to the same secret key used to encrypt the client data. The SMPC 108 protocol exchanges cryptographic data and other information between the server 104 and other computers in the cluster 108, ensuring that confidentiality of the data cannot be compromised even if an attacker is observing the network traffic, memory, and internal computation state of the server or any one of the computers in the cluster. Although some of the computers in the SMPC cluster 108 have access to the private key, the SMPC protocol ensures that confidentiality cannot be compromised even if an attacker is observing one of the computers holding the private key, unless the attacker is also attacking the server 104 at the same time. The third phase 400 receives the encrypted data from the server 104 and decrypts it using the same private key using a Q-group decryption operation 106 to generate plaintext data for the client 102 .

[0016] Figure 5 shows further details of the encryption process 200 shown in Figure 2, and Figure 6 shows further details of the decryption process 400 shown in Figure 4. The system of Figure 1 can use Q-group encryption 500 and Q-group decryption 600 operations as encryption schemes. A first step 502, 602 of both operations uses a pseudo-random function (Prf), which is a cryptographic function such as AES encryption or HMAC-SHA message digest, to generate a pseudo-random pad, which is combined with the data in a second step using a Q-group addition or Lsub operation 504, 604 to generate a result (either encrypted data in Figure 5 or plaintext data in Figure 6).

[0017] More specifically, the first step 502, 602 takes a nonce N, which is a random number used once, a length L, which is the number of bits in the data, and a secret key K used by Prf. The NIST standard AES Counter Mode (CTR-XOR) uses the AES encryption function as Prf and the Xor function as the Q-group operation. The NIST standard describes how the CTR-XOR encryption takes plaintext data M of length L bits, a nonce N, and a secret key K, and first generates a set of m=ceiling(L / 128) input blocks of 128 bits each taken from N, N+1, ..., N+m-1, respectively, then encrypts each input block using AES encryption with key K to generate m output blocks, and finally concatenates all m output blocks to generate a pseudorandom pad P of length L bits. In the second step of the CTR-XOR encryption, the pseudorandom pad P is XORed with the plaintext data M to generate encrypted data C having L bits that is stored with the nonce N as ciphertext (N, C). The system and disclosed process generalize the known Prf function used in the first step of CTR-XOR to be any cryptographic pseudorandom function, and generalize the Xor operation in the second step of CTR-XOR to be any Q-group operation 504.

[0018] A Q-group G consists of a set GS that contains all binary sequences of length L and three operations: G.Add, G.Lsub, and GRsub. The G.Add operation takes any two elements A and B from the set GS and produces another element C in the set GS. The G.Lsub operation takes any two elements A and C from the set GS and produces a unique element B from the set such that G.Add(A,B)=C. The G.Rsub operation takes any two elements B and C from the set GS and produces a unique element A in the set such that G.Add(A,B)=C. The G.Lsub operation is known as the left-inverse, and the G.Rsub operation is known as the right-inverse of the G.Add operation.

[0019] The CTR-Q-group scheme shown in Figures 5 and 6 selects a Q-group and then replaces the Xor operation of the NIST standard CTR-XOR with Q-group Add 504 for encryption and Q-group Lsub 506 for decryption as shown. If the selected Q-group is G, then the intermediate cipher block produced by encrypting nonce N with key K is the pseudorandom pad P = Prf(K,N,L), and the cipher data produced by the Q-group cipher of plaintext data M is the cipher data C = G.Add(P,M). The Q-group decryption function of cipher data C uses the same pseudorandom pad P = Prf(K,N,L) as input to the G.Lsub function to decrypt the cipher data C to produce plaintext data M = G,Lsub(P,C).

[0020] The NIST standard CTR-XOR can be viewed as a specific instantiation of the Q-group scheme in which the XOR.Add, XOR.Lsub, and XOR.Rsub functions are all Xor, as shown below. XOR.Add(P,M) = Xor(P,M) XOR.Lsub(P,C)=Xor(P,C) XOR.Rsub(M,C)=Xor(M,C)

[0021] A slight variation of the standard CTR-XOR is to introduce a constant H of length L bits and perform an Xor of the inputs by the constant H as shown below. XOR2.Add(P,M) = Xor(P,M,H) XOR2.Lsub(P,C)=Xor(P,C,H) XOR2.Rsub(M,C)=Xor(M,C,H)

[0022] For example, use an all 1-bit constant H to generate the CTR-XNOR encryption scheme. The CTR-XNOR scheme differs from the standard CTR-XOR, but does not offer any significant advantages over CTR-XOR.

[0023] The process described below can be used to address the problem of outsourcing private computation to a public cloud, providing a technical solution that provides encryption for data security but allows operations on the encrypted data (without sacrificing security), examples of these operations are described herein.

[0024] The first Q-group encryption shown in Figures 5 and 6 uses modulo 2 L Addition and subtraction can be used to generate the CTR-ADD symmetric encryption scheme as follows: ADD.Add(P,M) = (P+M) mod 2 L- ADD.Lsub(P,C)=(CP) mod 2 L- ADD.Rsub(M,C)=(CM) mod 2 L-

[0025] The second Q group is modulo 2 L Using addition and subtraction, generate CTR-SUB as follows: SUB.Add(P,M) = (P M) mod 2 L- SUB.Lsub(P,C)=(P C) mod 2 L- SUB.Rsub(M,C)=(C+M) mod 2 L-

[0026] The advantage of CTR-SUB over CTR-ADD is that the SUB.Add and SUB.Lsub functions are structurally identical, so the same function implementation is used for both encryption and decryption.

[0027] Many other Q-group operations can be used for encryption due to the security proof that replacing Xor with any Q-group addition operation results in a symmetric-key encryption scheme that is as secure as the NIST standard AES CTR-XOR encryption. A Q-group for a set with N elements is defined by an addition function represented by a two-dimensional Cayley table containing N rows and N columns indexed from 0 to N-1, where each entry is the result of Add(row_index, column_index). The addition table for a Q-group is a Latin square, since the Lsub function requires that no column entries are repeated and the Rsub function requires that no row entries are repeated. Thus, the number of possibilities for addition functions is at least N!(N-1)!...2!1!, and a large number of secure encryption schemes are possible.

[0028] Among all possible Q-group encryption schemes, the disclosed system and process involves a binary string of length L and a summation function G: L We can use a Q group G with the set GS containing the elements. G.Add(P,M)=(D * P+E * M+H) mod 2 L- where + is modulo -2 L- Shows addition, * is modulo-2 L- indicates multiplication, and D and E are both 2 L is a constant from the set GS that is relatively prime to x, and H is another constant from the set GS.

[0029] In the definition of G.Add, by choosing D=1, E=1, and H=0, we obtain the Q group for the CTR-ADD encryption scheme, while by choosing D=1, E=-1, and H=0, we obtain the Q group for the CTR-SUB encryption scheme.

[0030] Modulo-2 L- Using the algebraic properties of arithmetic operations, define G.Add = (D * P+E *M+H) mod 2 L A small reconstruction of such a Q-group G is such that for all P and all M, G.Add(P,M)=(G.Add(P,0)+E * M) mod 2 L- where L is a string of 0 bits. This constraint is satisfied by the equation F(X,Y)=(A * X+B * Y+Q) mod 2 L For some function F, modulo -2 L- Equation F(G.Add(P1,M1), G.Add(P2,M2))=F(G.Add(P1,0), G.Add(P2,0))+E * F(M1,M2). Therefore, the result of the operation on the plain texts E * F(M1,M2) can be obtained by combining the function result F(C1,C2) of the ciphertext of server 104 with the function result of pad F of SMPC 108 cluster computer 1 (Add(P1,0), Add(P2,0)).

[0031] Equation F(X,Y)=(A * X+B * Y+Q) mod 2 L In, choosing A=1, B=1, and Q=0 results in F(X,Y)=X+Y, which results in P=P3 and M=E * Constraint G.Add(P,M)=G.Add(P,0)+E on (M1+M2) * E combined with M * The formula for (M1+M2) is obtained, and the formula for computing C3 and S in the additive SMPC protocol / process is obtained as shown in Figure 8. Definition F(X,Y)=(A * X+B * Y+Q) mod 2 L Choosing A=-1, B=1, and Q=R in results in F(X,Y)=Y-X+R, which gives the formulas for computing V and X in the protocol / process shown in Figures 10 and 11.

[0032] <Encrypted addition operation> Figure 7-9 shows the encryption process, the encryption addition process and the decryption process of the encryption addition process. The advantage of CTR-ADD and CTR-SUB over CTR-XOR is that data encrypted by any of these Q-group encryption schemes can be added as shown in the following SMPC protocol / process shown in Figure 7-9 for adding two encrypted data.

[0033] The encrypted addition process may include the following processes. a. The client 102 performs these steps: i. encrypting plaintext data M1 using a Q group 106 with a nonce NI to generate ciphertext (N1, C1) for storage on the server 104; ii. encrypting the plaintext data M2 using the Q group 106 with the nonce N2 to generate ciphertext (N2, C2) for storage on the server 104; and iii. Initiating an addition operation on the two ciphertexts at the server 104. b. Server 104 sending (N1, N2) to SMPC cluster 108 computer 1; Execute. c. SMPC cluster 108 computer 1 performs these steps: i. receiving (N1, N2) from the server 104; ii. generating a new nonce N3; iii. For i=1, 2, and 3, pad Pi=Prf(K,Ni,L) and plaintext data Mi=0. S=(Prf(K,N3,L)-Prf(K,N1,L)-Prf(K,N2,L)) mod 2 L computing S=Add(P3,0)-Add(P1,0)-Add(P2,0) which simplifies to iv. returning (N3, S) to the server 104; Execute. d. The server 104 performs these steps: i. receiving (N3,S) from SMPC cluster 108 computer 1; ii. C3 = (C1 + C2 + S) mod 2 L and computing iii. sending (N3, C3) as the sum ciphertext to the client 102; Continue the server process by e. Client 102 decrypts the ciphertext (N3, C3) using Lsub to recover the plaintext data of the addition M1+M2 as shown in FIG.

[0034] In this manner, the disclosed system and method provide a technical solution to the technical problem being solved: adding encrypted data while maintaining security in situations where private computing is performed in a public cloud. As an example, consider a database in a public cloud that contains a table called PAYROLL where each row contains a person's name and an encrypted number for their SALARY. An attacker of the database would not be able to decrypt any of the salary information without the encryption key. However, the owner (client) of this database and table could use the addition operation described above to obtain the following: SELECT SUM(salary)FROM payroll The total expenditure of the department can be computed by issuing a SQL query such as

[0035] The addition operation amounts to computing an encrypted sum using the SMPC protocol which then needs to be decrypted by Q-group decryption with the appropriate encryption key.

[0036] <Under-encryption calculation> Figure 10 shows the encryption process of the encryption subprocess, and Figure 11 shows the encryption subprocess. The ciphertexts generated by the CTR-ADD and CTR-SUB encryption schemes can be compared in the subprocess according to the following protocol / process.

[0037] In the Less Than process, the system has an SMPC 108 but uses two computers in an SMPC cluster, SMPC Computer 1 108A and SMPC Computer 2 108B, as shown in FIG. 11, whose operations are described below. The process relies in part on an Order-Revealing Encryption (ORE) scheme, such as “Practical Order-Revealing Encryption with Limited Leakage” taught by Nathan Chenette et al. in 2016. The ORE scheme encrypts operands using a function OreEncrypt with an additional secret key K2 shared between the server 104 and SMPC Cluster 108A Computer 1. Although the secret key K2 is not available to SMPC Cluster Computer 2 108B, SMPC Cluster Computer 2 108B executes a function OreCmp to compare two operands for Less Than while leaking only the most significant bit of the difference between the operands.

[0038] The pre-encryption process may include the following processes: a. The client 102 performs these steps: i. encrypting plaintext data M1 by Q-group encryption with a nonce N1 to generate ciphertext (N1, C1) for storage on a server; ii. encrypting the plaintext data M2 by Q-group encryption with a nonce N2 to generate a ciphertext (N2, C2) for storage on the server; and iii. initiating a subtraction operation on the server 104 of the two ciphertexts; Execute. b. The server 104 performs these steps: Step of generating a random integer R less than i.L; Step of computer-calculating V = (C2 - C1) + R; Step of computer-calculating W = OreEncrypt(K2, V); Step of sending (N1, N2, R) to the SMPC cluster computer 1 108A, and Step of sending W to the SMPC cluster computer 2 108B. Execute. c. The SMPC cluster computer 1 108A performs these steps: Step of receiving (N1, N2, R) from the server 104; Step of computer-calculating X = (Prf(K, N2, L) - Prf(K, N1, L)) + R, simplified to X = (Add(P2, 0) - Add(P1, 0) + R) by the padding Pi = Prf(K, Ni, L) for i = 1 and 2 and the plaintext data Mi = 0; Step of computer-calculating Y = OreEncrypt(K2, X), and Step of sending Y to the SMPC cluster computer 2 108B. Execute. d. The SMPC cluster computer 2 108B performs these steps: Step of receiving W from the server 104; Step of receiving Y from the SMPC cluster computer 1 108A; Step of computer-calculating Z = OreCompare(W, Y), and Step of sending the result L depending on the most significant non-zero bit of Z to the server 104. Execute. e. The server 104 receives the result L that can determine whether M1 < M2 to be returned to the client 102. "L" is the result of the less-than protocol. If M1 < M2, then L is set to 1; if M1 >= M2, L is set to 0.

[0039] For example, assume that a database in a public cloud contains a table called PEOPLE that contains an encrypted column LASTNAME that holds an encryption of a person's name, and an encrypted column BIRTHDATE that holds an encryption of a birthdate (the encrypted ciphertext with the birthdate). An attacker of the database cannot decrypt any of the encrypted BIRTHDATE values ​​without the correct key. However, a client can respond to queries such as the following using less-than-encryption operations: SELECT lastname FROM people WHERE birthdate < '2000-01-01'

[0040] An attacker of the database cannot see which birthdate is being queried without the decryption key. The attacker can see how many results were selected that matched the filter, but cannot see the last name without the decryption key. A Qgroup decryption operation with the appropriate key can decrypt the last name in the result set of the query.

[0041] <Summary of Results> The Q-group encryption method and the SMPC protocol based on this encryption have provable security and good performance. Although not as fast as hardware solutions such as Intel SGX, the disclosed process does not depend on specific hardware and is not vulnerable to side channel attacks as described in the background art above. The disclosed sub-SMPC protocol reduces multiple rounds of communication between the server and the SMPC cluster computer to a single round, and is therefore much faster than pre-published protocols such as in the Sharemind system. Ad-hoc stream ciphers built using Q-groups maintain the confidentiality of the ciphertext by keeping the Q-group operations secret, and the disclosed system and method use a proven method of exposing the Q-group as well as the encryption function but keeping only the key secret. The results and effectiveness of the disclosed system and method are shown when implemented on commercial databases such as Cassandra, MySQL, MariaDB, Postgres, MongoDB, Oracle, and Microsoft SQL Server developed on public clouds such as Amazon Web Services and Microsoft Azure.

[0042] The above description has been provided for purposes of illustration with respect to specific embodiments. However, the above illustrative discussion is not intended to be exhaustive or to limit the disclosure to the precise form disclosed. Many modifications and variations are possible in light of the above teachings. The present embodiments have been selected and described to best explain the principles and possible applications of the disclosure, and thereby to best enable the utilization of various embodiments of the disclosure and various modifications as suited to the particular applications contemplated.

[0043] The systems and methods disclosed herein may be implemented via one or more components, systems, servers, appliances, other subcomponents, or may be distributed among such elements. When implemented as a system, such a system may include and / or contain, among other things, software modules, a general purpose CPU, RAM, and other components found in a general purpose computer. In implementations in which the invention resides on a server, such a server may include or contain a CPU, RAM, and other components found in a general purpose computer.

[0044] Additionally, the systems and methods herein may be accomplished through implementations with different or entirely separate software, hardware and / or firmware components in addition to those described above. With respect to such other components (e.g., software, processing components, etc.) and / or computer-readable media associated with or embodying the present invention, for example, aspects of the invention herein may be implemented to be compatible with numerous general purpose or special purpose computer systems or configurations. Various exemplary computer systems, environments, and / or configurations that may be suitable for use with the invention herein include, but are not limited to, software or other components embodied in or on a personal computer, one or more server computing devices such as routing / connection components, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, consumer electronics devices, network PCs, other existing computing platforms, distributed computing environments including one or more of the above systems or devices, and others.

[0045] In some cases, aspects of the systems and methods can be accomplished or performed through logic and / or logical instructions, including program modules, executed in conjunction with such components or circuits, for example. Generally, program modules can include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular instructions herein. The present invention can also be implemented in the context of a distributed software, computer, or circuit configuration, where circuits are connected via communication buses, circuits, or links. In a distributed configuration, control / instructions can originate from both local and remote computer storage media, including memory storage devices.

[0046] Software, circuits, and components herein may include and / or utilize one or more types of computer readable media. Computer readable media may be any available media present on or associated with or accessible by such circuits and / or computer components. By way of example and not limitation, computer readable media may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and fixed media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital multifunction disks (DVDs) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other media that can be used to store the requested information and that can be accessed by a computer component. Communication media may include computer readable instructions, data structures, program modules, and / or other components. Additionally, communication media may include wired media such as a wired network or a direct-wired network, although any such type of media herein does not include transitory media. Combinations of any of the above are also included within the scope of computer-readable media.

[0047] As used herein, terms such as component, module, device, etc., may refer to any type of logical or functional software component, circuit, block, and / or process that may be implemented in a wide variety of ways. For example, the functions of various circuits and / or blocks may be combined with one another into any other number of modules. Each module may be implemented as a software program stored in a tangible memory (e.g., random access memory, read-only memory, CD-ROM memory, hard disk drive, etc.) that is read by a central processing unit to perform the functions of the invention herein. Alternatively, the modules may include programming instructions transmitted via a transmission carrier wave to a general-purpose computer or processing / graphics hardware. Also, the modules may be implemented as hardware logic circuits that perform the functions encompassed by the invention herein. Finally, the modules may be implemented using special purpose instructions (SIMD instructions), field programmable logic arrays, or any mixture thereof that provides the desired level of performance and cost.

[0048] As disclosed herein, features consistent with the present disclosure may be implemented via computer hardware, software, and / or hardware. For example, the systems and methods disclosed herein may be embodied in various forms, including, for example, a data processor, such as a computer, including a database, digital electronic circuitry, firmware, software, or a combination thereof. Furthermore, while some of the disclosed implementations describe specific hardware components, the systems and methods consistent with the invention herein may be implemented by any combination of hardware, software, and / or firmware. Furthermore, the above-mentioned features and other aspects and principles of the invention herein may be implemented in a variety of environments. Such environments and related applications may include general-purpose computers or computer platforms that may be specially configured to execute various routines, processes, and / or operations according to the present invention, or they may be selectively activated or reconfigured with code that provides the required functionality. The processes disclosed herein are not inherently related to any particular computer, network, architecture, environment, or other apparatus, but may be implemented by any suitable combination of hardware, software, and / or firmware. For example, various general-purpose machines may be used with the programs described in accordance with the teachings of the present invention, or it may be convenient to configure specialized devices or systems to execute the required methods and techniques.

[0049] Aspects of the methods and systems, such as logic described herein, can be implemented as programmed functions in any of a wide variety of circuits, including field programmable gate arrays ("FPFA"), programmable array logic ("PAL") devices, electrically programmable logic and memory devices and standard cell-based devices, as well as programmable logic devices ("PLDs") such as application specific integrated circuits. Some other possibilities for implementing aspects include memory devices, microcontrollers with memory (such as EEPROMs), embedded microprocessors, firmware, software, and others. Additionally, aspects can be embodied in microprocessors with software-based circuit emulation, discrete logic (sequential and combinatorial), custom devices, fuzzy (neural) logic, quantum devices, and hybrids of any of the above device types. The underlying device technologies can be provided in a wide variety of component types, including, for example, metal-oxide-semiconductor field effect transistor ("MOSFET") technologies such as complementary metal-oxide-semiconductor ("CMOS"), bipolar technologies such as emitter-coupled logic ("ECL"), polymer technologies (e.g., silicon-conjugated polymer and metal-conjugated polymer-metal structures), and mixed analog and digital.

[0050] Additionally, the various logic and / or functionality disclosed herein may be enabled in terms of behavioral characteristics, register transfer characteristics, logical component characteristics, and / or other characteristics using any number of combinations of hardware, firmware, and / or as data and / or instructions embodied in a machine-readable or computer-readable medium. Computer-readable media in which such formatted data and / or instructions may be embodied may include, without limitation, various forms of non-volatile storage media (e.g., optical, magnetic, or semiconductor storage media), but again does not include transitory media. Throughout this specification, terms such as "comprise" and "comprising" are to be construed in an inclusive sense, as opposed to an exclusive or exhaustive sense, i.e., "including, but not limited to," unless the context clearly requires otherwise. Additionally, words using the singular or plural number include the plural or singular, respectively. Also, the words "herein," "hereunder," "above," "below," and words of similar import refer to this application as a whole and not to any particular portions of this application. When the word "or" is used in reference to a list of two or more items, this word includes all of the interpretations of any item in the list, all of the items in the list, and any combination of the items in the list.

[0051] While certain presently preferred implementations of the invention have been specifically described herein, it will be apparent to those skilled in the art to which the invention pertains that variations and modifications of the various implementations shown and described herein may be made without departing from the spirit and scope of the invention. Accordingly, it is intended that the invention not be limited only to the extent required by the applicable regulations.

[0052] While the foregoing has referred to particular embodiments of the present disclosure, those skilled in the art will recognize that modifications of the present embodiments can be made without departing from the principles and spirit of the disclosure, the scope of the disclosure as defined by the appended claims.

Claims

1. encrypting the first and second plaintext data items from the client using Q-group encryption to generate first and second encrypted data items received by the server, the first encrypted data item including the first share and the second share, and the second encrypted data item including the first share and the second share; receiving at the server from the client an encrypted addition operation request for the first and second encrypted data items to perform an operation on the encrypted data; transmitting the first fragment of the first cryptographic data item and the first fragment of the second cryptographic data item from the server to a Secure Multi-Party Computation (SMPC) computer of an SMPC cluster; receiving, at the SMPC computer, the first fragment of the first cryptographic data item and the first fragment of the second cryptographic data item; Calculating, at the SMPC computer, a first fraction of the encryption result as a new random value of a first size; calculating, on the SMPC computer, an intermediate sum as the difference between a Q-group encryption of the encrypted result using the first fragment and a sum of two Q-group encryptions using the first fragment of the first encrypted data item and the first fragment of the second encrypted data item; transmitting the first fragment of the encryption result and the intermediate sum from the SMPC computer to the server; calculating, at the server, a second fragment of the encryption result as a modulo sum of the intermediate sum and the second fragment of the first encrypted data item and the second fragment of the second encrypted data item; transmitting a combined encryption result from the server to the client, the combined encryption result including the first fragment of the encryption result received from the SMPC server and the second fragment of the encryption result calculated by the server; performing, at the client, a Q-group decryption of the combined encryption result to generate the first plaintext data item and the second plaintext data item; A method comprising:

2. and encrypting the first plaintext data item and the second plaintext data item further comprises generating cipher data for each of the first plaintext data item and the second plaintext data item using a Q-group addition operation with a pseudo-random pad for each of the first plaintext data item and the second plaintext data item. The method of claim 1.

3. and encrypting the first plaintext data item and the second plaintext data item further comprises generating the pseudorandom pad for each of the first plaintext data item and the second plaintext data item using a pseudorandom function, a nonce, and a length of the plaintext data. The method of claim 2.

4. the pseudorandom function being one of a cryptographic method and a cryptographic message digest; The method according to claim 3.

5. performing the Q-group decryption further comprises generating a plaintext result for the encryption result using a pseudo-random padded Q-group Lsub for each of the first plaintext data item and the second plaintext data item. The method of claim 1.

6. Performing the Q-group decryption further includes generating the pseudorandom pad using a pseudorandom function, a nonce, and a length of the encryption result, the pseudorandom function being one of an encryption method and a cryptographic message digest. The method according to claim 5.

7. A server; a client capable of connecting to the server and issuing encrypted data operations to the server, the encrypted data operations including one of an encrypted add operation and an encrypted less than operation; a Q-group encryption engine connected between the client and the server, the Q-group encryption engine encrypting first and second plaintext data items from the client to generate first and second encrypted data items received by the server; a secure multi-party computing (SMPC) cluster connected to the server, the SMPC cluster receiving the first and second items of encrypted data and generating an encrypted result in response to an operation on the encrypted data; Equipped with The Q-group encryption engine decrypts the encryption result according to the method of claim 1 to generate a result, and the server returns the result to the client. system.

8. the Q-group encryption engine generates cipher data for each of the first data item and the second data item using Q-group addition with a pseudo-random pad for each of the first plaintext data item and the second plaintext data item; The system of claim 7.

9. the Q-group encryption engine generates, for each plaintext data item, the pseudorandom pad using a pseudorandom function, a nonce, and the length of the plaintext data item; The system of claim 8.

10. the pseudorandom function being one of a cryptographic method and a cryptographic message digest; The system of claim 9.

11. the Q-group encryption engine generates a result from the encryption result using a Q-group Lsub with a pseudo-random pad for each of the first plaintext data item and the second plaintext data item; The system of claim 7.

12. the Q-group encryption engine generates the pseudorandom pad using a pseudorandom function, a nonce, and the length of the encryption result; The system of claim 11.

13. the pseudorandom function being one of a cryptographic method and a cryptographic message digest; The system of claim 12.

14. the Q-group encryption engine generates encrypted data for each of the first and second plaintext data items using a pseudo-random pad and a Q-group addition with the plaintext data items for each of the first and second plaintext data items, and generates a result from the encryption result using a Q-group Lsub with a pseudo-random pad; The system of claim 7.

15. the SMPC cluster performs a cryptographic addition operation on the first and second cryptographic data items; The system of claim 14.

16. the SMPC cluster generates a second nonce and a second pseudorandom pad on a computer of the SMPC cluster, and calculates an encryption sum based on the first and second cryptographic data items, the second nonce, and the second pseudorandom pad on a computer of the SMPC cluster; The system of claim 15.

17. the SMPC cluster performs a cryptographic less-than operation on the first and second cryptographic data items; The system of claim 14.

18. The server generates a random integer less than the length of the plaintext data, calculates V with a value equal to the random integer, and calculates W, which is the value of the order-disclosing encryption of V.

20. The system of claim 17.

19. a first computer of the SMPC cluster generates a subdivision result based on the nonces of the first and second plaintext data items and the random integer, and calculates an order-disclosing encrypted subdivision result using a second key and the subdivision result; 20. The system of claim 18.

20. A second computer of the SMPC cluster computes an oreCompare operation on W and the order-disclosing encryption less than result, and sends the result L to the server.

20. The system of claim 19.

Images