Methods and systems for privacy-protecting computation across a plurality of computing nodes

Abstract

Embodiments perform privacy-protecting computation across computing nodes. One such embodiment partitions private input data into secret shares. The shares are encrypted to produce a first set of ciphertexts. The first set is transmitted to computing node(s) of the nodes. A second set of ciphertexts is received from the node(s). Workload operation(s) of a workload computation to be performed using the second set is identified. Responsive to determining that a given workload operation of the operation(s) is expressible homomorphically, the operation is performed on ciphertext(s) of the second set. Responsive to determining that the operation is not expressible homomorphically: a portion of the second set associated with the operation is decrypted to produce a secret share; a plaintext-domain operation is performed on the share to produce a processed share; and the processed share is re-encrypted to generate a processed ciphertext. A result ciphertext is output representing a result of the computation.

Description

6200.2023001METHODS AND SYSTEMS FOR PRIVACY-PROTECTING COMPUTATION ACROSS A PLURALITY OF COMPUTING NODESRELATED APPLICATION

[0001] This Application claims the benefit of U.S. Provisional Application No. 63 / 745,974, filed on lanuary 16, 2025. The entire teachings of the above Application are incorporated herein by reference.BACKGROUND

[0002] The use of high-security applications, such as in the healthcare, finance, and government sectors, among others, has increased over time. However, current approaches for executing computational workloads on data while also ensuring data privacy remain inadequate.SUMMARY

[0003] Conventional approaches for privacy-preserving data computation inevitably present unacceptable tradeoffs. For example, some traditional approaches incur unwarranted communications overhead. Other existing approaches have inordinately high computational costs. Still other conventional approaches are vulnerable to various attacks. Thus, functionality with improved efficiency, performance, security, robustness, and scalability is needed.Embodiments provide such functionality.

[0004] An example embodiment is directed to a computer-implemented method of privacyprotecting computation across a plurality of computing nodes. The method begins by partitioning private input data into a plurality of secret shares. Next, the plurality of secret shares is encrypted to produce a first set of ciphertexts. Each of the first set of ciphertexts is an encrypted representation of one or more of the plurality of secret shares. The first set of ciphertexts corresponds to a first portion of a combined dataset of the plurality of computing nodes. In turn, the first set of ciphertexts is transmitted to at least one computing node of the plurality of computing nodes. A second set of ciphertexts is then received from the at least one computing node. The second set of ciphertexts corresponds to a second portion of the combined dataset. Next, at least one workload operation of a workload computation to be performed using the received second set of ciphertexts is identified. Responsive to determining that a given workload operation of the at least one workload operation is expressible homomorphically, the given workload operation is performed on at least one ciphertext of the received second set of- 1 - 5013684. vl6200.2023001ciphertexts. Responsive to determining that the given workload operation is not expressible homomorphically: (1) a portion of the received second set of ciphertexts associated with the given workload operation is decrypted to produce a secret share; (2) a plaintext-domain operation is performed on the secret share to produce a processed share, which plaintext-domain operation corresponds to the given workload operation; and (3) the processed share is reencrypted to generate a processed ciphertext. In turn, a result ciphertext is output that represents a result of the workload computation. The method thereby protects the private input data during the workload computation.

[0005] In an example embodiment, partitioning the private input data may include implementing a secret-sharing (SS) multi-party computation (MPC) protocol. According to one such embodiment, the SS MPC protocol may include Shamir’s Secret Sharing or additive secret sharing.

[0006] According to an example embodiment, the method may further include aggregating ciphertexts received from the at least one computing node into a single packed ciphertext, thereby reducing communication overhead.

[0007] In an example embodiment, the method may further include transmitting the received second set of ciphertexts to a Trusted Execution Environment (TEE). The TEE may include a secure enclave. The method may further include executing the workload computation inside the secure enclave. The portion of the received second set of ciphertexts may be decrypted within the secure enclave. The result ciphertext may be output from the secure enclave. The plaintext corresponding to the combined dataset may be confined within the secure enclave. According to one such embodiment, the secure enclave may include Intel® Software Guard Extensions (SGX), AMD Secure Encrypted Virtualization (SEV), Arm® TrustZone®, another TEE platform, or a combination thereof. In another such embodiment, the TEE may be implemented in a cloud-based enclave hardware platform. The method may further include transmitting the result ciphertext to the at least one computing node for post-processing, thereby masking intermediate plaintext.

[0008] According to an example embodiment, the at least one workload operation may include at least one of (i) a dot product computation, (ii) a comparison operation, and (iii) a cardinality computation that is used to construct higher-level analytics functions.

[0009] In an example embodiment, encrypting the plurality of secret shares may include implementing a fully homomorphic encryption (FHE) protocol using a public encryption parameter. According to one such embodiment, the FHE protocol may be a leveled- 2 - 5013684. vl6200.2023001Brakerski / Fan-Vercauteren (BFV) scheme. Decrypting the portion, performing the plaintextdomain operation, and re-encrypting the processed share may reduce ciphertext noise growth associated with bootstrapping.

[0010] Another example embodiment is directed to a computer-based system for privacyprotecting computation across a plurality of computing nodes. The system includes a processor and a memory with computer code instructions stored thereon. The processor and the memory, with the computer code instructions, are configured to cause the system to implement any embodiments or combination of embodiments described herein.

[0011] Yet another embodiment is directed to a computer program product for privacyprotecting computation across a plurality of computing nodes. The computer program product includes a non-transitory computer-readable medium with computer code instructions stored thereon. The computer code instructions are configured, when executed by a processor, to cause an apparatus associated with the processor to implement any embodiments or combination of embodiments described herein.

[0012] It is noted that embodiments of the method, system, and computer program product may be configured to implement any embodiments or combination of embodiments described herein.BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The foregoing will be apparent from the following more particular description of example embodiments, as illustrated in the accompanying drawings in which like reference characters refer to the same parts throughout the different views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating embodiments.

[0014] FIG. l is a block diagram of an example framework for sharing anonymized data.

[0015] FIG. 2 is a block diagram of an example framework for multi-party computation.

[0016] FIG. 3 is a block diagram of an example framework for fully homomorphic encryption.

[0017] FIG. 4 is a block diagram of an example framework according to an embodiment.

[0018] FIG. 5 is a sequence diagram illustrating an example protocol for computing a secure dot product according to an embodiment.

[0019] FIG. 6 is a flowchart of a method of privacy-protecting computation across a plurality of computing nodes according to an example embodiment.

[0020] FIG. 7 is a schematic view of a computer network in which embodiments may be implemented.- 3 - 5013684. vl6200.2023001

[0021] FIG. 8 is a block diagram illustrating an example embodiment of a computer node in the computer network of FIG. 7.DETAILED DESCRIPTION

[0022] A description of example embodiments follows.

[0023] Introduction

[0024] FIG. 1 is a block diagram of an example framework 100 for sharing anonymized data. As shown in FIG. 1, a first entity 102a may desire to collaborate with one or more other entities such as second entity 102b. For instance, the entities 102a and 102b may be a coordinator hospital and a local hospital, respectively. The hospitals 102a and 102b may wish to engage in a joint activity or task such as training a machine learning (ML) model 106 (e.g., a large language model (LLM)) in the cloud to advance pediatric disease detection. To train the model 106, the hospital 102a may use data (not shown) from the hospital 102a’s own patients as well as anonymized patient data 104 shared by the hospital 102b.

[0025] Enterprises may need to share data with other organizations or companies to develop collaborative solutions, e.g, artificial intelligence (Al) solutions, or extract valuable business insights from the data. For instance, a healthcare organization may share patient records with an Al company to develop a predictive model for early disease detection. Such a collaboration may provide the Al company with real -world data that can be used to improve the company’s algorithms, while the healthcare organization may benefit from obtaining access to cutting-edge Al tools without needing to develop them in-house. FIG. 1 shows an example where the local hospital 102b shares its patient records 104 with the other hospital 102a to jointly develop the predictive model 106 for early disease detection. However, such data sharing may involve sharing sensitive personal and / or proprietary information. Strict measures may thus be required to ensure data security and privacy. Regulatory requirements may further complicate a data sharing process by imposing stringent restrictions on sharing identifiable data. To address these concerns, enterprises may rely on existing techniques such as data anonymization or signing nondisclosure agreements (NDAs) for data sharing. Organizations desiring to train ML models may also resort to conventional measures such as federated learning. Federated learning works by training a model across multiple decentralized devices without sharing the raw data itself. This allows for collaborative learning without exposing private data directly.

[0026] The existing approaches described above lack strong data security and privacy guarantees. Moreover, such traditional approaches are typically trust-based. For example, signing an NDA relies heavily on trust. An NDA has no foolproof or inherent mechanism to prevent- 4 - 5013684. vl6200.2023001individuals with access to data from misusing it. In an NDA-based regime, it is also difficult to determine whether data has been misused. Moreover, prosecuting or pursuing wrongdoers and other malicious actors who misuse data may require significant effort and / or expense. Similarly, while enterprises may adopt data anonymization measures, there have been numerous instances of data breaches involving anonymized data. Examples of data de-anonymization attacks include re-identification attacks (re-identifying individuals using additional knowledge), linkage attacks (combining anonymized data with external datasets that contain identifiable information), and data correlation attacks (inferring individuals’ identities by correlating anonymized data with another dataset).

[0027] To protect against the above and other data de-anonymization attacks, enterprises may employ conventional techniques like ^-anonymity, federated learning, and differential privacy (DP), ^-anonymity enhances privacy by ensuring that each combination of quasiidentifiers (attributes that can be used to infer identity) is shared by at least k-1 other individuals in a dataset. This makes it difficult to identify individuals based on the attributes. DP adds controlled randomness or noise to a dataset to obscure individual data items. This makes it challenging to determine if any specific individual’s data is present or has been removed from the dataset.

[0028] Using federated learning together with DP is one way to enhance privacy. For example, DP can be applied to model updates sent in a federated learning regime to further obfuscate individual data contributions. However, neither ^-anonymity nor federated learning with DP guarantees complete data privacy. If ^-anonymity is not carefully implemented, attackers can still re-identify individuals by analyzing unique attribute combinations in the anonymized data. Similarly, if DP parameters are not properly configured, the added noise may be too small to effectively protect sensitive information. This makes the data susceptible to privacy breaches.

[0029] To address the data security and privacy challenges described hereinabove, privacypreserving techniques including secure multi-party computation (MPC), fully homomorphic encryption (FHE), and secure enclaves can be employed. These techniques are designed to provide stronger data privacy and security than the other approaches described hereinabove, such as when sharing sensitive data between enterprises. MPC and FHE each offer distinct advantages. Unlike federated learning, where parties rely on a third party for aggregation, MPC allows multiple parties to collaboratively compute a function using their private inputs without revealing them to one another. Each party knows only its own input and a final result of the- 5 - 5013684. vl6200.2023001computation. MPC also enables secure computation by splitting data into secret shares that are distributed among parties. In comparison, FHE enables computations to be carried out on encrypted data without needing to decrypt it first. The resulting output is also in encrypted form. This encrypted output, when decrypted, matches the output of operations performed on the original non-encrypted data. FHE thus ensures that data remains secure throughout the computation process. Both MPC and FHE have broad applicability and can be utilized for secure cloud computing, privacy-preserving AI / ML, secure data sharing and analysis, and sensitive data processing in regulated industries. Secure enclaves, in comparison with MPC and FHE, provide a trusted execution environment (TEE) for sensitive computations.

[0030] However, these existing techniques each have their own limitations. MPC generally has lower computational overhead compared to FHE for certain types of computations like dot product computation. In contrast, FHE often incurs higher computational and storage costs due to the complexity of operations performed on encrypted data. MPC suffers from inefficiencies for complex workloads. In addition, MPC can incur significant communication and coordination overhead when scaled to a large number of parties — because computations require interactions among each of the multiple parties. FHE is scalable in terms of handling data operations, but its high performance penalty and high computational costs, such as for operations requiring bootstrapping or rotations, can hinder its practical adoption. As an example, FHE may encrypt multiple data items into a single vector. If an inner product operation is performed, many expensive rotation operations will thus be required. This in turn leads to increased computation costs for FHE. Secure enclaves are vulnerable to side-channel attacks and attacks that compromise hardware, which expose plaintext data during workload execution.

[0031] Existing hybrid approaches have attempted to combine FHE, MPC, and / or secure enclaves to mitigate their individual limitations. For example, traditional frameworks that integrate FHE and MPC reduce communication overhead while maintaining privacy. However, such existing frameworks often fail to address the computational inefficiencies inherent in FHE. Similarly, conventional approaches that combine secure enclaves with cryptographic techniques can enhance data security. These existing approaches do not fully eliminate vulnerabilities, however, because plaintext data may still be exposed within the enclave during certain operations. Existing solutions often lack the fine-grained optimization necessary to balance privacy, performance, and scalability effectively.

[0032] FIG. 2 is a block diagram of an example framework 200 for MPC. As shown in FIG.2, a first entity 202a may desire to collaborate with one or more other entities such as second- 6 - 5013684. vl6200.2023001entity 202b. For instance, the entities 202a and 202b may be a coordinator hospital and a local hospital, respectively. The hospitals 202a and 202b may wish to engage in a joint activity or task such as training an ML model 206 in the cloud to advance pediatric disease detection. To train the model 206, the hospital 202a may employ an MPC approach using data (not shown) from the hospital 202a’ s own patients as well as patient data 208 shared by the hospital 202b. FIG. 2 illustrates how a pure MPC approach leads to high communication complexity in the order of O(w), where n is the size of a dataset. This is reflected in FIG. 2 by the multiple arrows 208a-208d indicating the patient data being communicated from the hospital 202b to the hospital 202a. Conversely, the framework 200 only requires a single compute and / or storage resource 216.

[0033] FIG. 3 is a block diagram of an example framework 300 for FHE. As shown in FIG.3, a first entity 302a may desire to collaborate with one or more other entities such as second entity 302b. For instance, the entities 302a and 302b may be a coordinator hospital and a local hospital, respectively. The hospitals 302a and 302b may wish to engage in a joint activity or task such as training an ML model 306 in the cloud to advance pediatric disease detection. To train the model 306, the hospital 302a may employ an FHE approach using data (not shown) from the hospital 302a’ s own patients as well as encrypted patient data 312 shared by the hospital 302b. FIG. 3 illustrates how a pure FHE approach leads to high computation complexity in the order of n rotation operations (in worst case) to perform matrix multiplications. This is reflected in FIG 3 by the multiple compute and / or storage resources 316a-316i required by the framework 300. Conversely, the lower communication overhead is indicated by a single arrow for the data 312.

[0034] The following are examples that further illustrate the limitations of MPC and FHE. In an example, two hospitals may desire to jointly train an ML model in a privacy -preserving manner to achieve better model accuracy and generalizability. An MPC-based approach would require data to be exchanged between the two hospitals. The amount of communication overhead would be proportional to the number of patients — which could be in the millions. FIG. 2 shows the MPC example 200 where the local hospital 202b needs to transfer large amounts of data 208a-208d to the coordinator hospital 202a. The increased communication overhead may be attributed to MPC utilizing oblivious transfers (OT) as a mechanism to obscure the data. In an OT protocol, a sender transmits one of potentially many pieces of data to a receiver, but the sender remains oblivious as to which piece (if any) has been transmitted. Large communication costs may be incurred when using a 1-out-of-w OT protocol, because a sender must transmit n messages, even though a receiver only wishes to receive the z-th among the n messages.- 7 - 5013684. vl6200.2023001

[0035] Conversely, as shown in FIG. 3, an FHE-based approach would require the coordinator hospital 302a to consume numerous compute and / or storage resources 316a-316i — such as executing thousands of costly ciphertext rotation operations while performing matrix multiplication operations as part of training the ML model 306. This is because FHE lacks direct computation capabilities for sums of elements packed within the same ciphertext 312. Certain operations in FHE approaches are thus computationally intensive.

[0036] An approach that integrates secure enclaves can mitigate some of the above-described challenges with MPC- and FHE-based frameworks. Secure enclaves provide a TEE where sensitive computations can be performed securely and efficiently. For example, FHE ciphertexts can be decrypted within a secure enclave. This allows computationally intensive operations like rotations or plaintext summations to be performed without compromising data security. Secure enclaves can similarly streamline MPC operations by enabling efficient intermediate computations while maintaining the integrity and confidentiality of the data. While secure enclaves provide TEEs, secure enclaves may be vulnerable to side-channel attacks and potentially compromised hardware integrity.

[0037] FIG. 4 is a block diagram of an example framework 400 according to an embodiment. As shown in FIG. 4, a first entity 402a may desire to collaborate with one or more other entities such as second entity 402b. For instance, the entities 402a and 402b may be a coordinator hospital and a local hospital, respectively. The hospitals 402a and 402b may wish to engage in a joint activity or task such as training an ML model 406 in the cloud to advance pediatric disease detection. To train the model 406, the local hospital 402b and the coordinator hospital 402a may use an example embodiment to share encrypted secret shares 414a-414b of patient and model 406 data and can jointly perform model 406 training. In the embodiment of FIG. 4, only a modest amount of compute and / or storage resources 416a-416c are consumed.

[0038] To address the challenges posed by communication and computation overhead in traditional MPC and FHE approaches, respectively, an example embodiment may leverage MPC and FHE schemes to achieve a balanced and efficient solution as shown in FIG. 4. An example embodiment may capitalize on a secret sharing (SS) MPC protocol to avoid or circumvent resource-intensive operations (e.g., rotation operations) in FHE, thereby enhancing computational efficiency. For instance, an example embodiment may decrypt data locally. An example embodiment may also leverage an FHE data packing technique to encode multiple data elements within a single ciphertext, thereby reducing the volume of communication required in MPC. Communication overhead is minimized because an example embodiment transmits an- 8 - 5013684. vl6200.2023001encrypted vector instead of multiple data items. An approach according to an embodiment can ensure that no single party or computing node has access to a complete dataset, thereby significantly enhancing privacy without undermining computational efficiency. The solution of an example embodiment offers robust data security while optimizing both computational and communication aspects.

[0039] A secure enclave may be used to further optimize an example framework according to an embodiment by enabling sensitive operations, like ciphertext rotations and plaintext computations, to be performed securely and efficiently within a TEE. Such an integrated approach offers robust data security along with protection against side-channel attacks while reducing both computational and communication costs. By incorporating FEE within secure enclave(s), an example embodiment can mitigate side-channel attacks and risks of compromised hardware. This ensures that sensitive data remains encrypted throughout most of the computation process and minimizes plaintext exposure even within the enclave(s). An example embodiment may also identify common operations — such as dot product computations, comparisons, and cardinality computations — that can benefit from the synergy of MPC, FEE, and secure enclaves. By employing these foundational operations, an example embodiment can provide advanced functionalities for private data sharing, analytics, and retrieval operations, among other examples. The capabilities of embodiments are designed to meet the needs of enterprises and enable them to address complex business challenges while maintaining stringent data security and privacy standards at reduced costs.

[0040] An example embodiment may employ a unique mechanism to pack secret shares into FEE ciphertexts. This reduces communication overhead while ensuring that data remains encrypted during exchange and computation.

[0041] Within secure enclave(s), another example embodiment may support homomorphic operations like addition and multiplication, while selectively decrypting data for plaintext operations such as rotations. This technique eliminates the need for costly bootstrapping and significantly reduces computational overhead, thereby facilitating practical use of an example embodiment for real-world applications.

[0042] Overview of Example Embodiments

[0043] An example embodiment may overcome the most challenging aspects of conventional MPC and FEE schemes by addressing their individual drawbacks, including computational and communication overhead, implementation complexity, and storage requirements.- 9 - 5013684. vl6200.2023001

[0044] In an example embodiment, both an MPC protocol and FHE scheme may be selected to ensure an optimal balance between computation and communication. For the MPC protocol, an additive secret-sharing (SS) scheme may be selected, as it incurs the lowest communication cost among available MPC techniques. Other known MPC protocols are also suitable. To continue, the SS MPC scheme can be implemented using basic arithmetic operations such as addition and scalar multiplication, without incurring additional computational cost. For the FHE scheme, a Cheon-Kim-Kim-Song (CKKS) FHE scheme may be selected. The CKKS FHE scheme is well suited for ML applications because of its ability to perform computations on real numbers. Its scalability, enabled by batch processing through a multi-slot packing approach, makes it particularly advantageous for large-scale data analytics and privacy-preserving computations. According to another embodiment, if an application involves computations on integers, a Brakerski / Fan-Vercauteren (BFV) scheme may be a more suitable choice. This is because homomorphic multiplication in BFV is computationally less expensive than the same operation in the CKKS scheme. Other known FHE schemes are also suitable.

[0045] According to an implementation, a technique may be introduced to integrate the MPC and FHE schemes. First, the MPC scheme may be used to generate secret shares of sensitive data elements (e.g., the patient data 208 (FIG. 2)). As an example, an SS MPC mechanism may be used to partition the data into secret shares. In an aspect, the data may be split into secret shares using a mechanism such as Shamir’s Secret Sharing or additive secret sharing. Other known mechanisms are also suitable. The secret shares may then be encoded, encrypted, and / or packed into ciphertexts (e.g., 414a-414b (FIG. 4)). According to an implementation, computations may be performed directly on the encrypted data without exposing the underlying plaintext. In turn, the ciphertexts may be exchanged among the participating nodes or parties (e.g., the hospitals 402a and 402b (FIG. 4)). Such an approach may avoid the need to perform OTs between the parties. In an aspect, the ciphertexts may be exchanged among the parties via secure communication channels, thereby enabling collaborative computations while maintaining data confidentiality. After the encrypted secret shares are received by the respective parties, operations such as ciphertext addition and ciphertext-plaintext multiplication can be performed homomorphically — / .<?., in a way that preserves the relationships between the underlying data without first decrypting the data. Other known operations are also suitable. In an aspect, if rotation operations are employed, the parties can decrypt the data and perform equivalent computations in plaintext instead without compromising data privacy. This approach can eliminate the need for costly rotation operations and the storage of large rotation keys, which can- 10 - 5013684. vl6200.2023001reach several gigabytes. According to an embodiment, because each party may hold only secret shares rather than a full dataset, the parties may remain unaware of the actual data throughout a computation, thereby ensuring privacy. In addition, an example embodiment may simplify a homomorphic encryption circuit by reducing it to a single-level circuit, given that no rotation operation is performed. This in turn can eliminate numerous homomorphic multiplications and bootstrapping operations, thereby significantly improving efficiency while reducing computational and storage overhead.

[0046] An example embodiment can also run very efficiently within secure enclave(s). This in turn provides robust protection against side-channel attacks within TEE(s). By decrypting data within and performing computations within the secure enclave(s), an example embodiment can leverage the TEE(s) to execute or perform sensitive operations such as ciphertext rotations and plaintext computations securely. This ensures both data integrity and confidentiality throughout the computation process.

[0047] In an implementation, secure enclave(s), such as Intel® Software Guard Extensions (SGX), AMD Secure Encrypted Virtualization (SEV), and / or Arm® TrustZone®, may be used to optimize performance. Other known secure enclaves are also suitable. The secure enclave(s) may handle operations that are computationally expensive for FHE, such as rotations and certain plaintext operations. Within these TEE(s), ciphertexts may be decrypted, processed securely, and re-encrypted before leaving the enclave(s). This approach eliminates the need for costly FHE bootstrapping and reduces computational overhead, making an example framework according to an embodiment more practical for real-world applications.

[0048] According to an aspect, techniques like ciphertext packing, parallel processing, and / or distributed key management may be employed to enhance both efficiency and security.

[0049] In traditional MPC, the communication cost typically scales linearly with the number of elements in a dataset. This makes conventional MPC prohibitively expensive for large datasets containing billions of elements. An example embodiment may employ a single instruction, multiple data (SIMD) packing approach, whereby each ciphertext can contain N secret shares. In an implementation, the number of secret shares in each ciphertext may be configured based on an FHE scheme parameter N. The foregoing technique of embodiments can effectively reduce the communication cost of MPC to an order of 1 / N the size of a dataset, instead of the full size of the dataset. As a result, even as the dataset scales, the communication cost may increase only sub-linearly, thereby significantly reducing overhead associated with data transfers between parties.- 11 - 5013684. vl6200.2023001

[0050] An example embodiment may incorporate multi-layer secure enclave(s) to isolate different tasks within separate, highly protected environments. This improves security and supports more complex workflows.

[0051] Another example embodiment may leverage federated learning to enable secure AI / ML model training across distributed datasets, thereby ensuring privacy while enhancing collaborative analytics.

[0052] Yet another example embodiment may employ blockchain techniques to deliver secure data provenance and / or auditing mechanisms. This provides verifiable, immutable records of computations, which is advantageous for regulated industries.

[0053] An example framework according to an embodiment may be adapted for edge computing by leveraging lightweight secure enclaves that are suitable for resource-constrained devices, thereby offering privacy-preserving computations at the edge.

[0054] In an implementation, a decentralized framework may be provided that integrates blockchain-based MPC. This enables trustless, transparent computations across multiple parties.

[0055] According to an aspect, scalable MPC protocols may be employed to support large-scale collaborations.

[0056] An example embodiment may be optimized for real-time privacy-preserving analytics, which makes it suitable for applications like fraud detection and the Internet of things (loT).

[0057] Example Use Cases

[0058] Described hereinbelow are concrete examples of use cases for a protocol according to embodiments.

[0059] In an aspect, a first organization (e.g., the coordinator hospital 402a (FIG. 4)) may desire to collaborate with a second organization (e.g., the local hospital 402b (FIG. 4)) to jointly train an LLM for improving pediatric disease detection (e.g., the ML model 406 (FIG. 4)). Here, the second organization may be sharing its data (e.g., the patient data 208 (FIG. 2)) with the first organization. Training an LLM may involve numerous matrix multiplication operations, which in turn may rely on vector dot product computations. The case of securely computing a single vector dot product operation using an example protocol according to an embodiment is addressed hereinbelow for ease of illustration only. However, it should be noted that embodiments are not limited to securely computing a single vector dot product operation; embodiments may also be used to securely compute multiple such operations.- 12 - 5013684. vl6200.2023001

[0060] Conventional FHE alone is impractical for the above task of securely computing a single vector dot product operation, because summing elements within a ciphertext may require expensive slot rotations. For example, rotation operations may in turn require key-switching operations, which may incur significant data movement costs when reading large keys from main memory to on-chip memory. In contrast, existing MPC approaches that rely on OT may incur excessive communication overhead, which makes such approaches unsuitable for large-scale workloads. By leveraging aspects of both FHE and MPC, an example embodiment allows parties (e.g., 402a and 402b (FIG. 4)) to perform secure and efficient computations, such as dot product computations and, in turn, matrix multiplication operations. The solution of embodiments minimizes communication costs while optimizing computation performance. A practical benefit of embodiments, among others, is making privacy-preserving LLM training feasible in real-world settings, such as for healthcare applications.

[0061] FIG. 5 is a sequence diagram illustrating an example protocol 500 for computing a secure dot product according to an embodiment.

[0062] With reference to FIG. 5, described herein is an example of how a secure dot product can be performed efficiently using the protocol 500. A local hospital 502b may have data (not shown) for a total of m patients indexed from 1 through m. Each patient’s data may have n features, thus resulting in a dataset consisting of an m*n matrix. The first row in the matrix may be denoted by a vector B={bo,bi,b2, -,bn}. Next, a coordinator hospital’s 502a set of model weights may be denoted by a vector A={ao, ai,a2, •,««}. The parties 502a and 502b may desire to perform a secure dot product between the vectors A and B. This secure dot product may be denoted by f and can be computed by performing the example steps shown in FIG. 5.

[0063] The example protocol 500 begins at step 518a with the hospital 502a computing secret sharesdi andd? of the vector^. The hospital 502b likewise computes secret shares Bi and B2 of the vector B at step 518b. Each party 502a and 502b retains one share and securely transmits the other share to the opposite party. For example, the hospital 502a retains the share Ai and, at step 522a, securely transmits the other shared to the hospital 502b. The hospital 502b retains the share ^2, and, at step 522b, securely transmits the other Bi to the hospital 502a. Both parties 502a and 502b then perform local computations using their own secret shares and the received secret shares. For example, at step 524a, the hospital 502a computes scalar value a' based on the secret shares di andBi. At step 524b, the hospital 502b computes scalar value b' based on the secret shares ^2, i, and Bz. Following this, the local hospital 502b encrypts its remaining secret share Bz at step 526 and transmits the encrypted share Enc(B?) to the- 13 - 5013684. vl6200.2023001coordinator hospital 502a. The coordinator hospital 502a then generates a random vector C at step 528 and performs computations at step 534 using its retained secret share Ai, the received encrypted secret share Enc(72), and the encrypted random vector Enc(Q. An encrypted result of the computations 532 — encrypted vector Encfd') — is subsequently transmitted back to the local hospital 502b at step 534. In an aspect, using encryption in the example protocol 500 may ensure that the coordinator hospital 502b learns nothing about the local hospital’s 502b secret share Bi and using the random vector C may ensure that the local hospital 502b learns nothing about the coordinator hospital’s 502a secret share Ai during performance of the example protocol 500. Upon receiving the encrypted results 534, the local hospital 502b decrypts the vector Enc(A') at step 536 to compute a final sum at step 538. Finally, at step 542, the sum 538 is transmitted to the coordinator hospital 502a, which removes the random vector C and obtains the final result f of the dot product computation at step 544.

[0064] Example Compute Complexity

[0065] With reference to FIG. 5, in example steps 524a and 524b, the coordinator hospital 502a and local hospital 502b each compute a respective plain text dot product. In example step 526, the local hospital 502b performs just one FHE encryption operation to generate the encrypted share Enc(B2). In example step 532, the coordinator hospital 502a performs one FHE multiplication operation (z.e., HiEnc^)) and one FHE addition operation (i.e., diEncf / C) + Enc(Q). It should be noted that the FHE multiplication operation in step 532 is not followed by a relinearization operation, because the operation multiplies a plaintext (i.e., Ai) with a ciphertext (i.e., Enc(B2)) instead of multiplying two ciphertexts. Avoiding a relinearization operation in example step 532 makes the FHE multiplication operation lightweight. In example step 536, the local hospital 502b performs one FHE decryption operation. Then, in example steps 538 and 544, all operations are plaintext operations — i.e., A2B1 + A2B2 ++ C and a' + sum + sum of elements(C), respectively — which incurs very little computational overhead while performing FHE operations.

[0066] If the example of FIG. 5 were hypothetically implemented using only traditional FHE, the computational complexity would require n — or log n in the best case — FHE rotation operations. However, using only FHE is not feasible as a practical matter. This is because n, which in the example of FIG. 5 represents the number of patients, can have a value in, e.g., the millions. Such a large value would require the use of FHE rotation keys that occupy several terabytes (TB) of storage space. In turn, the multiple TB of rotation key data would need to be moved between on-chip memory and main memory, thereby severely degrading performance.- 14 - 5013684. vl6200.2023001Similarly, if the example of FIG. 5 were hypothetically implemented solely with conventional MPC, the computational complexity would be based on performing n OT operations and 3n public key encryption operations. The hypothetical MPC-only approach is thus impractical because of the need to perform, e.g., millions, of expensive OT and public key encryption operations. In contrast, an example embodiment eliminates both rotation and OT operations while requiring only a single public key encryption operation. This significantly reduces computational costs and makes an example embodiment a highly efficient alternative to existing FHE- and MPC-based approaches.

[0067] Example Communication Complexity

[0068] With reference to FIG. 5, in example steps 522a and 522b, the coordinator hospital 502a and local hospital 502b communicate once each to exchange vector shares^? andBi, respectively. In example steps 526 and 534, the coordinator hospital 502a and local hospital 502b communicate with each other once so that the coordinator hospital 502a can receive Enc B2) at step 526 and the local hospital can receive Enc(d') at step 534. In example step 542, the coordinator hospital 502a and local hospital 502b communicate with each other to exchange scalar values. Therefore, the overall complexity of the communication is < (l+w) using the example protocol 500. If, hypothetically, an existing MPC-based implementation alone were used, this leads to a communication complexity of O(3+n), because three vectors would need to be exchanged along with n OT transfers.

[0069] Example Method Embodiment

[0070] FIG. 6 is a flowchart of a method 600 of privacy-protecting computation across a plurality of computing nodes. The method 600 is computer-implemented and may be implemented using any computing device, e.g, a processor, or combination of computing devices known to those of skill in the art.

[0071] The method 600 begins at step 601 by partitioning private input data (e.g, the patient data 208 (FIG. 2)) into a plurality of secret shares. The private input data may be any suitable type(s) of data known in the art. Moreover, the private input data may be obtained from any suitable known data source, e.g., from users, computing nodes, organizations, enterprises, and / or other type(s) of entities. In an implementation, each of the plurality of secret shares may be allocated to a corresponding node of the plurality of computing nodes. According to an aspect, the secret shares may be such that no single node can reconstruct the private input data using only its own secret share. Next, at step 602, the plurality of secret shares is encrypted to produce a first set of ciphertexts (e.g., 414a (FIG. 4)). Each of the first set of ciphertexts is an encrypted- 15 - 5013684. vl6200.2023001representation of one or more of the plurality of secret shares. It should be noted that the number of ciphertexts may be the same as the number of secret shares, but may also be different from the number of secret shares. For example, ten secret shares may result in only five ciphertexts. In an implementation, a ratio of secret shares to ciphertexts may be configured based on one or more parameters of an FHE scheme. Continuing with the method 600, the first set of ciphertexts corresponds to a first portion of a combined dataset of the plurality of computing nodes. In turn, at step 603, the first set of ciphertexts is transmitted to at least one computing node (e.g., 402a (FIG. 4)) of the plurality of computing nodes. At step 604, a second set of ciphertexts (e.g., 414b (FIG. 4)) is then received from the at least one computing node (e.g, 402b (FIG. 4)). The second set of ciphertexts corresponds to a second portion of the combined dataset. According to an aspect, a given node of the plurality of computing nodes may be designated as a leader node that performs certain actions such as distributing the second set of ciphertexts. In an implementation, the second set of ciphertexts may instead be distributed by a trusted third party, for instance, when only two computing nodes are interacting with each other. Continuing with the method 600, at step 605, at least one workload operation of a workload computation (e.g, training the ML model 406 (FIG. 4)) to be performed using the received second set of ciphertexts is identified. Responsive to determining that a given workload operation of the at least one workload operation is expressible homomorphically, at step 606, the given workload operation is performed on at least one ciphertext of the received second set of ciphertexts. Responsive to determining that the given workload operation is not expressible homomorphically, at step 607: (1) a portion of the received second set of ciphertexts associated with the given workload operation is decrypted to produce a secret share; (2) a plaintext-domain operation is performed on the secret share to produce a processed share, which plaintext-domain operation corresponds to the given workload operation; and (3) the processed share is re-encrypted to generate a processed ciphertext. In turn, at step 608, a result ciphertext is output that represents a result of the workload computation. The method 600 thereby protects the private input data during the workload computation.

[0072] As noted, the method 600 is computer-implemented and, as such, the functionality and effective operations, e.g., the partitioning (601), encrypting (602), transmitting (603), receiving (604), identifying (605), performing (606), decrypting / performing / re-encrypting (607), and outputting (608), are automatically implemented by one or more digital processors. The method 600 can also be implemented using any computer device or combination of computing- 16 - 5013684. vl6200.2023001devices known in the art. Among other examples, the method 600 can be implemented using computer(s) / device(s) 50 and / or 60 described hereinbelow in relation to FIGS. 7 and 8.

[0073] In an example embodiment of the method 600, partitioning the private input data may include implementing an SS MPC protocol. According to one such embodiment, the SS MPC protocol may include Shamir’s Secret Sharing or additive secret sharing.

[0074] According to an example embodiment, the method 600 may further include aggregating ciphertexts received from the at least one computing node into a single packed ciphertext, thereby reducing communication overhead.

[0075] In an example embodiment, the method 600 may further include transmitting the received second set of ciphertexts to a TEE. The TEE may include a secure enclave. The method 600 may further include executing the workload computation inside the secure enclave. The portion of the received second set of ciphertexts may be decrypted within the secure enclave. The result ciphertext may be output from the secure enclave. The plaintext corresponding to the combined dataset may be confined within the secure enclave. According to one such embodiment, the secure enclave may include Intel SGX, AMD SEV, Arm TrustZone, another TEE platform, or a combination thereof. In another such embodiment, the TEE may be implemented in a cloud-based enclave hardware platform. The method 600 may further include transmitting the result ciphertext to the at least one computing node for post-processing, thereby masking intermediate plaintext.

[0076] According to an example embodiment of the method 600, the at least one workload operation may include at least one of (i) a dot product computation, (ii) a comparison operation, and (iii) a cardinality computation that is used to construct higher-level analytics functions.

[0077] In an example embodiment of the method 600, encrypting the plurality of secret shares may include implementing an FHE protocol using a public encryption parameter, e.g., a public encryption key. According to an aspect, a given node of the plurality of computing nodes may be designated as a leader node that provisions the public encryption parameter. In an implementation, the public encryption parameter may instead be provided by a trusted third party. According to one such embodiment, the FHE protocol may be a leveled BFV scheme. Decrypting the portion, performing the plaintext-domain operation, and re-encrypting the processed share may reduce ciphertext noise growth associated with bootstrapping.

[0078] Example Advantages and Applications

[0079] An example application of embodiments is in privacy-preserving data analytics platforms. Embodiments can allow organizations to analyze sensitive datasets without exposing- 17 - 5013684. vl6200.2023001raw data. Such capabilities are relevant to industries that include, e.g., healthcare, finance, and government, where compliance with strict data privacy regulations is often critical.

[0080] Similarly, embodiments can power secure collaborative computing services, thereby enabling multiple parties to compute on shared data without revealing individual contributions. Embodiments are thus useful for federated learning, supply chain management, and joint ventures, among other examples.

[0081] Another example application of embodiments lies in encrypted database management systems (DBMS) and privacy-enhanced AI / ML services. Embodiments can deliver solutions for secure query processing and AI / ML model training on encrypted data. Thus, embodiments are ideal for, e.g., cloud computing, legal compliance, and AI / ML-driven applications in sensitive domains like healthcare and finance.

[0082] Moreover, embodiments can enhance secure loT and edge computing, thereby ensuring privacy-preserving computations on devices in smart cities, industrial loT, and connected healthcare ecosystems, among other examples. By addressing the limitations of existing cryptographic and secure enclave technologies, embodiments also support the development of regulatory compliance tools, fraud detection systems, and encrypted cloud computing platforms. The innovations of embodiments ensure that data remains secure during processing while meeting stringent privacy requirements. Embodiments thus offer transformative technologies for industries seeking to balance privacy, performance, and scalability in their operations.

[0083] Embodiments provide advantages for numerous industries, including privacy, security, cloud computing, and data-driven industries, among other examples. For instance, cloud service providers can leverage embodiments to offer encrypted cloud computing platforms and privacy-preserving data analytics services. Such offerings in turn appeal to enterprises that wish to process sensitive workloads securely while ensuring compliance with data privacy regulations.

[0084] Cybersecurity companies can also use embodiments to enhance their products and services. For instance, embodiments can facilitate the development of secure data collaboration platforms for enterprises or fraud detection systems powered by privacy-preserving analytics.

[0085] Similarly, AI / ML and data analytics companies can integrate embodiments into privacy-enhanced AI / ML platforms, thereby enabling secure AL / ML model training and inference on encrypted data. These companies can also use embodiments to support secure federated learning services. By employing such services, multiple organizations can collaborate on data-driven projects without exposing their sensitive datasets.- 18 - 5013684. vl6200.2023001

[0086] Database and enterprise software providers can also adopt embodiments to create encrypted DBMS tailored for industries like finance, healthcare, and government. By doing so, these providers can offer privacy-preserving query processing and secure data sharing.

[0087] Moreover, loT and edge computing companies can use embodiments to build secure loT platforms for smart cities, industrial loT, and connected healthcare. By integrating privacypreserving capabilities into edge computing solutions, these companies can address the growing demand for secure processing in decentralized environments.

[0088] Embodiments offer advantages in the field of private data analytics as well. For example, financial companies face significant challenges, such as losses due to credit card fraud, which creates a need for advanced fraud detection solutions. Embodiments can facilitate fraud detection and secure multi-party computations without exposing sensitive financial information.

[0089] Similarly, healthcare providers rely on AI / ML models for tasks like effective disease diagnosis and treatment outcome prediction. These AI / ML models, however, depend on sensitive customer or patient data. Current practices involve anonymizing data or relying on third-party vendors. However, both of these approaches incur high costs and offer limited security guarantees. Embodiments deliver sophisticated, low-cost, zero-trust data analytics, which provides organizations with a secure and privacy-preserving way to utilize AI / ML-based insights effectively.

[0090] In the government and defense sectors, embodiments support secure data sharing and collaborative decision-making.

[0091] Moreover, embodiments offer advantages in the field of private data retrieval / sharing. This includes industries such as e-commerce and social media. Enterprises in these and other industries often encounter the same challenge of how to generate targeted advertising while preserving user privacy. Targeted advertising is a means of reaching the right audience with the right message at the right time. Doing so maximizes the relevance and effectiveness of the advertisers’ marketing efforts. However, targeted advertising may also give rise to privacy concerns and ethical considerations regarding topics such as data collection, user profiling, and ad personalization. Embodiments offer a solution that benefits targeted advertising by enabling information retrieval and processing of personal information in a privacy-preserving manner. This enables advertisers to conduct targeted ad campaigns without compromising user privacy.

[0092] Healthcare technology companies can leverage embodiments to develop tools for privacy-preserving analytics in patient data and clinical research. By employing such tools, healthcare organizations can analyze sensitive datasets securely, thereby advancing medical- 19 - 5013684. vl6200.2023001research while maintaining strict compliance with regulations like the Health Insurance Portability and Accountability Act (HIPAA).

[0093] Overall, their flexibility and robust security make embodiments a transformative technology for individuals and organizations across various industries.

[0094] Computer Support

[0095] FIG. 7 is a schematic view of a computer network in which embodiments may be implemented. Client computer(s) / devices 50 and server computer(s) 60 provide processing, storage, and input / output (I / O) devices executing application programs and the like. Client computer(s) / device(s) 50 can also be linked through communications network 70 to other computing devices, including other client device(s) / processor(s) 50 and server computer(s) 60. The communications network 70 can be part of a remote access network, a global network (e.g., the Internet), cloud computing servers or service, a worldwide collection of computers, local area or wide area networks, and gateways that currently use respective protocols (e.g., TCP / IP, Bluetooth®, etc.) to communicate with one another. Other electronic device / computer network architectures are also suitable.

[0096] FIG. 8 is a block diagram illustrating an example embodiment of a computer node (e.g., client processor(s) / device(s) 50 or server computer(s) 60) in the computer network 70 of FIG. 7. Each computer node 50, 60 contains system bus 79, where a bus is a set of hardware lines used for data transfer among components of a computer or processing system. The system bus 79 is essentially a shared conduit that connects different elements of a computer system (e.g., processor, disk storage, memory, I / O ports, network ports, etc.) that enables transfer of information between the elements. Attached to the system bus 79 is an I / O devices interface 82 for connecting various input and output devices (e.g., keyboard, mouse, display(s), printer(s), speaker(s), etc.) to the computer node 50, 60. A network interface 86 allows the computer node to connect to various other devices attached to a network (e.g., the network 70 of FIG. 7). A memory 90 provides volatile storage for computer software instructions 92a and data 94a used to implement embodiments of the present disclosure (e.g., the method 600 of FIG. 6, etc.). A disk storage 95 provides non-volatile storage for the computer software instructions 92b and data 94b used to implement an embodiment of the present disclosure. A central processor unit 84 is also attached to the system bus 79 and provides for execution of computer instructions.

[0097] In an embodiment, the processor routines 92a-92b and data 94a-94b are a computer program product (generally referenced as 92), including a non-transitory, computer readable medium (e.g., a removable storage medium such as DVD-ROM(s), CD-ROM(s), diskette(s),- 20 - 5013684. vl6200.2023001tape(s), etc.) that provides at least a portion of the software instructions for the disclosure system. The computer program product 92 can be installed by any suitable software installation procedure, as is well known in the art. In another embodiment, at least a portion of the software instructions may also be downloaded over a cable, communication, and / or wireless connection. In other embodiments, the disclosure programs are a computer program propagated signal product embodied on a propagated signal on a propagation medium (e.g., a radio wave, an infrared wave, a laser wave, a sound wave, or an electrical wave propagated over a global network such as the Internet, or other network(s)). Such carrier medium or signals provide at least a portion of the software instructions for the present disclosure routines / program 92.

[0098] In alternative embodiments, the propagated signal is an analog carrier wave or digital signal carried on the propagated medium. For example, the propagated signal may be a digitized signal propagated over a global network (e.g., the Internet), a telecommunications network, or other networks (such as the network 70 of FIG. 7). In one embodiment, the propagated signal is a signal that is transmitted over the propagation medium over a period of time, such as the instructions for a software application sent in packets over a network over a period of milliseconds, seconds, minutes, or longer. In another embodiment, the computer readable medium of the computer program product 92 is a propagation medium that the computer system 50 may receive and read, such as by receiving the propagation medium and identifying a propagated signal embodied in the propagation medium, as described above for computer program propagated signal product.

[0099] Generally speaking, the term “carrier medium” or transient carrier encompasses the foregoing transient signals, propagated signals, propagated medium, storage medium, and the like.

[0100] In other embodiments, the program product 92 may be implemented as a so-called Software as a Service (SaaS), or other installation or communication supporting end-users.

[0101] Embodiments or aspects thereof may be implemented in the form of hardware including but not limited to hardware circuitry, firmware, or software. If implemented in software, the software may be stored on any non-transient computer readable medium that is configured to enable a processor to load the software or subsets of instructions thereof. The processor then executes the instructions and is configured to operate or cause an apparatus to operate in a manner as described herein.

[0102] Further, hardware, firmware, software, routines, or instructions may be described herein as performing certain actions and / or functions of the data processors. However, it should- 21 - 5013684. vl6200.2023001be appreciated that such descriptions contained herein are merely for convenience and that such actions in fact result from computing devices, processors, controllers, or other devices executing the firmware, software, routines, instructions, etc.

[0103] It should be understood that the flow diagrams, block diagrams, and network diagrams may include more or fewer elements, be arranged differently, or be represented differently. But it further should be understood that certain implementations may dictate the block and network diagrams and the number of block and network diagrams illustrating the execution of the embodiments be implemented in a particular way.

[0104] Accordingly, further embodiments may also be implemented in a variety of computer architectures, physical, virtual, cloud computers, and / or some combination thereof, and, thus, the data processors described herein are intended for purposes of illustration only and not as a limitation of the embodiments.

[0105] The teachings of all patents, published applications, and references cited herein are incorporated by reference in their entirety.

[0106] While example embodiments have been particularly shown and described, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the scope of the embodiments encompassed by the appended claims.- 22 - 5013684. vl

Claims

6200.2023001CLAIMSWhat is claimed is:

1. A computer-implemented method of privacy-protecting computation across a plurality of computing nodes, the method comprising:partitioning private input data into a plurality of secret shares;encrypting the plurality of secret shares to produce a first set of ciphertexts, each of the first set of ciphertexts being an encrypted representation of one or more of the plurality of secret shares, the first set of ciphertexts corresponding to a first portion of a combined dataset of the plurality of computing nodes;transmitting the first set of ciphertexts to at least one computing node of the plurality of computing nodes;receiving, from the at least one computing node, a second set of ciphertexts, the second set of ciphertexts corresponding to a second portion of the combined dataset; identifying at least one workload operation of a workload computation to be performed using the received second set of ciphertexts;responsive to determining that a given workload operation of the at least one workload operation is expressible homomorphically, performing the given workload operation on at least one ciphertext of the received second set of ciphertexts;responsive to determining that the given workload operation is not expressible homomorphically:decrypting a portion of the received second set of ciphertexts associated with the given workload operation to produce a secret share;performing a plaintext-domain operation on the secret share to produce a processed share, the plaintext-domain operation corresponding to the given workload operation; andre-encrypting the processed share to generate a processed ciphertext; and outputting a result ciphertext representing a result of the workload computation, thereby protecting the private input data during the workload computation.

2. The method of claim 1, wherein partitioning the private input data includes implementing a secret-sharing (SS) multi-party computation (MPC) protocol.- 23 - 5013684. vl6200.20230013. The method of claim 2, wherein the SS MPC protocol includes Shamir’s Secret Sharing or additive secret sharing.

4. The method of claim 1, further comprising aggregating ciphertexts received from the at least one computing node into a single packed ciphertext, thereby reducing communication overhead.

5. The method of claim 1, further comprising:transmitting the received second set of ciphertexts to a Trusted Execution Environment (TEE), the TEE including a secure enclave; andexecuting the workload computation inside the secure enclave;wherein the portion of the received second set of ciphertexts is decrypted within the secure enclave;wherein the result ciphertext is output from the secure enclave; and wherein plaintext corresponding to the combined dataset is confined within the secure enclave.

6. The method of claim 5, wherein the secure enclave includes Intel® Software Guard Extensions (SGX), AMD Secure Encrypted Virtualization (SEV), Arm® TrustZone®, another TEE platform, or a combination thereof.

7. The method of claim 5, wherein the TEE is implemented in a cloud-based enclave hardware platform, and further comprising:transmitting the result ciphertext to the at least one computing node for postprocessing, thereby masking intermediate plaintext.

8. The method of claim 1, wherein the at least one workload operation includes at least one of (i) a dot product computation, (ii) a comparison operation, and (iii) a cardinality computation that is used to construct higher-level analytics functions.

9. The method of claim 1, wherein encrypting the plurality of secret shares includes implementing a fully homomorphic encryption (FHE) protocol using a public encryption parameter.

10. The method of claim 9, wherein the FHE protocol is a leveled Brakerski / Fan-Vercauteren (BFV) scheme, and wherein decrypting the portion, performing the plaintext-domain- 24 - 5013684. vl6200.2023001operation, and re-encrypting the processed share reduce ciphertext noise growth associated with bootstrapping.

11. The method of claim 1, further comprising:recording, in an immutable audit log, attested metadata describing at least one event relating to decrypting the portion, performing the plaintext-domain operation, and re-encrypting the processed share, the attested metadata including at least a timestamp, a type of plaintext-domain operation performed, and a unique identifier for the processed ciphertext.

12. A computer-based system for privacy-protecting computation across a plurality of computing nodes, the system comprising:at least one processor; anda memory with computer code instructions stored thereon, the least one processor and the memory, with the computer code instructions, being configured to cause the system to:partition private input data into a plurality of secret shares;encrypt the plurality of secret shares to produce a first set of ciphertexts, each of the first set of ciphertexts being an encrypted representation of one or more of the plurality of secret shares, the first set of ciphertexts corresponding to a first portion of a combined dataset of the plurality of computing nodes;transmit the first set of ciphertexts to at least one computing node of the plurality of computing nodes;receive, from the at least one computing node, a second set of ciphertexts, the second set of ciphertexts corresponding to a second portion of the combined dataset;identify at least one workload operation of a workload computation to be performed using the received second set of ciphertexts;responsive to determining that a given workload operation of the at least one workload operation is expressible homomorphically, perform the given workload operation on at least one ciphertext of the received second set of ciphertexts;responsive to determining that the given workload operation is not expressible homomorphically:- 25 - 5013684. vl6200.2023001decrypt a portion of the received second set of ciphertexts associated with the given workload operation to produce a secret share;perform a plaintext-domain operation on the secret share to produce a processed share, the plaintext-domain operation corresponding to the given workload operation; andre-encrypt the processed share to generate a processed ciphertext; andoutput a result ciphertext representing a result of the workload computation, thereby protecting the private input data during the workload computation.

13. The system of claim 12, where, in partitioning the private input data, the at least one processor and the memory, with the computer code instructions, are configured to cause the system to:implement a secret-sharing (SS) multi-party computation (MPC) protocol.

14. The system of claim 13, wherein the SS MPC protocol includes Shamir’s Secret Sharing or additive secret sharing.

15. The system of claim 12, wherein the at least one processor and the memory, with the computer code instructions, are further configured to cause the system to:aggregate ciphertexts received from the at least one computing node into a single packed ciphertext, thereby reducing communication overhead.

16. The system of claim 12, wherein the at least one processor and the memory, with the computer code instructions, are further configured to cause the system to:transmit the received second set of ciphertexts to a Trusted Execution Environment (TEE), the TEE including a secure enclave; andexecute the workload computation inside the secure enclave;wherein the portion of the received second set of ciphertexts is decrypted within the secure enclave;wherein the result ciphertext is output from the secure enclave; and wherein plaintext corresponding to the combined dataset is confined within the secure enclave.- 26 - 5013684. vl6200.202300117. The system of claim 16, wherein the secure enclave includes Intel® Software Guard Extensions (SGX), AMD Secure Encrypted Virtualization (SEV), Arm® TrustZone®, another TEE platform, or a combination thereof.

18. The system of claim 16, wherein the TEE is implemented in a cloud-based enclave hardware platform, and wherein the at least one processor and the memory, with the computer code instructions, are further configured to cause the system to:transmit the result ciphertext to the at least one computing node for postprocessing, thereby masking intermediate plaintext.

19. The system of claim 12, wherein the at least one workload operation includes at least one of (i) a dot product computation, (ii) a comparison operation, and (iii) a cardinality computation that is used to construct higher-level analytics functions.

20. The system of claim 12, where, in encrypting the plurality of secret shares, the at least one processor and the memory, with the computer code instructions, are configured to cause the system to:implement a fully homomorphic encryption (FHE) protocol using a public encryption parameter.

21. The system of claim 20, wherein the FHE protocol is a leveled Brakerski / Fan- Vercauteren (BFV) scheme, and wherein decrypting the portion, performing the plaintext-domain operation, and re-encrypting the processed share reduce ciphertext noise growth associated with bootstrapping.

22. The system of claim 12, wherein the at least one processor and the memory, with the computer code instructions, are further configured to cause the system to:record, in an immutable audit log, attested metadata describing at least one event relating to decrypting the portion, performing the plaintext-domain operation, and reencrypting the processed share, the attested metadata including at least a timestamp, a type of plaintext-domain operation performed, and a unique identifier for the processed ciphertext.

23. A computer program product for privacy-protecting computation across a plurality of computing nodes, the computer program product comprising a non-transitory computer- readable medium with computer code instructions stored thereon, the computer code- 27 - 5013684. vl6200.2023001instructions being configured, when executed by a processor, to cause an apparatus associated with the processor to:partition private input data into a plurality of secret shares;encrypt the plurality of secret shares to produce a first set of ciphertexts, each of the first set of ciphertexts being an encrypted representation of one or more of the plurality of secret shares, the first set of ciphertexts corresponding to a first portion of a combined dataset of the plurality of computing nodes;transmit the first set of ciphertexts to at least one computing node of the plurality of computing nodes;receive, from the at least one computing node, a second set of ciphertexts, the second set of ciphertexts corresponding to a second portion of the combined dataset; identify at least one workload operation of a workload computation to be performed using the received second set of ciphertexts;responsive to determining that a given workload operation of the at least one workload operation is expressible homomorphically, perform the given workload operation on at least one ciphertext of the received second set of ciphertexts;responsive to determining that the given workload operation is not expressible homomorphically:decrypt a portion of the received second set of ciphertexts associated with the given workload operation to produce a secret share;perform a plaintext-domain operation on the secret share to produce a processed share, the plaintext-domain operation corresponding to the given workload operation; andre-encrypt the processed share to generate a processed ciphertext; and output a result ciphertext representing a result of the workload computation, thereby protecting the private input data during the workload computation.

24. The computer program product of claim 23, where, in partitioning the private input data, the computer code instructions, when executed by the processor, cause the apparatus associated with the processor to:implement a secret-sharing (SS) multi-party computation (MPC) protocol.

25. The computer program product of claim 24, wherein the SS MPC protocol includes Shamir’s Secret Sharing or additive secret sharing.- 28 - 5013684. vl6200.202300126. The computer program product of claim 23, wherein the computer code instructions are further configured, when executed by the processor, to cause the apparatus associated with the processor to:aggregate ciphertexts received from the at least one computing node into a single packed ciphertext, thereby reducing communication overhead.

27. The computer program product of claim 23, wherein the computer code instructions are further configured, when executed by the processor, to cause the apparatus associated with the processor to:transmit the received second set of ciphertexts to a Trusted Execution Environment (TEE), the TEE including a secure enclave; andexecute the workload computation inside the secure enclave;wherein the portion of the received second set of ciphertexts is decrypted within the secure enclave;wherein the result ciphertext is output from the secure enclave; and wherein plaintext corresponding to the combined dataset is confined within the secure enclave.

28. The computer program product of claim 27, wherein the secure enclave includes Intel® Software Guard Extensions (SGX), AMD Secure Encrypted Virtualization (SEV), Arm® TrustZone®, another TEE platform, or a combination thereof.

29. The computer program product of claim 27, wherein the TEE is implemented in a cloudbased enclave hardware platform, and wherein the computer code instructions are further configured, when executed by the processor, to cause the apparatus associated with the processor to:transmit the result ciphertext to the at least one computing node for postprocessing, thereby masking intermediate plaintext.

30. The computer program product of claim 23, wherein the at least one workload operation includes at least one of (i) a dot product computation, (ii) a comparison operation, and (iii) a cardinality computation that is used to construct higher-level analytics functions31. The computer program product of claim 23, where, in encrypting the plurality of secret shares, the computer code instructions, when executed by the processor, cause the apparatus associated with the processor to:- 29 - 5013684. vl6200.2023001implement a fully homomorphic encryption (FHE) protocol using a public encryption parameter.

32. The computer program product of claim 31, wherein the FHE protocol is a leveled Brakerski / Fan-Vercauteren (BFV) scheme, and wherein decrypting the portion, performing the plaintext-domain operation, and re-encrypting the processed share reduce ciphertext noise growth associated with bootstrapping.

33. The computer program product of claim 23, wherein the computer code instructions are further configured, when executed by the processor, to cause the apparatus associated with the processor to:record, in an immutable audit log, attested metadata describing at least one event relating to decrypting the portion, performing the plaintext-domain operation, and reencrypting the processed share, the attested metadata including at least a timestamp, a type of plaintext-domain operation performed, and a unique identifier for the processed ciphertext.5013684. vl

Images