Homomorphic Encryption Decryption via Secure Element Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current homomorphic encryption methods require the device to be online for decryption of results, leading to inefficiencies and potential stalls if the device is offline or has only a one-way connection, especially in low-bandwidth IoT scenarios, as they necessitate additional computational effort and a round trip for secure communication.
Innovation Solution
A method utilizing a keyed-hash message authentication code (HMAC) One-Time-Password (HOTP) token combined with Secure Element (SE) based secure key storage and result metadata allows the cloud server to decrypt only the final result of homomorphically encrypted computations, preventing arbitrary data decryption and enabling secure, direct decryption in the cloud.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the device stores decryption keys and performs decryption locally, then data privacy is maintained, but the device must be online and available, causing delays and potential stalls
Solution Approach 1:
The decryption capability is extracted from the electronic device and transferred to the cloud server. The secret key is stored in a secure element within the cloud server, allowing decryption to occur locally in the cloud without requiring the electronic device to be online or perform computational decryption operations.
Solution Approach 2:
A secure element acting as an intermediary is introduced within the cloud server. This secure element securely stores the secret key and mediates the decryption process, enabling the cloud server to decrypt results without the electronic device needing to maintain an online connection or possess the decryption key.
2Reliability
If the device performs decryption operations, then security is maintained, but additional computational effort and round trips are required
Solution Approach 1:
The cloud server performs decryption operations autonomously using the secret key stored in its own secure element. The system serves itself by enabling the cloud infrastructure to decrypt results without requiring the electronic device to initiate or perform decryption operations, eliminating the need for secure key transmission and additional authentication round trips.
3Loss of energy
If one-way connection is used for IoT devices, then bandwidth is reduced, but decryption becomes impossible without device online availability
Solution Approach 1:
The decryption capability is extracted from the electronic device and relocated to the cloud server. This allows IoT devices with one-way connections to transmit only encrypted results and metadata to the cloud, where decryption occurs locally without requiring the device to be online or to initiate additional communication rounds.
Solution Approach 2:
The secret key is pre-loaded into the secure element within the cloud server during system setup. This preliminary action enables the cloud server to perform decryption operations autonomously without requiring real-time key provisioning or device online presence, making the system compatible with one-way IoT connections.
Data Source
AI summary
A method and electronic device are provided for decrypting homomorphically encrypted (HE) data. The method may include generating, in the electronic device, result metadata that specifies a size of the HE data to be decrypted. The electronic device generates or collects HE input data and the result metadata. The HE input data and the encrypted result metadata are transmitted to a cloud server in a cloud environment to allow the cloud server to perform computations using the HE input data. The cloud server is enabled by the hardware device to send a result of the computations on the HE input data to a secure element (SE) for decryption. A relatively secure online connection is established to the SE in the cloud environment. The SE is enabled by the electronic device to decrypt the result of the computations on the HE input data as specified by the result metadata.