Homomorphic Encryption Key Partitioning via Trusted Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing fully homomorphic encryption schemes rely on unproven computational hardness assumptions and are impractical due to high computation time and ciphertext size, while white-box cryptography schemes face generic and efficient attacks despite updates, lacking the ability to implement white-box cryptography with a single key for all input and output data.
Innovation Solution
A method where a trusted entity with higher security and slower processing speed generates and transmits parts of the encryption and decryption keys to a computing entity with lower security but higher speed, allowing the computing entity to encrypt and decrypt parts of the data using a transformed function, and adding redundancy to the input ciphertext for processing, enabling white-box cryptography execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If fully homomorphic encryption schemes are used to process encrypted data, then data security is improved, but computation time and ciphertext size become too large to be practical
Solution Approach 1:
The system divides the cryptographic keys into multiple parts, distributing them between the trusted entity and computing entity. This segmentation allows the computing entity to perform operations on encrypted data without possessing the complete decryption key, thereby maintaining security while enabling practical computation.
Solution Approach 2:
The trusted entity acts as an intermediary that holds parts of the cryptographic keys and provides cryptographic services to the computing entity. This intermediary structure enables secure encrypted data processing by the computing entity without requiring it to have full access to decryption capabilities.
2Ease of operation
If white-box cryptography schemes are used with a single key for all input and output data, then ease of operation is improved, but security becomes vulnerable to generic and efficient attacks
Solution Approach 1:
The cryptographic key is segmented into multiple parts, with different parts held by different entities (trusted entity and computing entity). This segmentation prevents any single entity from having complete control over the cryptographic operations, thereby resisting generic attacks while maintaining operational simplicity through the transformed function.
Solution Approach 2:
Different parts of the cryptographic system have different security properties. The trusted entity holds secure key parts, while the computing entity performs operations with limited key access. This local differentiation of security qualities allows the system to achieve both ease of operation and resistance to attacks.
3Reliability
If the trusted entity performs all cryptographic operations, then security level is improved, but processing speed decreases due to slower processing capability
Solution Approach 1:
The cryptographic workload is segmented between two entities: the trusted entity performs key management and holds secure key parts, while the computing entity performs the actual cryptographic operations on encrypted data. This segmentation allows fast processing by the computing entity while maintaining high security through the trusted entity's key control.
Solution Approach 2:
The trusted entity serves as an intermediary that enables the computing entity to perform fast cryptographic operations without compromising security. The trusted entity provides the necessary key parts and verification mechanisms, allowing the computing entity to process data at high speed while the trusted entity maintains overall security control.
Data Source
Figure 1~2
Figure 3a~3d
Figure 4
AI summary
A method for executing a cryptography scheme with a computing entity and a trusted entity is proposed, the method serving as a fully homomorphic encryption or a white-box cryptography method, the method comprising: transforming, at the trusted entity, a function P using a transformation P → T to a transformed function T (101), wherein the function P is adapted to calculate an output plaintext from an input plaintext, wherein the transformed function T is adapted to calculate an output ciphertext from an input ciphertext (104), wherein the transformation P → T includes calculating an encryption key for encrypting the input plaintext, and calculating a decryption key for decrypting the output ciphertext, wherein there is an ambiguity in the ciphertexts, such that one input ciphertext and the corresponding output ciphertext can be assigned to more than one input plaintext and the corresponding output plaintext of the function P, wherein the encryption and decryption keys may be calculated by the transformation P → T.