Homomorphic Encryption Server with Masking and Secure Enclave
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing homomorphic encryption systems suffer from increased computation time and inadequate data confidentiality during client-server interactions, particularly when executing confidential functions on encrypted data.
Innovation Solution
A computer server system utilizing homomorphic encryption and secure enclaves (TEE) to process encrypted requests, where the server performs homomorphic operations on encrypted identifiers, and a masking module generates a mask that is processed in a secure client enclave to execute the file in clear text, ensuring confidentiality and improved performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If homomorphic encryption is used to process encrypted data on the server, then data confidentiality is improved, but computation time increases
Solution Approach 1:
The system divides the computation into two segments: server-side homomorphic operations on encrypted identifiers (for confidentiality) and client-side decryption/execution in secure enclaves (for performance). This segmentation allows each party to perform operations optimized for their constraints, resolving the contradiction between confidentiality and computation time.
Solution Approach 2:
Secure enclaves act as an intermediary between the server and client, enabling the client to execute files in a protected environment. This intermediary allows the server to maintain confidentiality through homomorphic encryption while the client benefits from fast local execution, thus resolving the time-confinement contradiction.
2Productivity
If the server executes files directly, then computing performance is improved, but data confidentiality deteriorates
Solution Approach 1:
Instead of the server executing files directly (conventional approach), the system inverts the paradigm by having the client execute files in secure enclaves. This inversion allows the server to remain confidential while the client achieves fast execution, resolving the contradiction between performance and confidentiality.
Solution Approach 2:
The system creates a copy of the file in encrypted form on the server, which is then decrypted and executed in the client's secure enclave. This copying mechanism allows the server to maintain confidentiality while the client executes a functional copy for high-performance computation.
3Reliability
If homomorphic encryption is applied to all data processing, then confidentiality is improved, but device complexity increases
Solution Approach 1:
The system applies homomorphic encryption only locally to identifiers and metadata on the server side, while bulk data processing occurs in secure enclaves on the client side. This localized application of encryption reduces overall system complexity while maintaining confidentiality where it is most critical.
Solution Approach 2:
The client's secure enclave performs self-service decryption and execution without requiring the server to manage complex encryption/decryption operations. This self-service approach simplifies the server's role while maintaining strong confidentiality, reducing device complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This computer server (12) comprises: - a database (20) of computer files; - a management module (22) for receiving a request ([ReqF]) containing a first identifier of a client device (14) and a second identifier of a file (F) of the database (20), the second identifier included in the request ([ReqF]) having been encrypted via a homomorphic encryption algorithm; then for applying a homomorphic operation to the request to deliver an encrypted file ([F]); and - a masking module (24) for receiving the encrypted file ([F]); for generating a mask (M); for delivering an encrypted file ([F+M]) of a combination of the file (F) and the mask; and to transmit the mask to a secure client enclave (34) included in the client equipment (14), the enclave being adapted to receive the combination (F+M) of the file and the mask, then to remove the mask for the implementation of the file.