Homomorphic Encryption Task Segmentation for TEE Security and Performance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing homomorphic encryption technologies face challenges in achieving a practical balance between security and performance, with trusted execution environments (TEE) offering performance improvements but being vulnerable to side channel attacks and dependent on hardware manufacturers.
Innovation Solution
A confidential computing-based method that customizes security and performance by dividing computing tasks into multiple levels, allocating resources dynamically, and executing tasks within and outside the trusted execution environment based on user-defined parameters, ensuring optimal balance between security and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If TEE technology is used to accelerate homomorphic computing, then computing performance is greatly improved, but security is compromised due to side channel attack vulnerabilities
Solution Approach 1:
The patent segments the homomorphic computing task into two parts: security-sensitive operations are executed outside TEE using pure software homomorphic encryption, while non-security-critical operations are executed inside TEE for performance acceleration. This segmentation allows the system to simultaneously achieve both security and performance by assigning different operations to different execution environments based on their security requirements.
2Reliability
If pure software homomorphic encryption is used, then security is maintained, but computing performance remains low
Solution Approach 1:
The patent divides the computing workload into security-critical and non-security-critical components. Non-security-critical operations are offloaded to TEE hardware acceleration, while security-critical operations remain in pure software. This segmentation enables the system to achieve high performance without compromising security by strategically placing different operations in appropriate execution environments.
3Reliability
If all computing tasks are executed outside TEE, then security is maximized, but performance requirements cannot be satisfied
Solution Approach 1:
The patent applies local quality by assigning different execution qualities to different parts of the computing task. Security-critical operations receive the highest security quality (executed outside TEE), while non-security-critical operations receive performance-optimized quality (executed inside TEE). This localized quality assignment allows the system to optimize overall performance while maintaining maximum security where required.
4Productivity
If TEE is used for all operations, then performance is optimized, but dependency on hardware manufacturers and side channel attacks increase
Solution Approach 1:
The patent extracts security-critical operations from the TEE environment and executes them in pure software homomorphic encryption. This extraction removes the vulnerability to side channel attacks from the security-sensitive parts of the system while retaining TEE acceleration for non-security-critical operations, thereby reducing overall dependency on hardware manufacturers and mitigating side channel attack risks.
Data Source
AI summary
Provided is a confidential computing-based method for customizedly balancing between security and performance of homomorphic encryption, including the following steps: receiving a computing task, security and performance custom parameters, and encrypted computing data; when a user performs security customization, dividing the computing data into multiple security levels according to the security custom parameters, and according to the security levels of data involved in computing, executing partial corresponding computing task outside a trusted execution environment, and executing partial computing task in the trusted execution environment; when the user performs performance customization, dynamically allocating resources according to the performance custom parameters, executing partial computing task in the trusted execution environment, and executing partial computing task outside the trusted execution environment; and finally, returning a computing result to a request side.


