Virtual Execution Environment for Encrypted Data Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Homomorphic encryption schemes are inefficient due to large encrypted data sizes, making them impractical for real-world systems despite their high reliability.
Innovation Solution
A calculation device and method that constructs a virtual execution environment for encrypted data processing, decrypting the data within this environment for efficient calculation and then encrypting the result, while ensuring security by limiting access and discarding the environment after use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If homomorphic encryption scheme is used to perform calculation on encrypted data, then data security is improved, but processing efficiency deteriorates due to extremely large encrypted data sizes
Solution Approach 1:
The system segments the encryption process into two distinct phases: initial encryption of data before transmission to the cloud server, and subsequent decryption and re-encryption operations within a temporary virtual machine. This segmentation allows the cloud server to work with smaller decrypted data portions rather than processing entire large encrypted datasets, thereby improving processing efficiency while maintaining security through the temporary virtual machine isolation.
Solution Approach 2:
A temporary virtual machine acts as an intermediary between the client and the cloud server. The virtual machine receives encrypted data, decrypts it using a decryption key, performs calculations on the decrypted data, and then encrypts the results before returning them to the cloud server. This intermediary mechanism enables efficient processing by working with decrypted data locally while maintaining security through the isolated virtual environment.
2Reliability
If homomorphic encryption is applied to maintain high reliability in encrypted data processing, then data protection is improved, but device complexity increases due to enormous calculation requirements
Solution Approach 1:
The decryption operation is extracted from the cloud server environment and moved to a temporary virtual machine running on the client side. This extraction reduces the calculation complexity burden on the cloud server by performing decryption locally where computational resources are more abundant, while the cloud server only needs to handle the encrypted data transmission and final encryption operations.
Solution Approach 2:
The patent employs a temporary virtual machine that is created, used, and then destroyed after the calculation task is completed. This disposable virtual machine approach eliminates the need for persistent complex encryption infrastructure on the cloud server, reducing overall system complexity while maintaining security through the temporary isolated environment that automatically disappears after use.
3Reliability
If encrypted data is processed directly in cloud server, then security is improved, but calculation speed decreases due to large data sizes
Solution Approach 1:
Instead of the cloud server decrypting and processing large encrypted datasets directly, the system inverts the approach by having the client-side virtual machine decrypt the data and perform calculations locally. This inversion transfers the computationally intensive decryption and calculation operations from the cloud server to the client, significantly improving calculation speed while the cloud server maintains security by only handling encrypted data transmission.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Provided with a calculation device capable of calculating an encrypted data efficiently. A calculation device of the present invention is a device for performing a calculation for an encryption data in a virtual execution environment protected from a standard execution environment, the calculation device has a virtual execution environment construction unit for constructing the virtual execution environment, and the virtual execution environment includes: an encryption data acquisition unit for acquiring the encryption data; a source code acquisition unit for acquiring a source code for the calculation; a key acquisition unit for acquiring the system key; a decryption unit for decrypting the encryption data by the acquired system key; a source code execution unit for executing the source code; an encryption unit for encrypting a calculation result to which the source code is executed by the system key; and a calculation result providing unit for providing the encrypted calculation result to the standard execution environment.