Microsoft Technology Licensing, LLC

Michael Naehrig

Kristin E Lauter

Ran Gilad-Bachrach

Kim Laine

John Wernsing

Nathan Dowlin

David Junzi Wu

Joppe Willem Bos

Jacob J Loftus

Tony Feng

Peter L Montgomery

Vinod Vaikuntanathan

Adriana Lopez-Alt

Elisabeth Malmskog

Kristin Estella Lauter

The subject disclosure is directed towards secure computations of encrypted data over a network. In response to user desired security settings with respect to the encrypted data, software/hardware library components automatically select parameter data for configuring a fully homomorphic encryption scheme to secure the encrypted data items while executing a set of computational operations. A client initiates the set of computational operations via the library components and if requested, receives secure computation results in return.

Managed secure computations on encrypted data

The techniques and/or systems described herein are directed to improvements in homomorphic encryption to improve processing speed and storage requirements. For example, the techniques and/or systems can be used on a client device to encode data to be sent to a remote server, to be operated on while maintaining confidentiality of data. For example, data including a real number can be encoded as a polynomial, with the fractional part of the real number encoded as high-order coefficients in the polynomial. Further, real numbers can be approximated and encoded in a polynomial using a fractional base, and/or the encoding can include slot encoding. Thus, the optimized encodings disclosed herein provide an optimized homomorphic encryption scheme.

Homomorphic encryption with optimized encoding

The techniques and/or systems described herein are directed to improvements in homomorphic encryption to improve processing speed and storage requirements. For example, the techniques and/or systems can be used on a client device to encode data to be sent to a remote server, to be operated on while maintaining confidentiality of data. The encoding scheme can be optimized by automatically selecting one or more parameters using an error growth simulator based on an actual program that operates on the encoded data. For example, the simulator can be used iteratively to determine an optimized parameter set which allows for improved homomorphic operations while maintaining security and confidentiality of a user's data.

Homomorphic encryption with optimized parameter selection

The techniques and/or systems described herein are directed to improvements in homomorphic operations within a homomorphic encryption scheme. The homomorphic operations may be performed on encrypted data received from a client device without decrypting the data at a remote computing device, thereby maintaining the confidentiality of the data. In addition to the operations of addition, subtraction, and multiplication, the homomorphic operations may include an approximate division, a sign testing, a comparison testing, and an equality testing. By combining these operations, a user may perform optimized operations with improved processor and memory requirements.

Homomorphic encryption with optimized homomorphic operations

A user device and one or more server computers securely evaluate a k-nearest neighbor model, with reasonable computation speed and bandwidth utilization, using a combination of techniques. The user device encrypts input vectors using a client's public key to keep client information private. The server computer homomorphically computes a distance between the encrypted input vector and vectors stored in the k-nearest neighbor model. The server computer then engages in a minimization process which results in the user device receiving classification vectors corresponding to the k-nearest neighbors.

Secure computer evaluation of k-nearest neighbor models

Decision trees can be securely evaluated with reasonable computation speed and bandwidth utilization. A user device encrypts input vectors using a client's public key in an additively homomorphic encryption system. A server computer effectively randomizes the decision tree for each use, such that a value indicative of a path resulting from applying an input vector to the decision tree is different each time the decision tree is used. The server computer homomorphically computes the evaluations of each decision node. The server computer provides the value indicative of the path through the decision tree as one part accessible by the client, and another part accessible by the server. The server computer uses the parts to look up a corresponding output value from a database of output values for each path. In this operation, only the output value corresponding to the combined parts can be retrieved, and only by the intended recipient.

Secure computer evaluation of decision trees

Genomic data encryption embodiments are presented which generally maintain the privacy of genomic data via an encryption scheme which allows computations to be performed on the encrypted data without the need for decryption. The genomic data is encrypted using a homomorphic polynomial encryption scheme to produce a vector of ciphertexts, where each ciphertext represents a different sample of the genomic data and takes the form of a polynomial and its associated coefficients. Computations on the encrypted genomic data are then performed on the vector or vectors of ciphertexts without decrypting the data. The results of the computations are then provided to an end user who decrypts them.

Encrypting genomic data for storage and genomic computations

Representations of polynomials a, s, t, eand ecan be provided. Values of coefficients of the polynomials can be limited, and can be computed using randomization techniques. A verification key can be generated to include representations of polynomials a, b, and c. Computation of b can include computing a product using a and s, and adding e. Computation of c can include computing a product using a and t, and adding e. A signing key can represent s and t. The signing key can be used to produce a message signature that can represent a sum of t and a product of s and m, with m being derived from a message to be signed. The verification key can be used to verify the signature by checking coefficient sizes of a polynomial represented by the signature, and of a checking polynomial derived from the verification key and the signature.

Digital signatures with error polynomials

One or more techniques and/or systems are disclosed that provide for determining mathematical pairings for a curve for use in cryptography. A plurality of inversions used for determining the mathematical pairings for the curve are aggregated (e.g., into a single inversion in respective levels of a binary tree representation of elements of the computation). The mathematical pairings for the curve are determined in affine coordinates from a binary representation of a scalar read from right to left using the aggregated plurality of inversions.

Growing community of inventors

Sammamish, WA, United States of America

Michael Naehrig