a590003

Using Homomorphic Encryption for
Large Scale Statistical Analysis
CURIS 2012
David Wu and Jacob Haven
Advised by Professor Dan Boneh
Medical Records
from Hospital A
Medical Records
from Hospital B
Medical Records
from Hospital C
Motivation
Cloud-based solutions have become increasingly popular in the past few
years. An example of the cloud-based model is shown below. Here, three different
hospitals provide data to the cloud. The cloud computing platform then
analyzes and extracts useful information from the data.
Cloud
Computing
Platform
Statistical Analysis
of Medical Data
One of the main concern with cloud computing has been the privacy and confidentiality
of the data. One solution is to send the data encrypted to the cloud.
However, we still need to support useful computations on the encrypted data.
Fully homomorphic encryption (FHE) is a way of supporting such computations
on encrypted data.
We note that while other mechanisms exist for secure computation, they generally
require the different data providers to exchange information. Because
FHE schemes are public key schemes, FHE is much better suited for the scenario
where we have many sources of data.
Our Approach
Due to the significant overhead in homomorphic computation, implementations
of homomorphic encryption schemes for statistical analysis have been
limited to small datasets (≈ 100 data points) and low dimensional data (≈ 2-4
dimensions).
Using recent techniques in batched computation and a different message encoding
scheme, we demonstrate the viability of using leveled homomorphic
encryption to compute on datasets with over a million elements as well as
datasets of much higher dimension.
In particular, we consider two applications of homomorphic encryption: computing
the mean and covariance of multivariate data and performing linear regression
over encrypted datasets.
Computation over Large Integers
To support computation over large amounts of data, we need to be able to
handle large integers (i.e., 128-bit precision). However, it is not computationally
feasible to choose message spaces of this magnitude. To support computations
with at least 128-bit precision, we leverage the Chinese Remainder
Theorem (CRT):
Data
We choose primes
Data
Data
Data
Result
Result
Result
such that
CRT
Result
We perform the computation modulo each prime. Given the results of the
computation with respect to each prime, we apply the CRT to obtain the
value modulo the product of the primes (at least 128-bit precision).
The computations with respect to each prime is completely independent of
the computation with respect to the other primes. As such, all of the computations
are naturally parallelizable.
Homomorphic Encryption Scheme (Server Side)
Our leveled FHE scheme supports three basic operations: addition, multiplication, and Frobenius automorphisms.
Below, we show how we can use these operations to compute the inner product on encrypted data.
5 3 1 8
0 1 1 0
Homomorphic Encryption Scheme (Client Side)
Leveled fully homomorphic encryption (FHE) schemes supports addition and multiplication over ciphertexts.
Such schemes are capable of evaluating boolean circuits with bounded depth (determined by the number of
multiplications) over ciphertexts, and thus, can perform many computations over the ciphertext.
Consider a scenario where Charlie wants to compute the inner product of Alice’s and Bob’s data. Note that covariance
computation and linear regression can be expressed in terms of matrix products, which can be viewed
as a series of inner products.
Alice’s Data
[5, 3, 1, 8]
[0, 1, 1, 0]
Bob’s Data
5 3 1 8
0 1 1 0
0 3 1 0 3 4 1 0 4 4 4 4
4 0 0 0
Element-wise addition of batched ciphertexts.
Element-wise multiplication of batched ciphertexts.
3 1 0 0 1 0 3 4 1 0 0 0
Automorphism operation, which can apply arbitrary permutations to elements in the plaintext slots. Used
here to rotate slots by .
Because the individual plaintext slots are non-interacting, we use a series of automorphisms to rotate the
slots and additions to sum up the entries in a batch
In the last step of the circuit, we zero out the values of the remaining slots. In the case where the number
of slots is not a power of two, this ensures that no additional information about the data is leaked. The
result is stored in the first slot of the final ciphertext.
For security, we must add noise into ciphertexts during the encryption process. Homomorphic operations
on ciphertexts increase this noise. In order to decrypt successfully, the noise must be below a chosen
threshold.
In fully homomorphic computation, multiplication is substantially more expensive (both in terms of runtime
and amount of noise generated) than addition. We can quantify this by defining the depth of a circuit to be
the number of multiplications in the circuit. Evaluating deeper circuits requires larger parameters, and correspondingly,
longer runtimes. A comparison of addition and multiplication runtimes for different circuit
depths is given below:
Depth
pk Charlie
5 3 1 8
0 1 1 0
pk Charlie
Time to Perform
1 Addition (ms)
Cloud
Computing
Platform
Batching Encryption Evaluation Decryption
Time to Perform
1 Multiplication (s)
1 1.94 0.62
2 3.23 2.14
5 10.81 14.11
10 25.44 102.20
20 141.93 771.55
4 0 0 0
sk Charlie
Clear blocks represent plaintext blocks while striped blocks represent ciphertext blocks. The shading in the ciphertext
block represents the amount of noise in the ciphertext (explained below).
Batching: Pack multiple plaintext messages (data elements) into a single ciphertext block. This enables
the server to evaluate a single instruction on multiple data with low overhead.
Encryption: Encrypt the packed plaintext blocks with the FHE public key (Charlie’s public key).
Evaluation: Send the encrypted data to the cloud server for processing.
Decryption: The client (Charlie) decrypts the result using his secret key.
4
Experiments
Below are results from timing tests illustrating performance of linear regression
as well as mean and covariance computation on different datasets. Running
times are relative to one prime in the CRT decomposition.
Time (minutes)
Time (minutes)
Time (minutes)
Time (minutes)
700
600
500
400
300
200
100
0
350
300
250
200
150
100
50
0
1200
1000
800
600
400
200
0
450
400
350
300
250
200
150
100
50
0
Timing Tests for Linear Regression as a Function of Data Dimension
5.4 7.9 15.6 11.4 14.9 28.0 32.1 41.5 71.6 148.3
1 2 3 4 5
Dimension of Data
(left bar: 4096 data points, middle bar: 65536 data points, right bar: 262144 data points)
Key Generation Batching Encryption Computation Decryption
Timing Tests for Linear Regression as a Function of Dataset Size
10.0 9.6 10.0 10.5 14.8
214.7
199.0
28.2
84.8
549.8
531.9
665.7
305.0
1024 4096 8192 16384 65536 262144 1048576 4194304
Number of Data points
(2-dimensional data)
Key Generation Batching Encryption Computation Decryption
Timing Tests for Mean and Covariance Computation
as a Function of Data Dimension
250.3
444.3
689.8
1010.0
119.1
5.3 10.8 34.0
1 2 4 8 12 16 20 24
Dimension of Data
(4096 data points)
Key Generation Batching Encryption Computation Decryption
Timing Tests for Mean and Covariance Computation
as a Function of Dataset Size
119.1 119.3 121.9 131.7
34.2 34.6 36.6 42.2
66.4
190.8
4096 8192 16384 262144 65536 1048576
Number of Data points
(left bar: 4-dimensional data, right bar: 8-dimensional data)
154.1
403.0
Key Generation Batching Encryption Computation Decryption
Conclusion
We have constructed a scale-invariant leveled fully homomorphic
encryption system.
Using batching and CRT-based message encoding, we are able to perform
large scale statistical analysis on millions of data points and data of
moderate dimension.