Systems and methods for securely detecting data similarities

1. A computer-implemented method for securely detecting data similarities, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying a private data object that is subject to a similarity detection system whereby the private data object is subject to comparison with at least one potentially similar data object to determine a similarity between the private data object and the potentially similar data object;

establishing a connection between a client system that is authorized to access the private data object in plaintext form and that therefore has access to a private cryptographic key used to decrypt the private data object according to a partially homomorphic encryption scheme and a server that is not authorized to access the private data object in plaintext form and that therefore lacks access to the private cryptographic key;

generating a summary of the private data object by applying a summary generation protocol between the client system and the server to the private data object without exposing plaintext from the private data object to the server and without exposing a parameter of the summary generation protocol to the client system, wherein the summary of the private data object comprises intermediate data toward applying a similarity metric to the private data object, wherein the parameter partially determines the summary of the private data object and is selected and privately maintained by the server; and

computing the similarity, according to the similarity metric, between the private data object and the potentially similar data object by using the summary of the private data object and a summary of the potentially similar data object as input.

2. The computer-implemented method of claim 1 , further comprising reusing the summary of the private data object to compute a similarity, according to the similarity metric, between the private data object and an additional potentially similar data object by using the summary of the private data object and a summary of the additional potentially similar data object as input.

3. The computer-implemented method of claim 1 , wherein the summary of the potentially similar data object was generated without exposing plaintext from the potentially similar data object to the server and without exposing a parameter of the summary generation protocol used by the server to an additional client system authorized to access the potentially similar data object in plaintext form.

4. The computer-implemented method of claim 1 , wherein applying the summary generation protocol to the private data object comprises performing, at the server, a homomorphic operation within the partially homomorphic encryption scheme on input data that is derived from the private data object and that is in ciphertext form.

5. The computer-implemented method of claim 1 , wherein applying the summary generation protocol to the private data object comprises:

providing, from the client to the server, input data that is derived from the private data object and that is in ciphertext form;

receiving, at the client from the server, a result of the server performing a computation comprising a homomorphic operation within the partially homomorphic encryption scheme on the input data.

6. The computer-implemented method of claim 1 , wherein:

the private data object comprises a data set;

generating the summary of the private data object comprises identifying a plurality of minimum hash values for the data set that correspond to a plurality of parameterized hash functions without, for each minimum hash value in the plurality of minimum hash values, exposing a relative order of hash values for the data set to the client system and without exposing to the server which element of the data set in ciphertext form corresponds to the minimum hash value;

the parameter of the summary generation protocol comprises a parameter of at least one of the plurality of parameterized hash functions.

7. The computer-implemented method of claim 6 , wherein:

identifying the plurality of minimum hash values for the data set comprises performing a plurality of comparisons between a plurality of candidate minimum hash values;

performing the plurality of comparisons comprises providing, for each comparison in the plurality of comparisons, a result of the comparison to the client system without exposing to the client system to which elements within the data set the result of the comparison pertains.

8. The computer-implemented method of claim 1 , wherein:

the private data object comprises a vector;

generating the summary of the private data object comprises generating the summary without exposing a random projection applied to the vector to the client system.

9. The computer-implemented method of claim 1 , wherein generating the summary comprises generating the summary based on computations performed by the server and based on computations performed by the computing system.

10. The computer-implemented method of claim 1 , further comprising applying a data loss prevention policy to the private data object based on the similarity.

11. A system for securely detecting data similarities, the system comprising:

an identification module, stored in memory, that identifies a private data object that is subject to a similarity detection system whereby the private data object is subject to comparison with at least one potentially similar data object to determine a similarity between the private data object and the potentially similar data object;

a connection module, stored in memory, that establishes a connection between a client system that is authorized to access the private data object in plaintext form and that therefore has access to a private cryptographic key used to decrypt the private data object according to a partially homomorphic encryption scheme and a server that is not authorized to access the private data object in plaintext form and that therefore lacks access to the private cryptographic key;

a generation module, stored in memory, that generates a summary of the private data object by applying a summary generation protocol between the client system and the server to the private data object without exposing plaintext from the private data object to the server and without exposing a parameter of the summary generation protocol to the client system, wherein the summary of the private data object by intermediate data toward applying a similarity metric to the private data object, wherein the parameter partially determines the summary of the private data object and is selected and privately maintained by the server;

a computation module, stored in memory, that computes the similarity, according to the similarity metric, between the private data object and the potentially similar data object by using the summary of the private data object and a summary of the potentially similar data object as input; and

at least one physical processor configured to execute the identification module, the connection module, the generation module, and the computation module.

12. The system of claim 11 , wherein the computation module further reuses the summary of the private data object to compute a similarity, according to the similarity metric, between the private data object and an additional potentially similar data object by using the summary of the private data object and a summary of the additional potentially similar data object as input.

13. The system of claim 11 , wherein the summary of the potentially similar data object was generated without exposing plaintext from the potentially similar data object to the server and without exposing a parameter of the summary generation protocol used by the server to an additional client system authorized to access the potentially similar data object in plaintext form.

14. The system of claim 11 , wherein the generation module applies the summary generation protocol to the private data object by performing, at the server, a homomorphic operation within the partially homomorphic encryption scheme on input data that is derived from the private data object and that is in ciphertext form.

15. The system of claim 11 , wherein the generation module applies the summary generation protocol to the private data object by:

providing, from the client to the server, input data that is derived from the private data object and that is in ciphertext form;

receiving, at the client from the server, a result of the server performing a computation comprising a homomorphic operation within the partially homomorphic encryption scheme on the input data.

16. The system of claim 11 , wherein:

the private data object comprises a data set;

the generation module generates the summary of the private data object by identifying a plurality of minimum hash values for the data set that correspond to a plurality of parameterized hash functions without, for each minimum hash value in the plurality of minimum hash values, exposing a relative order of hash values for the data set to the client system and without exposing to the server which element of the data set in ciphertext form corresponds to the minimum hash value;

the parameter of the summary generation protocol comprises a parameter of at least one of the plurality of parameterized hash functions.

17. The system of claim 16 , wherein:

the generation module identifies the plurality of minimum hash values for the data set by performing a plurality of comparisons between a plurality of candidate minimum hash values;

the generation module performs the plurality of comparisons by providing, for each comparison in the plurality of comparisons, a result of the comparison to the client system without exposing to the client system to which elements within the data set the result of the comparison pertains.

18. The system of claim 11 , wherein:

the private data object comprises a vector;

the generation module generates the summary of the private data object without exposing a random projection applied to the vector to the client system.

19. A non-transitory computer-readable medium comprising computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify a private data object that is subject to a similarity detection system whereby the private data object is subject to comparison with at least one potentially similar data object to determine a similarity between the private data object and the potentially similar data object;

establish a connection between a client system that is authorized to access the private data object in plaintext form and that therefore has access to a private cryptographic key used to decrypt the private data object according to a partially homomorphic encryption scheme and a server that is not authorized to access the private data object in plaintext form and that therefore lacks access to the private cryptographic key;

generate a summary of the private data object by applying a summary generation protocol between the client system and the server to the private data object without exposing plaintext from the private data object to the server and without exposing a parameter of the summary generation protocol to the client system, wherein the summary of the private data object comprises intermediate data toward applying a similarity metric to the private data object, wherein the parameter partially determines the summary of the private data object and is selected and privately maintained by the server; and

compute the similarity, according to the similarity metric, between the private data object and the potentially similar data object by using the summary of the private data object and a summary of the potentially similar data object as input.

20. The computer-implemented method of claim 1 , wherein generating the summary of the private data object without exposing the parameter of the summary generation protocol to the client system comprises applying the parameter of the summary generation protocol at the server, according to a partially homomorphic encryption scheme, to data that is in ciphertext form and that is derived from the private data object.