Providing computation services with privacy
Techniques are provided for providing a local computation service on client device authorized by a remote service provider while keeping local data private from the remote service provider. In one example, a computer-implemented method comprises transmitting, by a device operatively coupled to a processor, a homomorphic encryption public key and homomorphically encrypted input data to a service provider. The computer-implemented method also comprises receiving, by the device from the service provider, a homomorphically encrypted signature generated based on the homomorphic encryption public key, the homomorphically encrypted input data, and a homomorphic encryption equivalent defined function. The computer-implemented method also comprises in response to a determination, based on a defined function corresponding to the homomorphic encryption equivalent defined function, that the homomorphically encrypted signature and input data corresponding to the homomorphically encrypted input data are valid for a computation service, performing, by the device, the computation service on the input data.
1. A system, comprising:
a memory that stores computer executable components;
a processor, coupled to the memory, and that executes computer executable components stored in the memory, wherein the computer executable components comprise:
a security component that:
in response to sending encrypted input data to a service provider that is remote from the system, receives an encrypted signature from the service provider that is generated based on an application of a homomorphic encryption public key and a homomorphic encryption equivalent defined function to the encrypted input data; and
decrypts the encrypted signature with a homomorphic encryption private key that is paired with the homomorphic encryption public key to generate a decrypted signature; and
a service provider application component, local to the system, that:
applies a defined function corresponding to the homomorphic encryption equivalent defined function on input data to generate a signature; and
in response to a determination that the signature matches the decrypted signature, grants the system access to a computation service of the service provider application component using the input data; and
the service provider application component performs the computation service on the input data in response to the granting the system access to the computation service.
2. The system of claim 1 , wherein the security component encrypts the input data using the homomorphic encryption public key to produce the encrypted input data.
3. The system of claim 1 , wherein the service provider application component, in response to a determination that the signature does not match the decrypted signature, denies the system access to the computation service to use the input data.
4. The system of claim 1 , wherein the service provider application component grants the system access to the computation service to use the input data for a defined number of executions of the computation service.
5. The system of claim 1 , wherein the computer executable components comprise an encryption component that generates the homomorphic encryption private key and the homomorphic encryption public key using a homomorphic encryption scheme.
6. The system of claim 5 , wherein the homomorphic encryption scheme is non-symmetric.
7. The system of claim 1 , wherein the defined function comprises mathematical operations selected from the group consisting of addition and multiplication.
8. The system of claim 1 , wherein the input data is not provided to or accessible by the service provider.
9. The system of claim 1 , wherein the security component sends the homomorphic encryption public key to the service provider.
10. The system of claim 1 , wherein the security component scales the input data to whole integers prior to encrypting the input data and the service provider application component scales the input data to whole integers prior to executing the defined function on the input data.
11. The system of claim 1 , wherein the service provider is a cloud computing system.
12. A computer-implemented method, comprising:
transmitting, by a device comprising a processor, a homomorphic encryption public key and homomorphically encrypted input data to a service provider;
receiving, by the device from the service provider, a homomorphically encrypted signature generated based on the homomorphic encryption public key, the homomorphically encrypted input data, and a homomorphic encryption equivalent defined function;
decrypting, by the device, the homomorphically encrypted signature using a homomorphic encryption private key to generate a decrypted signature;
generating, by the device, a signature using the defined function and the input data; and
in response to a determination, based on a defined function corresponding to the homomorphic encryption equivalent defined function, that the decrypted signature matches the signature, designating, by the device, the input data as valid for a computation service, and performing, by the device, the computation service on the input data.
13. The computer-implemented method of claim 12 , further comprising encrypting, by the device, the input data using a homomorphic encryption public key to produce the homomorphically encrypted input data that secures the input data from visibility by the service provider.
14. The computer-implemented method of claim 12 , further comprising in response to a determination that the decrypted signature fails to match the signature, designating, by the device, the input data as invalid for the computation service.
15. A computer program product for providing a local computation service for a client authorized by a remote service provider while keeping local client data private from the remote service provider, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing component on a device to cause the processing component to:
transmit a homomorphic encryption public key and homomorphically encrypted input data to a service provider located remotely from the device;
receive, from the service provider, a homomorphically encrypted signature generated based on the homomorphic encryption public key, the homomorphically encrypted input data, and a homomorphic encryption equivalent defined function;
decrypt the homomorphically encrypted signature using a homomorphic encryption private key to generate a decrypted signature;
generate a signature using the defined function and the input data; and
in response to a determination, based on a defined function corresponding to the homomorphic encryption equivalent defined function, that the decrypted signature matches the signature, designating, by the device, the input data as valid for a computation service, and perform the computation service on the input data.
16. The computer program product of claim 15 , wherein the program instructions executable by the processing component further cause the processing component to:
in response to a determination that the decrypted signature fails to match the signature, designate the input data as invalid for the computation service.
17. The computer program product of claim 15 , wherein the homomorphic encryption scheme is non-symmetric.
18. The computer program product of claim 15 , wherein the defined function comprises mathematical operations selected from the group consisting of addition and multiplication.
19. The computer program product of claim 15 , wherein the input data is not provided to or accessible by the service provider.
20. The computer program product of claim 15 , wherein the designating the input data as valid for the computation service comprises designating the input data as valid for the computation service for a defined number of executions of the computation service.