Method and system for privacy-protected execution of a workflow in a software application using encrypted inputs
Certain aspects of the present disclosure provide techniques for privacy-preserving execution of a workflow in a software application. Embodiments include generally includes receiving homomorphically encrypted inputs from a client device corresponding to user-provided data needed to calculate a result for a step of a workflow in the software application. A result is calculated for the step of the workflow using the received homomorphically encrypted inputs. The calculated result is returned to the client device. The calculated result is homomorphically encrypted as a result of calculating the result using the received homomorphically encrypted inputs.
1. A method for invoking privacy-preserving execution of a workflow in a remotely hosted software application, comprising: displaying a prompt for user input associated with items to be used in performing a step of a workflow in the remotely hosted software application; receiving user input for each of the items to be used in performing the step of the workflow; homomorphically encrypting the user input for the input data using an encryption key; transmitting, to an application server, the homomorphically encrypted user input and a request to perform the step of the workflow using the homomorphically encrypted user input; receiving, from the application server, a homomorphically encrypted result of the step of the workflow; decrypting the received homomorphically encrypted result using a decryption key paired with the encryption key; and displaying the result on a display coupled to the client device; and generating key-value pairs for the items, each key-value pair including a label associated with a respective item of the items and a corresponding homomorphically encrypted user input, wherein the homomorphically encrypted user inputs comprise the generated key-value pairs.
2. The method of claim 1 , wherein the encryption key comprises a public key portion of a public/private key pair and the decryption key comprises a private key portion of the public/private key pair.
3. The method of claim 2 , further comprising:
generating the public/private key pair; and
transmitting, to the application server, the public key portion of the public/private key pair prior to invoking execution of the workflow in the remotely hosted software application.
4. The method of claim 1 , wherein the encryption key comprises a generated cryptographic key and the decryption key comprises a derivative of the generated cryptographic key.
5. The method of claim 1 , wherein the request to perform the step of the workflow includes the encryption key.
6. The method of claim 1 , further comprising:
receiving an electronic document including the homomorphically encrypted user input and homomorphically encrypted result of the step of the workflow;
generating a plaintext version of the electronic document by decrypting the homomorphically encrypted user input and homomorphically encrypted result of the step of the workflow; and
displaying the plaintext version of the electronic document on the display coupled to the client device.
7. The method of claim 6 , wherein the electronic document is partially encrypted such that non-sensitive data is included in the electronic copy of the document in plaintext.
8. A system, comprising: a processor; and a memory having instructions stored thereon which, when executed by the processor, performs an operation for invoking privacy-preserving execution of a workflow in a remotely hosted software application, the operation comprising: displaying a prompt for user input associated with items to be used in performing a step of a workflow in the remotely hosted software application; receiving user input for each of the items to be used in performing the step of the workflow; homomorphically encrypting the user input for the input data using an encryption key; transmitting, to an application server, the homomorphically encrypted user input and a request to perform the step of the workflow using the homomorphically encrypted user input; receiving, from the application server, a homomorphically encrypted result of the step of the workflow; decrypting the received homomorphically encrypted result using a decryption key associated with the encryption key; and displaying the result on a display coupled to the client device; and wherein the operation further comprises: generating key-value pairs for the items, each key-value pair including a label associated with a respective item of the items and a corresponding homomorphically encrypted user input, wherein the homomorphically encrypted user inputs comprise the generated key-value pairs.
9. The system of claim 8 , wherein the operation further comprises:
generating the encryption key and the decryption key as one of a public/private key pair or a cryptographic key and a derivative of the cryptographic key; and
transmitting, to the application server, the encryption key prior to invoking execution of the workflow in the remotely hosted software application.
10. The system of claim 8 , wherein the operation further comprises:
completing execution of the workflow in the software application;
receiving an electronic document including the homomorphically encrypted user input and homomorphically encrypted result of the step of the workflow;
generating a plaintext version of the electronic document by decrypting the homomorphically encrypted user input and homomorphically encrypted result of the step of the workflow; and
displaying the plaintext version of the electronic document on the display coupled to the client device.