System and method for operating on streaming encrypted data

• US 9,338,144 B2
• Filed: 02/19/2014
• Issued: 05/10/2016
• Est. Priority Date: 02/19/2014
• Status: Active Grant

• Current Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation)
• Original Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation)
• Inventors: Rohloff, Kurt Ryan
• Primary Examiner(s): Mehedi, Morshed
• Assistant Examiner(s): Naghdali, Khalil
• Application Number:
  US14/184,552
• Publication Number:
  US 20150237020A1
• Time in Patent Office: 811 Days
• Field of Search: 713/168
• US Class Current: 1/1
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 65/70 Media network packetisation
• CPC Class Codes: H04L 9/008 involving homomorphic encryption
• CPC Class Codes: H04L 9/302 involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes
• CPC Class Codes: H04L 9/3093 involving Lattices or polynomial equations, e.g. NTRU scheme

Abstract

Method for data privacy in a distributed communication system includes: receiving first and second encrypted data from first and second client terminals, each having a different data representation; analyzing the first and second data representations to determine a common data representation; translating the first and second encrypted data to a shared data representation using the common data representation; performing operations on the first encrypted data and second encrypted data to generate a first and second operated encrypted data; reverting the first operated encrypted data back to said first data representation and sending the reverted first encrypted date to the first client terminal for decryption by the first client terminal; and reverting the second operated encrypted data back to said second data representation and sending the reverted second encrypted date to the second client terminal for decryption by the second client terminal.

Claims

1. A computer implemented method for data privacy in a distributed communication system, the method comprising:

receiving first encrypted data from a first client terminal, the first encrypted data having a first data representation, including a first cyphertext ring dimension;

receiving second encrypted data from a second client terminal, the second encrypted data having a second data representation, including a second cyphertext ring dimension, different than the first data representation;

analyzing the first and second data representations, respectively including the first and second cyphertext ring dimensions, to determine a first data rate for the first encrypted data and a second data rate for the second encrypted data and to determine a common data representation, including a common cyphertext ring dimension for both the first and second encrypted data;

translating the first and second encrypted data to a shared data representation having the same cyphertext ring dimension, using said common data representation including said common data rate;

performing data operations on the first encrypted data and second encrypted data having the common data representation to generate a first operated encrypted data and a second operated encrypted data having the shared data representation, respectively;

reverting the first operated encrypted data back to said first data representation including said first cyphertext ring dimension and sending a reverted first encrypted data to the first client terminal for decryption by the first client terminal; and

reverting the second operated encrypted data back to said second data representation including said second cyphertext ring dimension and sending a reverted second encrypted data to the second client terminal for decryption by the second client terminal, wherein the common data representation is a constant common ring dimension that does not vary with the first and second encrypted data.

2. The method of claim 1, wherein said performing data operation further comprises performing a data mixing operation.

3. The method of claim 1, wherein the shared ring dimension is the minimum of all the ring dimensions for the first and second encrypted data.

4. The method of claim 1, wherein the shared ring dimension is the maximum of all the ring dimensions for the first and second encrypted data.

5. The method of claim 1, wherein the first data representation includes a first cyphertext vector size and the second data representation includes a second cyphertext vector size.

6. The method of claim 5, wherein said analyzing the first and second data representations comprising measuring data rate for the first cyphertext vector and the second cyphertext vector to determine a shared vector size for both first and second encrypted data.

7. The method of claim 1, wherein said translating the first encrypted data to the common data representation further comprises:

performing an inverse Chinese remainder theorem (CRT) operation on the first encrypted data to generate first power-basis encrypted data; and

normalizing the first power-basis encrypted data using the determined common data representation; and

performing a CRT operation on the first encrypted data to revert to a Chinese remainder representation.

8. The method of claim 7, wherein said translating the first encrypted data to the power-basis data representation further comprises:

performing a ring switch operation by taking an inverse CRT of first encrypted data to convert the first encrypted data from a CRT representation to a power basis representation.

9. The method of claim 1, wherein said reverting the first operated encrypted data back to said first data representation further comprises:

performing an inverse CRT operation on the first operated encrypted data to generate first reverted encrypted data;

normalizing the first reverted encrypted data using the first data representation for the first client terminal; and

performing a CRT operation on the first encrypted data to revert to a Chinese remainder representation.

10. The method of claim 9, wherein said normalizing the first reverted encrypted data comprises inserting zeroes for every other entry in the first reverted encrypted data to change the data representation of the first reverted encrypted data.

11. The method of claim 1, wherein the distributed communication is voice communication, the method further comprising:

sampling the voice signals received from the first and second client terminals, encoding the sampled signals and encrypting the encoded signals to generate the first and second encrypted data, respectively; and

decrypting the reverted first and second encrypted data, decoding the decrypted data and playing back the decoded data by the first and second clients, respectively.

12. A data mixer system for data privacy in a distributed communication system comprising:

a first input port for receiving first encrypted data from a first client terminal, the first encrypted data having a first data representation, including a first cyphertext ring dimension;

a second input port for receiving second encrypted data from a second client terminal, the second encrypted data having a second data representation, including a second cyphertext ring dimension, different than the first data representation;

a selector circuit for analyzing the first and second data representations including the first and second cyphertext ring dimensions, to determine a first data rate for the first encrypted data and a second data rate for the second encrypted data and to determine a common data representation, including a common cyphertext ring dimension for both the first and second encrypted data;

a first and a second homogenizers for translating the first and second encrypted data to a shared data representation having the same cyphertext ring dimension, using said common data representation including said common data rate;

an operational circuit for performing data operations on the first encrypted data and second encrypted data having the common data representation to generate a first operated encrypted data and a second operated encrypted data having the shared data representation, respectively;

a first reverter for reverting the first operated encrypted data back to said first data representation including said first cyphertext ring dimension and sending a reverted first encrypted data to the first client terminal for decryption by the first client terminal, respectively; and

a second reverter for reverting the second operated encrypted data back to said second data representation including said second cyphertext ring dimension and sending a reverted second encrypted data to the second client terminal for decryption by the second client terminal, wherein the common data representation is a constant common ring dimension that does not vary with the first and second encrypted data.

13. The data mixer system of claim 12, wherein said operational circuit is a mixer logic for performing a data mixing operation.

14. The data mixer system of claim 12, wherein said first homogenizer performs an inverse CRT operation on the first encrypted data to generate first inverted encrypted data;

and normalizes the first inverted encrypted data using the determined common data representation.

15. The data mixer system of claim 12, wherein said first reverter performs an inverse CRT operation on the first operated encrypted data to generate first reverted encrypted data;

and normalizes the first reverted encrypted data using the first data representation for the first client terminal.