In the fifth episode of our series The Secret Life of PETs - in which we look at the pros and cons of this emerging technology - our Head of Solutions, Chris Lewis, looks at homomorphic encryption. Some other examples of PETs are also briefly reviewed.
Homomorphic encryption is a type of data encryption designed to allow mathematical operations
to be performed on encrypted data.
Essentially, it enables two encrypted data points to be operated upon (such as multiplied) in a fashion that when decrypted, would have the same result as performing the same operation on the data points in plaintext.
This includes the ability to match data within a fraud data matching scenario or screening individuals against PEPs and Sanctions lists, should it be that homomorphic encryption has been applied to all relevant data.
It also needs to be impossible to reveal information regarded the encrypted data points by observing encrypted calculations. So, in summary, incredibly complicated maths to enable encrypted regular mathematics.
As data is encrypted any data that has homomorphic encryption applied could be outsourced to a third party without necessarily trusting said third party to secure the data.
The main issue with homomorphic encryption is efficiency. According to KeyFactor13, fully
homomorphic encryption can be up to a million times more computationally intensive than performing operations in plaintext. These algorithms are slow and have significant storage requirements, which translates to both poor response times and high cost, particularly when considering cloud storage and compute costs.
When considering the incredibly tight service level agreements associated with fraud data matching, identity verification and PEPs/Sanctions screening, homomorphic encryption currently represents an unacceptable tradeoff in terms of performance. Especially when compared to traditional data matching and analytical techniques in the world of economic crime in the context of customer decisioning.
Homomorphic encryption is also incredibly complex in terms of mathematics, and incompatible with most operational systems used across financial services and adjacent sectors today, which represents a significant barrier to entry.
The previous three examples explained as part of this series aren’t the only examples of new or emerging PETs.
Other technologies include:
Differential privacy - The process of adding noise, to ensure the output of statistical analysis on that data will not reveal information specific to a single individual from the dataset.
Enclaved data - A secure data environment which limits access to confidential data at a hardware level, for example through the use of virtual machines, secure networks and protected memory regions. Data enclaves operate as opaque boxes to outside users and processes.
Federated analytics - The execution of programs on decentralised data. Data remains in place and is not shared, with only the results returned to the requesting party.
Synthetic data – Fake or computer generated data designed to mimic real data, to train machine learning models, conduct mock analytical exercises or test production-systems without production data.
As with any technology, there is overlap between the different technological approaches described, and if you are interested there is a wealth of information available about each approach freely available on the internet. Warning: the mathematics gets very hard, very quickly!
Episode 6 - The all important conclusion! (Doof doof, doof doof doof doof doof....)
Thursday 21st July 2022
If you have any questions about how traditional analytical and data matching techniques can help you prevent fraud and understand your customers, click here to contact us.
In the meantime, please feel free to read more articles and thought pieces in the 'Our Thinking' section of our website.
10 – https://research.aimultiple.com/secure-multi-party-computation/