1. Introduction

The Big Data Era has arrived. Today, millions of enterprises are working on Big Data projects, from small start-ups to large multinational corporations. Currently, the amount of data being generated is doubling every 18 months, which represents grow that is faster than Moore's Law [1]. The study of the International Data Corporation (IDC) estimated that from 2013 to 2020, the digital universe will grow by a factor of 10 - from 4.4 trillion to 44 trillion gigabytes and the amount of data managed by enterprises will grow by 50 times. With traditional solutions becoming too expensive to support Big Data processing and shortage of Big Data analytics talent, enterprises are scrambling to outsource their data solution to third party service providers (i.e. cloud and mobile cloud computing) for cost saving and performance efficiency [2-3]. However, this outsourced initiative in turn introduces a number of security and privacy concerns. Enterprises are delegating direct access and control over their data to un-trusted third parties, who might be able to abuse their access to the data. For instance, Hadoop, which is the most popular Big Data processing platform, only employs the Kerberos authentication protocol for controlling Big Data access. Kerberos, however, does not encrypt an enterprise's data during data analysis and computation [4-6].

One of the recent alternatives for protecting outsourced Big Data is by installing tamper-resistant hardware in an un-trusted third party in order to prevent unauthorized access to the confidential data. Alternatively, enterprises can also encrypt their sensitive data with existing commercial Big Data protection tools (e.g. IBM InfoSphere Optim Data Masking, DataGuise, Cloudera Sentry, etc.) before sending it to third party service providers. However, an issue arises when there is a need to perform computations on confidential data (such as computing the frequency of words of the first ten billion documents, computing drug usage based on millions or tens of millions of patients’ records, etc.), in which, both tamper-resistant hardware and existing encryption techniques are incompetent to support such operations. A trivial approach is that the enterprise can download the encrypted data (Big Data) and decrypt it before performing the analytical works, which is impractical and problematic.

Several recent advances in cryptography such as Private Information Retrieval (PIR), Searchable Encryption (SE), and Multi-Party Computation (MPC) schemes might be applicable to preserve the data privacy during data transformation. The PIR schemes [7-9] and SE schemes [10-14] enable enterprises to conduct searching of encrypted data, as well as retrieving private information securely, thereby, assuring the data security of un-trusted service providers. However, these schemes only support certain functionality, such as keyword search, ranking search, interval search, and subset search. The secure cloud storage schemes [15-18] that focus on executing various secure SQL statements over the outsourced databases can also be considered another alternative towards securing outsourced Big Data computation. Unfortunately, most of them [15-17] incur a high processing overhead during communication and decryption. Moreover, some of these schemes [10-17] leak the data access pattern, thus enabling third parties to learn from the search result [19-21]. On the other hand, the MPC protocol [22-25] allows a number of parties to jointly compute their desired algorithm based on the union of their data, without ever pooling or revealing their private data. The MPC protocol is well-designed for cooperative computation scenarios. A classic example of this protocol is when two or more competing corporates that jointly invest in a project that must satisfy both corporates’ private and valuable constraints, are able to cooperate with each other to conduct computation tasks based on their desired private algorithm. Both TrustDB [26] and CipherBase [27] were developed to protect outsourced databases. However, they work on a co-design of hardware and software for specific customers with specific needs, thereby increasing the economic costs as compared to previous alternatives.

To overcome these problems, this paper suggests homomorphic encryption as the mechanism to protect confidential data, while allowing corresponding third parties to perform computation on encrypted data without having to decrypt it. The aim of homomorphic encryption is to ensure data privacy during communication, storage, or when in use by mechanisms similar to conventional cryptography, but with added capabilities of computing in relation to encrypted data [28-29]. Thus, homomorphic encryption makes Big Data computation outsourcing possible.

In this paper, we report a survey on homomorphic encryption for outsourced Big Data computation. Firstly, a conclusive study on Big Data as well as its definition and characteristics, and how it is different from traditional data protection, are presented in Section 2. Section 3 discusses the homomorphic encryption schemes - their definition, requirements, and classification. Besides that, existing works on homomorphic encryption are critically reviewed and compared in terms of encryption scheme, homomorphism classification, algorithm design, noise management scheme, and security assumption. The current implementation of homomorphic encryption, future research possibilities and challenges towards practical Fully Homomorphic Encryption (FHE) for securing outsourced Big Data computation are further discussed in Section 4. Finally, Section 5 concludes.

2. Big Data Characteristics and How it is Different from Traditional Data Security

The term “Big Data” can be traced back to the discussions by the academia and industry in the 80s on handling large groups of datasets [30-31]. Unfortunately, after all these years, Big Data is still in its early stages. Both academia and industry are still trying to comprehend its core nature and definition. For instance, the Oracle elaborates Big Data from the data type perspective [32]; meanwhile, the EMC/IDC research organization defines Big Data from the technologies and architectures perspective [33].

While academia and industry key players are struggling to define Big Data, in June 2013, the National Institute of Standards and Technology (NIST), took the leading role in the development of the Big Data technology roadmap and further defined Big Data as follows:

NBD-PWG Definition: "Big Data refers to digital data volume, velocity and/or variety (veracity) that: i) Enable novel approaches to frontier questions previously inaccessible or impractical using current or conventional methods; and/or; ii) Exceed the capacity or capability of current or conventional methods and systems; iii) Differentiates by storing and analyzing population data and not sample sizes." [34]

Generally, the definition of Big Data is associated with the three "V's". The first "V", Volume, refers to the scale of data (from terabytes to zettabytes). The McKinsey Global Institute reported that 90% of all data ever created, has been created in the past three years and data is growing exponentially [35]. Obviously, this tremendous data growth leads to the second "V", Velocity, which implies the importance of the data processing speed. The third "V", Variety, refers to different forms of data such as structured data, unstructured data, semi-structured data, quasi-structured data, etc. Recently, researches [1,31] have further expanded Big Data characteristics into five "V’s", with an extra two "V's", namely: Veracity (also known as Verification or Variability) which refers to the uncertain nature of Big Data such as data consistency and trustworthiness, and Value which is an added-value that the collected data can bring to the intended process, activity, or predictive analysis. However, the nature of these "V's" remains within the measurement of data characteristics in itself. Table 1 further summarizes the differences between Big Data and traditional data.

Table 1.The differences between Big Data and traditional data

Data protection is significantly different in the era of Big Data due to its associated characteristics. The high volume of Big Data implicates that the data is too expensive to be queried and moved into another resource for computation. Consequently, Big Data engineering is referred to as "moving the processing to the data, not the data to the processing" [36-37]. Previously, Big Data processing was limited only to a finite number of large enterprises and governments. Generally, their Big Data infrastructures were built in-house and typically isolated from public networks, therefore, security and privacy issues were not a concern. Today, more and more small-to medium-sized organizations are embracing Big Data to support their decision-making and, research and development (R&D) activities, and achieving competitive advantages in market share. According to the International Data Group (IDG) Big Data report [38], the average organization possessed an average of 164 terabytes of data during 2014. Over the next 12 to 18 months (2015-2016), that number was expected to increase by 76 percent, to 289 terabytes. Since enterprises’ traditional data processing tools are becoming too expensive and limited to support Big Data processing, this rapid change has prompted enterprises to outsource their data storage, aggregation and analytical work to a third party [37].

These outsource computations, however, introduce a number of security and privacy concerns. This is because enterprises are delegating direct access and control over their data to an un-trusted third party, who might be able to abuse their access right to the data in order to infer, or more seriously sabotage, valuable information such as enterprises’ intellectual property, trade secrets, financial information, etc. Thereby, the conventional cryptosystems that aimed to protect data-at-rest, data-in-memory, and data-in transit are insufficient to adapt directly to secure outsourced Big Data computations.

While SE, PIR, and MPC schemes focus on searching, retrieving, and joint-computing in relation to encrypted data respectively, the Homomorphic Encryption (HE) scheme – another scheme that is capable of protecting data during the transformation – is further suggested in this paper to be the appropriate mechanism for confronting security and privacy issues of outsourced Big Data computations. Therefore, with consideration of the Big Data characteristics of high volume, high velocity, and high variety, homomorphic encryption with speed efficiency is highly sought-after to protect data, and consequently making Big Data computing viable from the data security perspective.

3. Homomorphic Encryption (HE) Schemes and Related Works

HE schemes were originally known as privacy homomorphism, which was introduced by Rivest [39], shortly after the invention of the RSA cryptosystem. Even though this scheme was broken by Brickell and Yacobi [40] in 1988, the journey of finding an ideal homomorphic encryption was just about to begin.

3.1 Core Nature of Homomorphic Encryption Schemes

3.1.1 Definition of a Homomorphic Encryption (HE) Scheme and Homomorphism Properties

Generally, a HE scheme allows computations to be performed on ciphertext without the need for the ciphertext to be decrypted. A HE scheme can be formally defined as follows:

Definition 1: A homomorphic encryption (HE) scheme is an encryption scheme, which has the following property for all C1, C2 ∈ C, M1, M2 ∈ P and K, where C1 = Enc(M1), C2 = Enc(M2) and C, P are groups:

where ⊙C and ⊙P are the group operation in the ciphertext and plaintext space respectively.

If the plaintext space P is an additive group, the homomorphic cryptosystem is known as additive homomorphism. Likewise, if the plaintext space is a multiplicative group, that homomorphic cryptosystem is considered as multiplicative homomorphism [29,41].

3.1.2 Symmetric Encryption Scheme vs. Asymmetric Encryption Scheme

Similar to conventional cryptography, the core nature of a HE scheme is to protect the confidentiality and privacy of data by encrypting the data either by using the same pair of secret keys (known as symmetric encryption scheme) or different pair of secret keys (known as asymmetric encryption scheme). Recent research on HEs are dominated by asymmetric encryption schemes [28,39,42-51,52-57,59-60,62-78,82,84-86]. Only a few researchers [58,61,79-81,83,87,88-91] have proposed HE schemes based on the symmetric algorithm. The main reason is the practical consideration for real-world deployments and the key management complexity of the symmetric crypto algorithm. Moreover, some of these symmetric homomorphic encryption schemes [58,61,79-80,88-90] still suffer from security flaws in their algorithm design [94-98]. It has been argued that a stronger security proof is needed for these symmetric schemes [81,83,88-92].

3.1.3 Deterministic vs. Probabilistic

The core nature of the HE scheme design can be further categorized into deterministic or probabilistic depending on the probability properties of the encryption algorithm. In the deterministic scheme, for a fixed secret key, a given plaintext will always be encrypted into the same ciphertext. If the HE scheme is able to produce a different ciphertext, even with the same secret key and plaintext, then the encryption is categorized as probabilistic. In general, the probabilistic scheme enjoys a stronger security level as compared to deterministic scheme and most of the recent probabilistic HE schemes are recognized as semantic secure if an adversary is unable to obtain any useful information from the ciphertext in order to recover the corresponding plaintext [99]. From the literature, most of the recent works on HE schemes are semantically secure due to their probabilistic properties [42-51,28,52-85]. Only a few HE schemes [39] are considered to be deterministic HE schemes.

3.2 Homomorphic Encryption Scheme Classification and Related Works

Depending on the supported homomorphism properties and number of operations, HE schemes can be further classified into three categories, namely Partial Homomorphic Encryption (PHE), Somewhat Homomorphic Encryption (SWHE) and Fully Homomorphic Encryption (FHE). Their definitions and current progress are presented in the following subsections.

3.2.1 Partial Homomorphic Encryption (PHE)

PHE is defined as follows:

Definition 2: Partial Homomorphic Encryption (PHE) is either an additive homomorphism that supports only additive operations, or multiplicative homomorphism that supports only multiplicative operations.

Several conventional cryptosystems enjoy some sort of homomorphism. These schemes are categorized into PHE due to their computation limitation, that is, they are only able to conduct one type of computation operation on the encrypted data. For instance, the RSA scheme [39] supports only multiplicative homomorphism. Given RSA public key (N, e) and two plaintexts M1 and M2, the multiplication of two ciphertexts returns a computed multiplication in the encrypted domain as follows:

On the other hand, the Pai scheme [47] is limited to only additive homomorphism. Given the public key (N, g), a random number (r1, r2), and two plaintexts M1 and M2, the multiplication of two ciphertexts returns a computed addition in the encrypted domain as follows:

In the following, existing conventional cryptosystems that are considered as PHE schemes are listed in Table 2. A technical review in terms of their HE properties, algorithm design, message expansion, and the hardness of security assumptions (Integer Factorization problem (IF), Discrete Logarithm (DL) problem, e' the Root (eR) problem, Weak r'th Residue (wrR) problem, Subgroup Decision (SD) Problem, p-Subgroup (p-SP) problem, Quadratic Residuosity (QR) problem, Composite Residuosity (CR) problem, and Semantically Secure (SS)) is further presented. From Table 2, existing PHE schemes are constructed based on asymmetric encryption schemes and most of them [42-49,51] enjoys non-deterministic properties, except for the RSA scheme [39] and MREA scheme [50]. Whereas majority of the existing PHE schemes [40-42,44-51] are categorized as additive homomorphism, only the RSA scheme [39] and EGM scheme [43] support multiplicative homomorphism. In terms of their performance, the RSA scheme [39], EGM [43], and Pai [43] enjoy a higher efficiency.

Table 2.A survey of Partial Homomorphic Encryption (PHE) schemes

Due to their performance efficiency, the majority of PHE schemes [39,42-44,47] are already being used in real-world applications. Most of these PHE schemes [39,42-44,47] are able to perform encryption and decryption in milliseconds. For example, the Pai scheme [47] which is widely applied in electronic voting protocols and biometric applications, takes approximately 2,313 milliseconds to encrypt and decrypt a 1024-bit data block. With their speed efficiency, these PHE schemes have been adapted for real-world Big Data application recently. CryptDB [100] that relies on a PHE scheme was commercialized in 2011. CryptDB executes an enterprise’s queries regarding encrypted data in a MySQL database with a collection of adjustable query-based encryption schemes (e.g. the Pai encryption scheme [47] is used for supporting count query, Song et al.’s [10] encryption scheme is used to support keyword search query, etc.). Tu et al. proposedMonomi [101], by improving the performance of CryptDB and increasing the capability to handle a more complex query. Subsequently, several variants of CryptDB have been proposed recently, including MrCrypt [102], Crypsis [103], and Computing on Masked Data (CMD) [104]. MrCrypt [102] – focuses on MapReduce operation. Likewise, Crypsis [103] focuses on the high-level data flow language, Pig Latin. Similar to CryptDB, the additive homomorphism of both MrCrypt [102] and Crypsis [103] relies on the Pai scheme [47], whereas the EGM [43] scheme is used to support multiplicative homomorphism. On the other hand, CMD [104] further extends CryptDB into NoSQL databases.

However, to support different types of queries, every piece of data in CryptDB [100] and its variants [101-104] need to be encrypted under a different encryption schemes (e.g. Pai encryption scheme [47] is used for supporting count query, Song et al.’s [10] scheme or EGM [43] scheme are used to support keyword search query, etc.). These result in an increased data storage size (e.g. approximately 3.76 times in CryptDB). This overhead also increases the communication costs when outsourced data is transferred, back and forth, to third-party service providers.

Evidently, the limitation on the range of operations has limited PHE schemes from being accepted as solutions for Big Data outsourced computation [29,41]. A few researchers have attempted to improve the versatility of existing PHE schemes. Examples of such effort include the MREA scheme [50] and CEG scheme [51]. However, the critical problem for both schemes is the approach of simply placing a plaintext as an exponent in order to support additive homomorphism. Firstly, both schemes do not support multiplicative homomorphism.

Therefore, both schemes still have low versatility as original schemes. Secondly, the speed performance of both the MREA and CEG schemes is slower than their original schemes. Thereby, both the MREA and CEG schemes are still inadequate to be adapted directly for securing Big Data outsourced computation which requires high versatility and high speed.

3.2.2 Somewhat Homomorphic Encryption (SWHE)

A SWHE scheme is an encryption scheme that has some homomorphic properties but is not fully homomorphic, which is further defined as follows:

Definition 3: Somewhat Homomorphic Encryption (SWHE) is a homomorphic cryptosystem which has the ability to perform both additive and multiplicative homomorphism, however, with a limited number of operations. This limitation is governed by the cryptosystem’s faintness to correctly decrypt resultant ciphertexts of homomorphic operations.

In general, each homomorphic encryption scheme outputs a ciphertext with a noise parameter, and the decryption works properly as long as the noise is less than the inherited security parameters. A SWHE scheme is able to support both additive and multiplicative homomorphism on encrypted data, however, with the compensation of increasing noise in the generated homomorphic ciphertext. Most of the HE schemes [28,52-57,59,65-67,101-106] proposed in the early twenty-first century are categorized into SWHE schemes due to the limited number of operations that can be executed in order to keep the noise parameters as small as possible. In other words, SWHE schemes can be used to support only a small subset of Big Data computations and certain real-world scenarios, such as protecting medical data [115], genomic and bioinformatics data [116-118], wireless sensor data [106], MySQL data [109], and Integer only data [108,112,113,119]. Several researchers have adapted SWHE schemes to perform custom Big Data computations, including predictive analysis [115], regression analysis [114], statistical analysis [116,119], and certain arithmetic operations [108].

3.2.3 Fully Homomorphic Encryption (FHE)

A FHE is similar to SWHE except that there is no increase in accumulated noise during computation. The general definition of a FHE scheme is further defined below:

Definition 4: Fully Homomorphic Encryption (FHE) supports both additive and multiplicative homomorphism which has the ability to perform an unlimited number of operations. Since addition and multiplication on any non-trivial ring constitute a Turing-complete set of gates, this scheme – if made efficient – allows one to employ any un-trusted computing resources without risk of revealing sensitive data [8,28,29].

The first FHE scheme [28] based on the ideal lattice approach was theoretically demonstrated by Gentry in 2009, after three decades of research exploration of homomorphic encryption. The technical review of existing FHE schemes in terms of their encryption scheme, homomorphism classification, algorithm design, noise management scheme, and security assumption are summarized in Table 3 and Table 4.

Table 3.A classification of Fully Homomorphic Encryption (FHE) schemes in terms of their encryption scheme, algorithm design and noise management techniques

Table 4.A classification of Fully Homomorphic Encryption (FHE) schemes in terms of their Security Assumptions

From the literature, as summarized in Table 3, the majority of the existing FHE schemes [28,52-57,59,65-67] are constructed from the SWHE with noise management techniques incorporated. Below is a list of noise management techniques used by FHE.

Bootstrapping. The first noise management technique introduced by Gentry in 2009 [28], in order to transform his SWHE scheme into a FHE scheme. Conceptually, bootstrapping is a technique extended from server-aided cryptography, where a ciphertext will be partially decrypted during the homomorphic computation in order to "refresh" and generate a new ciphertext with a low noise parameter. A bootstrapping technique involves a re-encryption algorithm and squashing algorithm. In the squashing algorithm, a "hint" of the secret key is encrypted as a portion of the public key. Whenever a ciphertext size or noise parameter grows too large during homomorphic computation, refreshing ciphertext with a re-encryption algorithm will be further applied. The ciphertext will be decrypted first and re-encrypted again using a "hint" of the secret key in order to produce a new encryption of the original plaintext, which is more compact and less noisy. However, the complex computations of squashing and re-encryption algorithms significantly result in slowing down the running speed of the FHE schemes. Existing FHE schemes that employ the bootstrapping technique to manage noise include [52-55,57-58,60,62,64,70-72].

Modulus Switching. To solve the performance issues of bootstrapping, Brakerski and Vaikuntanathan [56] proposed a more lightweight technique to manage noise parameters during homomorphic computations. The modulus switching method does not fully refresh a ciphertext (as the re-encryption algorithm does), but successfully limits the noise growth in the ciphertext during homomorphic computations. Using a technique similar to the "dimension reduction" procedure [56], the evaluator is able to reduce the magnitude of the noise without knowing the secret key as in the bootstrapping technique. Instead, the evaluator only needs to know the ciphertext size bound in order to transform a ciphertext, c modulo q into a different ciphertext modulo p without sacrificing the correctness of the decryption procedure. As a result, this technique has a small ciphertext size as compared to the bootstrapping technique. Existing FHE schemes that use modulus switching to manage the noise include [59,63,65,67-68,73-75,77-78,84-85].

Scale Invariant. In 2012, Brakerski [66] introduced another interesting noise management technique, known as “Scale Invariant”. Placing a message space in the “lower bits” of the decryption equation requires the modulus switching technique to manage the noise. To tackle this problem, the message space can be placed in the “upper bits” of the decryption equation with the scale invariant technique, thereby controlling the noise growth in a more effective way. However, the limitation of the scale invariant technique is that a more complex rounding operation is required in multiplicative homomorphism [111]. Existing FHE schemes that apply the scale invariant technique include [69,76].

Flattening. Recently, Gentry et al. [120] proposed the flattening technique which basically is a technique based on the modulus switching technique [56]. Generally, flattening is useful when the ciphertext is presented in matrix form and the encryption key is presented as a vector. The flattening technique uses a simple transformation [56] to modify the vectors without affecting the dot products, thus resulting in a better bound on the growth of the error. An existing FHE scheme that applies the flattening technique is [93].

Noise-free FHE Scheme. More recently, several researchers [61,79-81,82-83,86-87] have proposed a Noise-free FHE scheme. These is a FHE schemes that does not use any noise management techniques as discussed previously. Instead of using the lattice, these Noise-free FHE schemes are constructed based on the classical number-theoretic concepts such as octonion algebra, commutative ring, and non-commutative ring. Evidently, the constructions of these Noise-free FHE schemes are dominated by the symmetric FHE [61,79-81,83,86-87], although Nuida [82] proposed a Noise-free FHE scheme from the asymmetric perspective. However, some of these schemes [61,79-81] are not secure. The Kipnis and Hibshoosh scheme [61] that is based on commutative rings is subject to known plaintext key-recovery attack [97-98]. Subsequently, both the Yagisawa scheme [79,80] and Liu scheme [81] were proven to be not secure by Wang [96]. The Yagisawa scheme [86] that is based on the Discrete Logarithm problem cannot withstand quantum attack. On top of this, the Wang scheme [87] is only provable under the weak ciphertext-only security model. A detailed security analysis of these Noise-free FHE schemes is urgently sought after in order to establish a more reliable FHE scheme.

From the perspective of algorithm design, FHE schemes can be divided into three main categories: lattice-based, error correcting code-based and number theoretic-based. The detail of each category is further discussed in the following:

Lattice. Lattices are regular arrangements of points in Euclidean space. Lattice cryptography has been proved to have worst-case to average-case security with quantum reduction. As shown in Table 3, the majority of the existing FHE schemes [54-56,59,62-66,68-69,73-75,78,84-85,120] are constructed based on a lattice as found in Gentry's original work [28]. Under the lattice approach, the public key corresponds to the "bad" basis for a lattice, while the private key is the "good" basis of the same lattice. The lattice problems are conjectured to withstand quantum attacks. The main reason leading recent researchers to focus on lattices is because they can support both additive and multiplicative homomorphism. Besides that, the decryption circuit of a lattice is generally less complex as compared to former cryptosystems which involve exponentiation (e.g. RSA scheme [39], EGM scheme [43], etc.).

Depending on the inherited algorithm design and the hardness of the lattice problems (such as Polynomial Coset Problem (PCP), Ideal-Shortest Independent Vector Problem (I-SIVP), Sparse Subset-Sum Problem (SSSP), Bounded Distance Decoding Problem (BDDP), Learning With Error Problem (LWE), and Ring-Learning With Error (R-LWE)), these existing lattice-based FHE schemes can be further classified into three different classification approaches:

Error Correcting Codes. While most of the existing FHE schemes [54-56,59,62-66,68-69,73-75,78,84-85,120] are directed toward the lattice, Bogdanov and Lee [58] proposed a new alternative to construct a FHE scheme from error correcting codes. In both code and lattice-based approaches, the message is encrypted by applying affine transformation and then noise is added to the message. In the lattice-based approach, the message is encrypted and hidden inside the noise, and therefore security is based on the inability to distinguish the different noise patterns, whereas, in the code-based approach, the message is hidden in the input of the affine transformation, in which the aim of the noise insertion is to prevent inversion. Unfortunately, Bogdanov and Lee’s [58] scheme is subject to distinguisher-based attack [94]. Brakerski [95] on the other hand not only proved that Bogdanov and Lee’s [58] scheme is not secure, but further argued that the entire approach of code-based homomorphic encryption is not secure.

Number Theoretic. The number theoretic approach has served as the fundamental basis in algorithm design for classical public key cryptography. This scheme enjoys some homomorphic properties and has been categorized as a PHE scheme as shown in Table 2. Over the last couple of years, the number-theoretic approach has begun to gain attention among researchers. They used the number theoretic approach to design a noise-free FHE scheme with the aim to root out the efficiency bottleneck of lattice-based FHE schemes. Existing FHE schemes that are constructed based on the number theoretic approach are further divided into four different categories as follows.

A comparison among PHE, SWHE and FHE schemes in terms of speed and versatility criteria is summarized in Table 5. It is undeniable that PHE [39,42-51] perform faster than SWHE [105-119] and FHE [28,52-93,121]. However, these PHE schemes are only limited to additive homomorphism or multiplicative homomorphism. On the other hand, FHE schemes enjoy higher versatility as compared to SWHE and PHE schemes. Most existing FHE schemes use bootstrapping, dimension modulus reduction, scale-invariant or flattenning techniques. Complex computation has a negative impact on the speed performance of a FHE scheme. Whether these schemes can be further directly adapted to secure Big Data processing is still questionable.

Table 5.A Comparison of PHE, SWHE and FHE Scheme Based on Practical Homomorphic Scheme Criteria in Securing Outsourced Big Data Computation

4. Towards a Practical Fully Homomorphic Encryption for Big Data Outsourced Computation

4.1 Recent Implementation of FHE schemes

While most FHE schemes are theoretically constructed, recently, there have been efforts to bring forward FHE for real-world application. The first implementation of a FHE scheme was demonstrated by Gentry and Halevi [121] in 2011. Unfortunately, the result was quite disappointing as their scheme took more than 900 seconds to add two 32-bit integers and more than 67,000 seconds to multiply them. To encrypt a single bit, the Gentry and Halevi FHE scheme [37] requires a ciphertext of more than 780,000 bits. The recent optimized implementation of FHE schemes is summarized into three general categories as follows.

Parallelism Technique. Several parallelism techniques such as packing ciphertext, batching processing, and Single-Instruction Multiple-Data (SIMD) operations are further applied to optimize the implementation of FHE schemes. The packing technique was firstly introduced by Smart and Vercauteren [52], and implemented by Gentry and Halevi [121]. Instead of working on bit-by-bit encryption, several bits of plaintext are “packed” into vector elements and encrypted into a single ciphertext with the application of the Chinese Remainder Theorem (CRT). This subsequently allows the batching technique to perform parallel homomorphic evaluation of a ciphertexts; the SIMD operations can be used for parallelizing the re-encryption algorithm, thus leading to substantial speeding-up and dramatically improving the required bandwidth and communication cost. For instance, the Coron et al. scheme [67] requires more than 74TB of encrypted data to be sent over the network for every 4MB of plaintext. However, with the parallelism technique [72], the communication requirement can be lowered to approximately 280GB [130]. Recent FHE schemes that use parallelism techniques to optimize their performance include [62-64,69-74,113,127-132].

Scheme Conversion Approach. Conversion is used to reduce the bandwidth and storage size of ciphertext [63,73-74,130]. Generally, to speed up the re-encryption algorithm, plaintext will be encrypted with a symmetric encryption algorithm, which has a simple decryption circuit. If there is computation that needs to be carried out on the ciphertext, the decryption circuit of the targeted ciphertext will be evaluated homomorphically to re-encrypt the plaintext under the FHE scheme. Gentry et al. [63] were the first to demonstrate this technique by implementing their scheme [59] onto the Advanced Encryption Algorithm (AES) block ciphers. However, it took around 30 minutes to generate a single encryption key, and the corresponding encryption process of a1024-bit data block required over 36 hours of processing. In 2014, another group of researchers [73-74] repeated the work of Gentry et al.[63], with NRTU-based homomorphic encryption scheme [65] and replaced AES with a more lightweight symmetric algorithm, Prince, and produced a scheme that took 79.5 minutes to encrypt a 1024-bit data block [74]. The performance speed of this scheme was better than the previous attempt [71]; however, the improved scheme is still impractical to be implemented for real-world application. A more promising result was demonstrated by Lepoint and Naehrig [130]. They implemented both a NTRU-based FHE scheme [69] and R-LWE-based FHE scheme [110]. The homomorphic evaluation was conducted with the lightweight block cipher, SIMON, which is extremely small, easy, and efficient to implement in hardware. The encryption algorithm method took approximately 2.7 minutes and 5 minutes to encrypt for the NTRU-based FHE scheme [69] and R-LWE-based FHE scheme [110] respectively. However, the homomorphic evaluation with SIMON-64/128 on a single core processor took approximately 3.4 hours and 4.58 hours for the NTRU-based FHE scheme [69] and R-LWE-based FHE scheme [110] respectively.

Hardware Acceleration. Instead of optimizing a FHE scheme from the software perspective as discussed above, another group of researchers [133-136] started work on accelerating FHE by implementing FHE in hardware. The first hardware implementation of a FHE scheme was demonstrated by Doroz et al. [133]. They designed a custom architecture for Gentry and Halevi’s FHE scheme [121]. With several optimization techniques such as multi-million-bit multiplier based on Schnonhage Strassen multiplication and, spectral and precomputation strategy, the encryption, decryption and re-encryption algorithm per single bit took 18.1 milliseconds, 16.1 milliseconds, and 3.1 milliseconds respectively. Cao et al. [135] proposed the hardware implementation of two FHE schemes [57,67] by using the FPGA technologies with the speed improvement of 44.73 and 54.2. FPGA hardware acceleration was further applied by Cousins et al. [136] and Poppelmann et al. [137] to improve the homomorphic computation for the NTRU-based FHE scheme and R-LWE-based scheme.

4.2 Future Directions of FHE in Securing Outsourced Big Data Computation

In this section, future research possibilities and the challenges of a practical FHE scheme for securing outsourced Big Data Computation are discussed.

Hybrid or Non-Circuit Based. Most of the recent FHE schemes were constructed according to circuit-based approach as inherited from Gentry's original work. The representation of each ciphertext as a single bit allows an arbitrary Boolean function to be computed simply with the binary addition and multiplication operation. However, the circuit-based approach has dramatically reduced the speed performance of the proposed FHE schemes and increased the communication bandwidth and storage size as compared to conventional cryptosystems. While it is difficult to construct a universal FHE scheme for general Big Data computations in practice, a hybrid or non-circuit based approach that is custom targeted to handle different scenarios of outsourced Big Data Computation such as Zhou and Wornell’s scheme [77] is urgently sought after.

Work with Access Control Mechanism. A high volume of Big Data is being collected from diverse endpoints and accessed by different users. Whether FHE schemes can be further extended to enforce the access control on such data, so that authorized users are able to access sensitive data, while unauthorized users or malicious insiders are prohibited from obtaining this sensitive data, is another interesting topic to be explored. It includes working together with the decentralized key management approach, or taking advantages of the recent advancement of access control encryption schemes such as broadcast encryption scheme, Identity-Based Encryption (IBE) scheme, and Attribute-Based Encryption (ABE) scheme.

Verifiable Homomorphic Encryption Scheme. While FHE schemes can be used to protect the confidentiality of outsourced Big Data on un-trusted service providers, enterprises are concerned about the accuracy of computed results, and whether these un-trusted service providers are performing their actual work correctly or simply returning plausible results. To address this problem, homomorphic encryption can be used together with Verifiable Computation (VC) in order to guarantee the integrity of outsourced Big Data computations.

Work with Artificial Intelligence Algorithm. While the current works of improving the efficiency bottleneck of FHE are directed to algorithm design such as noise-free technique as well as, software and hardware implementation design, more recently, a few researchers from Microsoft [144] have demonstrated that machine learning algorithms can be applied to facilitate homomorphic computations. In CryptoNets [144], an enterprise’s data are encrypted with R-LWE-based FHE scheme [69], and then an artificial feed-forward neural network is applied on the cloud service providers’ side to speed up the homomorphic evaluation and make encrypted predictions. However, this neural network must be previously trained with a set of unencrypted data. The major limitation of this approach is the time needed to train the neural network efficiently. In the future, whether other artificial intelligence algorithms can be further applied to improve FHE performance is another interesting area to be explored.

Alternative towards Gentry-based FHE Schemes. Most FHE schemes are rooted in the Gentry’s original blueprint. FHE schemes are generally constructed based on two phases – first, designing a SWHE scheme, and second, using the noise management techniques (e.g. bootstrapping, modulus switching, scale-invariant, and flattening) to transform SWHE schemes into FHE schemes. Therefore, how to achieve FHE directly without SWHE is still an open problem. The recent attempt to construct Noise-free FHE schemes based on the number theoretic approach (e.g. octonion algebra and non-commutative rings, etc.) seems to be another alternative to achieve practical FHE schemes. However, detailed security analysis is further required to prove their reliability.

Secure FHE Scheme. Recent cryptanalysis [94-98,123-126,138-141] has called for an urgent need to improve the security of the existing FHE schemes. The provable weak instance inherited from both LWE [139] and R-LWE [140-141] has resulted in some of the existing FHE schemes [54,56,59,65,73,93,122,138] being vulnerable to attack. On top of this, almost all of the existing FHE schemes are only proved to be secure under the CCA-1 model, and whether FHE can further achieve CCA-2 is still questionable. In 2016, Gong et al. [142] attempted to construct a CCA-2 secure additive homomorphic encryption scheme, which was broken by Lee et al. [143] recently. Therefore, how to achieve a CCA-2 secure FHE scheme is still an open question to be solved.

5. Conclusion

Data protection in the era of Big Data is significantly different from that for traditional data due to the high volume, velocity, and variety of Big Data. In this paper, the homomorphic encryption scheme is suggested as the solution for securing outsourced Big Data computation. Subsequently, the existing works on homomorphic encryption are reviewed and discussed in terms of their encryption approaches, algorithm design, noise management scheme, and the hardness of security assumptions. While lattice and number theoretical-based homomorphic encryption still suffer from unsatisfactory speed performance, storage, and bandwidth size, some researchers have already begun to look for hybrid approaches such as scheme conversion, parallelism and non-circuit based techniques. However, current advancements are still not adequate to secure Big Data processing. This paper also touches on the recent and upcoming research on homomorphic encryption, which focuses on addressing both the speed and versatility of Big Data processing. Whether these newer schemes can be further extended to overcome Big Data challenges is another important open issue for data scientists to delve into.