Certified Cloud Security Professional (CCSP)Cloud Data SecurityHard
A cloud customer is implementing a new application that will process highly sensitive personal identifiable information (PII). They require a solution that ensures data remains encrypted both at rest and in transit, and also prevents the cloud provider from accessing the unencrypted data, even when it is being processed. Which cryptographic solution best addresses these requirements?
- AFormat-Preserving Encryption (FPE)
- BSearchable Encryption
- CHomomorphic Encryption
- DAttribute-Based Encryption (ABE)
Show answer & explanationAnswer & explanation
Correct answer: C. Homomorphic Encryption
Homomorphic encryption allows computations to be performed on encrypted data without decrypting it first, thus maintaining confidentiality even during processing by the cloud provider. This directly addresses the requirement to prevent the cloud provider from accessing unencrypted data during processing.
Why the other options are wrong
- A. Format-Preserving Encryption (FPE) encrypts data while retaining its original format, useful for database compatibility but not for secure computation.
- B. Searchable Encryption allows searching over encrypted data without decryption, but doesn't enable general computation on it.
- D. Attribute-Based Encryption (ABE) is primarily used for fine-grained access control based on user attributes, not for computation on encrypted data.
Homomorphic Encryption
Homomorphic encryption is a form of encryption that allows computations to be performed on ciphertext, generating an encrypted result which, when decrypted, matches the result of operations performed on the plaintext.
- Enables computation on encrypted data.
- Maintains data confidentiality throughout its lifecycle, even during processing.
- Computation results remain encrypted.
- Comes in partially, somewhat, and fully homomorphic forms.
Memory trick: Homomorphic Heroes Compute Encrypted.