Volume 10 Supplement 2
iDASH Privacy and Security Workshop 2016
Secure searching of biomarkers through hybrid homomorphic encryption scheme
 Miran Kim^{1}Email author,
 Yongsoo Song^{2} and
 Jung Hee Cheon^{2}
https://doi.org/10.1186/s1292001702803
© The Author(s) 2017
Published: 26 July 2017
Abstract
Background
As genome sequencing technology develops rapidly, there has lately been an increasing need to keep genomic data secure even when stored in the cloud and still used for research. We are interested in designing a protocol for the secure outsourcing matching problem on encrypted data.
Method
We propose an efficient method to securely search a matching position with the query data and extract some information at the position. After decryption, only a small amount of comparisons with the query information should be performed in plaintext state. We apply this method to find a set of biomarkers in encrypted genomes. The important feature of our method is to encode a genomic database as a single element of polynomial ring.
Result
Since our method requires a single homomorphic multiplication of hybrid scheme for query computation, it has the advantage over the previous methods in parameter size, computation complexity, and communication cost. In particular, the extraction procedure not only prevents leakage of database information that has not been queried by user but also reduces the communication cost by half. We evaluate the performance of our method and verify that the computation on largescale personal data can be securely and practically outsourced to a cloud environment during data analysis. It takes about 3.9 s to searchandextract the reference and alternate sequences at the queried position in a database of size 4M.
Conclusion
Our solution for finding a set of biomarkers in DNA sequences shows the progress of cryptographic techniques in terms of their capability can support realworld genome data analysis in a cloud environment.
Keywords
Homomorphic encryption BiomarkersBackground
The rapid development of genome sequencing technology enables us to access large genome dataset and it looks poised to make a significant breakthrough in medical research. While genomic data can be used for a wide range of applications including healthcare, biomedical research, and directtoconsumer services, it has numerous special distinguishing features and it can violate personal privacy via genetic disclosure or genetic discrimination [1–3]. Due to these potential privacy issues, it should be managed with care.
There have been various privacyenhancing techniques using cryptographic methods as outsourced analysis tools of genomic data. Recently, it has been suggested that we can preserve privacy through homomorphic encryption (HE), which allows computations to be carried out on ciphertexts. Yasuda et al. [4] gave a practical solution to find the location of a pattern in a text by computing multiple Hamming distance values on encrypted data. Lauter et al. [5] gave a solution to privately compute the basic genomic algorithms used in genomewide association studies.
Homomorphic encryption can be applied to privacypreserving sequence comparison, but it is still impractical for the analysis of entire human genome information. For example, Cheon et al. [6] presented a protocol to compute the edit distance on homomorphically encrypted data but it took about 27 s even on length 8 DNA sequence. It is not easy to efficiently approximate the edit distance over encryption even though the distance to a public human DNA sequence is given [7]. This inefficiency comes from the difficulty of homomorphic evaluation of equality test: Encrypting the inputs bitwise and computing over the encrypted bits yield expensive computation cost (at least linear in the data bitlength).
In this paper, we suggest an efficient method to securely search a set of biomarkers using hybrid RingGSW homomorphic encryption scheme.
Problem setting
The iDASH (Integrating Data for Analysis, ‘anonymization’ and SHaring) National Center organizes the iDASH Privacy & Security challenge for secure genome analysis. This paper is based on a submission to the task 3 in 2016 iDASH challenge: secure outsourcing of testing for genetic diseases on encrypted genomes. The goal of this task is to privately calculate the probability of genetic diseases through matching a set of biomarkers to encrypted genomes stored in a public cloud service. The requirement is that the entire matching process needs to be carried out using homomorphic encryption so that any information about database and query should not be revealed to the server during computation.
Suppose that the client has a Variation Call Format (VCF) file which contains genotype information such as chromosome number and position in the genome. It also contains some information for each position such as reference and alternate sequences, where each base must be one of SNPs: A,T,G, and C. The client encrypts the information using homomorphic encryption and the server calculates the exact match over the encrypted data. The outcome is the absence/presence of the specified biomarkers, that is, an encryption of 1 if matched; otherwise, an encryption of 0. Finally the client decrypts the result by the secret key of homomorphic encryption.
Practical homomorphic encryption
Fully Homomorphic cryptosystems allow us to homomorphically evaluate any arithmetic circuit without decryption. However, the noise of the resulting ciphertext grows during homomorphic evaluations, slightly with addition but substantially with multiplication. For efficiency reasons, for tasks which are known in advance, we use a more practical Somewhat Homomorphic Encryption (SHE) scheme, which evaluates functions up to a certain complexity. In particular, two techniques are used for noise management of SHE: one is the modulusswitching technique introduced by Brakerski, Gentry and Vaikuntanathan [8], which scales down a ciphertext during every multiplication operation and reduces the noise by its scaling factor. The other is a scaleinvariant technique proposed by Brakerski such that the same modulus is used throughout the evaluation process [9].
Let us denote by [ ·]_{ Q } the reduction modulo Q into the interval \((Q/2,Q/2]\cap \mathbb {Z}\) of the integer or integer polynomial (coefficientwise). For a security parameter λ, we choose an integer M=M(λ) that defines the Mth cyclotomic polynomial Φ _{ M }(X). For a polynomial ring \(\mathcal {R}=\mathbb {Z}[X]/ (\Phi _{M}(X))\), set the plaintext space to \(\mathcal {R}_{t}:= \mathcal {R}/t\mathcal {R}\) for some fixed t≥2 and the ciphertext space to \(\mathcal {R}_{Q}:= \mathcal {R}/Q\mathcal {R}\) for an integer Q=Q(λ). Let χ=χ(λ) denote a noise distribution over the ring R. We use the standard notation \(a \leftarrow \mathcal {D}\) to denote that a is chosen from the distribution \(\mathcal {D}\).
The basic scheme

RLWE.ParamsGen(λ): Given the security parameter λ, choose an integer M, a modulus Q, a plaintext modulus t with tQ, and discrete Gaussian distribution χ _{ err }. Output params←(M,Q,t,χ _{ err }).

RLWE.KeyGen(params): On the input parameters, let N=ϕ(M) and choose a sparse random s from {0,±1}^{ N }. Generate an RLWE instance (a,b)=(a,[−a s+e]_{ Q }) for e←χ _{ err }. We set the secret key sk←s and the public key pk←(a,b).

RLWE.Enc(m,pk): To encrypt \(m \in \mathcal {R}_{t}\), choose a small polynomial v and two Gaussian polynomials e _{0},e _{1} over \(\mathcal {R}\) and output the ciphertext$$\begin{array}{ll} \mathsf{ct} & \leftarrow(c_{0},c_{1})\\ & =((Q/t) m,0) + (bv+e_{0}, av+e_{1}) \in \mathcal{R}_{Q}^{2}. \end{array} $$

RLWE.Dec(ct,sk): Given a ciphertext ct=(c _{0},c _{1}), output m←⌊(t/Q)·[c _{0}+s·c _{1}]_{ Q }⌉.

RLWE.Add(ct,ct ^{′}): Given two ciphertexts ct=(c _{0},c _{1}) and ct ^{′}=(c0′,c1′), the homomorphic addition is computed by ct _{ add }←([c _{0}+c0′]_{ Q },[c _{1}+c1′]_{ Q }).

RLWE.Conv(ct): Given a ciphertext ct=(c _{0},c _{1}) with \(c_{0}=\sum _{i} c_{0,i}X^{i}\) and \(c_{1}=\sum _{i} c_{1,i}X^{i}\), output the vector ct ^{′}=(c _{0,0},c _{1,0},−c _{1,N−1},…,−c _{1,1}).

LWE.ModSwitch(ct): Given a ciphertext \(\mathsf {ct}\in \mathbb {Z}_{Q}^{N+1}\), output the vector \(\mathsf {ct}'\leftarrow \lfloor {(q/Q)\cdot \mathsf {ct}}\rceil \in \mathbb {Z}_{q}^{N+1}\).

LWE.Dec(ct,sk): Given a ciphertext \(\mathsf {ct}\in \mathbb {Z}_{Q}^{N+1}\), output the value \(m\leftarrow \lfloor {(t/q)\cdot [\langle {\mathsf {ct}},{\vec s}\rangle ]_{q}}\rceil \).
If \(\langle {\mathsf {ct}},{\vec s}\rangle =(q/t)\cdot m+e \pmod q\) for some small enough e, it returns the correct message m modulo t. More precisely, the decryption procedure works if te/q<1/2.
The RingGSW scheme

RGSW.ParamsGen(·),RGSW.KeyGen(·): Use the same parameter params and secret key s with the basic RLWE scheme. Additionally set the decomposition base B _{ g } and exponent d _{ g } satisfying \({B}_{\mathsf {g}}^{{d}_{\mathsf {g}}}\ge Q\).

RGSW.Enc(m,sk): To encrypt \(m \in \mathcal {R}_{t}\), pick a matrix \(\mathbf {a}\in \mathcal {R}_{Q}^{2{{d}_{\mathsf {g}}}}\) uniformly at random, and \(\mathbf {e} \in \mathcal {R}^{2{{d}_{\mathsf {g}}}} \simeq \mathbb {Z}^{2{{d}_{\mathsf {g}}} \cdot n}\) with discrete Gaussian distribution χ of parameter ς, and output the ciphertextwhere b=−a·s+e and the gadget matrix \(\mathbf {G}= \left (\mathbf {I} ~\Vert ~ {B}_{\mathsf {g}}\mathbf {I} ~\Vert ~ \ldots ~\Vert ~ {B}_{\mathsf {g}}^{{{d}_{\mathsf {g}}}1}\mathbf {I}\right)^{T} \in \mathcal {R}_{Q}^{2{{d}_{\mathsf {g}}} \times 2}\) for 2×2 identity matrix I.$$\mathsf{CT} \leftarrow [\mathbf{b}, \mathbf{a}] +\, m \mathbf{G} \in \mathcal{R}_{Q}^{2{{d}_{\mathsf{g}}} \times 2} $$

Hybrid.Mult(CT,ct): Given an RGSW ciphertext \(\mathsf {CT}\in \mathcal {R}_{Q}^{2{{d}_{\mathsf {g}}}\times 2}\) and an RLWE ciphertext \(\mathsf {ct}\in \mathcal {R}_{Q}^{2}\) output the vector \(\mathsf {ct}'\leftarrow \mathsf {CT}^{T}\cdot {\mathsf {WD}_{{B}_{\mathsf {g}}}}(\mathsf {ct})\).
If CT and ct are RGSW and RLWE encryptions of m and m ^{′}, respectively, their multiplication ct ^{′} is a valid RLWE encryption of m m ^{′}. For convenience, we will denote Hybrid.Mult(CT,ct) algorithm by \(\boxdot \), i.e., \((\mathsf {CT},\mathsf {ct})\in \mathcal {R}_{Q}^{2{{d}_{\mathsf {g}}}\times 2}\times \mathcal {R}_{Q}^{2}\mapsto \mathsf {CT}\boxdot \mathsf {ct}\in \mathcal {R}_{Q}^{2}\).
Methods
Privacypreserving database searching and extraction
Let us consider a database of a set of n tuples. Each tuple consists of pairs (d _{ i },α _{ i }) for i=1,…,n, where d _{ i } denotes a datatag in the domain \(\{0,1,\dots,\mathcal {T}1\}\) and α _{ i } represents the corresponding value attribute in a plaintext space \(\mathbb {Z}_{t}\backslash \{0\}\).Note that all the tags should be distinct from each other. For instance, in the case of personal information database, α _{ i } may be the age of user whose identity number is d _{ i }.
Given a query tag d from a tag domain and a query value α from a plaintext space, the matching problem is to determine the existence of an index i such that (d,α)=(d _{ i },α _{ i }). Now consider the following simplified search query: select α _{ i } if there exists an index i such that d _{ i }=d; otherwise zero (⊥). The purpose of this section is to store the database and carry out this search query on the public cloud. The server should learn nothing from encrypted query and any information other than the final result should not be leaked to user. Throughout this work, we will use semihonest (honest but curious) adversary model, which is a standard assumption for evaluation of homomorphic encryption.
The user encrypts this polynomial with the RLWE publickey encryption scheme and stores the ciphertext ct _{ DB } in the server. At the query phase, given a query tag d, the user encrypts the monomial X ^{−d } with the RGSW symmetric encryption scheme and sends the ciphertext CT _{ Q } to the server. We assume that the RGSW encryption scheme has the same secret key sk as the one of RLWE encryption scheme.
Since we use the cyclotomic polynomial ϕ _{ M }(X)=X ^{ N }+1 of poweroftwo degree, the polynomial ring \(\mathcal {R}\) has the property X ^{ N }=−1. Thus, for any tag d, the constant term of the polynomial DB(X)·X ^{−d } is α _{ i } if there is some index i satisfying d=d _{ i }, otherwise zero.
Now the server applies the RLWE.Conv algorithm on c t _{ mult } to compute an LWE encryption ct _{ conv } of this constant term. This conversion procedure not only prevents the leakage of information that has not been queried but also reduces the size of output ciphertext by half. In addition, the (optional) modulusswitching procedure can be considered to get a ciphertext c t _{ res } with a smaller modulus size and reduce the communication cost. Finally the user decrypts this LWE ciphertext and gets the desired value α _{ i } or zero (⊥). Algorithm 1 summarizes the procedure of secure searchandextraction.
Our method can be modified to support a secure comparison of data values using a hash (oneway) function. If hashed values of α _{ i } are used as polynomial coefficients, our method will return a hashed value of α _{ i } to the user instead of α _{ i }. The user may check whether the resulting value and the hashed query value are the same or not without knowing information about database.
Comparison with related work
Equality test has been traditionally considered difficult to perform on homomorphic encryption, because of its large circuit depth [7, 15, 16]. They evaluate the equality test on each encrypted tuple of database, so at least Ω(n) homomorphic operations are required for searching on database of size n. In addition, Boneh et al. [17] does not protect the database information to the users, that is, the whole database can be recovered by the resulting ciphertext of a query. However, our method is very efficient in parameter size and complexity since it requires only a single hybrid multiplication.
One limitation of this method is that the tags d _{ i } should be bounded by ciphertext dimension N to construct the encoding polynomial DB(X). Since the dimension N has a significant influence on the performance of HE scheme, too large value of N has an impractical impact on the performance. In the next section, we will describe how to overcome this problem in terms of the application to genomic data.
Secure searching of biomarkers
We return to our main goal of task3: secure outsourcing matching of a set of biomakers to encrypted genomes. We describe how to encode and encrypt the genotype information of VCF file in order to apply the privacypreserving database searching and extraction.
VCF file contains multiple genotype information lines, where each of them consists of a triple (ch _{ i },pos _{ i }, SNPs _{ i }) of chromosome number, position, and a sequence of SNP alleles. A chromosome identifier ch ranges from 1 to 22, X, and Y. A nonnegative integer pos represents the reference position with the first base having position 1, and SNPs is a reference or alternate sequence in {A,T,G,C}^{∗}. A query from user is also a triple of the same form and we aim to decide absence/presence of this biomarker in the database file.
The format of genome data and its encoding with n _{ SNP }=10
CHROM  POS  d  REF  ALT  α 

1  161235340  3869648161  G  A  12582916 
1  161235596  3869654305  C  T  14680069 
1  161235657  3869655769  G  T  12582917 
1  161235981  3869663545  G  A  12582916 
1  161237503  3869700073  ·  TTTTTGT  21849 
1  161237891  3869709385  G  A  12582916 
1  161238009  3869712217  G  ·  12582912 
1  161238488  3869723713  A  G  8388614 
1  161238683  3869728393  G  A  12582916 
1  161238856  3869732545  T  ·  10485760 
1  161239028  3869736673  AG  ·  37748736 
1  161239142  3869739409  A  G  8388614 
1  161239346  3869744305  G  T  12582917 
1  161239470  3869747281  C  T  14680069 
1  161239788  3869754913  ·  AA  16 
1  161239978  3869759473  C  T  12582917 
1  161240641  3869775385  TGAT  ·  740294656 
The user encrypts the polynomial with the RLWE publickey encryption scheme as described above.
The query genes are also encoded as a pair of integers (d,α), however, we consider only the information of d is encrypted using the RGSW symmetric encryption scheme, that is, the user encrypts the monomial X ^{−d }.
Results and discussion
In this section, we explain how to set the parameters and describe our optimization techniques for the implementation. We also present our results using the techniques. The dataset was randomly selected from Personal Genome Project. Our implementation is publicly available on github [18].
How to set parameters
Since all the matching computation is performed on encrypted data in the cloud, the security against a semihonest adversary follows from the semantic security of the underlying HE scheme. The security of the homomorphic encryption scheme relies on the hardness of the RLWE assumption. We derive a lowerbound on the ring dimension as \(N \geq \frac {\lambda +110}{7.2}\cdot \log _{2} Q\) to get λbit security level from the security analysis of [11].
Given the ciphertext modulus Q, it follows from the estimation of noise growth during evaluations [12] and decryption condition that we get the upper bound on the plaintext modulus t to ensure the correctness of decryption after computation. So we set t as the largest poweroftwo integer less than the upper bound. If the encodings of the allele strings are too large, we divide them into smaller integers so that each of them is smaller than t. Then we repeat the algorithm to construct the corresponding polynomials of each integer.
Optimization techniques
As we mentioned before, the ring dimension N needs to be larger than the encoded integers d _{ i }’s. However, the encoded integers d _{ i } from VCF files have bits size about 32, while a dimension N with about 11≤ log2N≤16 is considered appropriate for implementation of HE schemes to achieve both security and efficiency. Hence direct application of our method to the VCF file would yield an impractical result.
For compression of tag data and its rerandomization, we make the use of a pseudo random number generator H(·) which transforms a tag d _{ i } into a pair of two nonnegative integers \(d^{*}_{i}\) and \(d^{\dagger }_{i}\) less than N. Our implementation adopts SHA3 and extracts log2N=11 bits of the hashed value for each of \(d^{*}_{i}\) and \(d^{\dagger }_{i}\).
Now let ct denote the ciphertext computed by the homomorphic addition between \(\mathsf {ct}^{*}_{\mathsf {mult}}\) and \(\mathsf {ct}^{\dagger }_{\mathsf {mult}}\). Finally the server converts it into an LWE ciphertext and performs the modulusswitching procedure as described above. The Algorithm 3 describes the procedure of secure searchandextraction using our proposed optimization techniques.
Implementation results
The use of variable type ‘int32 _t’ accelerates the speed of implementations and basic C++ std libraries, so we set Q=2^{32} as the ciphertext modulus. We also set t=2^{11} as the modulus parameter of the plaintext space to ensure the correctness for the output ciphertext. We take the following parameters for Gadget matrix G: B _{ g }=128 and d _{ g }=5, so that they satisfy the condition \({B}_{\mathsf {g}}^{{{d}_{\mathsf {g}}}} \geq Q\).
Each coefficient of the secret key sk is chosen at random from {0,±1} and we set 64 as the number of nonzero coefficients in the secret key. As in the work of [12], we considered the Gaussian distribution of standard deviation σ=1.4 to sample random error polynomials.
For the efficiency of homomorphic multiplication, we also used the optimized library for complex FFT, i.e., the Fast Fourier Transform in the West [19]. That is, we use the complex primitive 2Nth root of unity rather than a primitive root in a prime field of order Q. We measure a running time of 0.804 s to set up the FFT environment at dimension 2N=2^{12}. The key generation of two schemes takes about 0.247 ms in total.
Implementation results of secure searching of biomarkers
DB size  n _{ SNP }  Complexity  Storage  

Query enc  DB enc  Eval  Dec  Query  DB  Result  
10 K  2  3.247 ms  3.563 ms  0.018 s  0.004 ms  160 KB  3 MB  0.75 MB 
5  7.212 ms  0.039 s  0.011 ms  6 MB  1.5 MB  
10  14.813 ms  0.079 s  0.027 ms  12 MB  3 MB  
100 K  2  21.424 ms  0.111 s  0.034 ms  17 MB  4.25 MB  
5  42.415 ms  0.227 s  0.064 ms  34 MB  8.5 MB  
10  99.921 ms  0.454 s  0.139 ms  68 MB  17 MB  
4 M  2  0.745 s  3.954 s  1.171 ms  593 MB  148 MB  
5  1.506 s  7.911 s  1.949 ms  1185 MB  296 MB  
10  3.001 s  15.442 s  3.795 ms  2370 MB  593 MB 
Conclusions
In this work, we suggested an efficient method to securely search the query tag and extract the corresponding value from a database over hybrid GSW homomorphic encryption scheme. We came up with a solution to the secure outsourcing matching problem by using polynomial encoding and extraction of desired value based on the multiplication of an RGSW ciphertext and an ordinary RLWE ciphertext. And then we applied this method to find a set of biomarkers in DNA sequences.
Our solution shows the progress of cryptographic techniques in terms of their capability can support realworld genome data analysis in a cloud environment. We list a few fascinating open problems to remain. First, we only considered the semihonest adversary model in this work. Other tools such as homomorphic authenticated scheme may lead to more efficient protocols in the malicious settings. Another issue is to support k multiple queries while maintaining the performance and communication cost less than k times of a single query case. We expect to have much faster performance by enabling a batching method.
Notes
Declarations
Acknowledgements
The authors would like to thank the referee for helpful comments. The authors would also like to thank the iDASH Secure Genome Analysis Contest organizers, in particular Xiaoqian Jiang and Shuang Wang, for running the contest and providing the opportunity to submit competing implementations for these important tasks.
Funding
Publication of this article has been funded by IT R &D program of MSIP/KEIT (No. B0717160098).
Availability of data and materials
Not applicable.
Authors’ contributions
MK, YS, and JC designed the baseline methods. MK and YS drafted the manuscript and conducted the experiment for the competition. JC guided the experimental design and provided detailed edits. All authors read and approved the final manuscript.
Competing interests
The authors declare that they have no competing interests.
Consent for publication
Not applicable.
Ethics approval and consent to participate
Not applicable.
About this supplement
This article has been published as part of BMC Medical Genomics Volume 10 Supplement 2, 2017: Proceedings of the 5th iDASH Privacy and Security Workshop 2016. The full contents of the supplement are available online at https://bmcmedgenomics.biomedcentral.com/articles/supplements/volume10supplement2.
Publisher’s Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Open Access This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made. The Creative Commons Public Domain Dedication waiver (http://creativecommons.org/publicdomain/zero/1.0/) applies to the data made available in this article, unless otherwise stated.
Authors’ Affiliations
References
 Humbert M, Ayday E, Hubaux JP, Telenti A. Addressing the concerns of the lacks family: quantification of kin genomic privacy. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security. ACM: 2013. p. 1141–52.Google Scholar
 Erlich Y, Narayanan A. Routes for breaching and protecting genetic privacy. Nat Rev Genet. 2014; 15(6):409–21.View ArticlePubMedPubMed CentralGoogle Scholar
 Naveed M, Ayday E, Clayton EW, Fellay J, Gunter CA, Hubaux JP, Malin BA, Wang X. Privacy in the genomic era. ACM Comput Surv (CSUR). 2015; 48(1):6.View ArticleGoogle Scholar
 Yasuda M, Shimoyama T, Kogure J, Yokoyama K, Koshiba T. Secure pattern matching using somewhat homomorphic encryption. In: Proceedings of the 2013 ACM Cloud Computing Security Workshop. ACM: 2013. p. 65–76.Google Scholar
 Lauter K, LópezAlt A, Naehrig M. Private computation on encrypted genomic data. In: International Conference on Cryptology and Information Security in Latin America. Springer International Publishing: 2014. p. 3–27.Google Scholar
 Cheon JH, Kim M, Lauter K. Homomorphic computation of edit distance. In: International Conference on Financial Cryptography and Data Security. Springer Berlin Heidelberg: 2015. p. 194–212.Google Scholar
 Kim M, Lauter K. Private genome analysis through homomorphic encryption. BMC Med Inform Decis Mak. 2015; 15(Suppl 5):3.View ArticleGoogle Scholar
 Brakerski Z, Gentry C, Vaikuntanathan V. (Leveled) fully homomorphic encryption without bootstrapping. ACM Transactions on Computation Theory. 2014; 6(3):13.View ArticleGoogle Scholar
 Brakerski Z. Fully homomorphic encryption without modulus switching from classical gapsvp. In: Advances in CryptologyCRYPTO. Springer Berlin Heidelberg: 2012. p. 868–86.Google Scholar
 Lyubashevsky V, Peikert C, Regev O. On ideal lattices and learning with errors over rings. In: Advances in CryptologyEUROCRYPT. Springer Berlin Heidelberg: 2010. p. 1–23.Google Scholar
 Gentry C, Halevi S, Smart NP. Homomorphic evaluation of the AES circuit. In: Advances in CryptologyCRYPTO. Springer Berlin Heidelberg: 2012. p. 850–67.Google Scholar
 Ducas L, Micciancio D. Fhew: Bootstrapping homomorphic encryption in less than a second. In: Advances in CryptologyEUROCRYPT. Springer Berlin Heidelberg: 2015. p. 617–40.Google Scholar
 Gentry C, Sahai A, Waters B. Homomorphic encryption from learning with errors: Conceptuallysimpler, asymptoticallyfaster, attributebased. In: Advances in CryptologyCRYPTO. Springer Berlin Heidelberg: 2013. p. 75–92.Google Scholar
 Chillotti I, Gama N, Georgieva M, Izabachene M. Faster fully homomorphic encryption: Bootstrapping in less than 0.1 s. In: Advances in CryptologyASIACRYPT. Springer Berlin Heidelberg: 2016. p. 3–33.Google Scholar
 Cheon JH, Kim M, Kim M. Searchandcompute on encrypted data. In: International Conference on Financial Cryptography and Data Security. Springer Berlin Heidelberg: 2015. p. 142–59.Google Scholar
 Cheon JH, Kim M, Kim M. Optimized searchandcompute circuits and their application to query evaluation on encrypted data. IEEE Trans Inf Forensic Secur. 2016; 11(1):188–99.View ArticleGoogle Scholar
 Boneh D, Gentry C, Halevi S, Wang F, Wu DJ. Private database queries using somewhat homomorphic encryption. In: International Conference on Applied Cryptography and Network Security. Springer Berlin Heidelberg: 2013. p. 102–18.Google Scholar
 Kim M, Song Y. Implementation of Secure Searching of Biomarkers. 2016. http://github.com/amedonis/HybridHE.
 Frigo M, Johnson SG. The design and implementation of fftw3. Proc IEEE. 2005; 93(2):216–31.View ArticleGoogle Scholar