New Encryption Scheme Could Protect Your Genome

sciencehabit writes "As the cost of genetic sequencing plummets, experts believe our genomes will help doctors detect diseases and save lives. But not all of us are comfortable releasing our biological blueprints into the world. Now cryptologists are perfecting a new privacy tool that turns genetic information into a secure yet functional format. Called homomorphic encryption, the method could help keep genomes private even as genetic testing shifts to cheap online cloud services."

Comments

New?

[jbmartin6]

This isn't new, although the application with gene sequencing might be.

Re:New?

[StripedCow]

However, I suspect that every new application requires the method to be applied differently. Also, for every new application, other attack vectors might be possible so it is crucial to sort these out. Just thinking.

Re:New?

[buswolley]

Can I encrypt it in my own body? If not what is the point. I leave cells everywhere.

Re:New?

[Anonymous Coward]

It's not new for genomic privacy either, I've first heard of it this summer.

Re:New?

[Immerman]

It doesn't protect you from that hot blond taking a strand of your hair to the local gene-scan station before going on a second date, but it does mean that the guy that hacked the NIH genetic database won't get the DNA of 400,000,000 people in one fell swoop. Though of course it probably also means that the NIH database will require thousands of times the storage capacity since de-duplication can't be applied to the massive genetic overlap between individuals.

And the nosy blond could be mostly stymied by laws requiring consent of the sampled individual, banning privately owned gene sequencers without a license and security check, etc.

Re:New?

[tragedy]

Though of course it probably also means that the NIH database will require thousands of times the storage capacity since de-duplication can't be applied to the massive genetic overlap between individuals.

The human genome is what? About 1.5 Gigabytes? That's a lot of data, but far from unmanageable. Store two copies for redundancy and you have 3 Gigabytes. Let's round down a bit and say you can get 600 people's DNA onto 2 TB worth of drives. Let's say you pay $120 per terabyte, then you're paying 20 cents per patient for two copies. Of course, this will be enterprise class storage for medical purposes, so let's say $4 per patient. Not exactly bank-breaking. Anyway, you haven't presented any good reason why you couldn't compress based on the parts of the genome that everyone has in common when you create the sequence in the first place, bringing the costs down to a few cents per patient for storage. Just because the sequences are all stored encrypted doesn't mean you couldn't apply such compression. The homomorphic calculations required might become more difficult because of it, but there's no evidence of that yet.

Of course, this is all moot since this is an article about a commercial company trying to sell a solution to a problem no-one has. The simple fact is, there's no rational reason to send out DNA from a set of servers for testing. Just do it locally. None of the tests you're going to want to do on it are all that computationally expensive (unless you're performing them on homomorphically encrypted data). If you need it encrypted on the local machine for patient privacy, then encrypt it, but have a local medical appliance where you can download it, decrypt it, then display results. Buld the appliance with no network functionality except through a custom one-way (except for control signals for error correction, etc.) port. Seriously, what would ever be the reason to have to send out data to a "lab" for results as if it were a biological sample?

If you were going to build an appliance for something like this, there's also no good reason it couldn't be a cheap device the patient keeps for themselves with 8 GB of storage and a cheap processor and a cheap screen and a some way to download analysis programs and upload results for those so inclined. Something like that could be made for mass production for $50 a piece. Well, I suppose the "good" reason would be that it would be considered a medical device and would have to be more like $5000 per unit. So scratch that idea.

In any case, it's not as if this scheme actually would be secure. Attacks have already been demonstrated on such encryption methods that could reveal details about the data being processed. Also, the results of all relevant medical information from the DNA would likely be pretty personally identifying anyway, and would need to be read out somewhere. Unless you really did have a special appliance for readout of results, the system could be easily compromised by any determined party.

Re:New?

[pepty]

Researchers realized that the complex algorithms used during genetic tests could be closely approximated by the two basic mathematical operations. Lattice cryptology enabled homomorphic encryption, allowing computers to analyze encrypted data and return encrypted results without ever being able to decode the information.

I can't see how it would be very useful for actual genetic research either, since researchers generally need the decoded information as well as personal and family medical history when interpreting the results. The 10^9 higher computational overhead would also be a huge problem in research since, unlike a medical test where you know a pattern and are just trying to find out whether a single sample matches it, you are instead trying to find patterns shared by a group of genomes associated with a similar medical problem but which are otherwise infrequent.

Re:New?

[Immerman]

I think the idea is mainly that you don't want to have to completely resequence your genome every time you want to test for something new - after all we could be discovering new medically-relevant genetic properties for centuries, and the company doing the sequencing doesn't necessarily know or care about every potentially interesting finding, so you keep it on file somewhere. If costs continue to follow the current trend the first factor will likely only be an issue for a decade or two, before the price drops so far that collecting the sample is more expensive than analyzing it, but then radical exponential changes have a tendency to run into unexpected brick walls which may or may not be surmountable. Meanwhile local analysis by your doctor is unrealistic unless there's some handy-dandy "insert DNA and standardized analysis parameters" software available - which would absolutely be the sane thing to do, but then so would having all cars on the planet using only one of 5 models of alternator. I'll believe it will happen when I actually see it.

I would agree that the ideal situation, if sequencing your complete DNA falls to trivial cost, would likely be to simply do the full sequencing and analysis on the same machine, and never let the raw DNA data leave the machine at all. Especially if your doctor can order up tests for arbitrary "cutting edge" genetic markers that might be relevant to your case rather than just selecting from a list of available options.

As for data-size, that was mainly just an aside acknowledging one of the potential costs of encryption - I would presume that if you're using homomorphic encryption then you don't want to deal with decompressing 1.5GB of encrypted data while under the influence of the extreme computational amplification just to examine a handful of bits. Not when 1.5GB of storage space is so cheap. In fact if you were doing anything more sophisticated then you probably want to store your encrypted data in as close to the optimal processing format as reasonably possible, even if it increases data size considerably. Not to mention I believe the article said they had managed something like a thousandfold performance increase by severely restricting the available homomorphic operations, which might well make decompression impossible. 0.2 seconds to perform a single risk-factor check is one thing, 200 seconds times every risk factor you want to look for could add up really fast.

Re:New?

[tragedy]

I think what they're really trying to sell in this article is saving everyone's data in a central repository where everyone's DNA could be mined for data without compromising their privacy. That's effectively impossible. The only way to do it would be to perform operations that examine the entire database to produce a sigle result. The required computing power/time would be astronomical under this model. Pretty much every other way of doing it allows you to narrow down a particular patients DNA and extract all kinds of identifying information. Enough, for example, for a three letter agency to compare against a sample of DNA they have on hand. Really, you can either make the system too difficult to do anything practical with and secure, or you can make it useful and insecure. Anything else is just a pipe dream or snake oil.

Re:New?

[Immerman]

Sounds like a good sales pitch, but how would homomorphic encryption enable such an anonymous data-mining paradise? As I understand it such encryption allows you to process the data without decrypting it, but the results are themselves encrypted with the same key. And if you have the key to access the results then you don't need the ability to process data without decrypting it.

I would assume that each DNA record has it's own key (otherwise it kind of defeats the point), and that you can't mix the processing of data encrypted with different keys. Granted those two I'm just not seeing any way that an encrypted DNA database would be useful as anything but a giant encrypted back-up. Unless of course some three-letter agency arranged for a back-door in the encryption algorithm.

Also, on further reflection I think compression would in fact be necessary for secure encryption, probably starting with converting every DNA sequence to a diff from some standardized reference - otherwise you've got a database full of encrypted data where you know what 99.8% of the unencrypted data in each file is. Forget the 500x increase in necessary storage capacity, that's *got* to open a few gaping attack vectors.

Re:New?

[tragedy]

Sounds like a good sales pitch, but how would homomorphic encryption enable such an anonymous data-mining paradise?

Well partly by being effectively backdoored from the start. It seems unrealistic to believe there wouldn't be some sort of backdoor from the start to fix things when they break in the large, complex, inpenetrable data set. After things are pretty stable, the developers will be reluctant to get rid of the back door because of the large number of times they would have had to rebuild entirely from scratch if they didn't have the back door, and it will hang around forever. Mostly, however, there's the simple fact that, for it to be useful, the data has to come out somewhere. Like the front ends of pretty much every otherwise ironclad security system this well not only be completely vulnerable, but people will say: "There's all this useful data in here for research/marketing/random number seeds for bingo, and it's completely secure, so let's mine the data."

Also, on further reflection I think compression would in fact be necessary for secure encryption, probably starting with converting every DNA sequence to a diff from some standardized reference - otherwise you've got a database full of encrypted data where you know what 99.8% of the unencrypted data in each file is. Forget the 500x increase in necessary storage capacity, that's *got* to open a few gaping attack vectors.

A very good point. And a very big problem. The majority of the genome, everyone shares with each other. But there's plenty of stuff in there that exists in say 5% of the population. Unless you actually have an open database of patient data that you can mine to determine the majority of unique sequences out there, then even the heavily compressed version is still going to be full of duplicate sequences that exist in relatively small percentages of the population and overlapping with other sequences that are also duplicated across a small percentage of the population, etc.

Re:New?

[Immerman]

Why would an honest individual put in a back door in the encryption for "testing"? Just test with data you have the key to. Much simpler and doesn't inherently undermine the integrity of the system you're building. And how can things "break" within an immutable data file? When's the last time you saw a "broken" bitmap or text file that wasn't due to either a failed creation (probably not worth fixing), or corruption of the transmission or storage medium that can be solved with an error-correcting wrapper around the securely encrypted data?

Honestly, I don't see overlap within a subset of the individual genetic data as being a problem, you just need to make sure there's enough variation in the data that the known contents don't poison the encryption and allow nefarious access to the rest. Storage is cheap - your entire uncompressed DNA sequence is only about 1.5GB - less than $0.15 worth of storage space on an overpriced consumer drive. Remove 99.8% of that by diffing with a reference source and you're down to only 3MB per person.

Re:New?

[tragedy]

Why would an honest individual put in a back door in the encryption for "testing"? Just test with data you have the key to.

It doesn't take a dishonest individual. It's just fairly typical in such situations. It depends on who's actually in charge and if they run into problems.

Consider that the US nuclear launch codes were 00000000 for two decades. Consider that something like 30 billion dollars a day is spent in credit/debit card transactions based using a system with effectively _no_ security. Consider the failing grade nearly all large organizations receive pretty much every time they are audited for security. Even when their job is security, most organizations end up using short-term pragmatist modes of thought, and wait until things break before they fix it.

And how can things "break" within an immutable data file?

When it's new and not fully understood and the problems that will crop up when it's massively scaled haven't ben encountered yet and the code is new and buggy.

When's the last time you saw a "broken" bitmap or text file that wasn't due to either a failed creation (probably not worth fixing), or corruption of the transmission or storage medium that can be solved with an error-correcting wrapper around the securely encrypted data?

About 9 hours ago. Technically the file was undamaged, just transformed in way that's normal for the software, but it was still unreadable because the metadata regarding that file in a database disagreed about what transformations it had gone through. Something did go wrong, but it wasn't due to failed creation or corruption during transmission or storage. It was a bug that the file and the database were allowed to be in disagreement, but these things happen when the software isn't infallible.

Honestly, I don't see overlap within a subset of the individual genetic data as being a problem, you just need to make sure there's enough variation in the data that the known contents don't poison the encryption and allow nefarious access to the rest.

Might be, might not be. Depends on other conditions. For example: Someone does a study on an ethnic group that effectively all have certain genetic details in common and, after the study is done, the sequences from that group get added to the broader collection in one big dump. That very well may be exploitable and lead to other opportunities.

Maybe I'm being way too pessimistic. I've just been disappointed far too many times by the intersection of systems that should be secure with politics/greed/stupidity/arrogance/carelessness and other aspects of reality.

Re:New?

[Immerman]

Okay, yeah editing is an issue as well, but not one relevant to archives of immutable data.

Fair point about data dumps from focused studies, I'm sure some of them would indeed contain common elements that could open an attack vector, though I don't know how big a vector a few known bits in a 3MB file would actually make. Certainly nothing like having 99.8% be known. It probably wouldn't be racial studies that do it though, IIRC there's not actually any well-defined racial boundaries from a genetic perspective - there's not even one single solitary gene shared by most black people that isn't also present in a lot of whites and asians (and vice-versa), we just travel and intermix too much. It only takes one person with a bad case of wanderlust a thousand years ago to introduce a gene into a large portion of an otherwise isolated population.

Yeah, I can't argue against the incompetence card. In fact that's why I think homomorphic encryption could be a wonderful thing for genetics - it means that the sequenced DNA need never be stored in plaintext anywhere outside the sequencing machine, not even in volatile memory while being analyzed. There's still the risk that someone gets their hands on both the key and data, but a single "never, ever keep these two things in the same place" security rule would go a long way towards protecting against that, and has at least a chance of being followed.

Hmm, an extreme yet convenient solution: your doctor is the only one who has the key, and the genetic analysis lab is the only one that has the data. And both have serious patient confidentiality laws encouraging them to keep them secure. After all there's no need for either party to ever have the other information. Doc could give the lab only the public encryption key, and she only ever receives the final results of an analysis that only she, with the private key, can access. The encryption might not be perfectly secure, but it's a bajillion times better than having medical professionals ever dealing with your plaintext DNA file. It also reduces the risk that anyone is ever tempted to get nosy - unless there's a conspiracy the lab tech will never know the results of the analysis he initiates and the lab can keep the oversight committee informed about exactly what tests Doc has been requesting.

Re:New?

[tragedy]

Okay, yeah editing is an issue as well, but not one relevant to archives of immutable data.

True, but I'm not as confident as you that early versions of this will actually allow for immutable data. Avoiding all bugs that might require things to be re-encoded is a monumental task. Maybe they could pull it off. I would be truly, truly impressed.

It probably wouldn't be racial studies that do it though, IIRC there's not actually any well-defined racial boundaries from a genetic perspective - there's not even one single solitary gene shared by most black people that isn't also present in a lot of whites and asians (and vice-versa), we just travel and intermix too much. It only takes one person with a bad case of wanderlust a thousand years ago to introduce a gene into a large portion of an otherwise isolated population.

True. It depends a bit on the groups. Island populations, for example. Specific studies on people with a particular medical condition with a genetic link might be better example than people with particular ethnicities.

Yeah, I can't argue against the incompetence card. In fact that's why I think homomorphic encryption could be a wonderful thing for genetics - it means that the sequenced DNA need never be stored in plaintext anywhere outside the sequencing machine, not even in volatile memory while being analyzed. There's still the risk that someone gets their hands on both the key and data, but a single "never, ever keep these two things in the same place" security rule would go a long way towards protecting against that, and has at least a chance of being followed.

That is true. I think something like that could be accomplished without a method that makes calculations millions of times slower at best, however. I wish them the best of luck in developing these methods however. There might be potential in these methods in other fields, such as secure crypto-currencies, etc.

Re:New?

[Immerman]

What is there to go fixably wrong? You sequence the DNA to a 1.5GB file - if there's any problem in that stage you're hosed already. Then you do a binary diff to your reference sequence - that's a pretty thoroughly mature technology. Then you encrypt it - again, any problems = you're hosed. And if we're working on the assumption that the lab has no access to the data once it leaves the sequencer as a 3MB encrypted file then they would be hard-pressed to fix anything in the data anyway, at most they could reformat it into something more efficient to process, but that would seem a risky undertaking when you have no access the data to verify that you didn't just hose things completely.

Besides, if re-sequencing from scratch is cheap then there's no particular reason to keep the data around for extended periods, you're really just making sure the data and key are stored in independent locations until all desired analysis has been performed. The only reason I can think of for long-term storage is as something like a police database, and if the data is secure that's useless - it's not like you can sequence some DNA from a crime scene and then go looking for a matching sequence in the database - it would have to also be encrypted with the same key as the original in order to find a match.

I too would prefer something that didn't make calculations millions of times slower, but that's the purist engineer in me. From a practical standpoint if 99% of the use cases amount to "do these few bytes match" tests that can be done in a fraction of a second despite that handicap, then you're paying a pretty small price for a huge leap in security. It might not be suitable for research and other specialty purposes, but there's no reason researchers need follow the same protocol - the lab can send the encrypted sequence to the researchers, who then decrypt it with their key and handle their own security as they see fit. This would just be a way to make sure that the vast bulk of sequencing done for routine medical tests don't run the risk of publishing patients DNA.

Re:New?

[tragedy]

What is there to go fixably wrong? You sequence the DNA to a 1.5GB file - if there's any problem in that stage you're hosed already. Then you do a binary diff to your reference sequence - thWhat is there to go fixably wrong? You sequence the DNA to a 1.5GB file - if there's any problem in that stage you're hosed already. Then you do a binary diff to your reference sequence - that's a pretty thoroughly mature technology. Then you encrypt it - again, any problems = you're hosed. And if we're working on the assumption that the lab has no access to the data once it leaves the sequencer as a 3MB encrypted file then they would be hard-pressed to fix anything in the data anyway, at most they could reformat it into something more efficient to process, but that would seem a risky undertaking when you have no access the data to verify that you didn't just hose things completely.at's a pretty thoroughly mature technology. Then you encrypt it - again, any problems = you're hosed. And if we're working on the assumption that the lab has no access to the data once it leaves the sequencer as a 3MB encrypted file then they would be hard-pressed to fix anything in the data anyway, at most they could reformat it into something more efficient to process, but that would seem a risky undertaking when you have no access the data to verify that you didn't just hose things completely.

Well that's pretty much the point. If the model of the system is so secure that you're hosed if anything at all goes wrong, most people are going to hedge their bets by putting in a back door so they can try to fix things. When you're going to have to tell your clients to redo millions of dollars of really expensive data entry if anything goes wrong, you're going to be under a fair amount of pressure to make sure that doesn't happen. One way to do that is to secretly break your security model. It happens all the time.

Agree on all the rest, I just have a lot of faith in human nature. I was just looking at my showerhead. It has a swiveling plastic ball joint through which water flows. Past that ball joint is a hook arrangement the showerhead hangs on, then a flexible hose leading to the showerhead. I've had more than one showerhead with this basic design and the ball joints tend to wear out and start spraying water around. The thing is, the swiveling joint swivels so that you can position the showerhead when it's hanging up, but the water goes from that ball joint to a flexible hose so that you can detach the showerhead. The ball joint isn't completely pointless in the design, but having the joint carry water is pointless. So, it's either very poorly thought out by someone who should know better, or intentionally designed that way to ensure that it doesn't last too long and you'll buy another one. Either way, that just helps bolster my faith in human nature... also, I really need to be the one to pick a showerhead the next time one wears out.

Re:New?

[Immerman]

I wish I could argue against your faith, but I've seen too many examples myself.

Think of this though - who is the customer for the DNA lab? Individual citizens on doctor's orders. And what exactly happens today if it turns out that there was a problem/something really unexpected with the last set of tests? Seems like mostly Doc sends you to get them done again. As long as that doesn't change with sequencing neither Doc nor the lab has much incentive to have the records around indefinitely, especially if a fresh sequencing only costs a few tens of dollars (billed rates may vary)

I would agree with you on the convenience of a back door if you were doing something sophisticated, where data might get shuffled around and reprocessed in multiple ways, but I just don't see any reason why you would want to do such a thing for DNA. Settle on a nice simple format for the data, create a validator to ensure your sequencer is in fact conforming to your well-defined format, and wrap the encrypted result in a nice error-correcting wrapper to fix any bit-rot. Then run a whole bunch of data though the system with your own encryption keys to make sure everything works properly. Finally erase each file within a year for "added patient privacy" and "lack of data retention capacity" so that patient X needs to get resequenced from scratch if there's anything further to be examined later.

Also, from a less cynical perspective, there's no reason to assume the sequencing machine is built by the lab using it. It wouldn't be terribly difficult to require machine makers to use a nice secure non-backdoored encryption scheme. It wouldn't stop the lab from sequencing the DNA with their own key and then "trans-crypting" it with the patient key once they have their "black file" copy, but that's something that adds complexity and clear intent (with the associated liability exposure), and fear and laziness are pretty good human motivators as well.

Your mom's homomorphic

[Anonymous Coward]

So there.

People still care about slashdot?

[Anonymous Coward]

http://soylentnews.org

Re:People still care about slashdot?

[phantomfive]

Sadly, the story selection on that site is even worse than on slashdot.......

Re:People still care about slashdot?

[davester666]

they put out ads to hire experienced "editors", and timothy put up his hand.

Heard that term before somewhere...

[Anonymous Coward]

Since this type of encryption was recently brought up on Slashdot as an "IBM breakthrough," we may as well get Bruce Schneier's arguments debunking the practicality of it out of the way...

https://www.schneier.com/blog/...

Re:Heard that term before somewhere...

[cryptizard]

That is from over four years ago, which, in a field that moves as fast as cryptography, might as well be a lifetime. There have been at least five new generations of homomorphic encryption since then, to the point that it is trillions of times faster now than it was when he posted that.

Re:Heard that term before somewhere...

[Immerman]

Honestly I don't see much attack on the practicality there. He highlights the *cost* of the technique (*much* slower performance), but how much that effects the practicality is entirely domain-dependent. For example the a doctor in TFA performed a genetic risk assessment for some condition in 0.2 seconds. I guarantee you that was by far the fastest part of the entire process - if it takes minutes or hours instead of seconds to perform a thorough genetic workup in such a way that *nobody* except myself or possibly my doctor has the key necessary to decrypt the results then that's probably worth considering. What's an hour of compute time cost you compared to getting your DNA published for the world (and insurance agents) to see?

Re:Heard that term before somewhere...

[tragedy]

The main attack you can make on the practicality of this system is that it evisions encrypting the information on one server and then sending it out to another server to perform operations on it. If a test that takes .2 seconds is a billion times slower than it needs to be, that means that any garden variety computer can perform that test very, very quickly. You can use a fancy encryption method that may already be broken to send out the DNA to some virtual "lab" as if you were sending out a blood sample, or you can just do it more securely locally. Store it with a proven encyption method, then download it to a standalone machine with a custom network port only designed to receive encrypted DNA sequences from the server and some method to receive updated programs (maybe through flash drives), but that can't be compromised because it can never send out information on the network. That would actually be more secure.

What's being advertised in this article is a solution looking for a problem.

Re:Heard that term before somewhere...

[Immerman]

Sure, most genetic tests amount to looking at a few bits in one or more known places in the data - not exactly advanced calculus. Even with a billionfold performance penalty a desktop PC could probably perform at least a handful of tests in a timely fashion. As for the lab, I suppose I was thinking more about inevitable attempts at corporate lock-in than actual necessity.

For security though... how many doctors have you dealt with on a personal level? These aren't security professionals - their bains are already jam-packed full of random trivia about the human body, if something can go wrong security-wise it will. As Exhibit A I offer pretty much ever health care system in the world with electronic medical records. Homomorphic encryption would simply cut down drastically on what can go wrong, in most cases at only minimal cost. Yes, the tests might be a billion times slower than they could be, but if they still only take five minutes then it's not much of a price to pay for drastically increased security around such sensitive information, no matter how much it may offend our purist sensibilities.

Re:Heard that term before somewhere...

[tragedy]

Even with a billionfold performance penalty a desktop PC could probably perform at least a handful of tests in a timely fashion.

If that PC is slightly modified to be a trustworthy device with a proper security model, then there's no reason for the homomorphic encryption. The device can just decrypt the data first, then do every test necessary in a very timely fashion...

As for the lab, I suppose I was thinking more about inevitable attempts at corporate lock-in than actual necessity.

There... there you have have a very good point. This article screams of "force patients to store their DNA on your servers, but provide an argument that's reasonably convincing, even to security, experts that it's safe and secure and not subject to the complete sham that doctor/patient confidentiality has become in this day and age."

For security though... how many doctors have you dealt with on a personal level?

Lots. I currently work for a company that makes medical devices. Lots of clinical trial sites. Lots of opinions from doctors about exactly how things should work.

These aren't security professionals - their bains are already jam-packed full of random trivia about the human body, if something can go wrong security-wise it will.

Believe me, I know this very well by now. Many (not all) of these doctors are also pretty bad at mathematical concepts and sometimes some basic understanding of physical principles which I would have thought would be absolutely vital for them to understand in their specialties. Some manage this even while still being fairly brilliant. There are some in there who also clearly just mechanically worked their way through medical school. Regardless of where they fall on that spectrum, nearly all of them don't have the time or energy to do much worrying about security themselves.

Homomorphic encryption would simply cut down drastically on what can go wrong, in most cases at only minimal cost. Yes, the tests might be a billion times slower than they could be, but if they still only take five minutes then it's not much of a price to pay for drastically increased security around such sensitive information, no matter how much it may offend our purist sensibilities.

Pretty much useless in the fields I'm working in. For one thing, you have to understand that some of our devices produce datasets as big as the human genome in a single patient session, and those patients often have to go in for a lot of sessions. Also, as complicated as DNA itself is, most of the actual testing is going to be more or less of the form: read from position X; does it contain sequence Y? That's oversimplifying, I know, but it's broadly accurate. Analysis of just about any other medical dataset is going to be far more complicated. Where I'm working, there's no automated analysis. Doctors review the data and do diagnosis. Automated diagnostic tools are actually something we have on vague future roadmaps but they're not planned features of anything we're currently working on. They're also not really something that would appeal to 90% of the doctors we work with. Same is true in most of the medical industry. Either you need Doctors to review things, in which case you have to decrypt, or you're doing bioinformatics which is so computationally intensive that anything that would slow it down even a little would cause insane extra costs.

All that said, stored data should definitely be encrypted where practical. That's a no brainer. The cases where you can do anything useful with that data without actually decrypting it at some point are just very limited.

Re:Heard that term before somewhere...

[Immerman]

> Analysis of just about any other medical dataset is going to be far more complicated.
Agreed. It's also going to tend to be far less sensitive for the simple fact that it contains far less information about you and your predispositions with regard to health, intelligence, personality, appearance, and everything else with a strong genetic component. It seems to me that homomorphic encryption is a technology with a very narrow window of utility - to wit, protecting extremely sensitive data that needs minimal processing to extract useful results. Secure DNA analysis would seem to be one of the few areas where it could really shine. I mean who's seriously going to outsource secure data processing to the Amazon Cloud at a million-fold increase in required computational power, much less a trillion?

>Automated diagnostic tools are ... not really something that would appeal to 90% of the doctors we work with
I'm not surprised. Modern doctors are largely professional diagnosticians - I have even heard that organic chemistry is a pre-req for medicine not so much because it's particularly relevant (unless you're a research doctor you will probably never care about the chemistry itself), but because it's too complicated to reason your way through, instead requiring you be able to finely hone your instincts - a "gatekeeper" course before being confronted with the even more difficult challenge of patient diagnosis.

Given that, I would not expect doctors to be at all enthusiastic about effective automated diagnostic tools, because an automated system promises to do what a doctor cannot hope to do - rationally analyze all the patient information in the context of the complete body of modern medical knowledge. And then whats left for the doctor to do? Surgeons will be needed for a while yet, but administering shots and setting bones isn't exactly rocket science, a good nurse with a "medical tricorder" could run circles around most doctors, destroying much of the social (and financial) prestige the occupation still holds.

We can't

[phantomfive]

We can't even keep credit card information private, and that's not just a matter of someone else's privacy, it's a matter of actually losing money.

What hope is there really of keeping your genome private if you are sending it across the internet?

Re:We can't

[nurb432]

Besides the 'internet security issue', its not that hard to get your DNA to test themselves if someone wants it.

Re:We can't

[phantomfive]

I was going to mention that, but I wasn't sure. Can you get a full genome sequenced from hair, or do you need a certain quantity of blood or something?

Re:We can't

[ubrgeek]

I'm still chuckling over the use of the words "private" and "cloud" in the same sentence...

Re:We can't

[jbmartin6]

Information wants to be free.

Re:We can't

[phantomfive]

"I'm still chuckling over the use of the words "private" and "cloud" in the same sentence..."

Wow, that's a quote that should go on the wall in every corporate board room.....

Re:We can't

[Kjella]

I was going to mention that, but I wasn't sure. Can you get a full genome sequenced from hair, or do you need a certain quantity of blood or something?

As far as I can tell you need full cells so hair that has been cut with a scissor no, but if you have a hair follicle pulled out by a hair brush that's enough. Any blood, saliva, semen or tissue sample will also do. a quick check suggests as little as 5 cells are needed so we're talking nanograms of material here.

Re:We can't

[Anonymous Coward]

We can't even keep credit card information private, and that's not just a matter of someone else's privacy, it's a matter of actually losing money.

Nice to know you value money over privacy. Remind me never to tell you anything in confidence.

Back on topic:
We release copies of our DNA everyday via normal biological processes. It's impossible to prevent it, unless you live in an air-tight self-contained enviroment seperate from everyone else and have no way in or out.

This won't work as the second this comes out one of two things will happen (or both).
1. Goverments will require that everyone must hand over an unencrypted copy of their genetics to law enforcement.
2. Goverments will simply make the use of such encryption illegal. (Cue the /. argument over the law being absolute and the right to question / defiy it.)

Not to mention that once someone has decoded your encrypted genetics, you would need to re-encrypt your DNA again, and you can bet that someone will be keeping records of the variations. This is yet another game of cat and mouse.

Plus what is the down side to this? To me (Disclaimer: I am not a genetics expert.) it would seem this could lead to more errors occuring during replication. Not to mention the effects of doing multiple encryptions on a person's DNA. Is there anyone who could comment on this?

Re:We can't

[phantomfive]

Nice to know you value money over privacy.

It's not a matter of what I value, it's just being honest about the priorities of the corporations who hold your data.

Remind me never to tell you anything in confidence.

Please don't.

Re:We can't

[Immerman]

If they're interested in *your* DNA specifically, no, technological measures won't stop it (though legally requiring licenses to possess gene sequencers and "informed consent" laws in regards to human DNA sequencing would go a long way towards holding back any GATTACA-esque abuses.

On the other hand, how valuable would a database of thousands or millions of people's unencrypted DNA be?

Re:We can't

[Immerman]

If it's important enough you can get a full DNA sequence from a single cell - DNA was designed to replicate, and it's not that hard to get it to do just that in the lab. If you've got hundreds/thousands/millions of cells then it makes it even easier since you can use "shotgun" sequencing techniques to accelerate the process dramatically. And that's still a pretty small sample - most animal cells are around 10-30um in diameter, so you're looking at 35,000-1,000,000 of the suckers in a 1mm cube sample.

Blood's probably not he best source though - unlike every other cell in the body, red blood cells have no nuclear DNA, so you'd be counting on whatever white blood cells or random floaters happened to also get caught.

Re:We can't

[CrimsonAvenger]

Remind me never to tell you anything in confidence.

Does the old saying "Three men can keep a secret, so long as two of them are dead" have any meaning for you?

Best way to keep your secrets is to not tell ANYONE.

Re:We can't

[TrollstonButterbeans]

"As far as I can tell you need full cells so hair that has been cut with a scissor no"

Ah, the 1980s where Lex Luthor can clone Superman from a strand of his hair in Superman IV.

Re:We can't

[thoughtlover]

a quick check suggests as little as 5 cells are needed so we're talking nanograms of material here.

Yup. Scientists discovered they could extract your DNA from your fingerprint ~2003. http://science.slashdot.org/st...

I don't know...

[Anonymous Coward]

"Called homomorphic encryption"

Sounds pretty gay.

Re:I don't know...

[Immerman]

Yeah, better stay away from homogenous beverages as well, just to be safe. If you don't have to shake before opening there's no telling *what* it's doing to your sexuality.

Window managers

[pingbat]

What's wrong with AES256 for protecting my Gnome?

Re: Window managers

[Anonymous Coward]

What's wrong with reading the article?

hehehe

[Sigvatr]

he said homo

Homomorphic

[Anonymous Coward]

Homo means gay, morphic means transform, so applying this procedure to our genes would transform all of us into gays. (yes, that's a joke)

Re:Homomorphic

[Anonymous Coward]

Or gay people into straight. Humanity might be saved after all.

Re:Homomorphic

[K. S. Kyosuke]

Sounds more like Power Rangers to me. You know, transforming people into something gay.

Re:Homomorphic

[Immerman]

It was a lousy joke.

>Homo means gay
Somebody needs to brush up on their Greek. Homo- as a prefix means "the same", as in homomorphic = the same form.
Or alone as Latin for "man" (as in Homo Sapien = intelligent man, versus homo erectus = upright man)

Yes, I'm perpetually annoyed by ignorant people sexualizing useful words, much less common prefixes. Why do you ask? We've got a perfectly good word for sex, it's even one of the coveted limited-edition single-syllable models reserved for only the most important concepts. Why must we perpetually degrade the language by throwing around euphamisms when everybody knows what we mean anyway?

Keep it

[Chemisor]

Encryption can be broken, especially the kind that exposes useful information about the plaintext as this one does. A much simpler alternative is to keep your genetic information in your own control, processing it on your own computer with open source software. You know, just what we already do with other sensitive information like passwords.

Re:Keep it

[cryptizard]

It doesn't expose any information about the plaintext. It exposes an interface which lets you manipulate the plaintext. Not the same thing.

Re:Keep it

[LargeMythicalReptile]

Hi. I'm a theoretical cryptographer.

Encryption can be broken,

Some implementations have been broken. Encryption itself is generally fine (as long as you go with well-studied, standardized methods). There is a point that encryption is always subject to real-world factors, but the most common libraries are pretty good. Whenever you read about a data breach in the news, it's not because encryption was broken--something else went wrong (and, frequently, exposed data that wasn't encrypted in the first place).

especially the kind that exposes useful information about the plaintext as this one does.

Homomorphic encryption does not expose useful information about the plaintext, although the article doesn't make that clear. You start with an encrypted input, perform an operation, and get an encrypted output. Only the person with the key--who is not the person performing the computation--can decrypt the result.

There is a somewhat-related but distinct concept, called "functional encryption", in which one can distribute a key associated with a function f. That key allows a user to take an encryption of x and obtain f(x)--but nothing else about x other than f(x), where "nothing else" has a mathematical formalization. So you could (conceptually) encrypt your entire medical record and give your doctor a key for the function that calculates the probability that you'll have a heart attack in the next five years. Then they'll be able to calculate that probability, but nothing else about you.

A much simpler alternative is to keep your genetic information in your own control, processing it on your own computer with open source software. You know, just what we already do with other sensitive information like passwords.

This I agree with, in an ideal world. Will we be living in such a world, 5, 10, or 20 years down the line? I don't know. Right now, the trends are largely in outsourcing everything--more and more, your data and computation live on the cloud. For medical information, your doctor doesn't do all the tests himself--he outsources them to a lab. For genetic information, 23andMe doesn't sell software that lets you analyze your own genetic markers--they take your information and perform the analysis on it themselves. So these trends will need to change before the above takes place.

It would be great to keep one's own data and get all the various analysis tools via FOSS. But someone needs to write and distribute those tools--as well as make it feasible to obtain one's own data in the first place (I don't know about you, but I don't have an MRI machine in my house). So until that world exists, homomorphic encryption is a potentially useful tool in this area.

[It also has uses beyond securely outsourcing computation, but that's somewhat off-topic.]

Re:Keep it

[Immerman]

Right, because I have the knowledge and equipment to sequence my own DNA make sense of the results.

Sure, encryption can be broken, and I don't know how far I'd trust IBMs 1st-generation homomorphic encryption, much less this "streamlined, high performance" version adapted by medical researchers, but it's a hell of a lot better than nothing.

Also, while I'm not an encryption expert, it sounds like homomorphic encryption doesn't actually expose useful information (at least not intentionally, I'm sure it opens up some new attack vectors, everything does). Encrypt A to get B. Apply operations f(B) to get C, decrypt C to get f(A). C is still encrypted gibberish.

So, assuming it's possible to do public/private key homomorphic encryption, my doctor could send a sample for sequencing along with a public key. DNA gets sequenced and encrypted (ideally both on the same non-networked hardware so that the plaintext data is never accessible to anyone), and the encrypted sequence is sent back to my doctor, archived in a public database, whatever.. Doc can then send it to a third-party DNA analysis firm in Nigeria, who perform all manner of analysis on it and send the reams of gibberish test results back. He then calls me in, the only holder of the private key, and I can then decrypt the results on my secure, open-source computer and present them for his interpretation and advice.

exactly how long would it take to die, and how?

[Thud457]

That requires a mitochondria upgrade at extra charge. Or else you might experience complications.

Re:exactly how long would it take to die, and how?

[JamieIanMacgregor]

and don't forget your key.

I just can't.

[LaminatorX]

I'm trying to say something intelligent involving homomorphic encryption with random seeds and salt that doesn't trigger the Beavis & Butthead reflex, but I just can't make it happen.

Would be more useful . . .

[Idou]

If I were not constantly releasing millions of copies of my DNA in the form of dead skin cells everywhere I go. Either my cells need to also adopt this encryption standard, or I need a lifestyle where I am completely self sufficient (including my waste disposal), never having to leave my home.

Even then, a gust of wind while I am in the backyard might be all that is required one day for someone's reader to catch my DNA and run a simulation to match with facial recognition.

Re:Would be more useful . . .

[Impy the Impiuos Imp]

Don't give the NSA and FBI ideas.

A few years back, the Supreme Court ruled they couldn't use IR scanners without a warrant on buildings. Although it was "broadcast" out to common areas, you historically had the expectation of privacy. Yey originalism and intent of Founding Fathers.

That atitude is dead as a doornail now (not that it wasn't always DOA in government reaching -- hence that case) but now it's even more of a struggle with Congress and the President acquiesing to all kinds of metadata stuff.

I still maintain historians will call this the "1984 " Era, because we stupidly built the tools of tyrrany for the same reason historical democracies all failed -- authorizing emergency powers to fight something.

Re:Would be more useful . . .

[Immerman]

I think the point is less to protect your personal DNA sequence, and more to protect the anonymity of databases/sequencing labs/doctors offices/etc. that are otherwise carrying around massive blinking "hack me" signs.

Re:Would be more useful . . .

[Idou]

Right, but why go through the trouble and risk of hacking someone else's database when it will soon be cheap enough to sequence directly yourself?

Obtain a used air filter of a building, and you may have the DNA of anyone who has been in that building for the last couple of days . . . legally.

Homomorphic encryption helps?

[sckienle]

I am not a cryptography expert, but I have been supporting genomic medicine for 10 years. For Homomorphic encryption to be of any use in research, or diagnostics, it is necessary to know that each genetic sequence is encrypted to the same results. That is XYZ for person 1 has to be the same genetic sequence as XYZ for person 2. Otherwise we are comparing apples to wood and the results are gibberish. So if XYZ is XYZ is XYZ, how is that any more secure, from a genetic profiling, etc. POV than the raw genetic sequence? It's like saying your SSN is safe, no one will know it is 123-45-6789, we "secured" it as abc-de-fghi but otherwise is just as unique in identifying you. Am I missing something here?

Re:Homomorphic encryption helps?

[Anonymous Coward]

Am I missing something here?

Yes (assuming that actually manage to achieve a fully homomorphic encryption (FHE) system):
"Using such a scheme, any circuit can be homomorphically evaluated, effectively allowing the construction of programs which may be run on encryptions of their inputs to produce an encryption of their output. Since such a program never decrypts its input, it can be run by an untrusted party without revealing its inputs and internal state."

Re:Homomorphic encryption helps?

[Kjella]

Near as I can tell, it's simply a way to outsource number crunching. Like for example in a paternity suit, you can encrypt the DNA of the people in question, hand it over to a cloud provider who'll give you a paternity index score but can't recover the actual DNA sequences involved. Okay, not best example. Say you have a huge number of samples like a genetic archive. You want to find "The people with genes XYZ, what other genetic differences do they have from the general population?", so you hand a cloud provider a million encrypted DNA sequences, say "I'm interested in knowing how these 300 differ from the rest, crunch it" Or you have one suspected rapist, compare this to everyone else in the database and tell me best full/partial matches.

What you get back are results saying which genes are often found/not found together wtih XYZ or what persons are matching but they're scrambled by the encryption. Only the one who encrypted it can decrypt it and discover what actual genes in the DNA material or actual people it's pointing to. Imagine if that was for example a criminal registry, even if you hacked the number cruncher you still can't svab a person and tell if he's on the registry or not. That said, it still looks like symmetric encryption so it doesn't let two institutions/systems compare data anonymously. Whoever can encrypt their data can also decrypt other's data encrypted to the same key. So you need one trusted place and it seems easier to just do the crunching there on the unencrypted material.

Re:Homomorphic encryption helps?

[Immerman]

To rephrase AC: using homomorphic encryption you:
Encrypt A to A*
Perform analysis on A* to get B* (the gibberish encrypted results)
Decrypt B* to get B.

So basically you, as some lab doing the analysis, has *no* idea what the incoming DNA is, nor what the results of your analysis are. All you need know is how to perform the analysis if they *weren't* encrypted. You can then send the encrypted results back to the doctor who sent you the encrypted DNA, and *she* (or the patient in question) can decrypt them to find out what they are.

Re: Can't

[Anonymous Coward]

A hair may be too little to do pyrosequencing, but you can absolutely test for certain traits.
But the point here I think it's that the info in the cloud could be used to increment the already unnerving databases used for marketing (and other) purposes. Try to get a hair from every person on earth!

You can't keep your genome private.

[Anonymous Coward]

Would be nice if you could keep your genome off the grid, but let's face it. Every newborn baby gets swabbed and its genome input somewhere. If the man wants your DNA he can get it a hundred different ways. And some relative of yours has already been input when they got busted or joined the military.

As a specimen of perfection you're welcome

[Anonymous Coward]

Take all the DNA you want so long as I don't have to pay child support. ;)

Genetic security through obscurity vs. cooperation

[Paul Fernhout]

So true. But DNA security is more that an issue of privacy. In the near future, understanding the human genome will make possible developing bioweapons targeted at individuals (with collateral damage) as well as bioweapons that could probably kill all humans exposed to the pathogen (like Ebola). We have, up to now, been protected by the obscurity and complexity of the issue. With advanced computers, vast data collection, and improved scientific understanding, creating individual and global bioweapons will become college-level biochemistry. Maybe not this decade, but probably within several decades (my guesstimate). In that sense, the movie GATTACA was a utopian fantasy, because people did not live in fear of apocalypse every day given everyone's DNA was known precisely and used for identification.

For current trends, consider recent US government activities (but other countries might do it too):
"U.S. Chases Foreign Leaders' DNA, WikiLeaks Shows"
http://www.wired.com/dangerroo...
"State Department representatives didn't immediately respond to questions about why diplomats need to acquire DNA and other biometric data on foreigners, what State does with any biometric information it gets, or how long the department retains it."

And also:
http://www.theatlantic.com/mag...
"The U.S. government is surreptitiously collecting the DNA of world leaders, and is reportedly protecting that of Barack Obama. Decoded, these genetic blueprints could provide compromising information. In the not-too-distant future, they may provide something more as well--the basis for the creation of personalized bioweapons that could take down a president and leave no trace. "

Unlike private encryption keys for a computer system, or a lock and key for your front door, you can't easily change your DNA if someone else gets a sample of it (like from a used drinking glass). In fact, so far, you can't significantly change your DNA at all. And the fact is, probably almost every citizen in the Western world already has taken some kind of medical test where potentially, if archived, their specific DNA would be available. So, we are probably already all compromised..

So, sadly, this trend towards increased genetic understanding may eventually mean the end of human day-to-day living as we know it in the near future (if not actual life). Individually targeted weapons are actually a lesser worry. Imagine a vast plague launched by some genetic-script kiddy showing off how "1eet" they are. Imagine a flu season where just everyone who gets it dies a few weeks after seemingly getting well -- and where everyone gets it. Or imagine perhaps 10 bad flu seasons in a row year after year, each with 30% mortality like the black plague.

Remember, unlike computer viruses, you can't right now just issue a patch for human DNA. And even if you could, the patch itself might be deadly. So avoidance may be the only option if the virus has been specifically designed to target some newly discovered human weakness in all human DNA.

Of course, we face similar risks in theory with nanotechnology, and groups like the Foresight Institute have discussed them. But, nanotechnology in the form of sophisticated mobile nanobots is still theoretical. Biotechnology and disease is a reality of our every day lives.

Preventing this risk of a 100% fatal designer plague would probably mean changing large aspects of how we live. This might include living in air-tight Biosphere-II-like structures and/or space habitats. Could it be that human tribalism and sparring at borders had evolutionary adaptive value to keep tribes mostly isolated to prevent disease transmission? Perhaps things might even go so far as never being in the physical presence of another human being and never receiving a physical object including food from outside your enclosure (

Seems like some cryptographers looking for funding

[Anonymous Coward]

This sounds more like inventing one more use case, so that one can tap into the huge funding available for biotech. Homomorphic encryption is currently well out-of-range from anything practical on any large datasets and will probably be so for a very long time.

ps. I'm a cryptographer myself.

Re:Genetic security through obscurity vs. cooperat

[phantomfive]

That's a long post

hmm, SHA512 from 1999-2001, 1977 DES .htpasswd

[raymorris]

That's an interesting comment. Consider hashes as one important part of cryptography. SHA2 is a current standard used by some up-to-date software, while a lot of systems don't support it yet. It's too new to be used everywhere, having been officially standardized thirteen years ago.

Millions of web sites use .htpasswd files which default to DES (1977) and that's just one example out of many software packages that call crypt() to get a DES hash.

I've thought of cryptography as careful, methodical, slow compared to other technology related disciplines.

Re:hmm, SHA512 from 1999-2001, 1977 DES .htpasswd

[cryptizard]

There's a huge gap between what researchers know and what is actually done in practice. Academia knew about padding attacks on TLS for a decade before someone actually made it into an exploit that forced developers to fix their code. Using your example, we already have SHA-3 even though you say no one uses SHA-2 yet.

Secret Sharing

[Anonymous Coward]

Secret Sharing is also a feasible way of securing genome data - it's like one-time pads used to split the data into multiple parts that are not usable by themselves, and doing secure multi-party computation on them. See http://sharemind.cyber.ee for an example solution using secret sharing - and this is not the only one.

Am I missing Something?

[smith6174]

I studied bioinformatics, but I've never understood this illusion of a bunch of goofball scientists toiling away in lab coats somewhere. Modern personal computers are more than capable of doing whatever analysis an individual user might want done. You want expert analysis of your results? Ask a doctor, who is already legally required to keep everything confidential.

n.n.n.n.s.a

[Anonymous Coward]

N.n.n.n.n.s.a.... please don't hack my d.d.d.d.d.n.a....