Many countries use nation-wide citizen identifiers, which are typically stated on identity cards. However, for privacy and legal reasons, sensitive personal data should be processed and stored under pseudonyms: unique codes that enable a service to link information about the same person, without knowing the official citizen identifier.

The conversion from citizen identifier to pseudonym, and vice versa, is the task of a translator. This entity is ideally blind, meaning that it doesn’t see the identifiers or pseudonyms. However, the current generation of blind translators lacks quantum resistance.

Together with Smals, the joint ICT organization of Belgian public institutions, Belfort Labs showed that Fully Homomorphic Encryption (FHE) can do this translation more than 10 times faster than other state-of-the-art solutions, while staying quantum safe. Belfort defined a roadmap to build a secure, practical, ultra-fast and cost-effective solution, ready for deployment within months.

One patient, many organizations

National healthcare systems tend to be complex, with tens of thousands of caregivers such as doctors, physiotherapists, dentists and pharmacists, dozens of hospitals and many other organizations involved in storage, exchange and analysis of medical data. This data is usually not stored in one nation-wide database: several health services are responsible for specific categories of medical data. One may be responsible for cancer data, another one for fertility data and yet another one for prescription data.

Only caregivers need to know the true identity of the patient they are treating. Citizen identifiers are hidden from health services, which instead rely on unique pseudonyms. Caregivers only see citizen identifiers, and health services only see pseudonyms.

There’s still a catch: some entity should perform the translation between identifier and pseudonym. If such an entity could see both the identifier and pseudonym, it would carry a huge privacy risk. The translation, therefore, needs to happen blindly, even to the systems performing it, which is where FHE fits in perfectly.

A translator that cannot read

Encrypted computing is able to translate identifiers to pseudonyms, without exposing either of them. With this technology, the identifier enters the translator in encrypted form. The service applies the translation blindly and returns an encrypted pseudonym without intermediate decryption.

Under blind translation, authorized organizations get a consistent pseudonym they can match records on, and nobody gets to build a central list linking pseudonyms to real people.

Encrypted computing enables the flexibility required in real-world settings, where a wide range of use cases exist: converting pseudonyms back into identifiers, or into other pseudonyms. Additionally, the protection is future-proof: encrypted computing rests on mathematics that even a quantum computer cannot break, so a pseudonymized record stays protected during its entire lifetime.

Making it practical at national scale

Protection doesn’t come for free. Encrypted computation is demanding on compute resources, and a national service handling millions of requests a day will need dedicated hardware accelerators to keep it fast and efficient. Belfort is able to rapidly deploy cost-effective hardware acceleration to deliver the throughput required for such a translator service at scale.

The problem goes far beyond healthcare

Healthcare researchers want to connect genomic data with hospital histories, without either party disclosing patients’ identities. Clinical-trial sites wish to combine safety data without building a shared database of identifiable participants.

Banks face a similar challenge. Fraud spans several institutions, and privacy rules limit what financial institutions can share. With blind pseudonymization, they could match related activity without exchanging customer identities. A credit provider could weigh an applicant’s financial history without receiving a name or address.

In each case, organizations link what belongs together, without trusting an intermediary with access to the identities underneath.

What’s next?

For years, engineers have dismissed encrypted computing as promising, but impractical. Belfort’s software and purpose-built hardware are closing that gap.

Are you working on sensitive data sharing in healthcare, government, or financial services? We would like to hear what you are building and how Belfort can protect it.

‍

About Belfort

Belfort is building the foundation for trustless intelligence. Belfort builds encrypted computing (FHE) infrastructure so sensitive data can be processed without ever being decrypted. Spun out of KU Leuven’s COSIC lab, its hardware-software co-design makes this practical at scale. The company has offices in San Francisco, USA, and Leuven, Belgium. https://belfortlabs.com/