Encrypting genomic data for storage and genomic computations

[0001] The development of cloud storage and services has allowed users to offload both storage of their data and associated computations on that data. As a result, businesses can choose to forego the expensive proposition of maintaining their own data centers, relying instead on cloud storage and computational services.

[0002] One type of data amenable to cloud storage and computational services is genomic data. The field of genomics involves analyzing the function and structure of genomes. This includes DNA sequencing and genetic mapping, as well as the study of interactions between loci and alleles within the genome. Human genomic data can be mined to identify variants in genes that can contribute to diseases. However, a large and diverse genomic data set is needed to identify these genetic links. To this end large databases of genomic data are being established.

[0003] Genomic data encryption embodiments described herein generally maintain the privacy of genomic data via an encryption scheme which allows computations to be performed on the encrypted data without the need for decryption.

[0004] In one embodiment, the genomic data is first encoded as polynomials in a message space of a homomorphic encryption scheme. Then the encoded genomic data is encrypted using the homomorphic polynomial encryption scheme to produce a vector of ciphertexts, where each ciphertext represents a different sample of the genomic data and takes the form of a polynomial and its associated coefficients. The aforementioned computations on the encrypted genomic data are then performed on the vector or vectors of ciphertexts without decrypting the data.

[0005] With regard to the aforementioned encoding of the genomic data, in one embodiment this involves, for each real number making up the data, encoding the number by generating a bit decomposition of the number, converting the bit decomposition to a truncated bit decomposition {right arrow over (α)}=(α_k , , , α₀, α₋₁ , , , α_−u) based on the desired precision u, and then encoding the real number as a polynomial using

[0006] $e_{\alpha }\left(x\right)\stackrel{\mathrm{def}}{=}\sum _{i=0}^{k+u}{\beta }_i{x}^i\in R_2,$
where β_i=α_i−u and k+u is the total number of bits in the truncated bit decomposition. The encoded real number is then encrypted using an appropriate homomorphic encryption scheme. Computations can then be performed on the encrypted real number data without decryption to produce an encrypted result. In one embodiment, this involves computing on the encrypted real number data using an equation in the form of G(e_α)=Σ_i=0^Da_i·x^(D−i)u·e_αⁱ, where D is the degree of the polynomial and the a_i's are prescribed coefficients. The encrypted result can be decrypted using the appropriate homomorphic decryption. Then, the decrypted results are transformed using

[0007] $F\left(\tilde{\alpha }\right)=\frac{G\left(e_{\alpha }\right)\left(\mathrm{mod}\left(x-2\right)\right)}{2^{\mathrm{Du}}},$
and evaluated at x=2 to obtain {tilde over (α)}, which represents the truncated real number representing the results.

[0008] The foregoing encrypting, computations and decrypting can be accomplished by separate entities. For example, a user can encrypt the data and transmit it for storage in the cloud. In addition, while in the cloud, computations can be performed on the encrypted data, without decryption. The results of these computations can then be provided to an end user (who can be the encrypting user) in encrypted form. The end user then decrypts the results.

[0009] It should also be noted that this Summary is provided to introduce a selection of concepts, in a simplified form, that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

[0022] In the following description of genomic data encryption embodiments reference is made to the accompanying drawings which form a part hereof, and in which are shown, by way of illustration, specific embodiments in which the technique may be practiced. It is understood that other embodiments may be utilized and structural changes may be made without departing from the scope of the technique.

[0023] It is also noted that for the sake of clarity specific terminology will be resorted to in describing the genomic data encryption embodiments described herein and it is not intended for these embodiments to be limited to the specific terms so chosen. Furthermore, it is to be understood that each specific term includes all its technical equivalents that operate in a broadly similar manner to achieve a similar purpose. Reference herein to “one embodiment”, or “another embodiment”, or an “exemplary embodiment”, or an “alternate embodiment”, or “one implementation”, or “another implementation”, or an “exemplary implementation”, or an “alternate implementation” means that a particular feature, a particular structure, or particular characteristics described in connection with the embodiment or implementation can be included in at least one embodiment of the genomic data encryption. The appearances of the phrases “in one embodiment”, “in another embodiment”, “in an exemplary embodiment”, “in an alternate embodiment”, “in one implementation”, “in another implementation”, “in an exemplary implementation”, “in an alternate implementation” in various places in the specification are not necessarily all referring to the same embodiment or implementation, nor are separate or alternative embodiments/implementations mutually exclusive of other embodiments/implementations. Yet further, the order of process flow representing one or more embodiments or implementations of the genomic data encryption does not inherently indicate any particular order nor imply any limitations.

[0024] In genetics, a locus is the specific location of a gene or DNA sequence or position on a chromosome. A variant of the similar DNA sequence located at a given locus is called an allele. A single-nucleotide polymorphism (SNP) is a DNA sequence variation occurring when a single nucleotide in the genome (or other shared sequence) differs between members of a biological species or paired chromosomes in a human. In this case it is said that there are two alleles. Chromosomes having the same allele of a given gene at some locus are called homozygous with respect to that gene, while those that have different alleles of a given gene at a locus, are called heterozygous with respect to that gene.

[0025] It is advantageous to protect the privacy of individuals who donate their DNA to research, or patients undergoing genomic studies. This is particularly important for cloud storage of the genomic data and cloud-based computations performed using the stored data. These cloud-based computations take individuals' genomic data as input, which potentially compromises patient privacy, even in de-identified data sets. This is because it is possible to find the identity of a person using genomic data and publicly available records. Accordingly, many cloud storage solutions employ encryption on the user's data to preserve data privacy. Unfortunately, it is difficult to efficiently perform meaningful computations on encrypted data without decrypting the data first. The genomic data encryption embodiments described herein protect the privacy of individuals' genomic data while allowing these computational studies to be conducted without decryption.

[0026] More particularly the genomic data encryption embodiments described herein employ homomorphic encryption to encrypt encoded genomic data and then to compute on the encrypted data. To this end, referring to FIG. 1, in one embodiment genomic data is first encoded as polynomials in a message space of a homomorphic encryption scheme (process action 100). The encoded genomic data is then encrypted using the homomorphic polynomial encryption scheme to produce a vector of ciphertexts (process action 102). Generally the term “ciphertext” refers to an encrypted data set (e.g., an encrypted message, an encrypted data bit, encrypted text, etc.). In the context of the genomic data encryption embodiments described herein, the ciphertext refers to encrypted genomic data.

[0027] It is noted that each ciphertext in a ciphertext vector represents a different sample of the genomic data (e.g., a discrete sample of the genotype or genotype/phenotype pairing associated with a single-nucleotide polymorphism (SNP)) and takes the form of a polynomial and its associated coefficients. It is further noted that multiple ciphertext vectors can be generated, each of which could represent genomic data associated with a different locus. Once the genomic data is encoded and encrypted, it can be transmitted for storage and genomic computations (process action 104). This transmission can be via a computer network (such as the Internet).

[0028] With regard to the foregoing action of encrypting the encoded genomic data using a homomorphic polynomial encryption scheme, generally any appropriate homomorphic polynomial encryption method can be employed for this purpose. For example, in one embodiment, a somewhat homomorphic encryption (SwHE) scheme is employed. This SwHE scheme, represented by the expression SwHE=(SH.Keygen,SH.Enc,SH.Add,SH.Mult,SH.Dec), is associated with a number of parameters:

• • [0029] the dimension n, which is a power of 2;
  • [0030] the cyclotomic polynomial ƒ(x)=xⁿ+1;
  • [0031] the modulus q, which is a prime number such that q≡1(mod 2n) (together, n, q, and ƒ(x) define rings R=Z|x|/ƒ(x) and R_q=R/qR);
  • [0032] the error parameter σ, which defines a discrete Gaussian error distribution χ=D_Zn,σ with a standard deviation σ;
  • [0033] a prime number t<q, which defines the message space of the scheme as R_t=R/tR, the ring of integer polynomials modulo ƒ(x) and t; and
  • [0034] a number D>0, which defines a bound on the maximum number of multiplications that can be performed correctly using the scheme.

[0035] In one embodiment, the SwHE scheme is a function of the following component operations:

• • [0036] SH.Keygen(1^K): a key generation operation, which in one implementation includes (1) sampling a ring element s←χ, (2) defining a secret key sk=s, (3) sampling a uniformly random ring element a₁←R_q and an error e←χ, and (4) computing a public key pk=(a₀=−(a₁s+te), a₁);
  • [0037] SH.Enc(pk,m): an encoding operation, which in one implementation includes: (1) encoding the message m as a degree n polynomial with coefficients in Z_t—given the public key pk=(a₀,a₁) and a message mεR_q, the encryption algorithm samples u←χ and ƒ,g←χ, and (2) computing the ciphertext ct=(c₀,c₁)=(a₀u+tg+m,a₁u+tƒ); and
  • [0038] SH.Dec(sk, ct=(c₀, c₁, . . . , c_δ)): a decryption operation, which in one implementation includes: (1) decrypting by computing

[0039] $\tilde{m}=\sum _{i=0}^{\delta }{c}_i{s}^i\in R_q,$
and (2) outputting the message as {tilde over (m)}(mod t).

[0040] In addition, the SwHE scheme includes homomorphic operations SH.Add and SH.Mult. In one embodiment, in order to homomorphically compute an arbitrary function ƒ, an arithmetic circuit for ƒ (made of addition and multiplication operations over Z_t) may be constructed. The SH.Add and SH.Mult operations are used to iteratively compute ƒ on encrypted inputs. Although the ciphertexts produced by SH.Enc contain two ring elements, the homomorphic operations increase the number of ring elements in the ciphertext. In general, the SH.Add and the SH.Mult operations get as input two ciphertexts ct=(c₀, c₁, . . . , c_δ) and ct′=(c₀′, c₁′, . . . , c_γ′). The output of SH.Add contains max(δ+1, γ+1) ring elements, whereas the output of SH.Mult contains δ+γ+1 ring elements.

• • [0041] SH.Add(pk, ct₀, ct₁): Let ct=(c₀, c₁, . . . , c_δ) and ct′=(c₀′, c₁′, . . . , c_γ′) be two ciphertexts. Assume that δ=γ, otherwise, pad the shorter ciphertext with zeroes. Homomorphic addition is accomplished by component-wise addition of the ciphertexts. Namely, compute and output
    ct_add=(c₀+c₀′,c₁+c₁′, . . . ,c_max(δ,γ)+c′_max(δ,γ),)εR_q^max(δ,γ)
  • [0042] SH.Mult(pk, ct₀, ct₁): Let ct=(c₀, c₁, . . . , c_δ) and ct′=(c₀′, c₁′, . . . , c_γ′) be two ciphertexts. Let v be a symbolic variable and consider the expression

[0043] $\begin{array}{cc}\left(\sum _{i=0}^{\delta }{c}_i{v}^i\right)·\left(\sum _{i=0}^{\gamma }{c}_i^{\prime }{v}^i\right)\mathrm{over}{R}_q,& \left(1\right)\end{array}$
Eq. (1) can be decomposed by symbolically treating v as an unknown variable to compute ĉ₀, . . . , ĉ_δ+λεR_q such that for all vεR_q

[0044] $\begin{array}{cc}\left(\sum _{i=0}^{\delta }{c}_i{v}^i\right)·\left(\sum _{i=0}^{\gamma }{c}_i^{\prime }{v}^i\right)\equiv \sum _{i=0}^{\delta +\gamma }{\hat{c}}_i{v}^i& \left(2\right)\end{array}$
The output ciphertext is ct_mult=(ĉ₀, . . . , ĉ_δ+γ).

[0045] With regard to the foregoing action of transmitting the encoded and encrypted genomic data for storage and genomic computations, this can involve sending the data to cloud storage and performing the computations in the cloud as well. In this context, being “in the cloud” refers to computing concepts involving a large number of computers connected through a real-time computer network (such as the Internet). The encoded and encrypted data can be stored on one or more of these computers, and the aforementioned computations can be perform on one or more of these computers as well (either the same computer or computers, a different computer or computers, or any combination thereof).

[0046] FIG. 2 illustrates an example of the foregoing computing environment 200 for receiving encoded and encrypted genomic data from a user, storing the encrypted data, performing computations on the data without decrypting it first, and providing the results of the computations in the same encrypted form to the user. The user, as represented in the FIG. 2 by the user computer 202 (which is in communication with a computer network such as the Internet), encodes and encrypts the genomic data as described previously. This encrypted data 204 is transmitted via the computer network to a cloud storage and computation framework 206 (which can be one or more computers also in communication with the computer network). The encrypted genomic data 204 is received by one or more storage devices 208 residing within the cloud storage and computation framework 206. The aforementioned genomic computations are then performed on the encrypted data 204. In the depicted example one or more computation devices 210 residing within the cloud storage and computation system 206 obtain the stored encrypted data 204 from the storage device or devices 208 and perform the genomic computations without decrypting the data. The computation device or devices 210 then transmit the results of the genomic computations 212 to an end user. In the depicted example, the end user is the user computer 202 (although this need not be the case). It is noted that the results exhibit the same encryption as the genomic data. It is further noted that in other embodiments, the storage device or devices could also perform the computations and so act as the one or more computation devices.

[0047] Referring now to FIG. 3, an exemplary process for performing the aforementioned genomic computations is outlined. First, one or more computers (e.g., in the cloud) receive the encoded and encrypted genomic data (process action 300). As indicated previously this data includes at least one vector of ciphertexts, each ciphertext of which represents a different sample of the genomic data and takes the form of a polynomial and its associated coefficients. One or more computations are performed on the vector or vectors of ciphertexts without having to decrypt and decode the underlying genomic data (process action 302). These genomic computations correspond to statistical analyses that have been developed by computational biologists and statisticians to conduct genomic correlation studies on genomic data in populations. For example, as will be described in greater detail later, some of the genomic computations possible include the Pearson Goodness-of-Fit (Chi-Squared) Test to measure data quality, the Cochran-Armitage Test for trends on the correlations between genotypes and phenotypes, Estimation Maximization Algorithm for Haplotyping to estimate haplotype frequencies from genotype counts, and Linkage Disequilibrium statistic to estimate correlation between genes. These types of genomic computations involve multiplication and addition of the ciphertext vector(s).

[0048] Once the foregoing genomic calculations are complete, the results are provided to an end user (process action 304). It is noted that the end user can be the same entity that encoded and encrypted the genomic data in the first place (as shown in FIG. 2), or a different party that is authorized by the encoding and encrypting party to decrypt and decode the results. The results can be provided via a transmission over a computer network (such as the Internet).

1.1 Encoding and Encrypting Genotypes

[0049] For a plaintext m, the encryption of m is denoted as {circumflex over (m)}. For a single SNP, there are 3 possible genotypes which are represented as 0,1,2 with 1 being the heterozygous genotype and 0,2 being the homozygous genotypes. Additionally, there may be a missing genotype which is represented as −9.

[0050] The genotype numbers are encoded as elements in the ring

[0051] $R_q\stackrel{\mathrm{def}}{=}R/\mathrm{qR}$
where

[0052] $R\stackrel{\mathrm{def}}{=}Z\left[x\right]/\langle x^n+1\rangle$
(as described previously), and this encoding can be arbitrarily chosen as E_g:{0,1,2,−9}→R_q. To ensure that the coefficients of the encoding (in R_q) are small, the following further encoding is employed:

[0053] $\begin{array}{cc}{E}_g\left(z\right)\stackrel{\mathrm{def}}{=}\{\begin{array}{cc}-1& z=0\\ 0& z=1\\ 1& z=2\\ x^{\tau }& z=-9\end{array}\mathrm{where}\tau \stackrel{\mathrm{def}}{=}\log t& \left(3\right)\end{array}$
Note that t=2^τ is defined to be a power of 2.

[0054] Next, an indicator function g_i is defined by:

[0055] $\begin{array}{cc}{g}_i\left(z\right)=\{\begin{array}{cc}1& z=E_g\left(i\right)\\ 0& z\ne E_g\left(i\right)\end{array}& \left(4\right)\end{array}$

[0056] The input is a vector

[0057] $\stackrel{->}{z}\stackrel{\mathrm{def}}{=}{\left(z_1,,z_k\right)}^T\in \left\{-1,0,1,x^{\tau }\right\}$
of genotype samples. Let (2⁻¹)_q denote the inverse of 2 modulo q. Lagrange interpolation can be employed to find the polynomial computing each g_i. In one implementation, the following polynomials are computed (over R_q):

[0058] $\begin{array}{cc}{g}_0\left(z\right)\stackrel{\mathrm{def}}{=}{\left(2^{-1}\right)}_q·\left(z^2-z\right),g_1\left(z\right)\stackrel{\mathrm{def}}{=}\left(1-z^2\right)\left(1+z·x^{n-\tau }\right),g_2\left(z\right)\stackrel{\mathrm{def}}{=}{\left(2^{-1}\right)}_q·\left(z^2+z\right)& \left(5\right)\end{array}$
As a sanity check, note that for zε{−1,0,1}, g_i(z)=1 if z=E(i) and g_i(z)=0 if z≠E(i). When z=−9, it is desired that g_i(z)=0 always. This is not achieved exactly, but instead the functionally equivalent values are:
g₀(x^τ)=(2⁻¹)_q·(x^2τ−x^τ),g₁(x^τ)=(1−x^2τ)(1+xⁿ)=0,g₂(x^τ)=(2⁻¹)_q·(x^2τ+x^τ)  (6)

[0059] Note that g₁(x^τ)=0 because 1+xⁿ=0 in R_q. The case for g₀ and g₂ is different, but functionally equivalent because at decoding these polynomials will evaluate to 0. More particularly, to decode a polynomial p(x), p(x) mod t is computed where x=2 and mod t=x^τ. Accordingly, the encoding for a missing genotype, x^τ, decodes to 0 but its encoding is non-zero, guaranteeing that all encodings are distinct.

[0060] Further, as indicted previously, care is taken so that after the entire computation of the algorithm, there is no reduction mod xⁿ+1. This will guarantee that decoding gives the correct output. Therefore, if the algorithm it is desired to compute can be represented as a polynomial of degree D, care is taken to ensure that 2^D·τ<n.

[0061] Once the polynomials are computed and it has been determined there is no reduction mod xⁿ+1, the encryption can proceed as described previously.

1.1.1 Counting Genotype Frequencies

[0062] The first step in certain genomic computations is to compute genotype frequencies. For a specific genotype iε{0,1,2} the total number of samples with genotype i is computed (call it N_i) by summing over all samples z. In term of computing genotype frequencies on the now encrypted genomic data, in one embodiment, the following procedure for counting genotypes is employed. The genotype counts represent the aforementioned frequencies.

[0063] Given a vector of ciphertexts ({circumflex over (z)}₁ , , , {circumflex over (z)}_K) encrypting genotype samples in {−1,0,1,x^τ}, the genotype frequencies are counted using:
{circumflex over (N)}₀←Σ_k=1^Kg₀({circumflex over (z)}_k),{circumflex over (N)}₁←Σ_k=1^Kg₁({circumflex over (z)}_k),{circumflex over (N)}₂←Σ_k=1^Kg₂({circumflex over (z)}_k)  (7)
This produces ciphertexts {circumflex over (N)}₀, {circumflex over (N)}₁, {circumflex over (N)}₂ such that deg({circumflex over (N)}₀, {circumflex over (N)}₂)=2 and deg({circumflex over (N)}₁)=3, where {circumflex over (N)}₀, {circumflex over (N)}₁, {circumflex over (N)}₂ represent the encrypted genotype frequencies of the first homozygous genotype (0), the heterozygous genotype (1), and the second homozygous genotype (2), respectively.

[0064] In procedural terms, referring to FIG. 4, the foregoing genotype frequency computation involves first receiving a vector of ciphertexts each of which represents an encrypted genotype sample (process action 400). Then, an encryption of a count of each genotype present in the received vector of ciphertexts is computed as a measure of the frequency of that genotype (process 402). It is noted that this last action is performed without decrypting the genomic data.

1.1.2 Genomic Computations Using Encrypted Genotype Frequencies

[0065] Once the encrypted genotype frequencies are computed, various genomic computation can be performed using the encrypted data. For example, the aforementioned Pearson Goodness-of-Fit (Chi-Squared) Test, Estimation Maximization Algorithm for Haplotyping and Linkage Disequilibrium computations can be performed, as will be described in more detail in the sections to follow.

[0066] It is noted that certain definitions apply to the following descriptions of the genomic computations. For example, the χ² distribution with k degrees of freedom is defined as the distribution obtained from adding the squares of k independent standard normal random variables. In addition, the p-value of a test statistic T in comparison to distribution D is defined as the probability according to D of having observed an outcome at least as extreme as the value observed. For test statistics T>0, the p-value of T in comparison to D is Pr[D≧T]=1−CDF_D(T). For significance level α and p-value p, it is concluded that the deviation of T from D is statistically significant if p<α. Common significance levels are 0.05 and 0.01.

1.1.2.1 Pearson Goodness-of-Fit (Chi-Squared) Test

[0067] The Pearson Goodness-Of-Fit (Chi-Squared) Test is a test for deviations from Hardy-Weinberg Equilibrium. Hardy-Weinberg Equilibrium (HWE) is a principle that states that allele frequencies will stay the same from generation to generation unless perturbed by evolutionary influences. Equivalently, the HWE states that allele frequencies are independent. More formally, consider two alleles A and a and let p_A, p_a be their corresponding population frequencies, so that p_a=1−p_A. Similarly, let p_AA, p_Aa, p_aa be the corresponding population frequencies for genotypes AA, Aa, aa. Then alleles A and a are independent (and HWE holds) if:
p_AA=p_A²,p_Aa=2p_Ap_a,p_aa=p_a².  (8)

[0068] Let N_AA, N_Aa, N_aa be the observed counts for genotypes AA, Aa, aa, respectively, and let

[0069] $N\stackrel{\mathrm{def}}{=}{N}_{\mathrm{AA}}+N_{\mathrm{Aa}}+N_{\mathrm{aa}}$
be the total number of samples. Then the frequency of alleles A and a can be calculated by:

[0070] $\begin{array}{cc}{p}_A=\frac{2N_{\mathrm{AA}}+N_{\mathrm{Aa}}}{2N},p_a=1-p_A.& \left(9\right)\end{array}$

[0071] Thus, HWE indicates that the following counts are expected:

[0072] $\begin{array}{cc}{E}_{\mathrm{AA}}\stackrel{\mathrm{def}}{=}N{p}_A^2,E_{\mathrm{Aa}}\stackrel{\mathrm{def}}{=}2N{p}_A{p}_a,E_{\mathrm{aa}}\stackrel{\mathrm{def}}{=}N{p}_a^2.& \left(10\right)\end{array}$
Deviation from the HWE is tested by comparing the following test-statistic to the χ²-statistic with 1 degree of freedom (3 genotypes minus 2 alleles):

[0073] $\begin{array}{cc}{X}^2\stackrel{\mathrm{def}}{=}\sum _{i\in \left\{\mathrm{AA},\mathrm{Aa},\mathrm{aa}\right\}}\frac{{\left(N_i-E_i\right)}^2}{E_i}& \left(11\right)\end{array}$

[0074] To do this, the p-value p of X² is computed according to the χ²-distribution with 1 degree of freedom. It is then concluded that the data is in HWE only if p>α, for significance level α. When α=0.05, this reduces to checking if X²<3.84; and when α=0.01, this reduces to checking if X²<6.64.

[0075] The expected counts can be computed as:

[0076] $\begin{array}{cc}{E}_0={N\left(\frac{2N_0+N_1}{2N}\right)}^2,E_1=2N\left(\frac{2N_0+N_1}{2N}\right)\left(\frac{2N_2+N_1}{2N}\right),E_2={N\left(\frac{2N_2+N_1}{2N}\right)}^2,& \left(12\right)\end{array}$
which can be simplified to:

[0077] $\begin{array}{cc}{E}_0=\frac{{\left(2N_0+N_1\right)}^2}{4N},E_1=\frac{\left(2N_0+N_1\right)\left(2N_2+N_1\right)}{2N},E_2=\frac{{\left(2N_2+N_1\right)}^2}{4N}.& \left(13\right)\end{array}$
The test statistic X² can then be computed as:

[0078] $\begin{array}{cc}\begin{array}{c}{X}^2=\frac{{\left(N_0-E_0\right)}^2}{E_0}+\frac{{\left(N_1-E_1\right)}^2}{E_1}+\frac{{\left(N_2-E_2\right)}^2}{E_2}\\ =\frac{{\left(4N_0{N}_2-N_1^2\right)}^2}{4{N\left(2N_0+N_1\right)}^2}+\frac{{\left(4N_0{N}_2-N_1^2\right)}^2}{2N\left(2N_0+N_1\right)\left(2N_2+N_1\right)}+\frac{{\left(4N_0{N}_2-N_1^2\right)}^2}{4{N\left(2N_2+N_1\right)}^2}\\ =\frac{{\left(4N_0{N}_2-N_1^2\right)}^2}{2N}(\frac{1}{2{\left(2N_0+N_1\right)}^2}+\frac{1}{\left(2N_0+N_1\right)\left(2N_2+N_1\right)}+\\ \frac{1}{2{\left(2N_2+N_1\right)}^2})\end{array}& \left(14\right)\end{array}$
It therefore suffices to return encryptions of α, N, β₁, β₂, β₃, where:

[0079] $\begin{array}{cc}\alpha \stackrel{\mathrm{def}}{=}{\left(4N_0{N}_2-N_1^2\right)}^2,{\beta }_1\stackrel{\mathrm{def}}{=}2{\left(2N_0+N_1\right)}^2,{\beta }_2\stackrel{\mathrm{def}}{=}\left(2N_0+N_1\right)\left(2N_2+N_1\right),{\beta }_3\stackrel{\mathrm{def}}{=}2{\left(2N_2+N_1\right)}^2& \left(15\right)\end{array}$

[0080] In view of the foregoing, the Pearson Goodness-Of-Fit (Chi-Squared) Test can be performed using encrypted genotype frequencies as follows. The encrypted genotype frequency counts {circumflex over (N)}₀, {circumflex over (N)}₁, {circumflex over (N)}₂ with deg({circumflex over (N)}₀,{circumflex over (N)}₂)=2 and deg({circumflex over (N)}₁)=3 generated from the vector of ciphertexts ({circumflex over (z)}₁ , , , {circumflex over (z)}_K) encrypting genotype samples in {−1,0,1,x^τ} are input. Ciphertexts {circumflex over (α)},{circumflex over (N)}, {circumflex over (β)}₁,{circumflex over (β)}₂,{circumflex over (β)}₃ are then computed as follows:
{circumflex over (α)}←(4{circumflex over (N)}₀{circumflex over (N)}₂−{circumflex over (N)}₁²)² where deg({circumflex over (α)})=12;  (16)
{circumflex over (N)}←N₀+N₁+N₂ where deg({circumflex over (N)})=3; and  (17)
{circumflex over (β)}←2(2{circumflex over (N)}₀+{circumflex over (N)}₁)²
{circumflex over (β)}₂←(2{circumflex over (N)}₀+{circumflex over (N)}₁)(2{circumflex over (N)}₂+{circumflex over (N)}₁) where deg({circumflex over (β)}_i)=6
{circumflex over (β)}₃←2(2{circumflex over (N)}₂+{circumflex over (N)}₁)².  (18)

[0081] The ciphertexts {circumflex over (α)},{circumflex over (N)},{circumflex over (β)}₁,{circumflex over (β)}₂,{circumflex over (β)}₃ are then output (such as to the user as described previously). Once decrypted and decoded, X² can be computed such that:

[0082] $\begin{array}{cc}{X}^2=\frac{\alpha }{2N}\left(\frac{1}{{\beta }_1}+\frac{1}{{\beta }_2}+\frac{1}{{\beta }_3}\right).& \left(19\right)\end{array}$
1.1.2.2 Estimation Maximization for Haplotyping

[0083] Haplotypes cannot be exactly determined from genotypes. For example, consider two bi-allelic loci with alleles A,a and B,b. The genotype AaBb can be one of two possible haplotypes: (AB)(ab) or (Ab)(aB). Estimation Maximization (EM) is used to estimate haplotype frequencies from genotype counts. The EM procedure is an iterative method to estimate haplotype frequencies, starting with arbitrary initial values p_AB⁽⁰⁾, p_Ab⁽⁰⁾, p_aB⁽⁰⁾, p_ab⁽⁰⁾. These values are first used in an estimation stage to calculate the expected genotype frequencies (assuming the initial values are the true haplotype frequencies), and these, in turn, are used to estimate the haplotype frequencies for the next iteration in the maximization stage. The procedure stops when the haplotype frequencies have stabilized.

[0084] More particularly, in the ith estimation iteration:

[0085] $\begin{array}{cc}\begin{array}{c}{E}_{\mathrm{AB}/\mathrm{ab}}^{\left(i\right)}\stackrel{\mathrm{def}}{=}\left[N_{\mathrm{AB}/\mathrm{ab}}❘N_{\mathrm{AaBb}},p_{\mathrm{AB}}^{\left(0\right)},p_{\mathrm{Ab}}^{\left(0\right)},p_{\mathrm{aB}}^{\left(0\right)},p_{\mathrm{ab}}^{\left(0\right)}\right]\\ =N_{\mathrm{AaBb}}·\frac{p_{\mathrm{AB}}^{\left(i-1\right)}{p}_{\mathrm{ab}}^{\left(i-1\right)}}{p_{\mathrm{AB}}^{\left(i-1\right)}{p}_{\mathrm{ab}}^{\left(i-1\right)}+p_{\mathrm{Ab}}^{\left(i-1\right)}{p}_{\mathrm{aB}}^{\left(i-1\right)}}\end{array}& \left(20\right)\\ \begin{array}{c}{E}_{\mathrm{Ab}/\mathrm{aB}}^{\left(i\right)}\stackrel{\mathrm{def}}{=}\left[N_{\mathrm{Ab}/\mathrm{aB}}❘N_{\mathrm{AaBb}},p_{\mathrm{AB}}^{\left(0\right)},p_{\mathrm{Ab}}^{\left(0\right)},p_{\mathrm{aB}}^{\left(0\right)},p_{\mathrm{ab}}^{\left(0\right)}\right]\\ =N_{\mathrm{AaBb}}·\frac{p_{\mathrm{Ab}}^{\left(i-1\right)}{p}_{\mathrm{aB}}^{\left(i-1\right)}}{p_{\mathrm{AB}}^{\left(i-1\right)}{p}_{\mathrm{ab}}^{\left(i-1\right)}+p_{\mathrm{Ab}}^{\left(i-1\right)}{p}_{\mathrm{aB}}^{\left(i-1\right)}};\end{array}& \left(21\right)\end{array}$
and in the ith maximization iteration,
N_AB⁽ⁱ⁾=2N_AABB+N_AABb+N_AaBB+E_AB/ab⁽ⁱ⁾
N_ab⁽ⁱ⁾=2N_aabb+N_aaBb+N_Aabb+E_AB/ab⁽ⁱ⁾
N_Ab⁽ⁱ⁾=2N_AAbb+N_AABb+N_Aabb+E_Ab/aB⁽ⁱ⁾
N_aB⁽ⁱ⁾=2N_aaBB+N_AaBB+N_aaBb+E_Ab/aB⁽ⁱ⁾  (22)

[0086] Before running the EM procedure, the 9 genotype counts N_ij for i,jε{0,1,2} are computed. This can be done with the function ƒ_ij(z,z′)=g_i(z)·g_j(z′). In terms of the encrypted genotype frequency counts, the foregoing amounts to counting genotype frequencies for two loci.

[0087] More particularly, given two vectors of ciphertexts ({circumflex over (z)}₁ , , , {circumflex over (z)}_K), ({circumflex over (z)}′₁ , , , {circumflex over (z)}′_K) encrypting genotype samples in {−1,0,1,x^τ}, for loci 1 and 2 respectively, the genotype frequencies for two loci are counted using:
{circumflex over (N)}_ij←Σ_k=1^Kg_i({circumflex over (z)}_k)·g_j({circumflex over (z)}′_k) for i,jε{0,1,2}.  (23)
This produces ciphertexts {circumflex over (N)}₀₀, {circumflex over (N)}₁₀, {circumflex over (N)}₂₀, {circumflex over (N)}₀₁, {circumflex over (N)}₁₁, {circumflex over (N)}₂₁, {circumflex over (N)}₀₂, {circumflex over (N)}₁₂, {circumflex over (N)}₂₂ such that deg({circumflex over (N)}_ij)≦6.

[0088] In procedural terms, referring to FIG. 5, the foregoing frequency computation for two loci involves first receiving two vectors of ciphertexts, each vector representing encrypted genotypes from a different locus and each ciphertext of each vector representing an encrypted genotype sample from the locus associated with that vector (process action 500). Then, an encryption of a count of the pairings of each genotype from one of the vectors with each genotype from the other vector is computed as a measure of the frequency of that genotype pair (process 502). It is noted that this last action is performed without decrypting the genomic data.

[0089] Referring again to performing the EM procedure, the estimated haplotype frequencies p_*⁽ⁱ⁾ are real numbers. These can be substituted by the estimated haplotype counts

[0090] $N_{*}^{\left(i\right)}\stackrel{\mathrm{def}}{=}2N·p_{*}^{\left(i\right)}$
since this does not change the fraction in μ_AB/ab⁽ⁱ⁾ and μ_Ab/aB⁽ⁱ⁾ (essentially, this change multiplies both the numerator and the denominator by 4N²). This modifies the ith estimation iteration as follows:

[0091] $\begin{array}{cc}{E}_{\mathrm{AB}/\mathrm{ab}}^{\left(i\right)}=N_{11}·\frac{N_{\mathrm{AB}}^{\left(i-1\right)}{N}_{\mathrm{ab}}^{\left(i-1\right)}}{N_{\mathrm{AB}}^{\left(i-1\right)}{N}_{\mathrm{ab}}^{\left(i-1\right)}+N_{\mathrm{Ab}}^{\left(i-1\right)}{N}_{\mathrm{aB}}^{\left(i-1\right)}}\stackrel{\mathrm{def}}{=}\frac{{\alpha }^{\left(i\right)}}{{\beta }^{\left(i\right)}};& \left(24\right)\\ E_{\mathrm{Ab}/\mathrm{aB}}^{\left(i\right)}=N_{11}·\frac{N_{\mathrm{Ab}}^{\left(i-1\right)}{N}_{\mathrm{aB}}^{\left(i-1\right)}}{N_{\mathrm{AB}}^{\left(i-1\right)}{N}_{\mathrm{ab}}^{\left(i-1\right)}+N_{\mathrm{Ab}}^{\left(i-1\right)}{N}_{\mathrm{aB}}^{\left(i-1\right)}}\stackrel{\mathrm{def}}{=}\frac{{\gamma }^{\left(i\right)}}{{\beta }^{\left(i\right)}}.& \left(25\right)\end{array}$
It is also possible to simplify each iteration so that at any given point, only one numerator and one denominator are needed by defining:

[0092] $\begin{array}{cc}{\zeta }_{\mathrm{AB}}\stackrel{\mathrm{def}}{=}2N_{22}+N_{21}+N_{12};{\zeta }_{\mathrm{ab}}\stackrel{\mathrm{def}}{=}2N_{00}+N_{01}+N_{10};{\zeta }_{\mathrm{Ab}}\stackrel{\mathrm{def}}{=}2N_{20}+N_{21}+N_{10};{\zeta }_{\mathrm{aB}}\stackrel{\mathrm{def}}{=}2N_{02}+N_{12}+N_{01}.& \left(26\right)\end{array}$
Then:

[0093] $\begin{array}{cc}{N}_{\mathrm{AB}}^{\left(i\right)}={\zeta }_{\mathrm{AB}}+E_{\mathrm{AB}/\mathrm{ab}}^{\left(i\right)}={\zeta }_{\mathrm{AB}}+\frac{{\alpha }^{\left(i\right)}}{{\beta }^{\left(i\right)}}=\frac{{\zeta }_{\mathrm{AB}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}}{{\beta }^{\left(i\right)}};& \left(27\right)\\ N_{\mathrm{ab}}^{\left(i\right)}={\zeta }_{\mathrm{ab}}+E_{\mathrm{AB}/\mathrm{ab}}^{\left(i\right)}={\zeta }_{\mathrm{ab}}+\frac{{\alpha }^{\left(i\right)}}{{\beta }^{\left(i\right)}}=\frac{{\zeta }_{\mathrm{ab}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}}{{\beta }^{\left(i\right)}};& \left(28\right)\\ N_{\mathrm{Ab}}^{\left(i\right)}={\zeta }_{\mathrm{Ab}}+E_{\mathrm{Ab}/\mathrm{aB}}^{\left(i\right)}={\zeta }_{\mathrm{Ab}}+\frac{{\gamma }^{\left(i\right)}}{{\beta }^{\left(i\right)}}=\frac{{\zeta }_{\mathrm{Ab}}·{\beta }^{\left(i\right)}+{\gamma }^{\left(i\right)}}{{\beta }^{\left(i\right)}};& \left(29\right)\\ N_{\mathrm{aB}}^{\left(i\right)}={\zeta }_{\mathrm{aB}}+E_{\mathrm{Ab}/\mathrm{aB}}^{\left(i\right)}={\zeta }_{\mathrm{aB}}+\frac{{\gamma }^{\left(i\right)}}{{\beta }^{\left(i\right)}}=\frac{{\zeta }_{\mathrm{aB}}·{\beta }^{\left(i\right)}+{\gamma }^{\left(i\right)}}{{\beta }^{\left(i\right)}}.& \left(30\right)\end{array}$

[0094] At the next estimation iteration (i+1)th, the following is computed:

[0095] $\begin{array}{cc}\begin{array}{c}{E}_{\mathrm{AB}/\mathrm{ab}}^{\left(i+1\right)}=N_{11}·\frac{\left(\frac{{\zeta }_{\mathrm{AB}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}}{{\beta }^{\left(i\right)}}\right)\left(\frac{{\zeta }_{\mathrm{ab}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}}{{\beta }^{\left(i\right)}}\right)}{\begin{array}{c}\left(\frac{{\zeta }_{\mathrm{AB}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}}{{\beta }^{\left(i\right)}}\right)\left(\frac{{\zeta }_{\mathrm{ab}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}}{{\beta }^{\left(i\right)}}\right)+\\ \left(\frac{{\zeta }_{\mathrm{Ab}}·{\beta }^{\left(i\right)}+{\gamma }^{\left(i\right)}}{{\beta }^{\left(i\right)}}\right)\left(\frac{{\zeta }_{\mathrm{aB}}·{\beta }^{\left(i\right)}+{\gamma }^{\left(i\right)}}{{\beta }^{\left(i\right)}}\right)\end{array}}\\ =N_{11}·\frac{\left({\zeta }_{\mathrm{AB}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}\right)\left({\zeta }_{\mathrm{ab}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}\right)}{\begin{array}{c}\left({\zeta }_{\mathrm{AB}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}\right)\left({\zeta }_{\mathrm{ab}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}\right)+\\ \left({\zeta }_{\mathrm{Ab}}·{\beta }^{\left(i\right)}+{\gamma }^{\left(i\right)}\right)\left({\zeta }_{\mathrm{aB}}·{\beta }^{\left(i\right)}+{\gamma }^{\left(i\right)}\right)\end{array}}\stackrel{\mathrm{def}}{=}\frac{{\alpha }^{\left(i+1\right)}}{{\beta }^{\left(i+1\right)}}\end{array}& \left(31\right)\end{array}$
Similarly,

[0096] $\begin{array}{cc}{E}_{\mathrm{Ab}/\mathrm{aB}}^{\left(i+1\right)}=N_{11}·\frac{\left(\left({\zeta }_{\mathrm{Ab}}·{\beta }^{\left(i\right)}+{\gamma }^{\left(i\right)}\right)\left({\zeta }_{\mathrm{aB}}·{\beta }^{\left(i\right)}+{\gamma }^{\left(i\right)}\right)\right)}{\begin{array}{c}\left({\zeta }_{\mathrm{AB}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}\right)\left({\zeta }_{\mathrm{ab}}·{\beta }^{\left(i\right)}+{\alpha }^{\left(i\right)}\right)+\\ \left({\zeta }_{\mathrm{Ab}}·{\beta }^{\left(i\right)}+{\gamma }^{\left(i\right)}\right)\left({\zeta }_{\mathrm{aB}}·{\beta }^{\left(i\right)}+{\gamma }^{\left(i\right)}\right)\end{array}}\stackrel{\mathrm{def}}{=}\frac{{\gamma }^{\left(i+1\right)}}{{\beta }^{\left(i+1\right)}}& \left(32\right)\end{array}$

[0097] In other words, since the denominator, β⁽ⁱ⁾, of the N_*⁽ⁱ⁾'s always cancels out, only the numerators need be noted. The numerators depend on β⁽ⁱ⁾, so it is still computed as part of the numerator computation, but there is no need to keep track of it after this computation (with the exception that at the last iteration, it is necessary to divide by β⁽ⁱ⁾ to maintain correctness).

[0098] In view of the foregoing, the ith estimation iteration is,
α⁽ⁱ⁾=N₁₁·N_AB⁽ⁱ⁻¹⁾N_ab⁽ⁱ⁻¹⁾,γ⁽ⁱ⁾=N₁₁·N_Ab⁽ⁱ⁻¹⁾N_aB⁽ⁱ⁻¹⁾,β⁽ⁱ⁾=N_AB⁽ⁱ⁻¹⁾N_ab⁽ⁱ⁻¹⁾+N_Ab⁽ⁱ⁻¹⁾N_aB⁽ⁱ⁻¹⁾,  (33)
and the ith maximization iteration is,
N_AB⁽ⁱ⁾=ζ_AB·β⁽ⁱ⁾+α⁽ⁱ⁾,N_ab⁽ⁱ⁾=ζ_ab·β⁽ⁱ⁾+α⁽ⁱ⁾,N_Ab⁽ⁱ⁾=ζ_Ab·β⁽ⁱ⁾+γ⁽ⁱ⁾,N_aB⁽ⁱ⁾=ζ_aB·β⁽ⁱ⁾+γ⁽ⁱ⁾.  (34)

[0099] In each iteration, the degree goes from D to 2D+6. Starting with unencrypted estimations N_*⁽⁰⁾ (with degree 0), after m iterations the degree is 6·(2^m−1).

[0100] In view of the foregoing, the EM Algorithm for Haplotyping can be performed using encrypted genotype frequencies as follows. The two vectors of ciphertexts ({circumflex over (z)}₁ , , , {circumflex over (z)}_K),({circumflex over (z)}′₁ , , , {circumflex over (z)}′_K) encrypting genotype samples in {−1,0,1,x^τ}, for loci 1 and 2 respectively, and number of iterations m to be performed, are input, along with the ciphertexts {circumflex over (N)}₀₀, {circumflex over (N)}₁₀, {circumflex over (N)}₂₀, {circumflex over (N)}₀₁, {circumflex over (N)}₁₁, {circumflex over (N)}₂₁, {circumflex over (N)}₀₂, {circumflex over (N)}₁₂, {circumflex over (N)}₂₂ computed as described previously. Ciphertexts {circumflex over (η)}, {circumflex over (β)} are then computed as follows:
{circumflex over (ζ)}₁←2{circumflex over (N)}₁₁+{circumflex over (N)}₁₂+{circumflex over (N)}₂₁
{circumflex over (ζ)}₂←2{circumflex over (N)}₃₃+{circumflex over (N)}₃₂+{circumflex over (N)}₂₃//deg({circumflex over (ζ)}_i)=6;
{circumflex over (ζ)}₃←2{circumflex over (N)}₁₃+{circumflex over (N)}₁₂+{circumflex over (N)}₂₃
{circumflex over (ζ)}₄←2{circumflex over (N)}₃₁+{circumflex over (N)}₂₁+{circumflex over (N)}₃₂  (35)
{circumflex over (N)}←{circumflex over (N)}₀₀+{circumflex over (N)}₁₀+{circumflex over (N)}₂₀+{circumflex over (N)}₀₁+{circumflex over (N)}₁₁+{circumflex over (N)}₂₁+{circumflex over (N)}₀₂+{circumflex over (N)}₁₂+{circumflex over (N)}₂₂//deg({circumflex over (N)})=6;  (36)
{circumflex over (η)}₁⁽⁰⁾←{circumflex over (N)},{circumflex over (η)}₂⁽⁰⁾←{circumflex over (N)},{circumflex over (η)}₃⁽⁰⁾←{circumflex over (N)},{circumflex over (η)}₄⁽⁰⁾←{circumflex over (N)}//deg({circumflex over (η)}_i⁽⁰⁾)=6;  (37)
{circumflex over (β)}⁽⁰⁾←2//deg({circumflex over (β)}⁽⁰⁾)=0;  (38)
For each iteration i←1 to m
{circumflex over (α)}⁽ⁱ⁾←{circumflex over (N)}₂₂·{circumflex over (η)}₁⁽ⁱ⁻¹⁾{circumflex over (η)}₂⁽ⁱ⁻¹⁾  (39)
{circumflex over (γ)}⁽ⁱ⁾←{circumflex over (N)}₂₂·{circumflex over (η)}₃⁽ⁱ⁻¹⁾{circumflex over (η)}₄⁽ⁱ⁻¹⁾//deg({circumflex over (α)}⁽ⁱ⁾,{circumflex over (γ)}⁽ⁱ⁾)=6·(2ⁱ−1)  (40)
{circumflex over (β)}⁽ⁱ⁾←{circumflex over (η)}₁⁽ⁱ⁻¹⁾{circumflex over (η)}₂⁽ⁱ⁻¹⁾+{circumflex over (η)}₃⁽ⁱ⁻¹⁾{circumflex over (η)}₄⁽ⁱ⁻¹⁾//deg({circumflex over (β)}⁽ⁱ⁾)=6·(2ⁱ−2)  (41)
{circumflex over (η)}₁⁽ⁱ⁾←{circumflex over (ζ)}₁·{circumflex over (β)}⁽ⁱ⁾+{circumflex over (α)}⁽ⁱ⁾
{circumflex over (η)}₂⁽ⁱ⁾←{circumflex over (ζ)}₂·{circumflex over (β)}⁽ⁱ⁾+{circumflex over (α)}⁽ⁱ⁾//deg({circumflex over (η)}_j⁽ⁱ⁾)=6·(2ⁱ−1)
{circumflex over (η)}₃⁽ⁱ⁾←{circumflex over (ζ)}₃·{circumflex over (β)}⁽ⁱ⁾+{circumflex over (γ)}⁽ⁱ⁾
{circumflex over (η)}₄⁽ⁱ⁾←{circumflex over (ζ)}₄·{circumflex over (β)}⁽ⁱ⁾+{circumflex over (γ)}⁽ⁱ⁾  (42)
{circumflex over (η)}←{circumflex over (η)}₁^(m)//deg({circumflex over (η)})=6·(2^m−1)  (43)
{circumflex over (β)}←{circumflex over (β)}^(m)//deg({circumflex over (β)})=6·(2^m−2)  (44)

[0101] The ciphertexts {circumflex over (η)},{circumflex over (β)} are then output (such as to the user as described previously). Once decrypted and decoded, the estimated count for haplotype AB (i.e., N_AB) can be computed from η and β such that N_AB=η/β. It is noted that N_AB is used in calculating the scalar D for linkage disequilibrium as will be described next.

1.1.2.3 Linkage Disequilibrium

[0102] Linkage disequilibrium (LD) is an association in the alleles present at each of two sites in a genome (unlike HWE where it is assumed the alleles at each site are independent). Suppose A and a are possible alleles at site 1 and B and b are possible alleles at site 2, and let p_A, p_a, p_B, p_b be their corresponding population frequencies. Similarly, let p_AB, p_Ab, p_aB, p_ab be the frequencies of the haplotypes AB, Ab, aB, ab, respectively. Under linkage equilibrium, it is expected these frequencies are independent, ie., it is expected that:
p_AB=p_Ap_B,p_Ab=p_Ap_b,p_aB=p_ap_B,p_ab=p_ap_b  (45)

[0103] When the alleles are in linkage disequilibrium (LD), the frequencies will deviate from the values above by a scalar D, so that:
p_AB=p_Ap_B+D,p_Ab=p_Ap_b−D,N_aB=p_ap_B−D,N_ab=p_ap_b+D  (46)

[0104] This scalar D is calculated as D=p_ABp_ab−p_Abp_aB=p_AB−p_Ap_B. However, the range of D depends on the frequencies, which makes it difficult to use it as a measure of LD. One of two scaled-down variants is used instead, the D′-measure or the r²-measure.

1.1.2.3.1 D′-Measure

[0105] It is easy to show that max{−p_A p_B,−p_ap_b}≦D≦min{p_Ap_b,p_ap_B}, so that the maximum value D_max that |D| can take is:

[0106] $\begin{array}{cc}{D}_{\max }=\{\begin{array}{cc}\min \left\{p_A{p}_b,p_a{p}_B\right\}& D>0\\ \min \left\{p_A{p}_B,p_a{p}_b\right\}& D<0\end{array}& \left(47\right)\end{array}$
The D′-measure is then defined as

[0107] $\begin{array}{cc}{D}^{\prime }\stackrel{\mathrm{def}}{=}\frac{D}{D_{\max }}& \left(48\right)\end{array}$

[0108] The range of D′ is [0,1] with a value of 0 meaning complete equilibrium and a value of 1 meaning complete disequilibrium.

1.1.2.3.2 r²-Measure

[0109] The r² measure is given by:

[0110] $\begin{array}{cc}{r}^2\stackrel{\mathrm{def}}{=}\frac{X^2}{N}& \left(49\right)\end{array}$
where X² is the Pearson Goodness-of-Fit (Chi-Squared) Test statistic:

[0111] $\begin{array}{cc}{X}^2\stackrel{\mathrm{def}}{=}\sum _{i\in \left\{A,a\right\}j\in \left\{B,b\right\}}\frac{{\left(O_{\mathrm{ij}}-E_{\mathrm{ij}}\right)}^2}{E_{\mathrm{ij}}}& \left(50\right)\end{array}$
where

[0112] $O_{\mathrm{ij}}\stackrel{\mathrm{def}}{=}{N}_{\mathrm{ij}}$
is the observed count and

[0113] $E_{\mathrm{ij}}\stackrel{\mathrm{def}}{=}N{p}_i{p}_j$
is the expected count. Using the fact that |O_ij−E_ij|=ND, it can be shown that:

[0114] $\begin{array}{cc}{r}^2=\frac{D^2}{p_A{p}_B{p}_a{p}_b}& \left(51\right)\end{array}$
The range of r² is [0,1] with a value of 0 meaning perfect equilibrium and a value of 1 meaning perfect disequilibrium.
1.1.2.3.3 Linkage Disequilibrium Using Encrypted Genotype Frequency Counts

[0115] In view of the foregoing, LD measurement can be performed using encrypted genotype frequencies as follows. The two vectors of ciphertexts ({circumflex over (z)}₁ , , , {circumflex over (z)}_K), ({circumflex over (z)}′₁ , , , {circumflex over (z)}′_K) encrypting genotype samples in {−1,0,1,x^τ}, for loci 1 and 2 respectively, and number of iterations m to be performed, are input, along with the ciphertexts {circumflex over (N)}₀₀,{circumflex over (N)}₁₀,{circumflex over (N)}₂₀,{circumflex over (N)}₀₁,{circumflex over (N)}₁₁,{circumflex over (N)}₂₁,{circumflex over (N)}₀₂,{circumflex over (N)}₁₂,{circumflex over (N)}₂₂ computed as described previously. Ciphertexts {circumflex over (δ)}₁,{circumflex over (δ)}₂,{circumflex over (N)}_A,{circumflex over (N)}_a,{circumflex over (N)}_B,{circumflex over (N)}_b are then computed as follows:
{circumflex over (N)}←{circumflex over (N)}₀₀+{circumflex over (N)}₁₀+{circumflex over (N)}₂₀+{circumflex over (N)}₀₁+{circumflex over (N)}₁₁+{circumflex over (N)}₂₁+{circumflex over (N)}₀₂+{circumflex over (N)}₁₂+{circumflex over (N)}₂₂//deg({circumflex over (N)})=6  (52)
{circumflex over (R)}₀←{circumflex over (N)}₀₀+{circumflex over (N)}₀₁+{circumflex over (N)}₀₂,{circumflex over (R)}₁←{circumflex over (N)}₁₀+{circumflex over (N)}₁₁+{circumflex over (N)}₁₂,{circumflex over (R)}₂←{circumflex over (N)}₂₀+{circumflex over (N)}₂₁+{circumflex over (N)}₂₂  (53)
Ĉ₀←{circumflex over (N)}₀₀+{circumflex over (N)}₁₀+{circumflex over (N)}₂₀,Ĉ₁←{circumflex over (N)}₀₁+{circumflex over (N)}₁₁+{circumflex over (N)}₂₁,Ĉ₂←{circumflex over (N)}₀₂+{circumflex over (N)}₁₂+{circumflex over (N)}₂₂  (54)
{circumflex over (N)}_A←2{circumflex over (R)}₀+{circumflex over (R)}₁,{circumflex over (N)}_a←2{circumflex over (R)}₂+{circumflex over (R)}₁//deg({circumflex over (N)}_A,{circumflex over (N)}_a,{circumflex over (N)}_B,{circumflex over (N)}_b)=6  (55)
{circumflex over (N)}_B←2Ĉ₀+Ĉ₁,{circumflex over (N)}_b←2Ĉ₂+Ĉ₁  (56)
{circumflex over (η)},{circumflex over (β)}←EM({circumflex over (z)}₁ , , , {circumflex over (z)}_K,{circumflex over (z)}′₁ , , , {circumflex over (z)}′_K,m)//deg({circumflex over (η)})=6·(2^m−1),deg({circumflex over (β)})=6·(2^m−2)  (57)
{circumflex over (δ)}₁←2{circumflex over (N)}{circumflex over (η)}−{circumflex over (N)}_A{circumflex over (N)}_B{circumflex over (β)},{circumflex over (δ)}₂←2{circumflex over (N)}{circumflex over (β)}//deg({circumflex over (δ)}₁,{circumflex over (δ)}₂)≦6·2^m  (58)

[0116] The ciphertexts {circumflex over (δ)}₁,{circumflex over (δ)}₂,{circumflex over (N)}_A,{circumflex over (N)}_a,{circumflex over (N)}_B,{circumflex over (N)}_b are then output (such as to the user as described previously). Once decrypted and decoded, the LD measurement can be computed from δ₁, δ₂, N_A, N_a, N_B, N_b such that D=δ₁/δ₂

1.2 Encoding and Encrypting Phenotypes

[0117] In the same way an encoding E_g for genotypes is chosen, an encoding E_p is also chosen for phenotypes. There are two possible phenotypes, 0 and 1, with 0 being the unaffected phenotype and 1 being the affected phenotype. There also may be a missing phenotype, which is represented as −9.

[0118] In the case of phenotypes, the encoding can be arbitrarily chosen as E_p:{0,1,−9}→R_q. To ensure that the coefficients of the encoding (in R_q) are small, the following further encoding is employed:

[0119] $\begin{array}{cc}{E}_p\left(z\right)\stackrel{\mathrm{def}}{=}\{\begin{array}{cc}-1& z=0\\ 1& z=1\\ 0& z=-9\end{array}& \left(59\right)\end{array}$

[0120] For the purposes of the encrypted computations, a 2×3 contingency table of genotype/phenotype counts is needed. To this end, the input is a vector

[0121] $\stackrel{->}{z}\stackrel{\mathrm{def}}{=}{\left(z_1,,z_K\right)}^T\in \left\{-1,0,1,x^{\tau }\right\}$
of genotype samples, and a vector

[0122] $\stackrel{->}{y}\stackrel{\mathrm{def}}{=}{\left(y_1,,y_K\right)}^T\in \left\{0,1\right\}$
of phenotype samples. For each genotype/phenotype pair (i,j), it is desired to define an indicator polynomial h_i,j such that:

[0123] $\begin{array}{cc}{h}_{i,j}\left(z,y\right)=\{\begin{array}{cc}1& \left(z,y\right)=\left(E_g\left(i\right),E_p\left(j\right)\right)\\ 0& \left(z,y\right)\ne \left(E_g\left(i\right),E_p\left(j\right)\right)\end{array}& \left(60\right)\end{array}$

[0124] Here again, let (2⁻¹)_q denote the inverse of 2 modulo q. Lagrange interpolation can be employed to find the polynomial computing each h_i,j. In one implementation, the following polynomials are computed (over R_q):

[0125] $\begin{array}{cc}{h}_{i,1}\left(z,y\right)\stackrel{\mathrm{def}}{=}{g}_i\left(z\right)·{\left(2^{-1}\right)}_{q}2·\left(y^2+y\right)=g_i\left(z\right)·g_2\left(y\right),h_{i,0}\left(z,y\right)\stackrel{\mathrm{def}}{=}{g}_i\left(z\right)·{\left(2^{-1}\right)}_{q}2·\left(y^2-y\right)=g_i\left(z\right)·g_0\left(y\right)& \left(61\right)\end{array}$
Once the polynomials are computed, the encryption can proceed as described previously.
1.2.1 Counting Genotype/Phenotype Frequencies

[0126] The genomic computations also employ genotype/phenotype frequencies.

[0127] Given a vector of ciphertexts ({circumflex over (z)}₁ , , , {circumflex over (z)}_K) encrypting genotype samples in {−1,0,1,x^τ}, and vector of ciphertexts (ŷ₁ , , , ŷ_K) encrypting phenotypes in {−1,1,0}, in one embodiment the genotype/phenotype frequencies are counted using:
{circumflex over (N)}₀₀←Σ_k=1^Kg₀({circumflex over (z)}_k)·g₀(ŷ_k),{circumflex over (N)}₁₀←Σ_k=1^Kg₁({circumflex over (z)}_k)·g₀(ŷ_k),{circumflex over (N)}₂₀←Σ_k=1^Kg₂({circumflex over (z)}_k)·g₀(ŷ_k)
{circumflex over (N)}₀₁←Σ_k=1^Kg₀({circumflex over (z)}_k)·g₂(ŷ_k),{circumflex over (N)}₁₁←Σ_k=1^Kg₁({circumflex over (z)}_k)·g₂(ŷ_k),{circumflex over (N)}₂₁←Σ_k=1^Kg₂({circumflex over (z)}_k)·g₂(ŷ_k)  (62)

[0128] This produces ciphertexts {circumflex over (N)}₀₀,{circumflex over (N)}₁₀,{circumflex over (N)}₂₀,{circumflex over (N)}₀₁,{circumflex over (N)}₁₁,{circumflex over (N)}₂₁ such that deg({circumflex over (N)}_0j,{circumflex over (N)}_2j)=4 and deg({circumflex over (N)}_1j)=5. It is noted that {circumflex over (N)}₀₀ represents the encrypted genotype/phenotype frequency count of the first homozygous genotype (0)/unaffected phenotype (0), {circumflex over (N)}₁₀ represents the encrypted genotype/phenotype frequency count of the heterozygous genotype (1)/unaffected phenotype (0), {circumflex over (N)}₂₀ represents the encrypted genotype/phenotype frequency count of the second homozygous genotype (2)/unaffected phenotype (0), {circumflex over (N)}₀₁ represents the encrypted genotype/phenotype frequency count of the first homozygous genotype (0)/affected phenotype (1), {circumflex over (N)}₁₁ represents the encrypted genotype/phenotype frequency count of the heterozygous genotype (1)/affected phenotype (1), and {circumflex over (N)}₂₁ represents the encrypted genotype/phenotype frequency count of the second homozygous genotype (2)/affected phenotype (1).

[0129] In procedural terms, referring to FIG. 6, the foregoing genotype/phenotype frequency computation involves first receiving a vector of ciphertexts, each ciphertext of which represents an encrypted genomic sample and takes the form of an indicator polynomial and its associated coefficients which is indicative of a particular pairing of the genotypes and phenotypes (process action 600). Then, an encryption of a count of the pairings of each genotype and each phenotype is computed as a measure of the frequency of that genotype/phenotype pair (process 602). It is noted that this last action is performed without decrypting the genomic data.

1.2.2 Genomic Computations Using Encrypted Genotype and Genotype/Phenotype Frequencies

[0130] Once the encrypted genotype/phenotype frequencies are computed, various genomic computation can be performed using the encrypted data. For example, the aforementioned Cochran-Armitage test for trend computations can be performed, as will be described in more detail in the sections to follow. It is noted that the definitions described previously also apply to the following descriptions.

1.2.2.1 Cochran-Armitage Test for Trend (CATT)

[0131] The Cochran-Armitage test for trend is used for testing association between a candidate allele A and a disease in a case-control study. The input data is a 2×3 contingency table of 3 genotypes vs. case/controls, such as the exemplary table shown in FIG. 7.

[0132] The CATT computes the statistic:

[0133] $\begin{array}{cc}T\stackrel{\mathrm{def}}{=}\sum _{i=1}^3{w}_i\left(N_{1i}{R}_2-N_{2i}{R}_1\right)& \left(63\right)\end{array}$
where

[0134] $\overrightarrow{w}\stackrel{\mathrm{def}}{=}\left(w_1,w_2,w_3\right)$
is a vector of pre-determined weights, and the difference (N_1iR₂−N_2iR₁) can be thought of as the difference N_1i−N_2i after reweighing the rows to have the same sum.

[0135] The variance of this statistic can be computed as:

[0136] $\begin{array}{cc}\mathrm{Var}\left(T\right)=\frac{R_1{R}_2}{N}\left(\sum _{i=1}^3{w}_i^2{C}_i\left(N-C_i\right)-2\sum _{i=1}^{k-1}\sum _{j=i+1}^k{w}_i{w}_j{C}_i{C}_j\right)& \left(64\right)\end{array}$
The test statistic X² is then defined as follows and compared to a χ²-statistic with 1 degree of freedom:

[0137] $\begin{array}{cc}{X}^2\stackrel{\mathrm{def}}{=}\frac{T^2}{\mathrm{Var}\left(T\right)}& \left(65\right)\end{array}$

[0138] As in the Pearson Goodness-of-Fit (Chi-Squared) Test, the p-value p of X² according to the χ²-distribution with 1 degree of freedom is computed. It is then concluded that there is no association between the candidate allele and the disease if p>α, for significance level α. When α=0.05, this reduces to checking if X²<3.84; and when α=0.01, this reduces to checking if X²<6.64.

[0139] The weights {right arrow over (w)}=(w₁,w₂,w₃) are chosen as follows. The weights {right arrow over (w)}=(0,1,2) are used for the additive (co-dominant) model, {right arrow over (w)}=(0,1,1) for the dominant model (A is dominant over a), and {right arrow over (w)}=(0,0,1) for the recessive model (A is recessive to allele a).

1.2.2.2 Cochran-Armitage Test for Trend Using Encrypted Genotype/Phenotypes Frequency Counts

[0140] In view of the foregoing, CATT can be performed using encrypted genotype/phenotype frequencies as follows. A vector of ciphertexts ({circumflex over (z)}₁ , , , {circumflex over (z)}_K) encrypting genotype samples in {−1,0,1,x^τ}, a vector of ciphertexts (ŷ₁ , , , ŷ_K) encrypting phenotypes in {−1,0,1}, and vector of (plaintext) weights (w₀,w₁,w₂), are input, along with the ciphertexts {circumflex over (N)}₀₀,{circumflex over (N)}₁₀,{circumflex over (N)}₂₀,{circumflex over (N)}₀₁,{circumflex over (N)}₁₁,{circumflex over (N)}₂₁ representing the previously computed encrypted genotype/phenotype frequency counts. Ciphertexts {circumflex over (α)},{circumflex over (β)} are then computed as follows:
{circumflex over (R)}₀←{circumflex over (N)}₀₀+{circumflex over (N)}₁₀+{circumflex over (N)}₂₀,{circumflex over (R)}₁←{circumflex over (N)}₀₁+{circumflex over (N)}₁₁+{circumflex over (N)}₂₁//deg({circumflex over (R)}_i)=3  (66)
Ĉ₀←{circumflex over (N)}₀₀+{circumflex over (N)}₀₁,Ĉ₁←{circumflex over (N)}₁₀+{circumflex over (N)}₁₁,Ĉ₂←{circumflex over (N)}₂₀+{circumflex over (N)}₂₁//deg(Ĉ_i)=3  (67)
{circumflex over (N)}←{circumflex over (R)}₀+{circumflex over (R)}₁//deg({circumflex over (N)})=3  (68)
{circumflex over (T)}←Σ_i=0²w_i({circumflex over (N)}_i0{circumflex over (R)}₁−{circumflex over (N)}_i1{circumflex over (R)}₀)//deg({circumflex over (T)})=6  (69)
{circumflex over (α)}←{circumflex over (N)}·{circumflex over (T)}²//deg({circumflex over (α)})=15  (70)
{circumflex over (β)}←{circumflex over (R)}₀{circumflex over (R)}₁(Σ_i=0²w_i²Ĉ_i(N−Ĉ_i)−2Σ_i=0¹Σ_j=i+1²w_iw_jĈ_iĈ_j)//deg({circumflex over (β)})=12  (71)

[0141] The ciphertexts {circumflex over (α)},{circumflex over (β)} are then output (such as to the user as described previously). Once decrypted and decoded, the aforementioned test statistic X² can be computed from α,β such that X²=α/β

[0142] The genomic data encryption embodiments described herein are operational within numerous types of general purpose or special purpose computing system environments or configurations, as indicated previously. FIG. 8 illustrates a simplified example of a general-purpose computer system on which various embodiments and elements of genomic data encryption, as described herein, may be implemented. It is noted that any boxes that are represented by broken or dashed lines in the simplified computing device 10 shown in FIG. 8 represent alternate embodiments of the simplified computing device. As described below, any or all of these alternate embodiments may be used in combination with other alternate embodiments that are described throughout this document. The simplified computing device 10 is typically found in devices having at least some minimum computational capability such as personal computers (PCs), server computers, handheld computing devices, laptop or mobile computers, communications devices such as cell phones and personal digital assistants (PDAs), multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and audio or video media players.

[0143] To allow a device to implement the genomic data encryption embodiments described herein, the device should have a sufficient computational capability and system memory to enable basic computational operations. In particular, the computational capability of the simplified computing device 10 shown in FIG. 8 is generally illustrated by one or more processing unit(s) 12, and may also include one or more graphics processing units (GPUs) 14, either or both in communication with system memory 16. Note that that the processing unit(s) 12 of the simplified computing device 10 may be specialized microprocessors (such as a digital signal processor (DSP), a very long instruction word (VLIW) processor, a field-programmable gate array (FPGA), or other micro-controller) or can be conventional central processing units (CPUs) having one or more processing cores.

[0144] In addition, the simplified computing device 10 shown in FIG. 8 may also include other components such as a communications interface 18. The simplified computing device 10 may also include one or more conventional computer input devices 20 (e.g., pointing devices, keyboards, audio (e.g., voice) input devices, video input devices, haptic input devices, gesture recognition devices, devices for receiving wired or wireless data transmissions, and the like). The simplified computing device 10 may also include other optional components such as one or more conventional computer output devices 22 (e.g., display device(s) 24, audio output devices, video output devices, devices for transmitting wired or wireless data transmissions, and the like). Note that typical communications interfaces 18, input devices 20, output devices 22, and storage devices 26 for general-purpose computers are well known to those skilled in the art, and will not be described in detail herein.

[0145] The simplified computing device 10 shown in FIG. 8 may also include a variety of computer-readable media. Computer-readable media can be any available media that can be accessed by the computer 10 via storage devices 26, and can include both volatile and nonvolatile media that is either removable 28 and/or non-removable 30, for storage of information such as computer-readable or computer-executable instructions, data structures, program modules, or other data. Computer-readable media includes computer storage media and communication media. Computer storage media refers to tangible computer-readable or machine-readable media or storage devices such as digital versatile disks (DVDs), compact discs (CDs), floppy disks, tape drives, hard drives, optical drives, solid state memory devices, random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, magnetic cassettes, magnetic tapes, magnetic disk storage, or other magnetic storage devices.

[0146] Retention of information such as computer-readable or computer-executable instructions, data structures, program modules, and the like, can also be accomplished by using any of a variety of the aforementioned communication media (as opposed to computer storage media) to encode one or more modulated data signals or carrier waves, or other transport mechanisms or communications protocols, and can include any wired or wireless information delivery mechanism. Note that the terms “modulated data signal” or “carrier wave” generally refer to a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. For example, communication media can include wired media such as a wired network or direct-wired connection carrying one or more modulated data signals, and wireless media such as acoustic, radio frequency (RF), infrared, laser, and other wireless media for transmitting and/or receiving one or more modulated data signals or carrier waves.

[0147] Furthermore, software, programs, and/or computer program products embodying some or all of the various genomic data encryption embodiments described herein, or portions thereof, may be stored, received, transmitted, or read from any desired combination of computer-readable or machine-readable media or storage devices and communication media in the form of computer-executable instructions or other data structures.

[0148] Finally, the genomic data encryption embodiments described herein may be further described in the general context of computer-executable instructions, such as program modules, being executed by a computing device. Generally, program modules include routines, programs, objects, components, data structures, and the like, that perform particular tasks or implement particular abstract data types. The data extraction technique embodiments may also be practiced in distributed computing environments where tasks are performed by one or more remote processing devices, or within a cloud of one or more devices, that are linked through one or more communications networks. In a distributed computing environment, program modules may be located in both local and remote computer storage media including media storage devices. Additionally, the aforementioned instructions may be implemented, in part or in whole, as hardware logic circuits, which may or may not include a processor.

[0149] The foregoing description of the various genomic data encryption embodiments involved encoding the genomic data before encrypting it. The following describes another encoding embodiment that is designed to encode real numbers, and which can be employed for encoding genomic data.

[0150] For a real number αεR,

[0151] $\mathrm{decomp}\left(\alpha \right)\stackrel{\mathrm{def}}{=}\left({\alpha }_{k_{\alpha }},,{\alpha }_0,{\alpha }_{-1},\right)$
is defined to be the (possibly infinite) binary decomposition of α, so that:

[0152] $\begin{array}{cc}\alpha =\sum _{i=-\infty }^{k_{\alpha }}{\alpha }_i{2}^i.& \left(72\right)\end{array}$
For a sequence

[0153] $\overrightarrow{\alpha }\stackrel{\mathrm{def}}{=}\left({\alpha }_k,,{\alpha }_0,{\alpha }_{-1},,{\alpha }_{-s}\right),\mathrm{real}\left(\overrightarrow{\alpha }\right)\stackrel{\mathrm{def}}{=}\sum _{i=-s}^k{\alpha }_i{2}^i.$

[0154] The ring

[0155] $R\stackrel{\mathrm{def}}{=}Z\left[x\right]/\langle x^n+1\rangle$
is employed and λ is used to denote its expansion factor. For this specific ring, λ=n.

[0156] Now let αεR be a real number that it is desired to encode as a polynomial in R=Z[x]/xⁿ+1, and let u′ be the (decimal) precision it is desired to maintain. Let

[0157] $F\left(z\right)\stackrel{\mathrm{def}}{=}\sum _{i=0}^D{a}_i{z}^i$
be a degree-D polynomial that can be used in performing computations on the encoded (and encrypted using an appropriate homomorphic encryption scheme) real number data, i.e., it is desired to compute F(α) using decimal precision u′.

[0158] Let decomp(α)=(α_k , , , α₀, α₋₁,). Since it is desired to maintain decimal precision u′, binary precision

[0159] $u\stackrel{\mathrm{def}}{=}4u^{\prime }>{\log }_2\left(10\right)u^{\prime }$
will be maintained. Therefore only the truncated decomposition

[0160] $\stackrel{->}{\alpha }\stackrel{\mathrm{def}}{=}\left({\alpha }_k,,{\alpha }_0,{\alpha }_{-1},,{\alpha }_{-u}\right)\in {\left\{0,1\right\}}^{k+u+1}$
is considered, so that

[0161] $\tilde{\alpha }\stackrel{\mathrm{def}}{=}\mathrm{REAL}\left(\stackrel{->}{\alpha }\right)$
approximates α up to decimal precision u′. Computing

[0162] $F\stackrel{•}{\left(\alpha \right)}$
is the only concern.

[0163] For i=0,k+u,

[0164] ${\beta }_i\stackrel{\mathrm{def}}{=}{\alpha }_{i-u}\in \left\{0,1\right\}$
is defined and the encoding of α in R is defined as the polynomial:

[0165] $\begin{array}{cc}{e}_{\alpha }\left(x\right)\stackrel{\mathrm{def}}{=}\sum _{i=0}^{k+u}{\beta }_i{x}^i\in R_2.& \left(73\right)\end{array}$

[0166] The idea is then to perform the computation on e_α and decode by evaluating the resulting polynomial at x=2. However, note that e_α(2)=2^u·{tilde over (α)}. Therefore,

[0167] $\begin{array}{cc}F\left(\tilde{\alpha }\right)=F\left(\frac{e_{\alpha }\left(2\right)}{2^u}\right)=\sum _{i=0}^D\left(\frac{a_i}{2^{i·u}}\right)e_{\alpha }\left(2\right).& \left(74\right)\end{array}$

[0168] Multiplying by 2^Du results in:

[0169] $\begin{array}{cc}\begin{array}{c}{2}^{\mathrm{Du}}·F\left(\tilde{\alpha }\right)=\sum _{i=0}^D{a}_i·2^{\left(D-i\right)u}·{e_{\alpha }\left(2\right)}^i\\ =\sum _{i=0}^D{a}_i·x^{\left(D-i\right)u}·{e_{\alpha }\left(x\right)}^i\left(\mathrm{mod}\left(x-2\right)\right)\end{array}& \left(75\right)\end{array}$
where the last equality holds as long as there is no reduction modulo xⁿ+1, that is, as long as Du+D(k+u)=D(2u+└log α┘)<n.

[0170] Now define

[0171] $G\left(z\right)\stackrel{\mathrm{def}}{=}\sum _{i=0}^D{a}_i·x^{\left(D-i\right)u}·z^i.$
Then,

[0172] $\begin{array}{cc}F\left(\tilde{\alpha }\right)=\frac{G\left(e_{\alpha }\right)\left(\mathrm{mod}\left(x-2\right)\right)}{2^{\mathrm{Du}}}.& \left(76\right)\end{array}$
This means that to compute F({tilde over (α)}), simply compute G(e_α), evaluate the resulting polynomial at x=2, and divide by 2^Du. The function G is a transformation of the original function F, and is designed to be used in performing computations on the encoded encrypted real number data. Thus, the encrypted data will be plugged into that function G to carry out the actual computation on encrypted data. The reason for transforming the original function F into G is that the coefficients of the encrypted intermediate results stay smaller. This in turn allows for better parameters and more efficient schemes.

[0173] In procedural terms, referring to FIG. 9, the foregoing homomorphic polynomial encryption scheme for encrypting real numbers involves the encoding and encrypting entity (e.g., the aforementioned user as represented by the user computer) generating a bit decomposition of the real number to be encoded (process action 900). This corresponds to the previously introduced equation

[0174] $\mathrm{real}\left(\stackrel{->}{\alpha }\right)\stackrel{\mathrm{def}}{=}\sum _{i=-s}^k{\alpha }_i{2}^i$
for the bit decomposition sequence of the real number

[0175] $\stackrel{->}{\alpha }\stackrel{\mathrm{def}}{=}\left({\alpha }_k,,{\alpha }_0,{\alpha }_{-1},{\alpha }_{-s}\right).$
The bit decomposition is then converted to a truncated bit decomposition based on the desired precision (process action 902). Namely, the desired decimal precision u′ which corresponds to the binary precision u, as described previously. Thus, as described previously, the truncated bit decomposition

[0176] $\stackrel{->}{\alpha }\stackrel{\mathrm{def}}{=}\left({\alpha }_k,,{\alpha }_0,{\alpha }_{-1},,{\alpha }_{-u}\right)$
results. The truncated bit decomposition of the real number is then encoded using the polynomial

[0177] $e_{\alpha }\left(x\right)=\sum _{i=0}^{k+u}{\beta }_i{x}^i\in R_2,$
where β_i=α_i−u and k+u is the total number of bits in the truncated bit decomposition (process action 904). Then, in process action 906, the encoded real number is encrypted using an appropriate homomorphic encryption scheme. The encoded and encrypted real number data can then be provided to the entity or entities that perform storage and computations on the data (e.g., the previously described cloud-based entity or entities).

[0178] Referring now to FIG. 10, in process action 1000, the storage and computations entity or entities receive the encoded and encrypted real number, along with other similarly encoded and encrypted real numbers which form a data set (such as the previously described genomic data). The encoded and encrypted data set is then computed on using the equation G(e_α)=Σ_i=0^Da_i·x^(D−i)u·e_αⁱ, which is known along with the coefficients a_i to both the encoding and encrypting entity and the storage and computations entity or entities (process action 1002). It is noted that D is the degree of the polynomial function G (and F). It is also noted that the desired computations (e.g., one or more of the genomic computations described previously) are performed without decrypting the data. In process action 1004 the encrypted results are sent to the end user (e.g., the encrypting entity).

[0179] Referring now the FIG. 11, the end user receives the encrypted results (process action 1100), which are in the form of ciphertexts. The encrypted results are first decrypted using the appropriate homomorphic decryption scheme to recover the plaintext polynomials (process action 1102). Then, in process action 1104, the decrypted plaintext polynomials are transformed using Eq. (76) i.e.,

[0180] $F\left(\tilde{\alpha }\right)=\frac{G\left(e_{\alpha }\right)\left(\mathrm{mod}\left(x-2\right)\right)}{2^{\mathrm{Du}}},$
and evaluated at x=2 to obtain {tilde over (α)}, which represents the truncated real number representing the results.

[0181] It is also noted that any or all of the aforementioned embodiments throughout the description may be used in any combination desired to form additional hybrid embodiments. In addition, although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.