Performing secure queries from a higher security domain of information in a lower security domain

A computer system for a first entity in a higher security domain to query a second entity in a lower security domain, the system comprising:

• a memory;
• and
• a processor in communication with the memory, wherein the computer system is configured to perform a method comprising:
• generating, in the higher security domain, a public key and a secret key using a first homomorphic encryption scheme and passing the generated public key to a first shared security zone located between the higher security domain and the lower security domain and through the first shared security zone to the second entity in the lower security domain;
• passing a plain text query from the higher security domain to the first shared security zone, encrypting, in the first shared security zone, the plain text query using a second homomorphic encryption scheme to produce an encrypted plain text query, and passing the encrypted plain text query to the second entity in the lower security domain;
• performing, in the second entity in the lower security domain, an oblivious query based on the encrypted plain text query to generate an encrypted result, and passing the encrypted result from the lower security domain to a second shared security zone located between the higher security domain and the lower security domain via a data diode;
• passing the secret key from the higher security domain to the second shared security zone, and decrypting, in the second shared security zone, the encrypted result using the secret key to generate a plain text result;
• and
• passing the plain text result to the higher security domain.

A computer program product for a first entity in a higher security domain to query a second entity in a lower security domain, the computer program product comprising:

• a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to perform a method comprising:
• generating, in the higher security domain, a public key and a secret key using a first homomorphic encryption scheme and passing the generated public key to a first shared security zone located between the higher security domain and the lower security domain and through the first shared security zone to the second entity in the lower security domain;
• passing a plain text query from the higher security domain to the first shared security zone, encrypting, in the first shared security zone, the plain text query using a second homomorphic encryption scheme to produce an encrypted plain text query, and passing the encrypted plain text query to the second entity in the lower security domain;
• performing, in the second entity in the lower security domain, an oblivious query based on the encrypted plain text query to generate an encrypted result, and passing the encrypted result from the lower security domain to a second shared security zone located between the higher security domain and the lower security domain via a data diode;
• passing the secret key from the higher security domain to the second shared security zone, and decrypting, in the second shared security zone, the encrypted result using the secret key to generate a plain text result;
• and
• passing the plain text result to the higher security domain.