We're trying to build a packet sniffer that can search and quarantine malware in encrypted transactions without decrypting said transactions.
At present, we're exploring whether homomorphic encryption schemes can help us look for patterns that match rules (which are also encrypted). We're thinking of creating an on-premise solution that acts as a proxy for an API gateway.
Since HTTPS transmission uses a padded RSA, we believe we need to use re-encryption to make the ciphertext feasible to compute on. However re-encryption requires us to have the secret key and I think sending the secret key to this proxy would be unwise. Is this a valid prognosis if we were to implement it this way? This seems like the only way to achieve what we want and I'm hoping someone here has a better idea.
See Can we proxy-re-encrypt using homomorphic encryption schemes? on Cryptography Stack Exchange.
We're also looking into the paper Practical Techniques for Searches on Encrypted Data.
Other methods have been released since the time that this paper has been published but I usually see something along the lines of homomorphic encryption or MPC. Since throughput is an important metric for us, we're less inclined to go for the MPC route but we're still open to ideas.
Is this possible? Are we headed in the right direction?