WO2019148335A1

WO2019148335A1 - Secure data processing

Info

Publication number: WO2019148335A1
Application number: PCT/CN2018/074627
Authority: WO
Inventors: Wenxiu DING; Zheng Yan
Original assignee: Nokia Technologies Oy; Nokia Technologies (Beijing) Co., Ltd.
Priority date: 2018-01-30
Filing date: 2018-01-30
Publication date: 2019-08-08
Also published as: EP3747150A1; EP3747150A4

Abstract

According to an example aspect of the present invention, there is provided there is provided an apparatus comprising at least one processing core, at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processing core, cause the apparatus at least to process, using two random numbers R1, R 2, a pair of input ciphertexts to obtain a masked ciphertext encrypted using a public key of a computation node, provide the masked ciphertext to the computation node and receive a response from the computation node, and process the response to remove the mask, to obtain at least one of: a first output ciphertext comprising a maximum value of plaintexts corresponding to the input ciphertexts and a second output ciphertext comprising a minimum value of plaintexts corresponding to the input ciphertexts, wherein the output ciphertext is encrypted under a public key.

Description

SECURE DATA PROCESSING

FIELD

The present invention relates to processing information in encrypted form, for example in a cloud service provision environment.

BACKGROUND

Cloud computing services provide off-site opportunities for individuals and corporations. For example, cloud storage service enables off-site storage of data sets in a flexible manner in a data centre, reducing the need for users of the cloud service to obtain their own storage hardware, for example for archiving purposes.

A further example of a cloud service is a cloud processing service, wherein a user is given access to processors of a computer or computing grid. This may be useful, for example where a user needs access to high-capacity computing intermittently, and obtaining actual high-capacity computing hardware would be wasteful as the hardware would mostly be unused, since the need is only intermittent.

Consumers may use cloud services to back up their data, for example during operating system updates of their devices, such as computers, smartphones and laptops. Some smart devices are configured to automatically upload images captured by users to a cloud storage service.

While useful, cloud services present high risk to users. Personal information may accidentally, or purposefully, be stored on a cloud storage service. Such personal information may become vulnerable to theft, unauthorised access and modification or eavesdropping either during transit to or from the cloud storage service, or while in the cloud storage service, especially when the cloud storage service is intruded or attacked by a malicious party. Thus, the cloud service provider may be untrusted or only partially trusted. Furthermore, the cloud service may be distributed between several data centres, and customer data may be communicated between such data centres to balance load between the centres. Such communication presents additional risk of eavesdropping.

As it relates to cloud processing services, risks are also present. Where a user seeks to analyse medical patient data, for example, not only the data itself but also its processing is highly confidential by its intrinsic nature. Similar considerations apply to other confidential data that may be processed, such as governmental, corporate, personal or military data. For example, analysing stealth-defeating radar may comprise complex processing of plural radar signals and their combinations. Clearly, such signal processing is secret due to its nature.

SUMMARY OF THE INVENTION

According to some aspects, there is provided the subject-matter of the independent claims. Some embodiments are defined in the dependent claims.

According to a first aspect of the present invention, there is provided an apparatus comprising at least one processing core, at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processing core, cause the apparatus at least to process, using two random numbers R ₁, R ₂, a pair of input ciphertexts to obtain a masked ciphertext encrypted using a public key of a computation node, provide the masked ciphertext to the computation node and receive a response from the computation node, and process the response to remove the mask, to obtain at least one of: a first output ciphertext comprising a maximum value of plaintexts corresponding to the input ciphertexts and a second output ciphertext comprising a minimum value of plaintexts corresponding to the input ciphertexts, wherein the output ciphertext is encrypted under a public key.

Various embodiments of the first aspect may comprise at least one feature from the following bulleted list:

· the computation node comprises a cloud server node

· the apparatus is configured to process the pair of input ciphertexts using at least one homomorphic encryption operation

· the apparatus is configured to process the response using at least one homomorphic encryption operation

· the output ciphertext is encrypted under a public key of a data requesting node, and the apparatus is configured to provide the at least one of the first output ciphertext and the second output ciphertext to the data requesting node, to thereby enable the data requesting node to gain access to the maximum and/or the minimum value of the plaintexts corresponding to the input ciphertexts, respectively

· the apparatus is configured to obtain, from a plurality of pairs of input ciphertexts, a plurality of first output ciphertexts, each first output ciphertext comprising a maximum value of plaintexts corresponding to one pair of the input ciphertexts, form pairs of the first output ciphertexts, and obtain at least one second-generation first output ciphertext comprising a maximum value of plaintexts corresponding to one pair of the first output ciphertexts

· the apparatus is configured to obtain, from a plurality of pairs of input ciphertexts, a plurality of second output ciphertexts, each second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the input ciphertexts, form pairs of the second output ciphertexts, and obtain at least one second-generation second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the second output ciphertexts

· the apparatus is configured to select further two random numbers R ₃ and ck ₁, the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁ = R ₂ * R ₃ mod n ², and wherein the response from the computation node comprises data encrypted with attribute-based encryption, and wherein the output ciphertext is encrypted under a public key chosen by the computation node

· the apparatus is configured to form pairs of the second-generation first output ciphertexts, and to obtain for each such pair a third-generation first output ciphertext comprising a maximum value of plaintexts corresponding to one pair of the second-generation first output ciphertexts, select, for a second-to-last-generation first output ciphertext, two random numbers R ₃ and ck ₁, the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁ = R ₂ *R ₃mod n ², and wherein the response from the computation node to the masked second-to-last-generation first output ciphertext comprises ck ₁ encrypted with attribute-based encryption, and wherein the last-generation first output ciphertext is encrypted under a public key corresponding to ck ₁

· the apparatus is configured to form pairs of the second-generation second output ciphertexts, and to obtain for each such pair a third-generation second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the second-generation second output ciphertexts, and select, for a second-to-last-generation second output ciphertext further two random numbers R ₃ and ck ₁, the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁ =R ₂ *R ₃mod n ², and wherein the response from the computation node to the masked second-to-last-generation second output ciphertext comprises ck ₁ encrypted with attribute-based encryption, and wherein the last-generation second output ciphertext is encrypted under a public key corresponding to ck ₁.

According to a second aspect of the present invention, there is provided a method, comprising processing, using two random numbers R ₁, R ₂, a pair of input ciphertexts to obtain a masked ciphertext encrypted using a public key of a computation node, providing the masked ciphertext to the computation node and receiving a response from the computation node, and processing the response to remove the mask, to obtain at least one of: a first output ciphertext comprising a maximum value of plaintexts corresponding to the input ciphertexts and a second output ciphertext comprising a minimum value of plaintexts corresponding to the input ciphertexts, wherein the output ciphertext is encrypted under a public key.

· the computation node comprises a cloud server node

· the method comprises processing the pair of input ciphertexts using at least one homomorphic encryption operation

· the method comprises processing the response using at least one homomorphic encryption operation

· the output ciphertext is encrypted under a public key of a data requesting node, and the method comprises providing the at least one of the first output ciphertext and the second output ciphertext to the data requesting node, to thereby enable the data requesting node to gain access to the maximum and/or the minimum value of the plaintexts corresponding to the input ciphertexts, respectively

· the method comprises obtaining, from a plurality of pairs of input ciphertexts, a plurality of first output ciphertexts, each first output ciphertext comprising a maximum value of plaintexts corresponding to one pair of the input ciphertexts, forming pairs of the first output ciphertexts, and obtaining at least one second-generation first output ciphertext comprising a maximum value of plaintexts corresponding to one pair of the first output ciphertexts

· the method comprises obtaining, from a plurality of pairs of input ciphertexts, a plurality of second output ciphertexts, each second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the input ciphertexts, forming pairs of the second output ciphertexts, and obtaining at least one second-generation second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the second output ciphertexts

· the method comprises selecting further two random numbers R ₃ and ck ₁, the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁ = R ₂ *R ₃ mod n ², and wherein the response from the computation node comprises data encrypted with attribute-based encryption, and wherein the output ciphertext is encrypted under a public key chosen by the computation node

· the method comprises forming pairs of the second-generation first output ciphertexts, and obtaining for each such pair a third-generation first output ciphertext comprising a maximum value of plaintexts corresponding to one pair of the second-generation first output ciphertexts, selecting, for a second-to-last-generation first output ciphertext, two random numbers R ₃ and ck ₁, the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁ = R ₂ *R ₃mod n ², and wherein the response from the computation node to the masked second-to-last-generation first output ciphertext comprises ck ₁ encrypted with attribute-based encryption, and wherein the last-generation first output ciphertext is encrypted under a public key corresponding to ck ₁

· the method comprises forming pairs of the second-generation second output ciphertexts, and obtaining for each such pair a third-generation second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the second-generation second output ciphertexts, selecting, for a second-to-last- generation second output ciphertext, two random numbers R ₃ and ck ₁, the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁ = R ₂ *R ₃mod n ², and wherein the response from the computation node to the masked second-to-last-generation second output ciphertext comprises ck ₁ encrypted with attribute-based encryption, and wherein the last-generation second output ciphertext is encrypted under a public key corresponding to ck ₁.

According to a third aspect of the present invention, there is provided an apparatus comprising means for processing, using two random numbers R ₁, R ₂, a pair of input ciphertexts to obtain a masked ciphertext encrypted using a public key of a computation node, means for providing the masked ciphertext to the computation node and receiving a response from the computation node, and means for processing the response to remove the mask, to obtain at least one of: a first output ciphertext comprising a maximum value of plaintexts corresponding to the input ciphertexts and a second output ciphertext comprising a minimum value of plaintexts corresponding to the input ciphertexts, wherein the output ciphertext is encrypted under a public key.

According to a fourth aspect of the present invention, there is provided a non-transitory computer readable medium having stored thereon a set of computer readable instructions that, when executed by at least one processor, cause an apparatus to at least process, using two random numbers R ₁, R ₂, a pair of input ciphertexts to obtain a masked ciphertext encrypted using a public key of a computation node, provide the masked ciphertext to the computation node and receiving a response from the computation node, and process the response to remove the mask, to obtain at least one of: a first output ciphertext comprising a maximum value of plaintexts corresponding to the input ciphertexts and a second output ciphertext comprising a minimum value of plaintexts corresponding to the input ciphertexts, wherein the output ciphertext is encrypted under a public key.

According to a fifth aspect of the present invention, there is provided a computer program configured to cause a method in accordance with the second aspect to be performed.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGURE 1 illustrates an example system in accordance with at least some embodiments of the present invention;

FIGURE 2 illustrates an example system in accordance with at least some embodiments of the present invention;

FIGURE 3 illustrates an example apparatus capable of supporting at least some embodiments of the present invention;

FIGURE 4 illustrates a tree structure in accordance with at least some embodiments of the present invention;

FIGURE 5 illustrates signalling in accordance with at least some embodiments of the present invention, and

FIGURE 6 is a flow graph of a method in accordance with at least some embodiments of the present invention.

EMBODIMENTS

Confidential processing of data, to obtain maximum and/or minimum values of ciphered data, in a cloud service may be obtained by dividing processing into parts, the processing being conducted on encrypted data, which is known as ciphertext. A two-level process is disclosed with two service provision entities, a data service provider and a computation party, which co-operate to jointly perform secure processing of data and deliver processed data in encrypted form to a data requesting party, to enable this party to access the maximum and/or minimum data in plaintext form. The data requesting party may be a same party as the one which provided the data, that is, a data provider. At least some embodiments of the invention operate using homomorphic re-encryption and/or attribute-based encryption. Re-encrypting may comprise at least partial decryption followed by encryption.

FIGURE 1 illustrates an example system in accordance with at least some embodiments of the present invention. The system comprises data service provider, DSP, 120, which may comprise a cloud data storage data centre or cloud data centre system, for example. Data service provider 120 may also be a cloud processing service provider. A cloud data centre system may comprise a plurality of data centres, with load balancing arranged in a suitable manner between individual data centres comprised in the plurality. In general, data service provider, DSP, 120 may be configured to store data and provide some computation services.

The system of FIGURE 1 further comprises at least one computation party, CP, 130. Computation party 130 may comprise a processing-enabled computing entity, such as, for example, a data centre, data centre system, server, server farm or indeed an individual networked computer such as a desktop, laptop or tablet computer. In general, computation party 130 may be configured to provide data computation services and/or data access control for its users. In the model described herein, there may exist several computation parties, CP, 130 that are operated by different entities, such as medical institutions, schools, and/or banks. Different CPs may deal with different kinds of data, for example health-related data, student records and financial information. Hence, a user may freely choose a CP he trusts for service consumption. This may enhance user security.

The system of FIGURE 1 further comprises at least one data provider 110. Data provider 110 may comprise a data owner, such as, for example, a consumer, corporation or government entity, for example. For example, data provider 110 may generate or receive the data. Data may be provided by an X-ray device or body scanner where data provider 110 is a medical entity, such as a clinic or hospital. Data may be generated in an industrial process or a design tool where data provider 110 is a corporate entity, such as a manufacturer or engineering company. Data may be generated in a radar or flight control facility where data provider 110 is a government entity, such as a military or aviation authority. Data provider 110 may be configured to provide data in encrypted form to data service provider 120.

The system of FIGURE 1 further comprises data requester 140. Data requester 140 may comprise an entity authorised by data provider 110 to access, at least partly, data owned and/or generated by data provider 110. Data requester 140 may need the data of data provider 110 in a processed form. Data requester 140 may be the same entity as data provider 110.

Authority 150 may comprise, for example, a service provider, certificate authority, government entity or other trusted party, which is tasked with key management functions in various embodiments of the present invention.

Overall, data provider 110, data service provider 120, computation party 130, data requester 140 and authority 150 may be seen as roles or functions that may be assumed and performed by different kinds of physical devices. As indicated above, data provider 110 and data requester 140 may be one and the same. On the other hand, data service provider 120 and computation party 130 are not physically the same device. In detail, data service provider 120 need not be trusted by data provider 110, while computation party 130 may be trusted by data provider 110.

Networked connections interconnect the entities described above to each other. In detail, connection 112 enables data provider 110 to transmit ciphertext to data service provider 120. Connection 143 enables communication between data requester 140 and data service provider 120. Connection 123 enables communication between computation party 130 and data service provider 120. Finally, connection 142 enables communication between data requester 140 and authority 150. The connections may be wired or, at least partly, wireless, connections, where applicable. All entities except the fully trusted authority 150 are considered to be curious-but-honest. That is, they are curious about others’data but are expected to strictly follow the design of system protocols. These networked connections may comprise dedicated wire-line interfaces, or they may be implemented as protocol connections in a networked environment, such as the Internet or a corporate network, for example.

FIGURE 2 illustrates an example system in accordance with at least some embodiments of the present invention. Like numbering denotes like structure as in FIGURE 1. FIGURE 2 corresponds to the case, where data requester 140 is the same entity as data provider 110. For example, this is the case where a data owner requests a cloud data processing result of his own data. This entity performs, in effect, two roles, as the data provider 110 to store his data in data service provider 120, and as the data requester 140 to request and obtain the processed data from data service provider 120.

Three benefits are sought with various embodiments of the present invention. Firstly, privacy-preserving maximum and minimum determinations are enabled on encrypted data. Maximum and minimum computations play a significant role in real-life applications, such as classifications in privacy-preserving machine learning algorithms. Such algorithms rely on basic operations, including the determination of a maximum and/or minimum value [1] . To preserve the privacy of cloud users, encryption is introduced before data is outsourced from DP 110, which complicates processing of this data. Moreover, current literature tends to focus on computations such as multiplication and addition when performed on encrypted data [2-4] . Obtaining maximum and/or minimum values from ciphertexts, especially from a large number of ciphertexts, would thus serve a clear technical advantage.

Secondly, it is desired that the results of processing of encrypted data in a cloud could be controlled securely and accessed flexibly for enhancing the data security and user privacy. Prior solutions tend to neglect the question of flexible access to processed resuts, an instead concentrate on controlling access to the stored data itself. However, in a so-called big data era, data mining or analytics results need to be shared among more than one specified users, even a group of users, while respecting the privacy of data owners. How to control access to maximum and/or minimum computation results over encrypted datasets in a secure and fine-grained way is a significant research issue, which is expected to be solved for privacy preserving data mining and machine learning. Previous work [5, 6] has addressed the problem of basic mathematical operations over encrypted data and their flexible access control, however this work does not provide a method to gain the maximum and minimum values over a number of encrypted numbers.

Thirdly, reducing a number of interaction rounds among servers participating collaboratively in computation presents an optimization problem. Encryption of the underlying data makes mathematical operations available over the data more limited, when compared to the diverse array of mathematical operations which may be performed directly on plaintext, that is, on non-encrypted data. Thus, multiple rounds of interactions among servers to realize expected computations are described in previously proposed schemes, such as secure multi-party computation, SMC, [7] and partially homomorphic encryption, PHE, based schemes [4, 8] . When the number of input datasets is large, such a design could greatly, and adversely, impact computation performance, which should be improved in practice.

With the development of cloud computing, cloud users may benefit from cloud services by outsourcing data storage and/or processing. However, this incurs the risk of data leakage due to the loss of full control over their own personal data. Though research have been conducted in realizing privacy-preserving computations, how to realize privay-preserving maximum and minimum computations with flexible access control has remained an open issue. However, as laid out above, obtaining maximum and/or minimum values plays a role in various real-life applications.

Substantial research has been conducted in privacy-preserving data aggregation, for example in the area of wireless sensor networks, WSNs, and smart metering [9-11] . Some work [10] assumes there exists a trusted aggregator which is unable to protect user privacy from a distrusted or semi-trusted aggregator. Shi et al. [11] study aggregation of encrypted data in the presence of a distrusted aggregator. A secret key s ₀ owned by the aggregator is, in this work, split into additive shares among a set of users (say s ₀ = ∑ _i s _i) . Then each user i applies its secret share s _i to blind its own private data. Hence, no more information except the aggregation will be revealed to the aggregator. Wang et al. investigated how two non-colluding servers can leverage proxy re-encryption to jointly compute arithmetic functions over the ciphertexts of multiple users for addition and multiplication without learning the inputs or intermediate results in [2] . This scheme, however, needs to solve the problem of discrete logarithm, which also restricts the length of the input data.

Secure multi-party computation, SMC, enables operations over ciphertexts with a global function without leaking individual inputs, which provides plausible solutions for such problems as privacy-preserving database queries, intrusion detection and data mining [12] . But SMC needs to deploy at least three servers. For example, the method for financial analysis based on SMC [7] needs three servers, but still cannot support fine-grained access control.

The schemes described above do not take into consideration the scenario where there are multiple requesters that are unpredictable or unspecified before data collection and processing. A data requester may be any number of authorized parties, rather than an evaluating server or a designated requester. The existing work described above solves the problem of distributing data processing or analyzing results to an arbitrary number of unspecified authorized requesters at the same time while preserving the privacy of data providers and protecting the data processing or analyzing results. Moreover, the existing schemes mentioned above only work for encrypted data aggregation, and do not address the question of maximum and/or minimum computations.

Some studies tried to improve existing homomorphic encryption in order to support computations over encrypted data. Ayday et al. [9] propose a privacy-preserving data aggregation scheme based on homomorphic encryption to obtain the sum of a number of collected encrypted data through a two-level decryption in which a decryption key is divided into two parts and shared by a proxy and a medical center. This scheme cannot, however, support multiparty access to the data processing results. Peter et al. [3] propose an outsourcing multiparty computation framework under multiple keys based on additive homomorphic encryption. However, here a server can only access the final data processing result with the approval of data owners, which makes this scheme heavy with regard to communication complexity. The scheme in [13] can support multiparty access to evidence aggregation, but it is only applicable for addition operation. The schemes described above do not consider the computations of maximum and/or minimum.

Liu et al. [4, 8] propose a framework for outsourced data calculations with privacy preservation, which can also deal with maximum and minimum operations. Their framework, however, cannot flexibly issue access rights to data processing results to any number of eligible parties. Meanwhile, it does not comprise schemes to support maximum and/or minimum computations over more than two pieces of data. To enable privacy-preserving machine learning, Bost et al. [1] designed some computations including maximum which underlie certain classification protocols. However, their work requires entities A and B to perform a comparison first, and then to cooperate to obtain the maximum value, which increases the number of computation rounds and has higher communication overhead. Like the work described earlier, this work also cannot support flexible access control over processed results.

Many research attempts have been directed to protecting data from being disclosed to other entities. Access control list, ACL, is a basic solution for access control, but its computation complexity grows linearly with the number of data groups or users [14, 15] . Symmetric key cryptography, SKC, has high computation complexity in key management, and low flexibility. By combining public key cryptography, PKC, with SKC [15] , the data owner encrypts the original file with a symmetric key and then encrypts the symmetric key using PKC separately for each authorized data consumer. However, the overhead to encrypt the symmetric key is proportional to the number of data consumers, which is not optimally flexible and efficient. Proxy re-encryption can also be employed to manage encrypted data sharing in cloud [16, 17] . Role-based access control, RBAC, [18, 19] may provide partial flexibility based on one attribute, which guarantees that only the consumer with a specified role can access the data. However, these constructions are unable to support complex access policies and fine-grained access control.

Attributed-based Encryption, ABE, addresses this issue and seeks to realize fine-grained access control. It has been applied in cloud storage management for achieving flexibility, scalability and fine-grained access control [20, 21] . ABE enables schemes to introduce multiple attributes for access decisions, which overall enhances cloud data security. Besides ABE, trust evaluation can also be applied to support access control with high efficiency. The combination of trust evaluation and ABE is presented in [22] , but it neglects other attributes, such as role, department by only considering trust values. More attributes could still be needed to guarantee the data privacy and security in many real-life application scenarios.

Embodiments of the present invention mainly focus on maximum and/or minimum computations in four kinds of scenarios. That is, a single data requester and a group of data requesters with and without a large number of ciphertext computations. Further, some embodiments of the present invention realize fine-grained and flexible data access control on data computation results for multiple authorized parties. At least some embodiments of this invention aim to realize fine-grained access control over maximum and/or minimum computation results from ciphertexts to further enhance data security and user privacy. ABE and a homomorphic re-encryption, HRES, are combined to realize a secure scheme without the need of fully trusted cloud servers.

In general, a DSP 120 may obtain, from two input ciphertexts that are to be compared to each other as to the maximum and/or minimum values of their underlying plaintexts, a masked ciphertext encrypted using a public key of a computation node. To do this, the DSP 120 may select random numbers and transfer the ciphering of the input ciphertexts to a public key of the CP 130. The random numbers are used to mask the underlying plaintext, such that although CP 130 may undo the ciphering, the masking nonetheless prevents CP 130 from gaining access to the original input plaintexts underlying the input ciphertexts. Homomorphic re-encryption is usable to both mask the plaintext and to transfer the ciphering to another key. By transferring a ciphering to another key it is meant that the key needed to reverse the ciphering, and thus accessing the plaintext, is changed. In other words, before the transferring the plaintext may be accessed using one key, and after the ciphering is transferred to a second key, the second key is needed used to access the plaintext.

Once CP 130 has performed its processing on the data, the data is provided back to DSP 120, which may then remove the masking from the underlying plaintext, and provide the maximum and/or minimum value to at least one data requesting party, DR, 140. Removing the masking may be performed by homomorphic encryption mathematical operations. The DR 140 gains access to the data in a form, where the plaintext is encrypted using a public key of DR 140. DR 140 may then reverse the encryption using a secret key of DR 140, which the DR 140 has. Attribute-based encryption may be applied by CP 130 to define attributes of nodes which are to be enabled to open the encryption of the eventual result.

FIGURE 3 illustrates an example apparatus capable of supporting at least some embodiments of the present invention. Illustrated is device 300, which may comprise, for example, in applicable parts, a device performing as one of the nodes of FIGURE 1 or FIGURE 2. Comprised in device 300 is processor 310, which may comprise, for example, a single-or multi-core processor wherein a single-core processor comprises one processing core and a multi-core processor comprises more than one processing core. Processor 310 may comprise, in general, a control device. Processor 310 may comprise more than one processor. Processor 310 may be a control device. A processing core may comprise, for example, a Cortex-A8 processing core manufactured by ARM Holdings or a Steamroller processing core produced by Advanced Micro Devices Corporation. Processor 310 may comprise at least one Qualcomm Snapdragon and/or Intel Atom processor. Processor 310 may comprise at least one application-specific integrated circuit, ASIC. Processor 310 may comprise at least one field-programmable gate array, FPGA. Processor 310 may be means for performing method steps in device 300. Processor 310 may be configured, at least in part by computer instructions, to perform actions.

Device 300 may comprise memory 320. Memory 320 may comprise random-access memory and/or permanent memory. Memory 320 may comprise at least one RAM chip. Memory 320 may comprise solid-state, magnetic, optical and/or holographic memory, for example. Memory 320 may be at least in part accessible to processor 310. Memory 320 may be at least in part comprised in processor 310. Memory 320 may be means for storing information. Memory 320 may comprise computer instructions that processor 310 is configured to execute. When computer instructions configured to cause processor 310 to perform certain actions are stored in memory 320, and device 300 overall is configured to run under the direction of processor 310 using computer instructions from memory 320, processor 310 and/or its at least one processing core may be considered to be configured to perform said certain actions. Memory 320 may be at least in part comprised in processor 310. Memory 320 may be at least in part external to device 300 but accessible to device 300.

Device 300 may comprise a transmitter 330. Device 300 may comprise a receiver 340. Transmitter 330 and receiver 340 may be configured to transmit and receive, respectively, information in accordance with at least one cellular or non-cellular standard. Transmitter 330 may comprise more than one transmitter. Receiver 340 may comprise more than one receiver. Transmitter 330 and/or receiver 340 may be configured to operate in accordance with global system for mobile communication, GSM, wideband code division multiple access, WCDMA, 5G, long term evolution, LTE, IS-95, wireless local area network, WLAN, Ethernet and/or worldwide interoperability for microwave access, WiMAX, standards, for example.

Device 300 may comprise a near-field communication, NFC, transceiver 350. NFC transceiver 350 may support at least one NFC technology, such as NFC, Bluetooth, Wibree or similar technologies.

Device 300 may comprise user interface, UI, 360. UI 360 may comprise at least one of a display, a keyboard, a touchscreen, a vibrator arranged to signal to a user by causing device 300 to vibrate, a speaker and a microphone. A user may be able to operate device 300 via UI 360, for example to manage secure processing of data, as described herein.

Device 300 may comprise or be arranged to accept a user identity module 370. User identity module 370 may comprise, for example, a subscriber identity module, SIM, card installable in device 300. A user identity module 370 may comprise information identifying a subscription of a user of device 300. A user identity module 370 may comprise cryptographic information usable to verify the identity of a user of device 300 and/or to facilitate encryption of communicated information and billing of the user of device 300 for communication effected via device 300.

Processor 310 may be furnished with a transmitter arranged to output information from processor 310, via electrical leads internal to device 300, to other devices comprised in device 300. Such a transmitter may comprise a serial bus transmitter arranged to, for example, output information via at least one electrical lead to memory 320 for storage therein. Alternatively to a serial bus, the transmitter may comprise a parallel bus transmitter. Likewise processor 310 may comprise a receiver arranged to receive information in processor 310, via electrical leads internal to device 300, from other devices comprised in device 300. Such a receiver may comprise a serial bus receiver arranged to, for example, receive information via at least one electrical lead from receiver 340 for processing in processor 310. Alternatively to a serial bus, the receiver may comprise a parallel bus receiver.

Device 300 may comprise further devices not illustrated in FIGURE 3. For example, where device 300 comprises a smartphone, it may comprise at least one digital camera. Some devices 300 may comprise a back-facing camera and a front-facing camera, wherein the back-facing camera may be intended for digital photography and the front-facing camera for video telephony. Device 300 may comprise a fingerprint sensor arranged to authenticate, at least in part, a user of device 300. In some embodiments, device 300 lacks at least one device described above. For example, some devices 300 may lack a NFC transceiver 350 and/or user identity module 370.

Processor 310, memory 320, transmitter 330, receiver 340, NFC transceiver 350, UI 360 and/or user identity module 370 may be interconnected by electrical leads internal to device 300 in a multitude of different ways. For example, each of the aforementioned devices may be separately connected to a master bus internal to device 300, to allow for the devices to exchange information. However, as the skilled person will appreciate, this is only one example and depending on the embodiment various ways of interconnecting at least two of the aforementioned devices may be selected without departing from the scope of the present invention.

Four schemes are described herein with the cooperation of a data service provider, DSP, 120 and an computation party, CP, 130 to realize the maximum and/or minimum computation over encrypted data. Two schemes are designed for a specified data requester, DR, while other two are designed for a group of DRs whoever satisfy a pre-defined accss policy. Furthermore, a tree structure is proposed, to decrease the number of interactions between DSP 120 and CP 130. Specifically, the main idea of this invention can be summarized as below:

We first realize fine-grained access control over the maximum and/or minimum computation results from encrypted data. The proposed scheme can support the maximum and/or minimum computation over plural input data, which has higher usability and flexibility than prior schemes. A tree structure is adopted to reduce the number of interactions between DSP 120 and CP 130. In order to improve scalability, several schemes are proposed which can adapt to different application scenarios. This supports computations for a specified DR 140 or a group of DRs 140 for achieving flexible access control.

In order to realize flexible access control over encrypted computation results, we integrate homomophic encryption, HE, and attribute-based encryption, ABE. HE can support some computations over the ciphertexts, while it cannot support group access control over the processed result. Thus, we take the advantage of ABE to control the access. Meanwhile, we design a scheme to achieve maximum and minimum value over a number of encrypted data

The described schemes can be applied into a system that is composed of five types of entities as shown in FIGURE 1: data service provider, DSP, is responsible for data storage and some computation services, which may be provided by a cloud server, for example. Computation party, CP, is mainly in charge of secure data computation and data access control for its users. For example, CP may apply ABE to implement the access control aspects of at least some embodiments of the present invention. The CP may comprise a private cloud service provider or an administrative department of a company or an institute. Data providers, DPs, collect or produce data, and then upload them to DSP for data storing and processing. Data requesters, DRs, are the data consumers that acquire the processed result. Sometimes a DR can also work as a DP to provide collected data. Authority is fully trusted and responsible for key management

Herein, we introduce some preliminaries for implementing our invention, such as additive homomorphic encryption, key-policy attribute-based encryption and homomorphic re-encryption system, HRES.

An additive homomorphic encryption as a PHE algorithm, such as, for example, Paillier’s cryptosystem [23] , can only realize the addition of plaintexts through operations over encrypted data. Suppose we have N encrypted data under same key pk, which can be presented as [m _i] _pk (i = 1, 2, ..., N) . The additive homomorphic encryption satisfies the following equation

where D _sk () is the corresponding homomorphic decryption algorithm with secret key sk.

In order to support fine-grained access control, key-policy attribute-based encryption, KP-ABE, is adopted as an example. Ciphertext-policy attribute-based encryption, CP-ABE, [24] can also be applied to implement our scheme. KP-ABE consists of four algorithms: Setup, Encrypt, KeyGen, and Decrypt.

Setup ^ABE (λ, U) → (PK′, MSK′) . The setup algorithm takes as input security parameter λ and attribute universe description U. It outputs the public paramters PK′and a master secret key MSK′.

Enc ^ABE (M, γ, PK′) → CK′. The encryption algorithm takes as input message M, a set of attributes γ and the public parameters PK′. It outputs ciphertext CK′.

The key generation algorithm takes as input an access structure

and the master secret key MSK′. It outputs a private key SK′.

Dec ^ABE (CK′, PK′, SK′) → M. The decryption algorithm takes as input the ciphertext CK′, the public parameters PK′and the private key SK′. If the set of attributes satisfies the access tree

embedded in the private key, it finally outputs the message M.

KP-ABE is multiplicative and homomorphic if the same attributes are employed to encrypt two pieces of raw data. That is, given two ABE ciphertexts of M ₁ and M ₂ under the same policy, the ciphertext of M ₁ *M ₂ can be obtained through the multiplication of two ciphertexts Enc ^ABE (M ₁, γ, PK′) *Enc ^ABE (M ₂, γ, PK′) , marked as HE ^ABE. The length of raw data is limited and highly related to the system parameters.

Homomorphic re-encryption system, HRES:

To enable computations over encrypted data, the basic Paillier cryptosystem is revised to achieve flexible access control and computations and design a HRES algorithm in document PCT/CN2016/087876. This document is referred to as background to facilitate implementation of the HRES system, which is therein described. Here also, a detailed introduction to HRES is given.

Key Generation (KeyGen) : Let k be a security parameter and p, q be two large primes, where

returns the bit length of input data. Due to the property of safe primes, there exist two primes p′and q′, which satisfy that p = 2p′+ 1, q = 2q′+ 1. We compute n = p *q and choose a generator g with order λ = 2p′q′, which can be chosen by selecting a random number

and computing g = -z ²ⁿ. The value λ can be used to decrypt the encrypted data, however it is concealed from all involved parties. In HRES, only key pair (sk, g ^sk) is used for data encryption and decryption. During system setup, each entity i, including DSP 120 and CP 130, generates one key pair

And we have sk _DSP = a and sk _CP = b. Further DSP 120 and CP 130 negotiate their Diffie-Hellman key

which should be issued to its customers. Hence, the public system parameters include {g, n, PK} .

First, the encryption and decryption algorithms are directly obtained from [25]

Encryption (Enc) : With a public key pk _i and a random value r ∈ [1, n/4] , the raw data m can be encrypted as:

Second, a two-level decryption scheme for flexibly supporting outsourced data processing is designed:

Encryption with Two Keys (EncTK) : We propose encrypting original data under the Diffie-Hellman key of two servers to support ciphertext processing. Given message

of user i, we encrypt it with a random number r ∈ [1, n/4] and PK. The ciphertext is encrypted as [m _i] = [m _i] _PK = {T _i, T _i′} , where

T _i = (1 + m _i *n) *PK ^r mod n ² and T _i′ = g ^r mod n ².

for ease of presentation, [m _i] is used to denote the ciphertext of m _i encrypted with PK, which can only be decrypted under the cooperation of DSP and CP.

Partial Decryption with SK _DSP (PDec1) : Upon getting [m _i] , DSP may execute algorithm PDec1 to transfer it into another ciphertext which can be decrypted by the CP as follows:

Partial Decryption with SK _ACS (PDec2) : In this algorithm, the CP can directly decrypt

with its own secret key as follows:

The two decryption algorithms should be performed together to obtain the original data, while the decryption order can be changed. In addition, HRES has the following features:

1) Additive homomorphism:

2)

3)

4) Different from feature 2) , we use

to represent the following computation

mod n ², which only operates on the first part of ciphertext.

For easy presentation and understanding, the following table summarizes the notations used throughout this document:

Proposed schemes

In the following schemes, the system is first set up and data collected as shown below, these first two steps being the same in all four schemes.

Step 1: System Setup at all entities: The system calls the algorithm KeyGen to complete setup of HRES. In addition, the Authority should call Setup ^ABE (λ, U) to generate the public parameters PK′and master secret key MSK′of ABE algorithm. Then it also publishes PK′to its service consumers.

Step 2 Data Upload at DPs: DP encrypts their personal data before uploading it to DSP. It directly recalls EncTK to encrypt data m _i (Unless otherwise specified,

With the collected data from various DPs, some computations can be done for potential application requirements. In the following, these first two steps will be omitted for the sake of simplicity as they are shared between all the four schemes, and the interactions between DSP and CP will be described. Four different schemes are described to obtain the maximum and/or minimum results from encrypted data, which are suitable for flexible scenarios.

Scheme 1: maximum and minimum computations for a targeted data requester.

The first scheme aims to obtain the maximum and minimum value from two encrypted data items, that is, ciphertexts, for a specified data requester 140. Given two ciphertexts [m ₁] and [m ₂] , it can provide the sorting results

and

which indicate the maximum and the minimum results respectively for the target data requester DR.

Step 3, Data Preparation at DSP: The DSP chooses two random numbers R ₁ and R ₂ where

It first encrypts “1” and then computes as follows:

[1] = { (1 + n) *PK ^r′, g ^r′}

[m _-] = [m ₁ -m ₂] = [m ₁] * [m ₂] ^N-1

where m _-= m ₁ -m ₂ and m ₊ = m ₁ + m ₂.

Then it flips a coin s. If s = -1; it computes as follows:

Otherwise (s= 1) , it calls PDec1 and computes:

Further it calls PDec1 [R ₁ * (2m ₊ -1) + R ₂] to get

Finally, the data packet sent to the CP is

Step 4, Data Process at CP: Upon receiving the data packet from the DSP, the CP decrypts (T ₁ ⁽¹⁾ , T ₁′ ⁽¹⁾ ) with PDec2 () to obtain raw data m′= R ₁ * (2 *m _-+ 1) mod n if s = 1 or m′= -R ₁* (2*m _-+ 1) mod n if s = -1.

The CP compares

with

If

it sets u=1; otherwise, u = -1.

The CP further encrypts the raw data u *m′with the public key of data requester as:

The CP decrypts

and then encrypts it with pk _dr to get

Finally, the CP returns the following data packet to the DSP:

Step 5, Additional Process at DSP: The DSP first removes the mask R ₂ by computing

Then it will further perform the following computations:

r = (2R ₁) ^-1mod n

Step 6, Data Access at DR: The DR with the corresponding secret key can decrypt the ciphertexts ( [max] and [min] ) to obtain the maximum and minimum value.

Scheme 2: Maximum and minimum computations over plural ciphertexts for a targeted data requester.

The second scheme aims to obtain the maximum and minimum value from more than two pieces of encrypted data. Given an example of n pieces of ciphertexts ( [m ₁] , [m ₂] , … [m _i] , … [m _n] ) , it can obtain the maximum and minimum results

and

for a targeted data requester DR without revealing the raw data to DSP or CP.

The first scheme can provide the maximum and minimum value from two ciphertexts [m ₁] and [m ₂] for DR. If we use the PK to replace the public key of DR (pk _dr) , hence we can get the value [max] and [min] . Here we take maximum computation as an example, which has the same procedure to minimum computation.

In order to get the final maximum from lots of ciphertexts, we need to execute several rounds of first scheme. As shown in FIGURE 4, a tree structure may be employed. The tree structure divides the data into many groups and each group has no more than two pieces of data, forming a pair. Then the first scheme will be executed over every two ciphertexts, that is, over every pair, to get the [max] . Until the last two pieces of data are obtained, DSP and CP will execute the first scheme with the public key of DR to get the final

In terms of FIGURE 4, [max _1, 1] and [max [ _1, 2] are output ciphertexts obtained from input ciphertexts [m ₁] and [m ₂] , and from [m ₃] and [m ₄] , respectively, as illustrated. [max _1, 1] and [max [ _1, 2] are then used to form a new pair, and the maximum of this new pair is a second-generation output ciphertext. In terms of the present disclosure, as maximum is obtained in the example of FIGURE 4, [max _1, 1] and [max [ _1, 2] may be referred to as first output ciphertexts, and the maximum of them is a second-generation first output ciphertext. If a minimum was obtained instead of a maximum, the expressions second output ciphertexts and second-generation second output ciphertext could be used instead of first output ciphertexts and second-generation first output ciphertext. In some embodiments, minimum and maximum are obtained at the same time, or separately.

Through parallel processing, the DSP and CP can do the computations at each layer simultaneously. For example, in the first layer, it compares each two ciphertexts to get

new ciphertexts. It follows the tree structure down until it gets the final computation results. Our proposed design needs at most

rounds of the first scheme with the support of parallel computing, which is much more efficient than bubble sorting that needs to compare data one by one. In the first

rounds, the DSP and CP may conduct computation with PK rather than the public key of DR while they use pk _dr to do the final computation.

Scheme 3: Maximum and minimum computations with flexible access control.

The third scheme aims to enable flexible access control over the computation results. Given two ciphertexts [m ₁] and [m ₂] , this scheme can provide the sorting results

and

which indicates the maximum and the minimum results. Moreover, its corresponding secret key is encrypted with ABE, which guarantees the fine-grained access control over processed results.

Step 3: Data Preparation at DSP: The DSP chooses a random number R ₁ where

It first encrypts “1” and then computes as follows:

[1] = { (1 + n) *PK ^r′, g ^r′}

[m _-] = [m ₁ -m ₂] = [m ₁] * [m ₂] ^N-1

Then it randomly chooses three numbers: R ₁, R ₂, R ₃, ck ₁ which satisfy R ₁ = R ₂ *R ₃mod n ².

And it calls PDec1 to decrypt [R ₂ *m ₊] to get

Then it flips a coin s. If s = -1; it computes as follows:

Otherwise (s= 1) , it calls PDec1 and computes:

The data packet which is sent to the CP is

Step 4: Data Process at CP: Upon receiving the data packet from the DSP, the CP decrypts (T ₁ ⁽¹⁾ , T ₁′ ⁽¹⁾ ) with PDec2 () to obtain raw data m′= R ₁ * (2 *m _-+ 1) mod n if s = 1 or m′= -R ₁ * (2 *m _-+ 1) mod n if s = -1.

The CP compares

with

If

it sets u= 1; otherwise, u = -1.

The CP further encrypts the raw data u *m′with a randomly chosen key pair

Decrypt

to get R ₂ * (2m ₊ -1) and re-encrypt it as

Moreover, it needs to encrypt ck ₂ with ABE to get CK′ ₂= Enc ^ABE (ck ₂, γ, PK′) .

Finally, the CP forwards the data packet to DSP:

Step 5: Additional Process at DSP: The DSP does the following computations:

r = (2R ₁) ^-1mod n

where ck = ck ₁ *ck ₂ and

And it calls HE ^ABE to obtain CK = CK′ ₂ *Enc ^ABE (ck ₁, y, PK′) = Enc ^ABE (ck ₁ *ck ₂, γ, PK′) .

Step 6: Data Access at DR: The DR who satisfies the policy tree can decrypt the ciphertext to get the computation result.

Scheme 4: Maximum and minimum computations over lots of data with flexible access control.

The fourth scheme aims to enable flexible access control over the computation results from more than two pieces of data. In the first

rounds of operations in this scheme is the same as that in the second scheme. But in the last round of computation over

and

the DSP and CP use the third scheme in to obtain the final result

The procedure follows the tree structure illustrated in FIGURE 4.

FIGURE 4 illustrates a tree structure usable in processing a large number of input ciphertexts, as described herein above. Although a maximum calculation is used as an example in FIGURE 4, a minimum calculation follows the same logic.

FIGURE 5 illustrates signalling in accordance with at least some embodiments of the present invention In particular, FIGURE 5 is directed to the first scheme although the other schemes follow similar logic and signalling. On the vertical axes are disposed, from the left to the right, DP 110, DSP 120, CP 130 and DR 140 of FIGURE 1. Time advances from the top toward the bottom.

In phase 510, DP 110 provides his data to DSP 120 for storage. The data is stored in DSP 120 in encrypted form, that is, as ciphertext. In phase 520, DR 140 requests to know a maximum and/or minimum value of plaintext underlying two of the ciphertexts stored in DSP 120.

Before phase 530, DSP 120 performs the processing of Step 3 of scheme 1 described above, and in phase 530 DSP 120 transmits the masked data, ciphered using a public key of CP 130, to CP 130.

In response to receiving the data of phase 530, CP 130 performs the processing of Step 4 of scheme 1 described above, and in phase 540 CP 130 returns the processed data to DSP 120.

Prior to phase 550, DSP 120 performs the processing of Step 5 of scheme 1, described above, and finally DSP 120 provides the data to DR 140, phase 550.

FIGURE 6 is a flow graph of a method in accordance with at least some embodiments of the present invention. The phases of the illustrated method may be performed in DSP 120, an auxiliary device or a personal computer, for example, or in a control device configured to control the functioning thereof, when installed therein.

Phase 610 comprises processing, using two random numbers R ₁, R ₂, a pair of input ciphertexts to obtain a masked ciphertext encrypted using a public key of a computation node. By masked ciphertext it is meant, that the plaintext underlying the ciphertext has been masked and reversing the encryption of the ciphertext does not give access to the plaintext, which would remain masked. Phase 620 comprises providing the masked ciphertext to the computation node and receiving a response from the computation node. Finally, phase 630 comprises processing the response to remove the masking, to obtain at least one of: a first output ciphertext comprising a maximum value of plaintexts corresponding to the input ciphertexts and a second output ciphertext comprising a minimum value of plaintexts corresponding to the input ciphertexts, wherein the output ciphertext is encrypted under a public key.

Advantages of the schemes described herein above may include, in applicable parts, firstly, flexibility: the schems support privacy-preserving computations with flexible access control. In addition, four schemes can be flexibly applied in various scenarios. They can be adapted to support the classification in machine learning algorithms. Secondly, efficiency: by introducing tree structure, the number of interactions between DSP and CP may be decreased through parallel computing, which can reduce the computation delay. Thirdly, privacy-preserving maximum and minimum computation over a great number of data is obtained: most prior schemes only consider the computation over two ciphertexts. Working with more than two ciphertexts presents a significant benefit. Fourthly, secure and fine-grained access control: at least some of the schemes realize secure and fine-grained access control over encrypted data processing result, in particular maximum and minimum, which is not taken into consideration in the prior work in the literature. Different access control policy can be achieved through ABE encryption for satisfying different security requirements.

It is to be understood that the embodiments of the invention disclosed are not limited to the particular structures, process steps, or materials disclosed herein, but are extended to equivalents thereof as would be recognized by those ordinarily skilled in the relevant arts. It should also be understood that terminology employed herein is used for the purpose of describing particular embodiments only and is not intended to be limiting.

Reference throughout this specification to one embodiment or an embodiment means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of the phrases “in one embodiment” or “in an embodiment” in various places throughout this specification are not necessarily all referring to the same embodiment. Where reference is made to a numerical value using a term such as, for example, about or substantially, the exact numerical value is also disclosed.

As used herein, a plurality of items, structural elements, compositional elements, and/or materials may be presented in a common list for convenience. However, these lists should be construed as though each member of the list is individually identified as a separate and unique member. Thus, no individual member of such list should be construed as a de facto equivalent of any other member of the same list solely based on their presentation in a common group without indications to the contrary. In addition, various embodiments and example of the present invention may be referred to herein along with alternatives for the various components thereof. It is understood that such embodiments, examples, and alternatives are not to be construed as de facto equivalents of one another, but are to be considered as separate and autonomous representations of the present invention.

Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the preceding description, numerous specific details are provided, such as examples of lengths, widths, shapes, etc., to provide a thorough understanding of embodiments of the invention. One skilled in the relevant art will recognize, however, that the invention can be practiced without one or more of the specific details, or with other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the invention.

While the forgoing examples are illustrative of the principles of the present invention in one or more particular applications, it will be apparent to those of ordinary skill in the art that numerous modifications in form, usage and details of implementation can be made without the exercise of inventive faculty, and without departing from the principles and concepts of the invention. Accordingly, it is not intended that the invention be limited, except as by the claims set forth below.

The verbs “to comprise” and “to include” are used in this document as open limitations that neither exclude nor require the existence of also un-recited features. The features recited in depending claims are mutually freely combinable unless otherwise explicitly stated. Furthermore, it is to be understood that the use of "a" or "an" , that is, a singular form, throughout this document does not exclude a plurality.

INDUSTRIAL APPLICABILITY

At least some embodiments of the present invention find industrial application in cryptography.

ACRONYMS LIST

ABE: Attribute Based Encryption

HE: Homomorphic Encryption

DSP: Data Service Provider

CP: Computation Party

HRES: Homomorphic Re-Encryption System

SMC: Secure Multi-party Computation

PRE: Proxy Re-Encryption

DP: Data Provider

DR: Data Requester

ACL: Access Control List

SKC: Symmetric Key Cryptography

PKC: Public Key Cryptography

RBAC: Role-Based Access Control

WSN: Wireless Sensor Network

REFERENCE SIGNS LIST

110	data provider
120	data service provider
130	computation party
140	data requester
150	authority
300-370	structure of the device of FIGURE 4
510-550	phases of signaling of FIGURE 5
610-630	phases of the methof of FIGURE 6

CITATION LIST

[1] R. Bost, R.A. Popa, S. Tu, and S. Goldwasser, "Machine Learning Classification over Encrypted Data, " in NDSS, 2015.

[2] B. Wang, M. Li, S.S. Chow, and H. Li, "A tale of two clouds: Computing on data encrypted under multiple keys, " in 2014 IEEE Conference on Communications and Network Security (CNS) , 2014, pp. 337-345.

[3] A. Peter, E. Tews, and S. Katzenbeisser, “Efficiently outsourcing multiparty computation under multiple keys, ” IEEE Transactions on Information Forensics and Security (TIFS) , vol. 8, no. 12, pp. 2046-2058, 2013.

[4] X. Liu, R. Choo, R. Deng, R. Lu, and J. Weng, “Efficient and privacy-preserving outsourced calculation of rational numbers, ” IEEE Transactions on Dependable andSecure Computing (TDSC) , vol. PP, no. 99, pp. 1 -1, 2016.

[5] W. Ding, and Z. Yan, Secure Data Processing, Patent Application No. PCT/CN2016/087876, File Data 2016-06-30.

[6] W. Ding, and Z. Yan, Secure Distributed Data Processing, Patent Application No. PCT/CN2016/104553, File Date 2016-11-04.

[7] D. Bogdanov, R. Talviste, and J. Willemson, "Deploying secure multi-party computation for financial data analysis, " Financial Cryptography and Data Security, pp. 57-64: Springer, 2012.

[8] X. Liu, R.H. Deng, Y. Yang, H.N. Tran, and S. Zhong, “Hybrid privacy-preserving clinical decision support system in fog-cloud computing, ” Future Generation Computer Systems, 2017/03/18/, 2017.

[9] E. Ayday, J.L. Raisaro, J. -P. Hubaux, and J. Rougemont, "Protecting and evaluating genomic privacy in medical tests and personalized medicine, " in 12th ACM Workshop on Workshop on Privacy in the Electronic Society, 2013, pp. 95-106.

[10] Q. Li, G. Cao, and T. La Porta, “Efficient and privacy-aware data aggregation in mobile sensing, ” IEEE Transactions on Dependable and Secure Computing (TDSC) , vol. 11, no. 2, pp. 115-129, 2014.

[11] E. Shi, T.H. Chan, E. Rieffel, R. Chow, and D. Song, "Privacy-preserving aggregation of time-series data, " in 18th Annual Network and Distributed System Security Symposium (NDSS) , 2011, pp. 1-17.

[12] Z. Yan, P. Zhang, and A.V. Vasilakos, “A survey on trust management for Internet of Things, ” Journal of Network and Computer Applications, vol. 42, pp. 120-134, 2014.

[13] Z. Yan, W. Ding, V. Niemi, and A.V. Vasilakos, “Two schemes of privacy-preserving trust evaluation, ” Future Generation Computer Systems (FGCS) , vol. 62, pp. 175-189, 2015.

[14] M. Kallahalla, E. Riedel, R. Swaminathan, Q. Wang, and K. Fu, "Plutus: Scalable secure file sharing on untrusted storage, " in FAST, 2003, pp. 29-42.

[15] E. -J. Goh, H. Shacham, N. Modadugu, and D. Boneh, "SiRiUS: Securing Remote Untrusted Storage, " in NDSS, 2003, pp. 131-145.

[16] Z. Yan, W. Ding, and H. Zhu, "A scheme to manage encrypted data storage with deduplication in cloud, " International Conference on Algorithms and Architectures for Parallel Processing, pp. 547-561: Springer, 2015.

[17] C. Dong, G. Russello, and N. Dulay, "Shared and searchable encrypted data for untrusted servers, " in IFIP Annual Conference on Data and Applications Security and Privacy, 2008, pp. 127-143.

[18] W.C. Garrison III, A. Shull, S. Myers, and A.J. Lee, “On the practicality of cryptographically enforcing dynamic access control policies in the cloud, ” in 2016 IEEE Symposium on Security and Privacy, 2016.

[19] Z. Tianyi, L. Weidong, and S. Jiaxing, "An efficient role based access control system for cloud computing, " in IEEE 11th International Conference on Computer and Information Technology (CIT) , 2011, pp. 97-102.

[20] S. Yu, C. Wang, K. Ren, and W. Lou, "Achieving secure, scalable, and fine-grained data access control in cloud computing, " in 2010 proceedings IEEE INFOCOM, 2010, pp. 1-9.

[21] V. Goyal, O. Pandey, A. Sahai, and B. Waters, "Attribute-based encryption for fine-grained access control of encrypted data, " in 13th ACM conference on Computer and communications security, 2006, pp. 89-98.

[22] Z. Yan, X. Li, M. Wang, and A. Vasilakos, “Flexible data access control based on trust and reputation in cloud computing, ” IEEE Transactions on Cloud Computing, vol. PP, no. 99, pp. 1-1, 2015.

[23] P. Paillier, "Public-key cryptosystems based on composite degree residuosity classes, " in Advances in cryptology-EUROCRYPT’99, 1999, pp. 223-238.

[24] J. Bethencourt, A. Sahai, and B. Waters, "Ciphertext-policy attribute-based encryption, " in 2007 IEEE Symposium on Security and Privacy (SP′07) , 2007, pp. 321-334.

[25] E. Bresson, D. Catalano, and D. Pointcheval, "A simple public-key cryptosystem with a double trapdoor decryption mechanism and its applications, " Advances in Cryptology-ASIACRYPT 2003, pp. 37-54: Springer, 2003.

Claims

An apparatus comprising at least one processing core, at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processing core, cause the apparatus at least to:

- process, using two random numbers R ₁, R ₂, a pair of input ciphertexts to obtain a masked ciphertext encrypted using a public key of a computation node;

- provide the masked ciphertext to the computation node and receive a response from the computation node, and

- process the response to remove the mask, to obtain at least one of: a first output ciphertext comprising a maximum value of plaintexts corresponding to the input ciphertexts and a second output ciphertext comprising a minimum value of plaintexts corresponding to the input ciphertexts, wherein the output ciphertext is encrypted under a public key.
The apparatus according to claim 1, wherein the computation node comprises a cloud server node.
The apparatus according to claim 1 or 2, wherein the apparatus is configured to process the pair of input ciphertexts using at least one homomorphic encryption operation.
The apparatus according to any of claims 1-3, wherein the apparatus is configured to process the response using at least one homomorphic encryption operation.
The apparatus according to any of claims 1-4, wherein the output ciphertext is encrypted under a public key of a data requesting node, and the apparatus is configured to provide the at least one of the first output ciphertext and the second output ciphertext to the data requesting node, to thereby enable the data requesting node to gain access to the maximum and/or the minimum value of the plaintexts corresponding to the input ciphertexts, respectively.
The apparatus according to any of claims 1-5, wherein the apparatus is configured to:

- obtain, from a plurality of pairs of input ciphertexts, a plurality of first output ciphertexts, each first output ciphertext comprising a maximum value of plaintexts corresponding to one pair of the input ciphertexts,

- form pairs of the first output ciphertexts, and

- obtain at least one second-generation first output ciphertext comprising a maximum value ofplaintexts corresponding to one pair of the first output ciphertexts.
The apparatus according to any of claims 1-6, wherein the apparatus is configured to:

- obtain, from a plurality of pairs of input ciphertexts, a plurality of second output ciphertexts, each second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the input ciphertexts,

- form pairs of the second output ciphertexts, and

- obtain at least one second-generation second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the second output ciphertexts.
The apparatus according to any of claims 1-4, wherein the apparatus is configured to:

- select further two random numbers R ₃ and ck ₁, the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁=R ₂ *R ₃mod n ² , and wherein the response from the computation node comprises data encrypted with attribute-based encryption, and

- wherein the output ciphertext is encrypted under a public key chosen by the computation node.
The apparatus according to claim 6, wherein the apparatus is configured to:

- form pairs of the second-generation first output ciphertexts, and to obtain for each such pair a third-generation first output ciphertext comprising a maximum value of plaintexts corresponding to one pair of the second-generation first output ciphertexts,

- select, for a second-to-last-generation first output ciphertext, two random numbers R ₃ and ck ₁ , the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁ = R ₂ *R ₃mod n ², and wherein the response from the computation node to the masked second-to-last-generation first output ciphertext comprises ck ₁ encrypted with attribute-based encryption, and

- wherein the last-generation first output ciphertext is encrypted under a public key corresponding to ck ₁.
The apparatus according to claim 7, wherein the apparatus is configured to:

- form pairs of the second-generation second output ciphertexts, and to obtain for each such pair a third-generation second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the second-generation second output ciphertexts,

- select, for a second-to-last-generation second output ciphertext further two random numbers R ₃ and ck ₁, the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁ = R ₂ *R ₃mod n ², and wherein the response from the computation node to the masked second-to-last-generation second output ciphertext comprises ck ₁ encrypted with attribute-based encryption, and

- wherein the last-generation second output ciphertext is encrypted under a public key corresponding to ck ₁.
A method, comprising:

- processing, using two random numbers R ₁, R ₂, a pair of input ciphertexts to obtain a masked ciphertext encrypted using a public key of a computation node;

- providing the masked ciphertext to the computation node and receiving a response from the computation node, and

- processing the response to remove the mask, to obtain at least one of: a first output ciphertext comprising a maximum value of plaintexts corresponding to the input ciphertexts and a second output ciphertext comprising a minimum value of plaintexts corresponding to the input ciphertexts, wherein the output ciphertext is encrypted under a public key.
The method according to claim 11, wherein the computation node comprises a cloud server node.
The method according to claim 11 or 12, further comprising processing the pair of input ciphertexts using at least one homomorphic encryption operation.
The method according to any of claims 11-13, further comprising processing the response using at least one homomorphic encryption operation.
The method according to any of claims 11-14, wherein the output ciphertext is encrypted under a public key of a data requesting node, and the method comprises providing the at least one of the first output ciphertext and the second output ciphertext to the data requesting node, to thereby enable the data requesting node to gain access to the maximum and/or the minimum value of the plaintexts corresponding to the input ciphertexts, respectively.
The method according to any of claims 11-15, wherein the method comprises: obtaining, from a plurality of pairs of input ciphertexts, a plurality of first output ciphertexts, each first output ciphertext comprising a maximum value of plaintexts corresponding to one pair of the input ciphertexts,

- forming pairs of the first output ciphertexts, and

- obtaining at least one second-generation first output ciphertext comprising a maximum value of plaintexts corresponding to one pair of the first output ciphertexts.
The method according to any of claims 11-16, wherein the method comprises: obtaining, from a plurality of pairs of input ciphertexts, a plurality of second output ciphertexts, each second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the input ciphertexts,

- forming pairs of the second output ciphertexts, and

- obtaining at least one second-generation second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the second output ciphertexts.
The method according to any of claims 11-14, wherein the method comprises:

- selecting further two random numbers R ₃ and ck ₁, the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁ = R ₂ *R ₃modn ², and wherein the response from the computation node comprises data encrypted with attribute-based encryption, and

- wherein the output ciphertext is encrypted under a public key chosen by the computation node.
The method according to claim 16, wherein the method comprises:

- forming pairs of the second-generation first output ciphertexts, and obtaining for each such pair a third-generation first output ciphertext comprising a maximum value of plaintexts corresponding to one pair of the second-generation first output ciphertexts,

- selecting, for a second-to-last-generation first output ciphertext, two random numbers R ₃ and ck ₁, the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁ = R ₂ *R ₃mod n ², and wherein the response from the computation node to the masked second-to-last-generation first output ciphertext comprises ck ₁ encrypted with attribute-based encryption, and

- wherein the last-generation first output ciphertext is encrypted under a public key corresponding to ck ₁.
The method according to claim 17, wherein the method comprises:

- forming pairs of the second-generation second output ciphertexts, and obtaining for each such pair a third-generation second output ciphertext comprising a minimum value of plaintexts corresponding to one pair of the second-generation second output ciphertexts,

- selecting, for a second-to-last-generation second output ciphertext, two random numbers R ₃ and ck ₁, the selected random numbers R ₁, R ₂, R ₃ satisfying the relationship R ₁ = R ₂ *R ₃mod n ², and wherein the response from the computation node to the masked second-to-last-generation second output ciphertext comprises ck ₁ encrypted with attribute-based encryption, and

- wherein the last-generation second output ciphertext is encrypted under a public key corresponding to ck ₁.
An apparatus comprising:

- means for processing, using two random numbers R ₁, R ₂, a pair of input ciphertexts to obtain a masked ciphertext encrypted using a public key of a computation node;

- means for providing the masked ciphertext to the computation node and receiving a response from the computation node, and

- means for processing the response to remove the mask, to obtain at least one of: a first output ciphertext comprising a maximum value of plaintexts corresponding to the input ciphertexts and a second output ciphertext comprising a minimum value of plaintexts corresponding to the input ciphertexts, wherein the output ciphertext is encrypted under a public key.
A non-transitory computer readable medium having stored thereon a set of computer readable instructions that, when executed by at least one processor, cause an apparatus to at least:

- process, using two random numbers R ₁, R ₂, a pair of input ciphertexts to obtain a masked ciphertext encrypted using a public key of a computation node;

- provide the masked ciphertext to the computation node and receiving a response from the computation node, and

- process the response to remove the mask, to obtain at least one of: a first output ciphertext comprising a maximum value of plaintexts corresponding to the input ciphertexts and a second output ciphertext comprising a minimum value of plaintexts corresponding to the input ciphertexts, wherein the output ciphertext is encrypted under a public key.
A computer program configured to cause a method in accordance with at least one of claims 11-20 to be performed.