Two-Cloud-Servers-Assisted Secure Outsourcing Multiparty Computation

Algorithm 2

Protocol π: Two cloud servers-assisted secure outsourcing computation protocol

Setup.

For 𝑖=1,2,…,𝑚, sample a ring element vector 𝑎_𝑖←𝑅^𝑛_𝑞, a ring element 𝑠_𝑖←𝜒, and a ring

element vector 𝑥_𝑖←𝜒^𝑛. Then, the private key of 𝑃_𝑖 is 𝑠𝑘_𝑖∶=𝑠_𝑖; the public key of 𝑃_𝑖 is

𝑝_𝑖∶=𝑎_𝑖𝑠_𝑖+2𝑥_𝑖∈𝑅^𝑛_𝑞. And then, 𝑃_𝑖 shares a private random 𝑟_𝑖 with SC that has a private

number 𝑘_sc. CC has a private number 𝑘_cc. As a preparation, user 𝑃_𝑖 firstly sends 𝑟_𝑖⋅𝑠_𝑖 to CC;

CC computes 𝑘_cc⋅𝑟_𝑖⋅𝑠_𝑖 and then sends it back to SC. Then, SC can obtain 𝑘_cc⋅𝑠_𝑖 by

removing 𝑟_𝑖.

Upload.

For 𝑖=1,2,…,𝑚, each user 𝑃_𝑖 encrypts its own private input 𝑥_𝑖 by the LE scheme. Firstly, 𝑃_𝑖

samples 𝑒_𝑖←𝜒^𝑛 and computes 𝑐^𝑖₀∶=𝑝_𝑖,𝑒_𝑖+𝑥_𝑖∈𝑅_𝑞 and 𝑐^𝑖₁∶=𝑎_𝑖,𝑒_𝑖∈𝑅_𝑞. Then, it

outputs the ciphertext 𝑐_𝑖∶=𝑐^𝑖₀,𝑐^𝑖₁∈𝑅²_𝑞.

Outsourcing Computation.

After receiving all ciphertexts of the private inputs from users, SC stores all ciphertexts and

executes a midtransformation to the outsourced data when computing some function 𝑓(⋅).

After that, CC further transforms the midtransformed ciphertexts and then computes the

function 𝑓(⋅) following the circuit 𝒞_𝑓 that consisted of addition gates and multiplication gates.

(1) Midtransforming.

Firstly, SC midtransforms the ciphertexts encrypted by users’ own keys as 𝑐_𝑖→𝑐_𝑖^′, where

𝑐_𝑖^′=𝑐^𝑖₀^′,𝑐^𝑖₁^′=𝑘_sc⋅𝑐^𝑖₀,𝑘_sc⋅𝑘_cc⋅𝑠_𝑖⋅𝑐^𝑖₁, and sends 𝑐_𝑖^′ to CC.

(2) Computing.

After receiving 𝑐_𝑖^′, CC further transforms 𝑐_𝑖^′ to 𝑐_𝑖^′′=𝑘_cc⋅𝑘_sc⋅𝑐^𝑖₀,𝑘_sc⋅𝑘_cc⋅𝑠_𝑖⋅𝑐^𝑖₁.

Denote 𝑘=𝑘_sc⋅𝑘_cc; then, 𝑐_𝑖^′′=𝑐^𝑖₀^′′,𝑐^𝑖₁^′′=𝑘⋅𝑐^𝑖₀,𝑘⋅𝑠_𝑖⋅𝑐^𝑖₁. CC then computes the

ciphertext of the result by the transformed ciphertexts of users’ private inputs.

 Add. For each addition gate, 𝑐_𝑖^′′⊕𝑐_𝑗^′′=𝑐^𝑖₁^′′−𝑐^𝑖₀^′′⊕𝑐^𝑗₁^′′−𝑐^𝑗₀^′′=𝑘⋅𝑥_𝑖+𝑥_𝑗.

 Mul. For each multiplication gate, 𝑐_𝑖^′′⊗𝑐_𝑗^′′=𝑐^𝑖₁^′′−𝑐^𝑖₀^′′⊗𝑐^𝑗₁^′′−𝑐^𝑗₀^′′=𝑘²⋅𝑥_𝑖×𝑥_𝑗.

(3) Producing Custom-Made Result.

After computing gate by gate following the circuit 𝒞_𝑓, CC obtains the intermediate result

encrypted by the private numbers of the two assisted cloud servers SC and CC; that is,

𝑦^′=𝑘^𝑙+1⋅𝑦=𝑘_sc^𝑙+1⋅𝑘_cc^𝑙+1⋅𝑦, where 𝑦=𝑓𝑥₁,𝑥₂,…,𝑥_𝑚 and 𝑙 is the number of the

multiplication gates of 𝒞_𝑓. To produce a custom-made result for each user, CC firstly sends

𝑦^′ to SC. SC removes 𝑘^𝑙+1_sc and adds 𝑟_𝑡 to compute 𝑦_𝑡^′=𝑟_𝑡⋅𝑘^𝑙+1_cc⋅𝑦 and then sends 𝑦_𝑡^′ back

to CC. CC finally removes 𝑘^𝑙+1_cc to produce the custom-made ciphertext 𝑦_𝑡=𝑟_𝑡⋅𝑦 and sends

it to the authorized party 𝑃_𝑡,𝑡∈{1,2,…,𝑚}.

Output

For each authorized party 𝑃_𝑡,𝑡∈{1,2,…,𝑚}, it obtains the result 𝑦 by removing 𝑟_𝑡.