# US 10,482,270 B2 · Method for processing data streams with multiple tenants > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,270 B2 - Document ID: US10482270B2 - Status: Granted - Kind: B2 - Application number: 14/602,796 - Filed: 2015-01-22 - Published: 2015-07-23 - Granted: 2019-11-19 - Earliest claimed: 2014-01-23 - Assignees: ABS Schweiz AG - Applicants: ABB Technology AG - Inventors: Martin Naedele; Thomas Locher - Web page: https://patentgrep.com/patent/US10482270B2 ## CPC - G06F 21/606: {by securing the transmission between two devices or processes} - G06F 21/602: {Providing cryptographic facilities or services} - H04L 45/308: {Route determination based on user's profile, e.g. premium users} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 65/60: Network streaming of media packets - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present disclosure relates to the field of processing data in the stream processing network, such as processing data having data streams associated with multiple owners or entities. A method is disclosed of secure processing of input data by a stream processing network having first and second processing units, wherein the method can include: a) receiving input data from a communication channel, wherein the input data includes a first data stream associated with a first owner and a second data stream associated with a second owner; b) distinguishing data packets of the first data stream from that of the second data stream; and c) processing the first data stream with the first processing unit. ## Claims ### Claim 1 Method of secure processing of input data by a stream processing network having a first and a second processing unit, wherein the method comprises: a) transmitting first and second data streams over a communication channel, the first and second data streams being mixed together as input data transmitted over the same communication channel; b) receiving the input data from the same communication channel, wherein the input data includes the first data stream associated with a first owner and the second data stream associated with a second owner; c) distinguishing data packets of the first data stream from that of the second data stream using meta tags in headers of data packets of the first and second data streams; d) securely processing the first data stream with the first processing unit; and e) securely processing the second data stream with the second processing unit; wherein contents of the first data stream are not revealed to the second processing unit and contents of the second data stream are not revealed to the first processing unit. ### Claim 2 (depends on 1) Method according to claim 1, wherein the first data stream includes a confidential part, and wherein prior to the step a) the method comprises: encrypting at least the confidential part of the first data stream. ### Claim 3 (depends on 2) Method according to claim 2, comprising: decrypting the first data stream by the first processing unit using a first decryption key corresponding to a first encryption key used for encrypting the first data stream. ### Claim 4 (depends on 2) Method according to claim 2, wherein the second data stream includes a confidential part, and wherein the method comprises: encrypting at least the confidential part of the second data stream. ### Claim 5 (depends on 4) Method according to claim 4, comprising: decrypting the second data stream by the second processing unit using a second decryption key corresponding to a second encryption key used for encrypting the second data stream. ### Claim 6 (depends on 1) Method according to claim 1, wherein the first data stream includes a confidential part, and wherein prior to the step a) the method comprises: encrypting at least the confidential part of the first data stream. ### Claim 7 (depends on 1) Method according to claim 1, comprising: decrypting the first data stream by the first processing unit using a first decryption key corresponding to a first encryption key used for encrypting the first data stream. ### Claim 8 (depends on 7) Method according to claim 7, comprising: decrypting the second data stream by the second processing unit using a second decryption key corresponding to a second encryption key used for encrypting the second data stream. ### Claim 9 (depends on 1) Method according to claim 1, wherein the first and second processing units are separate components. ### Claim 10 (depends on 1) Method according to claim 1, further comprising: encrypting a confidential part of the first data stream prior to step a) with a first encryption key; encrypting a confidential part of the second data stream prior to step a) with a second encryption key; decrypting the first data stream by the first processing unit using a first decryption key corresponding to the first encryption key; and decrypting the second data stream by the second processing unit using a second decryption key corresponding to the second encryption key; wherein the first processing unit does not have access to the second decryption key and the second processing unit does not have access to the first decryption key. ### Claim 11 Method of secure processing of input data by a stream processing network having a first and a second processing unit, wherein the method comprises: a) transmitting first and second data streams over a communication channel, the first and second data streams being mixed together as input data transmitted over the same communication channel; b) receiving the input data from the same communication channel, wherein the input data includes the first data stream associated with a first owner and the second data stream associated with a second owner; c) distinguishing data packets of the first data stream from that of the second data stream; d) securely processing the first data stream with the first processing unit; and e) securely processing the second data stream with the second processing unit; wherein contents of the first data stream are not revealed to the second processing unit and contents of the second data stream are not revealed to the first processing unit; wherein the first data stream includes a confidential part, and wherein prior to the step a) the method comprises encrypting at least the confidential part of the first data stream; wherein the second data stream includes a confidential part, and wherein the method comprises encrypting at least the confidential part of the second data stream; wherein the encrypting and processing are carried out by homomorphic encryption. ### Claim 12 (depends on 11) Method according to claim 11, wherein the confidential part of the first or second data stream is relevant for multiple owners, the method comprising: using the homomorphic encryption to compute aggregate information on encrypted data items directly. ### Claim 13 (depends on 11) Method according to claim 11, comprising: using the homomorphic encryption to provide computational functions across multiple entities, in order to avoid a revealing confidential part of the data streams. ### Claim 14 Method of secure processing of input data by a stream processing network having a first and a second processing unit, wherein the method comprises: a) transmitting first and second data streams over a communication channel, the first and second data streams being mixed together as input data transmitted over the same communication channel; b) receiving the input data from the same communication channel, wherein the input data includes the first data stream associated with a first owner and the second data stream associated with a second owner; c) distinguishing data packets of the first data stream from that of the second data stream; d) securely processing the first data stream with the first processing unit; and e) securely processing the second data stream with the second processing unit; wherein contents of the first data stream are not revealed to the second processing unit and contents of the second data stream are not revealed to the first processing unit; further comprising decrypting the first data stream by the first processing unit using a first decryption key corresponding to a first encryption key used for encrypting the first data stream, and decrypting the second data stream by the second processing unit using a second decryption key corresponding to a second encryption key used for encrypting the second data stream; wherein the encrypting and processing are carried out by homomorphic encryption. ### Claim 15 Method of secure processing of input data by a stream processing network having a first and a second processing unit, wherein the method comprises: a) transmitting first and second data streams over a communication channel, the first and second data streams being mixed together as input data transmitted over the same communication channel; b) receiving the input data from the same communication channel, wherein the input data includes the first data stream associated with a first owner and the second data stream associated with a second owner; c) distinguishing data packets of the first data stream from that of the second data stream; d) securely processing the first data stream with the first processing unit; and e) securely processing the second data stream with the second processing unit; wherein contents of the first data stream are not revealed to the second processing unit and contents of the second data stream are not revealed to the first processing unit; further comprising prior to step a): labeling the first data stream with a unique first owner ID by adding or appending the unique first owner ID as meta tags into headers of data packets of the first data stream, and labeling the second data stream with a unique second owner ID by adding or appending the unique second owner ID as meta tags into headers of data packets of the second data stream; wherein step c) distinguishes data packets of the first data stream from that of the second data stream using the meta tags and unique first and second owner IDs. ### Claim 16 (depends on 15) Method according to claim 15, further comprising: encrypting a confidential part of the first data stream prior to step a) with a first encryption key; encrypting a confidential part of the second data stream prior to step a) with a second encryption key; decrypting the first data stream by the first processing unit using a first decryption key corresponding to the first encryption key; and decrypting the second data stream by the second processing unit using a second decryption key corresponding to the second encryption key; wherein the first processing unit does not have access to the second decryption key and the second processing unit does not have access to the first decryption key. ### Claim 17 (depends on 16) Method according to claim 16, wherein the unique first owner ID and unique second owner ID are not encrypted. ### Claim 18 (depends on 17) Method according to claim 17, wherein the first and second processing units are separate components.