Encrypted data exchange

A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations for a first data party and a second data party to jointly and securely compute an aggregated result from user data stored by the second data party for a set of users whose membership is maintained by the first data party without the second data party being exposed to the membership of the set and without the first data party being exposed to the user data, the operations comprising

• encrypting, by the first data party, identification data representing membership in the set of users, to generate a first identification data ciphertext;
• sending, by the first data party to the second data party, the first identification data ciphertext representing membership in the set of users;
• receiving, by the first data party from the second data party, a second identification data ciphertext obtained by the second data party encrypting the first identification data ciphertext;
• performing, by the first data party, a homomorphic decryption process on the second identification data ciphertext to generate a third identification data ciphertext representing the membership of the set encrypted by the second data party but not by the first data party;
• receiving, by the first data party, from the second data party, a ciphertext set, the ciphertext set comprising encrypted identification data stored by the second data party, homomorphically encrypted user data stored by the second data party, and mappings between identities in the encrypted identification data and corresponding encrypted user data;
• calculating, by the first data party, an intersection set of the encrypted identification data and the third identification data ciphertext;
• calculating, by the first data party, a homomorphic addition result of encrypted user data mapped to the intersection set;
• and
• sending, by the first data party, the homomorphic addition result to the second data party, the homomorphic addition result being decryptable by the second data party to obtain the aggregated result.

A computer-implemented system, comprising:

• one or more computers;
• and
• one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform operations for a first data party and a second data party to jointly and securely compute an aggregated result from user data stored by the second data party for a set of users whose membership is maintained by the first data party without the second data party being exposed to the membership of the set and without the first data party being exposed to the user data, the operations comprising:
• encrypting, by the first data party, identification data representing membership in the set of users, to generate a first identification data ciphertext;
• sending, by the first data party to the second data party, the first identification data ciphertext representing membership in the set of users;
• receiving, by the first data party from the second data party, a second identification data ciphertext obtained by the second data party encrypting the first identification data ciphertext;
• performing, by the first data party, a homomorphic decryption process on the second identification data ciphertext to generate a third identification data ciphertext representing the membership of the set encrypted by the second data party but not by the first data party;
• receiving, by the first data party, from the second data party, a ciphertext set, the ciphertext set comprising encrypted identification data stored by the second data party, homomorphically encrypted user data stored by the second data party, and mappings between identities in the encrypted identification data and corresponding encrypted user data;
• calculating, by the first data party, an intersection set of the encrypted identification data and the third identification data ciphertext;
• calculating, by the first data party, a homomorphic addition result of encrypted user data mapped to the intersection set;
• and
• sending, by the first data party, the homomorphic addition result to the second data party, the homomorphic addition result being decryptable by the second data party to obtain the aggregated result.