# US 11,451,369 B2 · Method and system for multi-authority controlled functional encryption

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,369 B2
- Document ID: US11451369B2
- Status: Granted
- Kind: B2
- Application number: 16/581,903
- Filed: 2019-09-25
- Published: 2020-10-22
- Granted: 2022-09-20
- Earliest claimed: 2019-04-16
- Assignees: NEC Corporation
- Applicants: NEC Laboratories Europe GmbH
- Inventors: Claudio Soriente; Miguel Ambrona; Dario Fiore
- Web page: https://patentgrep.com/patent/US11451369B2

## CPC

- H04L 9/008: {involving homomorphic encryption}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes}
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 2209/46: Secure multiparty computation, e.g. millionaire problem
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In a system having a plurality of servers, a method is executed to perform an encryption scheme. The method includes a server of the plurality of servers receiving a request token to compute a function on a data point, the data point being encrypted as a ciphertext and the request token being based on the ciphertext and the function. The server grants the request to compute the function on the datapoint by sending a function evaluation key, and participates in a distributed decryption protocol for determining a result of computing the function on the data point by sending a master secret key.

## Claims

### Claim 1

A method for performing an encryption scheme in a system having a plurality of servers, the method comprising:
receiving, by a first server of the plurality of servers, a request from a client to compute a function on a data point, the data point being encrypted as a ciphertext and the request including a request token generated by the client based on the ciphertext and the function; and
granting, by the first server, the request to compute the function on the data point by sending a function evaluation key to the client, wherein the function evaluation key is generated by the first server based on the request token and a master secret key associated with the first server, wherein the master secret key is based on a share of a secret key under a linearly-homomorphic encryption scheme and another secret key under an adaptive chosen ciphertext attack encryption scheme,
wherein the function evaluation key is one of a plurality of function evaluation keys, each function evaluation key in the plurality of function evaluation keys corresponding to one of the plurality of servers participating in a distributed decryption protocol, and the plurality of function evaluation keys enable the client to generate a result of computing the function on the data point.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the function is a non-linear function.

### Claim 3 (depends on 1)

The method according to claim 1, wherein the ciphertext is an output of an encryption algorithm using both the linearly-homomorphic encryption scheme and the adaptive chosen ciphertext attack encryption scheme.

### Claim 4 (depends on 3)

The method according to claim 3, wherein the ciphertext is of the form:
(x−r0,H.Enc(pkH,r0),{E.Enc(pkEi,ctri)}i∈[n]),
wherein H.Enc( ) is an encryption algorithm of the linearly-homomorphic encryption scheme, E.Enc( ) is an encryption algorithm of the adaptive chosen ciphertext attack encryption scheme, ctri=ri−1−ri,H.Enc(pkH,ri), ri(i∈[0,n−1]) is random, rn=0, x is the data point, n is the number of servers in the system, pkH is a public key under the linearly-homomorphic encryption scheme, {pkEi}i∈[n] are public keys of the plurality of servers under the adaptive chosen ciphertext attack encryption scheme.

### Claim 5 (depends on 1)

The method according to claim 1, wherein the function evaluation key is generated based upon the request token, the function, and the master secret key associated with the first server.

### Claim 6 (depends on 5)

The method according to claim 5, wherein the function evaluation key is generated by decrypting the request token.

### Claim 7 (depends on 1)

The method according to claim 1, wherein an authority generates the master secret key associated with the first server.

### Claim 8 (depends on 1)

The method according to claim 1, wherein the ciphertext comprises a plurality of ciphertexts of a plurality of data points, including the data point.

### Claim 9 (depends on 1)

The method of claim 1, wherein the first server does not learn the computed function on the data point.

### Claim 10

A method for performing an encryption scheme in a system having a plurality of servers, at least one data provider, and a client, the method comprising:
receiving, by the client from the at least one data provider, a ciphertext corresponding to an encrypted data point,
sending, by the client to each of the servers, a respective request to compute a function on the data point, each respective request including a respective request token corresponding to a particular server and generated based on the ciphertext and the function,
receiving, from each of the servers, a respective function evaluation key, and participating in a distributed decryption protocol for determining a result of computing the function on the data point by providing a private input, wherein the result is generated based on a plurality of function evaluation keys corresponding to the plurality of servers,
wherein the private input comprises the respective function evaluation key received from each of the servers and a decryption token, the decryption token being based on an encryption algorithm of a linearly-homomorphic encryption scheme.

### Claim 11 (depends on 10)

The method according to claim 10, wherein the method further comprises generating the respective request token for each of the servers according to:
ctxreq=E.Enc(pkEi,(ri−1−ri,(ri−1−ri,H.Enc(pkH,ri)))
wherein ctxreq is the respective request token for an i-th server, E.Enc( ) is an encryption algorithm of an adaptive chosen ciphertext attack encryption scheme, H.Enc( ) is an encryption algorithm of a linearly-homomorphic encryption scheme, pkEi is a public key under the adaptive chosen ciphertext attack encryption scheme for the i-th server, pkH is a public key under the linearly-homomorphic encryption scheme, ri(i∈[0,n−1]) is random, rn=0, and n is the number of servers.

### Claim 12 (depends on 10)

The method of claim 10, wherein the function is a non-linear function.

### Claim 13

A server comprising a processor coupled to a non-transitory storage medium containing instructions, which, when executed by the processor, cause the server to:
receive a request from a client to compute a function on a data point, the data point being encrypted as a ciphertext and the request including a request token generated by the client based on the ciphertext and the function, and
grant the request to compute the function on the data point by sending a function evaluation key to the client, wherein the function evaluation key is generated based on the request token and a master secret key associated with the server, wherein the master secret key is based on a share of a secret key under a linearly-homomorphic encryption scheme and another secret key under an adaptive chosen ciphertext attack encryption scheme,
wherein the function evaluation key is one of a plurality of function evaluation keys, each function evaluation key in the plurality of function evaluation keys corresponding to one of a plurality of servers participating in a distributed decryption protocol, and the plurality of function evaluation keys enable the client to generate a result of computing the function on the data point.