Method and system for non-interactive secure aggregation

A computing apparatus for securely aggregating data while preserving privacy of individual participants, the computing apparatus comprising:

• a processor;
• a memory;
• and
• a communication interface coupled to each of the processor and the memory,
• wherein the processor is configured to:
• receive, via the communication interface from each of a plurality of first users, a respective first ciphertext that masks a respective first input;
• forward, via the communication interface to each of a plurality of second users, a respective second ciphertext received from each of the plurality of first users;
• receive, via the communication interface from each of the plurality of second users, a respective second input that relates to a respective combination of third inputs recovered from the respective second ciphertexts received by each second user from each of the plurality of first users;
• combine the received second inputs in order to generate a first unmasking component;
• combine the first ciphertexts in order to generate an aggregated ciphertext;
• and
• generate an unmasked aggregate of the first inputs by using the first unmasking component and the aggregated ciphertext,
• wherein an unmasked version of each respective first input is unknowable by the at least one processor.

A non-transitory computer readable storage medium storing instructions for securely aggregating data while preserving privacy of individual participants, the storage medium comprising executable code which, when executed by a processor, causes the processor to:

• receive, from each of a plurality of first users, a respective first ciphertext that masks a respective first input;
• forward, to each of a plurality of second users, a respective second ciphertext received from each of the plurality of first users;
• receive, from each of the plurality of second users, a respective second input that relates to a respective combination of third inputs recovered from the respective second ciphertexts received by each second user from each of the plurality of first users;
• combine the received second inputs in order to generate a first unmasking component;
• combine the first ciphertexts in order to generate an aggregated ciphertext;
• and
• generate an unmasked aggregate of the first inputs by using the first unmasking component and the aggregated ciphertext,
• wherein an unmasked version of each respective first input is unknowable by the processor.