Method and system for secure multiparty cloud computation

1. A computer-executable method, comprising:

receiving, at a computing system, multiple encrypted datasets from multiple clients, wherein an encrypted dataset associated with a client is encrypted from a corresponding plaintext dataset using a unique, client-specific encryption key, wherein the client-specific encryption key is a public key selected from a public/private key pair;

re-encrypting the multiple encrypted datasets to a target format, comprising,

receiving a set of re-encryption keys, wherein a particular re-encryption key corresponding to the client is used to re-encrypt the encrypted dataset associated with the client, wherein the re-encryption key corresponding to the client is generated using a private key selected from the public/private key pair and a target public key published by a trusted third party, wherein the target public key corresponds to a target private key and each client receives a share of the target private key;

evaluating a function based on the re-encrypted multiple datasets to produce an evaluation result; and

sending the evaluation result to the multiple clients, which are configured to cooperatively decrypt the evaluation result to obtain a plaintext evaluation result using shares of the target private key.

2. The method of claim 1 , wherein re-encrypting the multiple encrypted datasets involves a homomorphic encryption scheme.

3. The method of claim 1 , wherein the function includes a multiplication and/or an addition.

4. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:

receiving multiple encrypted datasets from multiple clients, wherein an encrypted dataset associated with a client is encrypted from a corresponding plaintext dataset using a unique, client-specific encryption key, wherein the client-specific encryption key is a public key selected from a public/private key pair;

re-encrypting the multiple encrypted datasets to a target format, comprising,

receiving a set of re-encryption keys, wherein a particular re-encryption key corresponding to the client is used to re-encrypt the encrypted dataset associated with the client, wherein the re-encryption key corresponding to the client is generated using a private key selected from the public/private key pair and a target public key published by a trusted third party, and wherein the target public key corresponds to a target private key, and wherein each client receives a share of the target private key;

evaluating a function based on the re-encrypted multiple datasets to produce an evaluation result; and

sending the evaluation result to the multiple clients, which are configured to cooperatively decrypt the evaluation result to obtain a plaintext evaluation result using shares of the target private key.

5. The computer-readable storage medium of claim 4 , wherein re-encrypting the multiple encrypted datasets involves a homomorphic encryption scheme.

6. The computer-readable storage medium of claim 4 , wherein the function includes a multiplication and/or an addition.

7. A method for use in a cloud computing system, the method comprising:

obtaining, by a first client of a cloud computing system, an encrypted dataset from a plaintext dataset using a unique encryption key;

obtaining, by a second client of a cloud computing system, an encrypted dataset from a plaintext dataset using a unique encryption key, wherein each of the unique encryption keys is a public key selected from a public/private key pair;

storing the encrypted datasets at the cloud computing system;

generating, by the first client, a re-encryption key;

generating, by the second client, a re-encryption key, wherein each of the re-encryption keys is generated based on a private key selected from the public/private key pair and a target public key published by a trusted third party;

transmitting the re-encryption keys to the cloud computing system, thereby allowing the cloud computing system to re-encrypt the encrypted dataset received from the first client and re-encrypt the encrypted dataset received from the second client and generate an evaluation result of a function based on the re-encrypted datasets;

receiving the evaluation result from the cloud computing system;

receiving, from the trusted third party, a share of a target private key corresponding to the target public key; and

cooperating among at least the first client and the second client to decrypt the evaluation result to obtain a plaintext evaluation result.

8. The method of claim 7 , wherein cooperating among at least the first client and the second client to decrypt the evaluation result comprises:

computing a portion of a decrypted result;

receiving, by the first client, a portion of the decrypted result from the second client; and

computing the plaintext evaluation result based on the computed portion and the portion received from the first client.

9. The method of claim 7 , wherein the function includes a multiplication and/or an addition.

10. The method of claim 7 , wherein each of the re-encryption keys is a homomorphic encryption key.

11. A computer system comprising:

a processor;

a memory;

a receiving module configured to receive multiple encrypted datasets from multiple clients, wherein an encrypted dataset associated with a client is encrypted from a corresponding plaintext dataset using a unique, client-specific encryption key, wherein the client-specific encryption key is a public key selected from a public/private key pair;

a re-encryption module configured to re-encrypt the multiple encrypted datasets to a target format and receive a set of re-encryption keys, wherein a particular re-encryption key corresponding to the client is used to re-encrypt the encrypted dataset associated with the client, wherein the re-encryption key corresponding to the client is generated using a private key selected from the public/private key pair and a target public key published by a trusted third party, and wherein the target public key corresponds to a target private key, and wherein each client receives a share of the target private key;

an evaluation module configured to evaluate a function based on the re-encrypted multiple datasets to produce an evaluation result; and

an output module configured to send the evaluation result to the multiple clients, which are configured to cooperatively decrypt the evaluation result to obtain a plaintext evaluation result using shares of the target private key.

12. The computer system of claim 11 , wherein while re-encrypting the multiple encrypted datasets, the re-encryption module is further configured to apply a homomorphic encryption scheme.