Sharing Privacy Protected and Statistically Sound Clinical Research Data Using Outsourced Data Storage

Box 1

CSA Protocol.

Key Generation. Each user 𝒰_𝑖 (1≤𝑖≤𝗇) runs the following CSA.Key(1^𝑛,1^𝑚,𝑞) algorithm to get a public key pair

𝑝𝑘_𝑖=(𝐀_𝑖,𝐌_𝑖) and a secret key 𝑠𝑘_𝑖=𝐓_𝑖.

CSA.Key(1^𝑛,1^𝑚,𝑞): Given 𝑛, 𝑚, and 𝑞, output a public key pair 𝑝𝑘_𝑖=(𝐀_𝑖,𝐌_𝑖) and a secret key 𝑠𝑘_𝑖=𝐓_𝑖 by

performing following steps:

 (1) perform GHV∗.Key(1^𝑛,1^𝑚,𝑞) to get 𝐀_𝑖 and 𝐓_𝑖,

 (2) choose a uniformly random matrix 𝐌_𝑖∈ℤ_𝑞^𝑛×𝑚.

Encryption. Each user 𝒰_𝑖 (1≤𝑖≤𝗇) runs the following CSA.Enc(𝑝𝑘_𝑖,𝐛_𝑖) algorithm to get a ciphertext pair (𝐜_𝑖,𝐜^′_𝑖).

CSA.Enc(𝑝𝑘_𝑖,𝐛_𝑖): Given a public key pair 𝑝𝑘_𝑖=(𝐀_𝑖,𝐌_𝑖) and a plaintext 𝐛_𝑖∈ℤ^𝑚_𝑝, output a ciphertext pair (𝐜_𝑖,𝐜^′_𝑖)

by performing following steps:

 (1) choose 𝐫_𝑖∈{0,1}^𝑚 at random,

 (2) compute 𝐬_𝑖=𝗁_𝐌𝑖(𝐫_𝑖)∈ℤ^𝑛_𝑞,

 (3) choose a uniformly random vector 𝐬^′_𝑖∈ℤ^𝑛_𝑞,

 (4) choose Gaussian error vectors 𝐱_𝑖∈ℤ^𝑚_𝑞 and 𝐱^′_𝑖∈ℤ^𝑚_𝑞,

 (5) compute 𝐜_𝑖=𝐀_𝑖𝐬_𝑖+𝑝𝐱_𝑖+𝐛_𝑖(mod𝑞),

 (6) compute 𝐜^′_𝑖=𝐀_𝑖𝐬^′_𝑖+𝑝𝐱^′_𝑖+𝐫_𝑖(mod𝑞).

Aggregation.  𝒜𝒢𝒢 aggregates ciphertext pairs {(𝐜_𝑖,𝐜^′_𝑖)}_𝑖∈ℐ generated under distinct public key pairs {𝑝𝑘_𝑖}_𝑖∈ℐ by

performing the following CSA.Agg({(𝐜_𝑖,𝐜^′_𝑖)}_𝑖∈ℐ,ℐ).

CSA.Agg({(𝐜_𝑖,𝐜^′_𝑖)}_𝑖∈ℐ,ℐ): Given ciphertext pairs (𝐜_𝑖,𝐜^′_𝑖) where 𝑖∈ℐ, output 𝐜, {𝐜^′_𝑖}_𝑖∈ℐ and ℐ by performing following

steps:

 (1) Let ℐ={𝑖₁,…,𝑖_|ℐ|} where |ℐ| is the number of elements in ℐ,

 (2) 𝐜=𝐜_𝑖1+⋯+𝐜_𝑖|ℐ|.

re-Aggregation. Each user 𝒰_𝑖 (1≤𝑖≤𝗇) can run the following CSA.reAgg(𝐜^′,𝐜^′_𝑖,𝑝𝑘_𝑖,𝑠𝑘_𝑖,𝐀_ℛ) algorithm to get a

re-aggregated ciphertext.

CSA.reAgg(𝐜^′,𝐜^′_𝑖,𝑝𝑘_𝑖,𝑠𝑘_𝑖,𝐀_ℛ): Given an aggregated ciphertext 𝐜^′, a ciphertext 𝐜^′_𝑖, a public key pair 𝑝𝑘_𝑖=(𝐀_𝑖,𝐌_𝑖),

a secret key 𝑠𝑘_𝑖=𝐓_𝑖, and a public key 𝐀_ℛ of 𝒰_ℛ, output 𝐜 by performing following steps:

 (1) perform GHV∗.Dec(𝑠𝑘_𝑖,𝐜^′_𝑖) to get 𝐫_𝑖,

 (2) compute 𝐬_𝑖=𝗁_𝐌𝑖(𝐫_𝑖),

 (3) choose a uniformly random vector 𝐬_𝑖^′′∈ℤ^𝑛_𝑞,

 (4) choose a Gaussian error vector 𝐱_𝑖^′′∈ℤ^𝑚_𝑞,

 (5) compute 𝐜=𝐜^′−𝐀_𝑖𝐬_𝑖+𝐀_ℛ𝐬_𝑖^′′+𝑝𝐱_𝑖^′′(mod𝑞).

dec-Aggregation.  𝒜𝒢𝒢 gives an aggregated ciphertext 𝐜=𝐜_𝑖1+⋯+𝐜_𝑖|ℐ| to 𝒰_𝑖1, and a ciphertext 𝐜^′_𝑖𝑗 and a public key

𝐀_ℛ of 𝒰_ℛ to each user 𝒰_𝑖𝑗 (1≤𝑗≤|ℐ|), respectively. Let 𝐜₀=𝐜, then the receiver 𝒰_ℛ obtains 𝐛=𝐛_𝑖1+⋯+𝐛_𝑖|ℐ|

by performing following steps:

 (1) Each user 𝒰_𝑖𝑗 (1≤𝑗≤|ℐ|−1) in turn,

   (a) computes 𝑐_𝑗 = CSA.reAgg(𝐜_𝑗−1,𝐜^′_𝑖𝑗,𝑝𝑘_𝑖𝑗,𝑠𝑘_𝑖𝑗,𝐀_ℛ),

   (b) sends 𝐜_𝑗 to the next user 𝒰_𝑖𝑗+1.

 (2) 𝒰_𝑖|ℐ| computes 𝐜_|ℐ| = CSA.reAgg(𝐜_|ℐ|−1,𝐜^′_𝑖|ℐ|,𝑝𝑘_𝑖|ℐ|,𝑠𝑘_𝑖|ℐ|,𝐀_ℛ) and sends 𝐜_|ℐ| to 𝒰_ℛ.

 (3) 𝒰_ℛ performs GHV∗.Dec(𝑠𝑘_ℛ,𝐜_|ℐ|) to get 𝐛=𝐛_𝑖1+⋯+𝐛_𝑖|ℐ|.