# Supporting Privacy of Computations in Mobile Big Data Systems +
## 4 Secure and Verifiable Cloud Computing for Mobile Systems
### Secure and Verifiable Cloud Computing through Secure Multiparty Computation  
In a secure multiparty computation protocol, multiple parties hold private inputs, and receive the result of the computation. However, in our proposed secure cloud computing system, while multiple parties participate in the creation of garbled circuits, only the client holds private inputs and obtains the result of the computation in garbled form. Therefore, we adapt the protocols of [PERSON] and BMR in a number of ways, as we discuss in this section, to build an efficient, secure cloud computing system, that also enables the client to easily verify the outputs of the computation. First, note that in the protocol of [PERSON] [8; 9], each party \(p_{i}\) sends its share \((f(x_{1},x_{2},\ldots,x_{n}))_{i}\) to all the other parties. Using these shares, each party computes \(f(x_{1},x_{2},\ldots,x_{n})\) as \(\bigoplus_{i=1}^{n}(f(x_{1},x_{2},\ldots,x_{n}))_{i}\). In our secure cloud computing system, however, we require each server \(p_{i}\) (\(1\leq i\leq n\)), to send its share \((f(x_{1},x_{2},\ldots,x_{n}))_{i}=(A_{ab})_{i}\) to only one server, \(p_{c}\), which combines the received shares using the \(XOR\) operation to produce entries such as \(A_{ab}\) for each garbled table in the garbled circuit, \(GC\). Second, in the BMR protocol [11; 12], which is also a secure multiparty computation protocol, in addition to creating the garbled circuit, for evaluation, the \(n\) parties also create garbled inputs using secure multiparty computation. Then, each of these \(n\) parties evaluates the garbled circuit and obtains the result of the computation. In our system model, since only the client holds the inputs for the computation, it generates the corresponding garbled input for each input wire on its own using the seed values it sends to each server, \(p_{i}\) (\(1\leq i\leq n\)). Then, it sends these garbled values to the server \(p_{e}\) for evaluating the garbled circuit and obtains the result in garbled form. Note that in our model, only the server \(p_{e}\) evaluates the garbled circuit, and that \(p_{e}\) cannot interpret any garbled value, unless it colludes with all the \(n\) servers, \(p_{i}\) (\(1\leq i\leq n\)). Third, in the BMR protocol [11; 12], the \(\lambda\) value is set to zero for each output wire in the Boolean circuit. Therefore, each party evaluating the garbled circuit obtains the result of the computation in plaintext form from the LSB of the garbled output for each output wire in the circuit. In our system model, however, the \(\lambda\) value for each output wire is also determined using the \(XOR\)-sum of the shares from all the \(n\) servers, \(p_{i}\) (\(1\leq i\leq n\)). As a consequence, result of the computation in plaintext form remains as secret for the evaluator \(p_{e}\). Fourth, in the protocol of [PERSON] [8; 9], each party splits and shares each of its private input bits with all the other parties over pairwise secure communication channels. In our system, we eliminate this communication using a unique seed value \(s_{ik}\) that the client shares with all pairs of parties, \((p_{i},p_{k})\), \((1\leq i,k\leq n)\). To split and share each of its \(m\) private input bits \(x_{ij}\) (\(1\leq j\leq m\)), party \(p_{i}\) uses the seed value \(s_{ik}\) to generate \(r_{kj}\) (\(\forall k\
eq i\)). Specifically, party \(p_{i}\) sets its own share as \(x_{ij}\bigoplus_{k=1,k\
eq i}^{n}r_{kj}\), where \(r_{kj}=R(s_{ik},j,gate_{id},entry_{id})\) corresponds to the output of the pseudorandom bit generator using the seed value \(s_{ik}\) for the \(j^{th}\) private input bit of party \(p_{i}\), for a specific garbled table entry (\(entry_{id}\)) of one of the gates (\(gate_{id}\)) in the Boolean circuit. Similarly, party \(p_{k}\) sets its own share as \(r_{kj}=R(s_{ik},j,gate_{id},entry_{id})\).