A method, comprising: at a tamper-proof second user device: generating encrypted user data by homomorphically encrypting user data; and generating digitally signed encrypted user data by signing the encrypted user data; at a first user device: receiving the digitally signed encrypted user data from the tamper-proof second user device; recovering the user data by decrypting the digitally signed encrypted user data; aggregating the user data according to a first logic; transmitting the aggregated user data and the digitally signed encrypted user data to an external server; at the external server: verifying whether the first logic, by which the aggregated user data and the user data are related to each other, corresponds to a predefined second logic for verifying a validity of the aggregated user data, wherein verifying whether the first logic corresponds to the predefined second logic comprises: determining first encrypted aggregated user data by aggregating the digitally signed encrypted user data received from the first user device according to the predefined second logic; determining second encrypted aggregated user data by homomorphically encrypting the aggregated user data received from the first user device; and verifying the validity of the aggregated user data by checking the first and the second encrypted aggregated user data (330-2, 330-2) for correspondence. at a tamper-proof second user device: generating encrypted user data by homomorphically encrypting user data; and generating digitally signed encrypted user data by signing the encrypted user data; generating encrypted user data by homomorphically encrypting user data; and generating digitally signed encrypted user data by signing the encrypted user data; at a first user device: receiving the digitally signed encrypted user data from the tamper-proof second user device; recovering the user data by decrypting the digitally signed encrypted user data; aggregating the user data according to a first logic; transmitting the aggregated user data and the digitally signed encrypted user data to an external server; receiving the digitally signed encrypted user data from the tamper-proof second user device; recovering the user data by decrypting the digitally signed encrypted user data; aggregating the user data according to a first logic; transmitting the aggregated user data and the digitally signed encrypted user data to an external server; at the external server: verifying whether the first logic, by which the aggregated user data and the user data are related to each other, corresponds to a predefined second logic for verifying a validity of the aggregated user data, wherein verifying whether the first logic corresponds to the predefined second logic comprises: determining first encrypted aggregated user data by aggregating the digitally signed encrypted user data received from the first user device according to the predefined second logic; determining second encrypted aggregated user data by homomorphically encrypting the aggregated user data received from the first user device; and verifying the validity of the aggregated user data by checking the first and the second encrypted aggregated user data (330-2, 330-2) for correspondence. determining first encrypted aggregated user data by aggregating the digitally signed encrypted user data received from the first user device according to the predefined second logic; determining second encrypted aggregated user data by homomorphically encrypting the aggregated user data received from the first user device; and verifying the validity of the aggregated user data by checking the first and the second encrypted aggregated user data (330-2, 330-2) for correspondence.