Patent Description:
Customers or users can interact with external entities via a smart contract specifying various conditions, services and/or interactions between participating entities (e.g. the user and the external entity).

Some smart contracts may rely on user data. Such smart contracts may further provide for a verification of a validity of the user data to make sure that the user data has not been tampered by the user. In order to verify a validity of the user data, the user may need to reveal user data to the external entity. Since the user data may contain sensitive personal information, a privacy of the user can be violated by revealing the user data to the external entity.

Further, the external entity may have concerns that the user data has been tampered.

A first document (<CIT>) proposes a concept for receiving or sending a verification that a user performed a physical exercise prescribed by an incenting arrangement.

However, the first document does not disclose an appropriate concept for preserving a privacy of the user. This concept may require a verification based on plaintext user data indicative of the physical exercise.

A second document (<CIT>) discloses a concept for processing performance-based healthcare payments. The concept provides for receiving, by a processor, patient health data from a computing device, determining by the processor, that the patient health data fulfills a condition of terms of a contract, and automatically executing, by the processor, the contract in response to determining that the patient health data fulfills the conditions. This may require to evaluate the patient health data in a deciphered form. Thus, the second document may not provide a concept for preserving the privacy of the patient/user.

A third document (<CIT>) proposes a concept for providing user privacy and security using dynamically generated tokens to make a user's identity and actions anonymous during the user's activities, exchanges or communications on a computer network.

Nonetheless, the concept proposed by the third document does not deliver a solution to overcome concerns of an external entity regarding to tampered user data.

A fourth document (<CIT>) discloses an activity evaluation system. The evaluation system comprises an electronic evaluation module configured to determine an activity safety level of a worker from activity data of the worker. Further, the activity evaluation system comprises a communications module to provide the activity data and/or the activity safety level to a computer system operated by a second entity for adjusting risk-related parameters.

The fourth document may not provide a concept for preserving the privacy of a user.

A fifth document (<CIT>) proposes a concept for tracking and reporting fitness data of a cardholder associated with a payment card. The fitness payment card has a fitness tracking component and an ability to report the fitness data to a payment network.

The concept proposed by the fifth document may not be suitable to preserve a privacy of a user/cardholder.

A sixth document (<CIT>) proposes an information processing method and system based on a signature aggregation medical health monitoring network model.

There may be a demand of a concept providing a privacy preserving verification of user data.

Advantageous embodiments are defined by the dependent claims.

According to a first aspect, the present disclosure relates to a method. The method comprises, at a tamper-proof second user device, generating encrypted user data by homomorphically encrypting user data and generating digitally signed encrypted user data by signing the encrypted user data. The method further comprises, at a first user device, receiving the digitally signed encrypted user data from the second user device. Further, the method comprises, at the first user device, recovering the user data by decrypting the digitally signed encrypted user data, aggregating the user data according to a first logic and transmitting the aggregated user data and the digitally signed encrypted user data to an external server. The method further comprises, at the external server, verifying whether the first logic, by which the aggregated user data and the user data are related to each other, corresponds to a predefined second logic for verifying a validity of the aggregated user data. Verifying whether the first logic corresponds to the predefined second logic comprises determining first encrypted aggregated user data by aggregating the digitally signed encrypted user data received from the first user device according to the predefined second logic. Additionally, verifying whether the first logic corresponds to the predefined second logic comprises determining second encrypted aggregated user data by homomorphically encrypting the aggregated user data received from the first user device. Verifying whether the first logic corresponds to the predefined second logic further comprises verifying the validity of the aggregated user data by checking the first and the second encrypted aggregated user data for correspondence.

The first user device, for example, is a personal computer (PC) or a mobile phone. Optionally, the first user device can be any other programmable hardware. The first user device can be coupled with the second user device via a data link, such as a Bluetooth, a Near-Field Communication (NFC) interface or a network path, to obtain the user data.

The user data, for example, may comprise one or more records like activity data (e.g. travelled distance and/or number of steps), health data (e.g. heart rate and/or blood pressure) or personal information (e.g. age). Further, the user data may comprise a single or multiple records, for example, each indicative of a daily step count of consecutive days.

The second user device, for example, is an activity tracker or a mobile device comprising a heart rate sensor, blood pressure sensor, a Global Positioning System (GPS) sensor, a step counter and/or a data processing circuitry to obtain the user data by monitoring the user.

The user data, for example, can be signed using a private key of the second user device. Thus, the second user device can be identified as a source of the user data.

The second user device is tamper-proof such that the user or a third party cannot manipulate the user data. Thus, the user may not be able to increase a number of steps included in the user data or pretend an activity, for example, to generate the activity data in "illicit manner". The first and/or the second logic may specify a rule and/or an arithmetic operation for aggregating the user data. For example, the first logic provides for adding up sequential records of the user data, such as daily step counts.

By comparing the user data with the aggregated user data, the external server can determine whether an aggregation of the digitally signed data according to the first logic is reconcilable with the second logic.

The second logic may be defined by an external entity. For example, the second logic may be defined in connection with a smart contract between the user and the external entity.

The external server can be configured to connect to the first user device via a network path or via the internet to transmit the aggregated user data and the user data.

Moreover, the external server can be operated by a trusted third party such that the external entity cannot access the user data.

Thus, a privacy of the user can be preserved towards the external entity.

According to a second aspect, the present disclosure relates to a data processing system which comprises an external server, a first user device and a second tamper-proof user device. The second user device is configured to generate encrypted user data by homomorphically encrypting user data and generate digitally signed encrypted user data by signing the encrypted user data. The first user device is configured to receive the digitally signed encrypted user data from the second user device, recover the user data by decrypting the digitally signed encrypted user data and aggregate the user data according to a first logic. Moreover, the first user device is configured to transmit the aggregated user data and the digitally signed encrypted user data to the external server. The external server is configured to verify whether the first logic by which the aggregated user data and the user data are related to each other corresponds to a predefined second logic for verifying a validity of the aggregated user data. For verifying whether the first logic corresponds to the predefined second logic, the external server is configured to: determine first encrypted aggregated user data by aggregating the digitally signed encrypted user data received from the first user device according to the predefined second logic; determine second encrypted aggregated user data by homomorphically encrypting the aggregated user data received from the first user device; and verify the validity of the aggregated user data by checking the first and the second encrypted aggregated user data for correspondence.

According to a third aspect, the present disclosure relates to a computer program comprising instructions which, when executed by the aforementioned data processing system, causes the data processing system to perform the aforementioned method.

Accordingly, while further examples are capable of various modifications and alternative forms, some particular examples thereof are shown in the figures and will subsequently be described in detail. However, this detailed description does not limit further examples to the particular forms described. Further examples may cover all modifications, equivalents, and alternatives falling within the scope of the disclosure. Same or like numbers refer to like or similar elements throughout the description of the figures, which may be implemented identically or in modified form when compared to one another while providing for the same or a similar functionality.

It will be understood that when an element is referred to as being "connected" or "coupled" to another element, the elements may be directly connected or coupled via one or more intervening elements. If two elements A and B are combined using an "or", this is to be understood to disclose all possible combinations, i.e. only A, only B as well as A and B, if not explicitly or implicitly defined otherwise. An alternative wording for the same combinations is "at least one of A and B" or "A and/or B". The same applies, mutatis mutandis, for combinations of more than two Elements.

In order to verify a validity of user data, for example in connection with a smart contract, the user may need to reveal the user data to an external entity participating in the smart contract. Since the user data may contain sensitive personal information, a privacy of the user may be violated by revealing the user data to the external entity.

Thus, there may be a demand of a concept providing a privacy preserving verification of user data.

<FIG> schematically illustrates a method <NUM> for a privacy preserving verification of user data.

The method comprises, at a first user device, receiving <NUM> user data from a tamper-proof second user device and aggregating <NUM> the user data according to a first logic. Further, the method <NUM> comprises transmitting <NUM> the aggregated user data and the user data to an external server.

Further, the method <NUM> provides for verifying whether the first logic, by which the aggregated user data and the user data are related to each other, corresponds to a predefined second logic for verifying a validity of the aggregated user data at the external server.

As can be seen in <FIG>, the external server can be implemented as cloud storage <NUM> of a data processing system <NUM>.

The data processing system <NUM> further comprises a mobile phone <NUM> of a user <NUM> as the first user device.

The mobile phone <NUM> can communicate with a second user device <NUM> to transmit the user data. In the shown example, the second user device <NUM> corresponds to an activity tracker. As can be seen in <FIG>, the activity tracker <NUM> is, for example, designed as a wristband.

As illustrated in <FIG>, user data <NUM> can comprise a first set <NUM>-<NUM> and at least one second set <NUM>-<NUM> of the user data <NUM>. The first and the second set <NUM>-<NUM> and <NUM>-<NUM> of the user data <NUM>, for example, each represent a daily record. In some embodiments of the present disclosure, each of the first and the second set <NUM>-<NUM> and <NUM>-<NUM> of the user data <NUM> may comprise multiple records.

The activity tracker <NUM> may communicate digitally signed encrypted user data <NUM> to the mobile phone <NUM> of the user <NUM>. For this, the activity tracker <NUM> can encrypt and sign the user data <NUM>. The activity tracker <NUM>, for example, homomorphically encrypts the daily records with a public key of the mobile phone <NUM>.

The user data <NUM> or the encrypted user data can be signed with a private (signing) key of the activity tracker <NUM> to obtain the digitally signed encrypted user data <NUM>.

The private (signing key) can be (physically) embedded in a hardware of the activity tracker <NUM> by its manufacturer. Thus, a signature on the digitally signed encrypted user data <NUM> can guarantee their authenticity.

The mobile phone <NUM> is capable of recovering the user data <NUM> by decrypting the digitally signed encrypted user data <NUM> with a private key of the mobile phone <NUM>, as illustrated in <FIG>.

Hence, the mobile phone <NUM> can aggregate the (plaintext) user data <NUM> according to the first logic for3 generating (plaintext) aggregated user data <NUM>-<NUM>, for a comparison with the second predefined logic, as stated in more detail later.

The predefined second logic, for example, prescribes adding up the first set <NUM>-<NUM> of the user data <NUM> and at least a second set <NUM>-<NUM> of the user data <NUM> for generating the aggregated user data <NUM>-<NUM>.

Moreover, the first set <NUM>-<NUM> of user data <NUM> can be indicative of first time period and the second set <NUM>-<NUM> of the user data <NUM> can be indicative of a second time period.

For example, the first set and the second set <NUM>-<NUM> and <NUM>-<NUM> of the user data <NUM> are indicative of daily step counts.

As indicated with an arrow in <FIG> and <FIG>, the mobile phone <NUM> transmits the digitally signed encrypted user data <NUM> and the aggregated user data <NUM>-<NUM> to the cloud storage <NUM>.

For a verification, the cloud storage <NUM> determines first encrypted aggregated user data <NUM>-<NUM> by aggregating the digitally signed encrypted user data <NUM> received from the mobile phone <NUM> according to the predefined second logic.

Further, the cloud storage <NUM> determines second encrypted aggregated user data <NUM>-<NUM> by homomorphically encrypting the aggregated user data <NUM>-<NUM> received from the mobile phone <NUM>.

Consequently, the cloud storage can verify the validity of the aggregated user data <NUM>-<NUM> data by checking the first and the second encrypted aggregated user data <NUM>-<NUM> and <NUM>-<NUM> for correspondence.

Due to a homomorphic encryption of the first and the second encrypted aggregated user data <NUM>-<NUM> and <NUM>-<NUM>, those may correspond if they stem from the same user data <NUM> and if the first logic corresponds to the second logic.

This may enable an external entity <NUM> to obtain certainty about the validity of the aggregated user data <NUM>-<NUM>. Simultaneously, the user <NUM> does not need to reveal single records of the user data <NUM> to the external entity <NUM> for the verification of the aggregated user data <NUM>-<NUM>. Moreover, the records of the user data <NUM> are not visible publically at any time.

The external entity <NUM>, for example, is a private person or a company.

Subsequently, the external entity <NUM> can access the (plaintext) aggregated user data <NUM>-<NUM> and a result of the verification to check the validity of the aggregated user data <NUM>-<NUM>.

This concept described in connection with the aforementioned embodiments may further enable a non-interactive, but privacy preserving way for the verification of the aggregated user data <NUM>-<NUM>.

In order to prevent from precomputation attacks affecting the digitally signed encrypted user data <NUM>, an encryption of the user data <NUM> can provide for adding some random noise to records of the user data <NUM>. The random noise can be multiple magnitudes lower than values of the records <NUM>-<NUM> and <NUM>-<NUM> of the user data <NUM> such that the random noise has no influence on the first and the second encrypted aggregated user data <NUM>-<NUM> and <NUM>-<NUM> determined from the digitally signed encrypted user data <NUM>.

Thus, the digitally signed encrypted user data <NUM> cannot be precomputed, whereas the aggregated user data <NUM> may not be influenced by the random noise.

The aforementioned method can be comprised of a smart contract <NUM> between the user <NUM> and the external entity <NUM>.

Depending on the validity of the aggregated user data <NUM>-<NUM>, the method <NUM> may further comprise triggering an interaction between the user <NUM> and the external entity <NUM> in accordance with the smart contract <NUM>, as shown in <FIG>.

The interaction, for example, implies a refund and/or a discount for the user <NUM> on products of the external entity <NUM>.

For reasons of transparency and security, the cloud storage <NUM> which executes the verification and/or stores/manages the smart contract <NUM>, can be implemented as a blockchain (system).

As can be seen in <FIG> and <FIG>, in examples of the method <NUM> not according to the claimed subject-matter, the method <NUM> can comprise providing the user data <NUM> and the aggregated user data <NUM>-<NUM> to a zero-knowledge proof (ZKP) proving function (as input) for generating a cryptographic proof <NUM> which denotes whether the aggregated user <NUM>-<NUM> data is calculated based on the user data <NUM> according to the second logic without containing or revealing the user data <NUM> and the aggregated user data <NUM>-<NUM>. This, for example, is executed by the mobile phone <NUM> running a (proper) proving program or a "ZKP prover" using the above proving function for generating the cryptographic proof <NUM>.

In other words, the user, for example, runs the "ZKP prover" program which takes the user data <NUM> and the aggregated user data <NUM>-<NUM> as input to generate the cryptographic proof <NUM>. The cryptographic proof <NUM>, for example, is a zero-knowledge succinct non-interactive argument of knowledge (zk-SNARK) which does not contain the user data <NUM> and/or the aggregated user data <NUM>-<NUM> explicitly.

Further, the mobile phone <NUM> can transmit the aggregated user data <NUM>-<NUM> and the cryptographic proof <NUM> to the external entity. Thereby, the mobile phone <NUM>, for example, does not transmit the user data <NUM> itself.

The cryptographic proof <NUM> allows to verify that the aggregated user data <NUM>-<NUM> was generated based on the second logic which, for example, provides for adding up the user data <NUM>.

Thus, the cryptographic proof <NUM> can be understood as a proof of a/an (agreed) computation.

Moreover, the method <NUM> can comprise obtaining <NUM> a binary value from the cryptographic proof <NUM> using a ZKP verifying function related to the ZKP proving function. In this context, the ZKP verifying function can be understood as being "related to the ZKP proving function" in such a way that the ZKP verifying function is configured or dedicated to verify cryptographic proofs generated by the ZKP proving function.

The binary value indicates whether the first logic denoting the aggregation of the user data <NUM> corresponds to the predefined second logic. Thus, the binary value denotes the validity of the aggregated user data <NUM>-<NUM>.

The external entity <NUM>, for example, runs a "ZKP verifier" program which takes the cryptographic proof <NUM> and the aggregated user data <NUM>-<NUM> as input for verifying whether the aggregated user data <NUM>-<NUM> results from an aggregation of the user data <NUM> according to the predefined second logic.

In cryptography, a zero knowledge proof can be used by a first party (prover) to prove to another party (verifier) that they know a value x, without conveying any information apart from the fact that they know the value x.

Depending on which of various concepts (based on e.g. a discrete log of the value, a Hamiltonian cycle for a graph, (non-) interactive zero knowledge proof) is used for generating the cryptographic proof <NUM>, various mathematical operations can be applied to the user data <NUM> and the aggregated user data <NUM>-<NUM> which can be understood as input of the ZKP proving function.

As can be seen in <FIG>, the mobile phone <NUM> can communicate the cryptographic proof <NUM> to a blockchain <NUM>.

The blockchain <NUM>, for example, is configured to obtain the binary value from the cryptographic proof <NUM> and the aggregated user data <NUM>-<NUM> using the ZKP verifying function. The binary value, for example, is a Boolean value.

Depending on its state (e.g. "True" or "False"), the Boolean value indicates whether the first logic corresponds to the predefined second logic ("True") or not ("False"). Thus, the Boolean value may implicitly indicate the validity of the aggregated user data.

Subsequently, the mobile phone <NUM> can transmit the aggregated user data <NUM>-<NUM> to the external entity <NUM>, either directly or via the blockchain <NUM>, for example, in order to trigger an interaction defined by the smart contract <NUM>.

As well as aforementioned embodiments of the method <NUM>, this concept incorporating the cryptographic proof <NUM> may enable a non-interactive, privacy preserving verification of the aggregated user data <NUM>-<NUM> since an amount of information exposed to the external server can be reduced compared to known concepts.

The skilled person having benefit from the present disclosure will appreciate that the aforementioned concept using the cryptographic proof <NUM> for verifying the validity of the aggregated user data <NUM>-<NUM> can be adapted to various use cases stated above in the present disclosure.

Functions of various elements shown in the figures, including any functional blocks labeled as "means", "means for providing a signal", "means for generating a signal. ", etc., may be implemented in the form of dedicated hardware, such as "a signal provider", "a signal processing unit", "a processor", "a controller", etc. as well as hardware capable of executing software in association with appropriate software. When provided by a processor, the functions may be provided by a single dedicated processor, by a single shared processor, or by a plurality of individual processors, some of which or all of which may be shared. However, the term "processor" or "controller" is by far not limited to hardware exclusively capable of executing software, but may include digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC), field programmable gate array (FPGA), read only memory (ROM) for storing software, random access memory (RAM), and non-volatile storage.

Claim 1:
A method, comprising:
at a tamper-proof second user device (<NUM>):
generating encrypted user data by homomorphically encrypting user data (<NUM>); and
generating digitally signed encrypted user data (<NUM>) by signing the encrypted user data;
at a first user device (<NUM>):
receiving the digitally signed encrypted user data (<NUM>) from the tamper-proof second user device;
recovering the user data (<NUM>) by decrypting the digitally signed encrypted user data (<NUM>);
aggregating the user data (<NUM>) according to a first logic;
transmitting the aggregated user data (<NUM>-<NUM>) and the digitally signed encrypted user data (<NUM>) to an external server;
at the external server (<NUM>):
verifying whether the first logic, by which the aggregated user data (<NUM>-<NUM>) and the user data (<NUM>) are related to each other, corresponds to a predefined second logic for verifying a validity of the aggregated user data (<NUM>-<NUM>), wherein verifying whether the first logic corresponds to the predefined second logic comprises:
determining first encrypted aggregated user data (<NUM>-<NUM>) by aggregating the digitally signed encrypted user data (<NUM>) received from the first user device (<NUM>) according to the predefined second logic;
determining second encrypted aggregated user (<NUM>-<NUM>) data by homomorphically encrypting the aggregated user data (<NUM>-<NUM>) received from the first user device (<NUM>); and
verifying the validity of the aggregated user data (<NUM>-<NUM>) by checking the first and the second encrypted aggregated user data (<NUM>-<NUM>, <NUM>-<NUM>) for correspondence.