A computer-implemented system for protecting sensitive data via data re-encryption, comprising: a database to maintain encrypted data, wherein the encrypted data comprises a property of supporting additions of plaintext underlying the encrypted data; a server comprising a central processing unit, memory, an input port, and an output port, wherein the central processing unit is configured to generate a re-encryption key for the encrypted data using a public key of one of a plurality of users; and a further server comprising a central processing unit, memory, an input port to receive at least a portion of the encrypted data from the database and the re-encryption key from the server, and an output port, wherein the central processing unit is configured to: re-encrypt the portion of encrypted data using the re-encryption key; transmit the re-encrypted data to the user; and characterized in that the system further comprises: a message encryptor to encrypt each message by dividing each message into segments, further dividing each segment, using secret sharing, into two blocks comprising a first block and a second block, collecting the first block from each segment in the message and generating ciphertext on the set of the first blocks , collecting the second block from each segment in the message and generating ciphertext on the set of the second blocks, wherein the generating of the ciphertext is performed separately on the first set of blocks and the second set of blocks using a public key of a data owner, and combining the ciphertext from the first and the second blocks as an encryption of that message, in order to generate the encrypted data to be maintained in the database. a database to maintain encrypted data, wherein the encrypted data comprises a property of supporting additions of plaintext underlying the encrypted data; a server comprising a central processing unit, memory, an input port, and an output port, wherein the central processing unit is configured to generate a re-encryption key for the encrypted data using a public key of one of a plurality of users; and a further server comprising a central processing unit, memory, an input port to receive at least a portion of the encrypted data from the database and the re-encryption key from the server, and an output port, wherein the central processing unit is configured to: re-encrypt the portion of encrypted data using the re-encryption key; transmit the re-encrypted data to the user; and re-encrypt the portion of encrypted data using the re-encryption key; transmit the re-encrypted data to the user; and characterized in that the system further comprises: a message encryptor to encrypt each message by dividing each message into segments, further dividing each segment, using secret sharing, into two blocks comprising a first block and a second block, collecting the first block from each segment in the message and generating ciphertext on the set of the first blocks , collecting the second block from each segment in the message and generating ciphertext on the set of the second blocks, wherein the generating of the ciphertext is performed separately on the first set of blocks and the second set of blocks using a public key of a data owner, and combining the ciphertext from the first and the second blocks as an encryption of that message, in order to generate the encrypted data to be maintained in the database. <EOS>