A method, comprising: at a tamper-proof second user device : generating encrypted user data by homomorphically encrypting user data ; and generating digitally signed encrypted user data by signing the encrypted user data; at a first user device : receiving the digitally signed encrypted user data from the tamper-proof second user device; recovering the user data by decrypting the digitally signed encrypted user data ; aggregating the user data according to a first logic; transmitting the aggregated user data (330-1) and the digitally signed encrypted user data to an external server; at the external server : verifying whether the first logic, by which the aggregated user data (330-1) and the user data are related to each other, corresponds to a predefined second logic for verifying a validity of the aggregated user data (330-1), wherein verifying whether the first logic corresponds to the predefined second logic comprises: determining first encrypted aggregated user data (330-3) by aggregating the digitally signed encrypted user data received from the first user device according to the predefined second logic; determining second encrypted aggregated user (330-2) data by homomorphically encrypting the aggregated user data (330-1) received from the first user device ; and verifying the validity of the aggregated user data (330-1) by checking the first and the second encrypted aggregated user data (330-2, 330-2) for correspondence. at a tamper-proof second user device : generating encrypted user data by homomorphically encrypting user data ; and generating digitally signed encrypted user data by signing the encrypted user data; generating encrypted user data by homomorphically encrypting user data ; and generating digitally signed encrypted user data by signing the encrypted user data; at a first user device : receiving the digitally signed encrypted user data from the tamper-proof second user device; recovering the user data by decrypting the digitally signed encrypted user data ; aggregating the user data according to a first logic; transmitting the aggregated user data (330-1) and the digitally signed encrypted user data to an external server; receiving the digitally signed encrypted user data from the tamper-proof second user device; recovering the user data by decrypting the digitally signed encrypted user data ; aggregating the user data according to a first logic; transmitting the aggregated user data (330-1) and the digitally signed encrypted user data to an external server; at the external server : verifying whether the first logic, by which the aggregated user data (330-1) and the user data are related to each other, corresponds to a predefined second logic for verifying a validity of the aggregated user data (330-1), wherein verifying whether the first logic corresponds to the predefined second logic comprises: determining first encrypted aggregated user data (330-3) by aggregating the digitally signed encrypted user data received from the first user device according to the predefined second logic; determining second encrypted aggregated user (330-2) data by homomorphically encrypting the aggregated user data (330-1) received from the first user device ; and verifying the validity of the aggregated user data (330-1) by checking the first and the second encrypted aggregated user data (330-2, 330-2) for correspondence. determining first encrypted aggregated user data (330-3) by aggregating the digitally signed encrypted user data received from the first user device according to the predefined second logic; determining second encrypted aggregated user (330-2) data by homomorphically encrypting the aggregated user data (330-1) received from the first user device ; and verifying the validity of the aggregated user data (330-1) by checking the first and the second encrypted aggregated user data (330-2, 330-2) for correspondence. <EOS>