# Sharing Privacy Protected and Statistically Sound Clinical Research Data Using Outsourced Data Storage

Authors: Geontae Noh; Ji Young Chun; Ik Rae Jeong
Journal: Journal of Applied Mathematics
 (2014)

---

## Abstract

It is critical to scientific progress to share clinical research data stored in outsourced generally available cloud computing services. Researchers are able to obtain valuable information that they would not otherwise be able to access; however, privacy concerns arise when sharing clinical data in these outsourced publicly available data storage services. HIPAA requires researchers to deidentify private information when disclosing clinical data for research purposes and describes two available methods for doing so. Unfortunately, both techniques degrade statistical accuracy. Therefore, the need to protect privacy presents a significant problem for data sharing between hospitals and researchers. In this paper, we propose a controlled secure aggregation protocol to secure both privacy and accuracy when researchers outsource their clinical research data for sharing. Since clinical data must remain private beyond a patient’s lifetime, we take advantage of lattice-based homomorphic encryption to guarantee long-term security against quantum computing attacks. Using lattice-based homomorphic encryption, we design an aggregation protocol that aggregates outsourced ciphertexts under distinct public keys. It enables researchers to get aggregated results from outsourced ciphertexts of distinct researchers. To the best of our knowledge, our protocol is the first aggregation protocol which can aggregate ciphertexts which are encrypted with distinct public keys.


---

## Body

## 1. Introduction

Researchers can accelerate their learning curve if they are able to freely access clinical data from other studies. Such clinical data sharing in outsourced publicly available services is crucial to scientific progress in clinical research. The benefits of clinical data sharing using these services have been widely reported, including reduced research costs, reduced management costs, improvement of quality control, and reduced time in discovering diseases and dealing with them effectively. Through shared data, researchers access valuable information that they would not ordinarily obtain. In its policy statement on grants, the U.S. National Institute of Health (NIH) supports data sharing by requiring investigators to include a plan for data sharing or explain why data sharing is not possible.The problem with clinical data sharing in outsourced publicly available services for research is that researchers can inadvertently violate patient privacy. HIPAA (Health Insurance Portability and Accountability Act) offers protection of patients’ personal health information, but it is difficult not to invade patient privacy while sharing clinical data in outsourced publicly available data storage services [1]. Therefore, researchers would rather not make their data publicly available than run the risk of violating HIPAA.To mitigate privacy concerns, the HIPAA describes two ways to use and disclose clinical data for research purposes. Under the HIPAA Safe Harbor policy, clinical data should be deidentified so that patients are not individually identifiable. The HIPAA Safe Harbor policy stipulates that the data sharer should deidentify data by removing 18 specific data attributes, such as name, address, and all dates related to the individual patient, which may include birth date and date of death. (In addition, some researchers continue to assert that combinations of other data that are excluded from the HIPAA Safe Harbor policy could individually identify a specific person with nonnegligible probability, so they insist that there are more than 18 specific data attributes that should be included in the Safe Harbor policy [2–4].) Once identifying information has been removed, the deidentified data are no longer subject to the Institutional Review Board (IRB) overview. Alternatively, researchers may use anonymity techniques to deidentify patient information instead of removing all of the 18 or more data attributes that are required to be deidentified. To date, anonymity techniques have been proposed, such as k-anonymity [5–7], l-diversity [8], and t-closeness [9].It is useful to protect patient privacy with deidentification formats when sharing clinical data in outsourced publicly available data storage services, but doing so degrades the statistical accuracy since it makes it difficult to get precise statistical results. However, in some cases where accurate statistical data on patients are critical, the anonymity techniques for deidentification are not sufficient. Due to poorly deidentified data, researchers can make bad decisions. Therefore, there needs to be a privacy-preserving method for accurate statistical data.In this work, we propose how to outsource clinical research data securely and how to control the outsourced data against potential breaches of privacy, while not compromising the accuracy of statistical results. For example, a malicious researcher could circumvent any encryption by asking for one piece of data on one patient; in this way, the researcher could ultimately obtain each patient’s private information. In this case, we propose a method that will foil such a malicious attempt.The system environment we propose for hospitals, aggregator, and researchers is illustrated in Figure1. In our system, each hospital outsources its own clinical data to cloud storage servers. The clinical data must be deidentified or encrypted to be stored publicly. We use a hybrid method to store the clinical data; that is, we deidentify the clinical data for approximate statistical data requests and encrypt numerical clinical data for accurate statistical data requests. Therefore, researchers can request both approximate and accurate statistical data. Researchers would obtain approximate statistical data directly from the cloud storage servers but cannot obtain accurate statistical data directly. When researchers would like to get accurate statistical data, they can get the data through the aggregator. The aggregator aggregates the requested data from the encrypted database stored in the cloud storage servers, and then asks each hospital to decrypt the aggregated data by consent. Hospitals can refuse the request of the aggregator, unless initial consents that have been obtained from patients allow the secondary research. Since there are ethical and practical issues associated with aggregating databases [10], hospitals should ensure that they are following “best practices” for their outsourced data, such as determining whether initial consents that have been obtained allow secondary research.System environment ((a) store phase and (b) search phase).
(a)
(b)Since clinical data should remain private beyond a patient’s lifetime, cryptographic long-term security is absolutely needed [11] in the area of managing clinical data. Therefore, we take advantage of a lattice-based homomorphic encryption in order to encrypt clinical data. Lattice-based cryptography is believed to be secure against quantum computing attacks and guarantees long-term security. RSA, ECC, and DLP cryptosystems, which have gained attention so far, could be attacked with quantum computers [12]. Quantum computing is not yet possible, but may become so in our lifetime. Furthermore, lattice-based cryptographic algorithms are more efficient than others in computational overhead because they require only linear operations on matrices such as addition, multiplication, and inverse.In 2009, Gentry proposed the first fully homomorphic encryption scheme using ideal lattices [13]. In 2010, Gentry et al. have proposed a novel homomorphic encryption scheme (referred to asGHV homomorphic encryption scheme hereafter) that supports one multiplicative and polynomially many additive operations on encrypted data [14]. As a building block, we use a variant of theGHV homomorphic encryption scheme, which supports only additive operations. This can make it possible to aggregate ciphertexts which are encrypted under distinct public keys. Due to this property, the aggregator can aggregate the outsourced encrypted data from hospitals. Therefore, once hospitals outsource their clinical data, they do not need to encrypt the clinical data again for individual researchers. Each hospital only has to encrypt the clinical data, and then it outsources the encrypted data.Contributions. In this paper, we propose a controlled secure aggregation protocol in sharing clinical research data to balance the interests between hospitals and researchers. The main contributions of this paper are as follows.(i)
Researchers can get approximate statistical data from deidentified clinical data directly. Researchers can also obtain accurate and aggregated clinical data from the encrypted database through the aggregator by obtaining each hospital’s consent.(ii)
We take advantage of a lattice-based homomorphic encryption which is secure against quantum computing attacks. Therefore, our protocol resists quantum attacks and could remain secure in the long term.(iii)
The aggregator can aggregate encrypted clinical data which are encrypted with distinct public keys. Therefore, hospitals do not have to encrypt the clinical data again whenever researchers send requests.To the best of our knowledge, our protocol is the first protocol which takes advantage of the lattice-based homomorphic encryption in order to share outsourced clinical research data.Organization. The remainder of this paper is organized as follows. Section 2 provides related works and background. Section 3 presents our controlled secure aggregation protocol. We present our secure clinical data aggregation system in Section 4 and analyze it in Section 5. We provide our conclusions in Section 6.


## 2. Related Works and Background

In this section, we present related works and background.


### 2.1. Data Aggregation Based on Homomorphic Encryption

In 2004, Hacıgümüş et al. proposed an aggregation protocol over encrypted relational databases [15]. They designed the aggregation protocol using the PH (Privacy Homomorphism) which supports additive and multiplicative operations. In the aggregation protocol, permitted users can get the accurate and aggregated data. However, Mykletun and Tsudik showed that the aggregation protocol using the PH is not secure against ciphertext-only attacks [16]. Since then, various aggregation protocols over encrypted data have been proposed in the literatures [17–23]. Among those protocols, few literatures have focused on the health-care environment. In addition, most protocols considered the aggregation for a single provider’s data.Molina et al. [22] designed the aggregation protocol,HICCUPS, using homomorphic encryption in the health-care environment. InHICCUPS, clinical data of multiple providers can be aggregated as follows: caregivers who store clinical data on their own database are randomly chosen as the aggregator. When a researcher requests the aggregated result, the aggregator aggregates the encrypted clinical data from each caregiver and sends the aggregated result to the researcher.SinceHICCUPS is not based on the outsourcing system, caregivers have to provide clinical data whenever a researcher requests a certain data. In addition,HICCUPS requires each caregiver to aggregate and encrypt clinical data with the researcher’s public key so that the aggregator can aggregate the encrypted clinical data. However, a malicious aggregator may want to have a researcher get a misleading result by intentionally excluding the encrypted clinical data from certain caregivers. Even though the malicious aggregator fabricates the aggregated result on purpose, there is no way for a researcher to detect the malicious behavior of the aggregator inHICCUPS.To resolve the above issues, we design the controlled secure aggregation protocol which can aggregate outsourced ciphertexts under distinct public keys. Therefore, data providers (or hospitals) do not have to encrypt clinical data again, once they have outsourced their clinical data. Our protocol also enables a researcher to detect the malicious behavior of the aggregator. If the malicious aggregator excludes the encrypted clinical data from certain data providers on purpose, a researcher can detect that. Since each data provider (or hospital) collaboratively makes the aggregated data decryptable by a researcher, if the aggregated data is generated maliciously then the researcher cannot get a plausible result. The researcher gets the random result that cannot seem to be a meaningful result. Therefore, in our protocol, the researcher can be sure that the requested data are aggregated correctly.


### 2.2. Anonymity Techniques for Deidentification

Samarati and Sweeney introduced an anonymity technique calledk-anonymity [5–7]. They considered a relational database that consists of unique identifiers, quasi-identifiers, and sensitive attributes. A unique identifier is any attribute that is able to identify only one private individual, such as a personal ID, an e-mail address, or a cell phone number. A quasi-identifier is any set of attributes that can be joined with additional information to identify only one private individual, such as a zip code and a birthday. A sensitive attribute is any attribute that a data owner does not want to publish, such as health-care data. In order to preserve privacy, all unique identifiers must be removed and all quasi-identifiers must be anonymized. In k-anonymity, each quasi-identifier is indistinguishable from at least k-1 other quasi-identifiers. Tables 1 and 2 are good examples of the original health-care data and the 4-anonymous pieces of health-care data.Table 1
Original health-care data.
Number
Nonsensitive
Sensitive
Zip code
Age
Condition
1
13033
22
Gastric ulcer
2
13062
25
Gastric ulcer
3
13032
27
Gastric ulcer
4
13067
28
Gastric ulcer
5
13065
31
Flu
6
13038
33
Stomach cancer
7
13035
35
Gastritis
8
13060
36
Gastritis
9
14856
43
Flu
10
14850
45
Gastritis
11
14852
50
Stomach cancer
12
14855
52
Gastric ulcerTable 2
4-anonymous health-care data.
Number
Nonsensitive
Sensitive
Zip code
Age
Condition
1
130**
<30
Gastric ulcer
2
130**
<30
Gastric ulcer
3
130**
<30
Gastric ulcer
4
130**
<30
Gastric ulcer
5
130**
3*
Flu
6
130**
3*
Stomach cancer
7
130**
3*
Gastritis
8
130**
3*
Gastritis
9
148**
≥40
Flu
10
148**
≥40
Gastritis
11
148**
≥40
Stomach cancer
12
148**
≥40
Gastric ulcerHowever,k-anonymity is not secure against homogeneity attacks and background knowledge attacks [8]. For example, suppose that Alice knows that Bob is in his twenties and his zip code is 13032; then, Alice can identify that Bob must have a gastric ulcer from Table 2.To mitigate these attacks, Machanavajjhala et al. introduced a new anonymity technique, calledl-diversity [8]. In l-diversity, all the equivalence classes that have the same quasi-identifiers must have l or more different sensitive attributes. Table 3 shows the 3-diverse kinds of health-care data.Table 3
3-diverse health-care data.
Number
Nonsensitive
Sensitive
Zip code
Age
Condition
3
1303*
<40
Gastric ulcer
1
1303*
<40
Gastric ulcer
7
1303*
<40
Gastritis
6
1303*
<40
Stomach cancer
8
1306*
<40
Gastritis
2
1306*
<40
Gastric ulcer
5
1306*
<40
Flu
4
1306*
<40
Gastric ulcer
10
1485*
≥40
Gastritis
11
1485*
≥40
Stomach cancer
12
1485*
≥40
Gastric ulcer
9
1485*
≥40
FluSince this result ofl-diversity, Li et al. showed that l-diversity is insufficient for anonymity [9]. In l-diversity, any information can be released if there exists a significant distribution difference between sensitive attributes of any equivalence class and all sensitive attributes. For example, if Alice knows Bob’s personal information such as his age and zip code, she will be able to identify from Table 3 that Bob has stomach-related disease (e.g., gastric ulcer, gastritis, and stomach cancer.)To mitigate such potential problem, Li et al. introduced another new anonymity technique, calledt-closeness [9]. t-closeness requires the distribution of sensitive attributes of any equivalence class to be similar to that of all sensitive attributes.


### 2.3.GHV Homomorphic Encryption Scheme

GHV homomorphic encryption scheme supports one multiplicative and polynomially many additive operations on encrypted data [14]. The security of theGHV homomorphic encryption scheme is based on the learning with errors (LWE) problem [24] which is one of the hardest assumptions so far.Letn be the security parameter, then other parameters are as follows:(i)
c=c(n)>0,(ii)
p is a positive integer by setting a prime number q=ω(p2n3c+1log⁡5n),(iii)
m=⌊8nlog⁡q⌋, and(iv)
β=1/(27n1+(3c/2)log⁡nlog⁡qqm) is a Gaussian parameter.Then the IND-CPA secure [25]GHV homomorphic encryption schemeGHV= {GHV.Key,GHV.Enc,GHV.Dec,GHV.Add,GHV.Mul} is as follows.(i)
GHV.Key(1n,1m,q): given n, m, and q, output a public key pk=A∈Zqm×n and a secret key sk=T∈Zm×m such that TA=0(mod⁡q), T is invertible, and the elements of T are bounded by O(nlog⁡q). (To generate two matrices A and T, the trapdoor sampling algorithm in [26] can be used. For further details, please refer to [14].)(ii)
GHV.Enc(pk,B): given pk and a plaintext B∈Zpm×m, choose a uniformly random matrix S∈Zqn×m and a Gaussian error matrix X∈Zqm×m. Then output a ciphertext C=AS+pX+B(mod⁡q).(iii)
GHV.Dec(sk,C): given sk and a ciphertext C∈Zqm×m, compute E=TCTt(mod⁡q). Then output a plaintext B=T-1E(Tt)-1(mod⁡p).In this algorithm,(1)E=TCTt(mod⁡q)=TASTt+TpXTt+TBTt(mod⁡q)=TpXTt+TBTt(mod⁡q)=TpXTt+TBTt,B=T-1E(Tt)-1=T-1TpXTt(Tt)-1+T-1TBTt(Tt)-1=pX+B=B(mod⁡p).(iv)
GHV.Add(C1,…,Cn): given n ciphertexts, C1=AS1+pX1+B1(mod⁡q), …, Cn=ASn+pXn+Bn(mod⁡q), output
(2)C1+⋯+Cn=AS1+pX1+B1+⋯+ASn+pXn+Bn(mod⁡q)=A(S1+⋯+Sn)+p(X1+⋯+Xn)+(B1+⋯+Bn)(mod⁡q)=AS′+pX′+B′(mod⁡q).That is, the output ofGHV.Dec(sk,C1+⋯+Cn) is B′=B1+⋯+Bn.(v)
GHV.Mul(C1,C2): given two ciphertexts, C1=AS1+pX1+B1(mod⁡q) and C2=AS2+pX2+B2(mod⁡q), output
(3)C1·C2t=(AS1+pX1+B1)·(AS2+pX2+B2)t(mod⁡q)=A·(S1C2t)+p(X1(pX2+B2)+B1X2t)+B1B2t+(pX1+B1)S2t·At(mod⁡q)=AS′′+pX′′+B′′+S′′′At(mod⁡q).That is, the output ofGHV.Dec(sk,C1·C2t) is B′′=B1·B2t.In this paper, we use, as a building block, a variant version of theGHV homomorphic encryption scheme which supports only additive operations. We call this variant version of theGHV homomorphic encryption scheme a GHV* homomorphic encryption scheme hereafter. We can replace S∈Zqn×m, X∈Zqm×m, B∈Zpm×m, and C∈Zqm×m of theGHV homomorphic encryption scheme with s∈Zqn, x∈Zqm, b∈Zpm, and c∈Zqm of the GHV* homomorphic encryption scheme without any loss of security. Then the IND-CPA secure [25] GHV* homomorphic encryption scheme GHV* = {GHV*.Key, GHV*.Enc, GHV*.Dec, GHV*.Add} is as follows.(i)
GHV*.Key(1n,1m,q): given n, m, and q, output a public key pk=A∈Zqm×n and a secret key sk=T∈Zm×m such that TA=0(mod⁡q), T is invertible, and the elements of T are bounded by O(nlog⁡q).(ii)
GHV*.Enc(pk,b): given pk and a plaintext b∈Zpm, choose a uniformly random vector s∈Zqn and a Gaussian error vector x∈Zqm. Then output a ciphertext c=As+px+b(mod⁡q).(iii)
GHV*.Dec(sk,c): given sk and a ciphertext c∈Zqm, compute e=Tc(mod⁡q). Then output a plaintext b=T-1e(mod⁡p).


### 2.4. Ajtai’s One-Way Function

Ajtai constructed a one-way function whose security is based on some well known approximation problems in lattices [27, 28].Letn be the security parameter, m a positive integer, and q a positive integer. For a uniformly random matrix M∈Zqn×m and r∈{0,1}m, the Ajtai’s one-way function hM:{0,1}m→Zqn is as follows:
(4)hM(r)=Mr(mod⁡q).Note that the Ajtai’s one-way functionhM is regular [29]; that is, every output of hM is uniformly distributed over Zqn [30].


## 2.1. Data Aggregation Based on Homomorphic Encryption

In 2004, Hacıgümüş et al. proposed an aggregation protocol over encrypted relational databases [15]. They designed the aggregation protocol using the PH (Privacy Homomorphism) which supports additive and multiplicative operations. In the aggregation protocol, permitted users can get the accurate and aggregated data. However, Mykletun and Tsudik showed that the aggregation protocol using the PH is not secure against ciphertext-only attacks [16]. Since then, various aggregation protocols over encrypted data have been proposed in the literatures [17–23]. Among those protocols, few literatures have focused on the health-care environment. In addition, most protocols considered the aggregation for a single provider’s data.Molina et al. [22] designed the aggregation protocol,HICCUPS, using homomorphic encryption in the health-care environment. InHICCUPS, clinical data of multiple providers can be aggregated as follows: caregivers who store clinical data on their own database are randomly chosen as the aggregator. When a researcher requests the aggregated result, the aggregator aggregates the encrypted clinical data from each caregiver and sends the aggregated result to the researcher.SinceHICCUPS is not based on the outsourcing system, caregivers have to provide clinical data whenever a researcher requests a certain data. In addition,HICCUPS requires each caregiver to aggregate and encrypt clinical data with the researcher’s public key so that the aggregator can aggregate the encrypted clinical data. However, a malicious aggregator may want to have a researcher get a misleading result by intentionally excluding the encrypted clinical data from certain caregivers. Even though the malicious aggregator fabricates the aggregated result on purpose, there is no way for a researcher to detect the malicious behavior of the aggregator inHICCUPS.To resolve the above issues, we design the controlled secure aggregation protocol which can aggregate outsourced ciphertexts under distinct public keys. Therefore, data providers (or hospitals) do not have to encrypt clinical data again, once they have outsourced their clinical data. Our protocol also enables a researcher to detect the malicious behavior of the aggregator. If the malicious aggregator excludes the encrypted clinical data from certain data providers on purpose, a researcher can detect that. Since each data provider (or hospital) collaboratively makes the aggregated data decryptable by a researcher, if the aggregated data is generated maliciously then the researcher cannot get a plausible result. The researcher gets the random result that cannot seem to be a meaningful result. Therefore, in our protocol, the researcher can be sure that the requested data are aggregated correctly.


## 2.2. Anonymity Techniques for Deidentification

Samarati and Sweeney introduced an anonymity technique calledk-anonymity [5–7]. They considered a relational database that consists of unique identifiers, quasi-identifiers, and sensitive attributes. A unique identifier is any attribute that is able to identify only one private individual, such as a personal ID, an e-mail address, or a cell phone number. A quasi-identifier is any set of attributes that can be joined with additional information to identify only one private individual, such as a zip code and a birthday. A sensitive attribute is any attribute that a data owner does not want to publish, such as health-care data. In order to preserve privacy, all unique identifiers must be removed and all quasi-identifiers must be anonymized. In k-anonymity, each quasi-identifier is indistinguishable from at least k-1 other quasi-identifiers. Tables 1 and 2 are good examples of the original health-care data and the 4-anonymous pieces of health-care data.Table 1
Original health-care data.
Number
Nonsensitive
Sensitive
Zip code
Age
Condition
1
13033
22
Gastric ulcer
2
13062
25
Gastric ulcer
3
13032
27
Gastric ulcer
4
13067
28
Gastric ulcer
5
13065
31
Flu
6
13038
33
Stomach cancer
7
13035
35
Gastritis
8
13060
36
Gastritis
9
14856
43
Flu
10
14850
45
Gastritis
11
14852
50
Stomach cancer
12
14855
52
Gastric ulcerTable 2
4-anonymous health-care data.
Number
Nonsensitive
Sensitive
Zip code
Age
Condition
1
130**
<30
Gastric ulcer
2
130**
<30
Gastric ulcer
3
130**
<30
Gastric ulcer
4
130**
<30
Gastric ulcer
5
130**
3*
Flu
6
130**
3*
Stomach cancer
7
130**
3*
Gastritis
8
130**
3*
Gastritis
9
148**
≥40
Flu
10
148**
≥40
Gastritis
11
148**
≥40
Stomach cancer
12
148**
≥40
Gastric ulcerHowever,k-anonymity is not secure against homogeneity attacks and background knowledge attacks [8]. For example, suppose that Alice knows that Bob is in his twenties and his zip code is 13032; then, Alice can identify that Bob must have a gastric ulcer from Table 2.To mitigate these attacks, Machanavajjhala et al. introduced a new anonymity technique, calledl-diversity [8]. In l-diversity, all the equivalence classes that have the same quasi-identifiers must have l or more different sensitive attributes. Table 3 shows the 3-diverse kinds of health-care data.Table 3
3-diverse health-care data.
Number
Nonsensitive
Sensitive
Zip code
Age
Condition
3
1303*
<40
Gastric ulcer
1
1303*
<40
Gastric ulcer
7
1303*
<40
Gastritis
6
1303*
<40
Stomach cancer
8
1306*
<40
Gastritis
2
1306*
<40
Gastric ulcer
5
1306*
<40
Flu
4
1306*
<40
Gastric ulcer
10
1485*
≥40
Gastritis
11
1485*
≥40
Stomach cancer
12
1485*
≥40
Gastric ulcer
9
1485*
≥40
FluSince this result ofl-diversity, Li et al. showed that l-diversity is insufficient for anonymity [9]. In l-diversity, any information can be released if there exists a significant distribution difference between sensitive attributes of any equivalence class and all sensitive attributes. For example, if Alice knows Bob’s personal information such as his age and zip code, she will be able to identify from Table 3 that Bob has stomach-related disease (e.g., gastric ulcer, gastritis, and stomach cancer.)To mitigate such potential problem, Li et al. introduced another new anonymity technique, calledt-closeness [9]. t-closeness requires the distribution of sensitive attributes of any equivalence class to be similar to that of all sensitive attributes.


## 2.3.GHV Homomorphic Encryption Scheme

GHV homomorphic encryption scheme supports one multiplicative and polynomially many additive operations on encrypted data [14]. The security of theGHV homomorphic encryption scheme is based on the learning with errors (LWE) problem [24] which is one of the hardest assumptions so far.Letn be the security parameter, then other parameters are as follows:(i)
c=c(n)>0,(ii)
p is a positive integer by setting a prime number q=ω(p2n3c+1log⁡5n),(iii)
m=⌊8nlog⁡q⌋, and(iv)
β=1/(27n1+(3c/2)log⁡nlog⁡qqm) is a Gaussian parameter.Then the IND-CPA secure [25]GHV homomorphic encryption schemeGHV= {GHV.Key,GHV.Enc,GHV.Dec,GHV.Add,GHV.Mul} is as follows.(i)
GHV.Key(1n,1m,q): given n, m, and q, output a public key pk=A∈Zqm×n and a secret key sk=T∈Zm×m such that TA=0(mod⁡q), T is invertible, and the elements of T are bounded by O(nlog⁡q). (To generate two matrices A and T, the trapdoor sampling algorithm in [26] can be used. For further details, please refer to [14].)(ii)
GHV.Enc(pk,B): given pk and a plaintext B∈Zpm×m, choose a uniformly random matrix S∈Zqn×m and a Gaussian error matrix X∈Zqm×m. Then output a ciphertext C=AS+pX+B(mod⁡q).(iii)
GHV.Dec(sk,C): given sk and a ciphertext C∈Zqm×m, compute E=TCTt(mod⁡q). Then output a plaintext B=T-1E(Tt)-1(mod⁡p).In this algorithm,(1)E=TCTt(mod⁡q)=TASTt+TpXTt+TBTt(mod⁡q)=TpXTt+TBTt(mod⁡q)=TpXTt+TBTt,B=T-1E(Tt)-1=T-1TpXTt(Tt)-1+T-1TBTt(Tt)-1=pX+B=B(mod⁡p).(iv)
GHV.Add(C1,…,Cn): given n ciphertexts, C1=AS1+pX1+B1(mod⁡q), …, Cn=ASn+pXn+Bn(mod⁡q), output
(2)C1+⋯+Cn=AS1+pX1+B1+⋯+ASn+pXn+Bn(mod⁡q)=A(S1+⋯+Sn)+p(X1+⋯+Xn)+(B1+⋯+Bn)(mod⁡q)=AS′+pX′+B′(mod⁡q).That is, the output ofGHV.Dec(sk,C1+⋯+Cn) is B′=B1+⋯+Bn.(v)
GHV.Mul(C1,C2): given two ciphertexts, C1=AS1+pX1+B1(mod⁡q) and C2=AS2+pX2+B2(mod⁡q), output
(3)C1·C2t=(AS1+pX1+B1)·(AS2+pX2+B2)t(mod⁡q)=A·(S1C2t)+p(X1(pX2+B2)+B1X2t)+B1B2t+(pX1+B1)S2t·At(mod⁡q)=AS′′+pX′′+B′′+S′′′At(mod⁡q).That is, the output ofGHV.Dec(sk,C1·C2t) is B′′=B1·B2t.In this paper, we use, as a building block, a variant version of theGHV homomorphic encryption scheme which supports only additive operations. We call this variant version of theGHV homomorphic encryption scheme a GHV* homomorphic encryption scheme hereafter. We can replace S∈Zqn×m, X∈Zqm×m, B∈Zpm×m, and C∈Zqm×m of theGHV homomorphic encryption scheme with s∈Zqn, x∈Zqm, b∈Zpm, and c∈Zqm of the GHV* homomorphic encryption scheme without any loss of security. Then the IND-CPA secure [25] GHV* homomorphic encryption scheme GHV* = {GHV*.Key, GHV*.Enc, GHV*.Dec, GHV*.Add} is as follows.(i)
GHV*.Key(1n,1m,q): given n, m, and q, output a public key pk=A∈Zqm×n and a secret key sk=T∈Zm×m such that TA=0(mod⁡q), T is invertible, and the elements of T are bounded by O(nlog⁡q).(ii)
GHV*.Enc(pk,b): given pk and a plaintext b∈Zpm, choose a uniformly random vector s∈Zqn and a Gaussian error vector x∈Zqm. Then output a ciphertext c=As+px+b(mod⁡q).(iii)
GHV*.Dec(sk,c): given sk and a ciphertext c∈Zqm, compute e=Tc(mod⁡q). Then output a plaintext b=T-1e(mod⁡p).


## 2.4. Ajtai’s One-Way Function

Ajtai constructed a one-way function whose security is based on some well known approximation problems in lattices [27, 28].Letn be the security parameter, m a positive integer, and q a positive integer. For a uniformly random matrix M∈Zqn×m and r∈{0,1}m, the Ajtai’s one-way function hM:{0,1}m→Zqn is as follows:
(4)hM(r)=Mr(mod⁡q).Note that the Ajtai’s one-way functionhM is regular [29]; that is, every output of hM is uniformly distributed over Zqn [30].


## 3. Controlled Secure Aggregation Protocol

In this section, we propose our controlled secure aggregation protocol (CSA protocol hereafter). Let n be the security parameter. Then we choose other parameters which are used in ourCSA protocol as follows:(i)
c=c(n)>0,(ii)
p is a positive integer by setting a prime number q=ω(p2n3c+1log⁡5n),(iii)
m=⌊8nlog⁡q⌋, and(iv)
β=1/(27n1+(3c/2)log⁡nlog⁡qqm) is a Gaussian parameter.Suppose that there aren users, Ui(1≤i≤n), a receiver  UR, and an aggregator AGG.   Each user Ui(1≤i≤n) outsources its own numerical data bi with encrypted form. We assume that the receiver UR wants to know an aggregated value b=∑j=1j=|I|‍bij, where I={i1,…,i|I|}⊆{1,…,n} and |I| is the number of elements in I. We also assume that the receiver UR has a public key pkR=AR and a secret key skR=TR by performing GHV*.Key(1n,1m,q). Then the receiver UR can get b by performing ourCSA protocol.OurCSA protocol consists of the following phases which are illustrated in Box 1:Key Generation,Encryption,Aggregation,re-Aggregation, anddec-Aggregation. In theKey Generationphase, each user generates a public key pair and a secret key. In theEncryption phase, each user encrypts its numerical data with his/her public key pair. In theAggregation phase, ciphertexts generated underdistinct public key pairs are aggregated. That is, to get an aggregated value, the receiver UR allows the aggregator AGG to know I={i1,…,i|I|}. Then an aggregator AGG aggregates each ciphertext on bij(1≤j≤|I|) in this phase. In there-Aggregation phase, the user Ui eliminates Aisi from a ciphertext c′ and adds GHV*.Enc(AR,0)=ARsi′′+pxi′′(mod⁡q) which is a ciphertext on 0 under the receiver’s public key AR. In this phase, a ciphertext under the public key Ai is converted into a ciphertext under the public key AR maintaining the same plaintext. For example, suppose that c′=ci=Aisi+pxi+bi(mod⁡q) and ci′=Aisi′+pxi′+ri(mod⁡q), then
(5)CSA.reAgg(c′,ci′,pki,ski,AR)=c′-Aisi+ARsi′′+pxi′′(mod⁡q)=Aisi+pxi+bi-Aisi+ARsi′′+pxi′′(mod⁡q)=ARsi′′+p(xi+xi′′)+bi(mod⁡q)=GHV*.Enc(AR,bi).
As a result, a ciphertext which is decryptable by a user Ui is converted into a ciphertext which is decryptable by the receiver UR maintaining the same plaintext bi. This phase is needed in thedec-Aggregation phase to make an aggregated ciphertext c′ decryptable by the receiver UR. In thedec-Aggregation phase, each user Uij(1≤j≤|I|) in turn makes an aggregated ciphertext c decryptable by the receiver UR. Through these phases, the receiver UR can get an aggregated value b=∑j=1j=|I|‍bij.Box 1:
CSA Protocol.
Key Generation. Each user Ui (1≤i≤n) runs the following CSA.Key(1n,1m,q) algorithm to get a public key pair
p
k
i
=
(
A
i
,
M
i
) and a secret key ski=Ti.
CSA.Key(1n,1m,q): Given n, m, and q, output a public key pair pki=(Ai,Mi) and a secret key ski=Ti by
performing following steps:
(1) performGHV*.Key(1n,1m,q) to get Ai and Ti,
(2) choose a uniformly random matrixMi∈Zqn×m.
Encryption. Each user Ui (1≤i≤n) runs the following CSA.Enc(pki,bi) algorithm to get a ciphertext pair (ci,ci′).
CSA.Enc(pki,bi): Given a public key pair pki=(Ai,Mi) and a plaintext bi∈Zpm, output a ciphertext pair (ci,ci′)
by performing following steps:
(1) chooseri∈{0,1}m at random,
(2) computesi=hMi(ri)∈Zqn,
(3) choose a uniformly random vectorsi′∈Zqn,
(4) choose Gaussian error vectorsxi∈Zqm and xi′∈Zqm,
(5) computeci=Aisi+pxi+bi(mod⁡q),
(6) computeci′=Aisi′+pxi′+ri(mod⁡q).
Aggregation.  AGG aggregates ciphertext pairs {(ci,ci′)}i∈I generated under distinct public key pairs {pki}i∈I by
performing the followingCSA.Agg({(ci,ci′)}i∈I,I).
CSA.Agg({(ci,ci′)}i∈I,I): Given ciphertext pairs (ci,ci′) where i∈I, output c, {ci′}i∈I and I by performing following
steps:
(1) LetI={i1,…,i|I|} where |I| is the number of elements in I,
(2)c=ci1+⋯+ci|I|.
re-Aggregation. Each user Ui (1≤i≤n) can run the following CSA.reAgg(c′,ci′,pki,ski,AR) algorithm to get a
re-aggregated ciphertext.
CSA.reAgg(c′,ci′,pki,ski,AR): Given an aggregated ciphertext c′, a ciphertext ci′, a public key pair pki=(Ai,Mi),
a secret keyski=Ti, and a public key AR of UR, output c- by performing following steps:
(1) performGHV*.Dec(ski,ci′) to get ri,
(2) computesi=hMi(ri),
(3) choose a uniformly random vectorsi′′∈Zqn,
(4) choose a Gaussian error vectorxi′′∈Zqm,
(5) computec-=c′-Aisi+ARsi′′+pxi′′(mod⁡q).
dec-Aggregation.  AGG gives an aggregated ciphertext c=ci1+⋯+ci|I| to Ui1, and a ciphertext cij′ and a public key
A
R of UR to each user Uij(1≤j≤|I|), respectively. Let c-0=c, then the receiver UR obtains b=bi1+⋯+bi|I|
by performing following steps:
(1) Each userUij(1≤j≤|I|-1) in turn,
(a) computes c-j = CSA.reAgg(c-j-1,cij′,pkij,skij,AR),
(b) sends c-j to the next user Uij+1.
(2)Ui|I| computes c-|I| = CSA.reAgg(c-|I|-1,ci|I|′,pki|I|,ski|I|,AR) and sends c-|I| to UR.
(3)UR performs GHV*.Dec(skR,c-|I|) to get b=bi1+⋯+bi|I|.For example, we assume thatn=5 users participating in our controlled secure aggregation protocolCSA and each user Ui(1≤i≤5) has its numerical data bi. Each user Ui (1≤i≤5) outsources its numerical data with encrypted form (ci,ci′)=(Aisi+pxi+bi(mod⁡q), Aisi′+pxi′+ri(mod⁡q)) using CSA.Enc(pki,bi) algorithm. Suppose that the receiver UR wants to know an aggregated value b=b2+b5. The receiver UR lets the aggregator AGG know I={2,5}. Then AGG runs the CSA.Agg((c2,c2′),(c5,c5′),{2,5}) algorithm to get c=c2+c5=A2s2+px2+b2+A5s5+px5+b5(mod⁡q).  AGG gives c, c2′, and AR to U2, and c5′ and AR to U5. Then U2 runs GHV*.reAgg(c¯0=c,c2′,pk2,sk2,AR) to get
(6)c¯1=c¯0-A2s2+ARs2′′+px2′′(mod⁡q)=A2s2+px2+b2+A5s5+px5+b5-A2s2+ARs2′′+px2′′(mod⁡q)=p(x2+x2′′)+b2+A5s5+px5+b5+ARs2′′(mod⁡q).U2 sends c¯1 to U5; then U5 runs GHV*.reAgg(c¯1,c5′,pk5,sk5,AR) to get
(7)c¯2=c¯1-A5s5+ARs5′′+px5′′(mod⁡q)=p(x2+x2′′)+b2+A5s5+px5+b5+ARs2′′-A5s5+ARs5′′+px5′′(mod⁡q)=AR(s2′′+s5′′)+p(x2+x2′′+x5+x5′′)+b2+b5(mod⁡q).U5 sends c¯2 to UR; then UR runs GHV*.Dec(skR,c¯2) to get b=b2+b5. That is,
(8)e=TRc¯2(mod⁡q)=TRAR(s2′′+s5′′)+TRp(x2+x2′′+x5+x5′′)+TRb2+TRb5(mod⁡q)=TRp(x2+x2′′+x5+x5′′)+TRb2+TRb5(mod⁡q)=TRp(x2+x2′′+x5+x5′′)+TRb2+TRb5,b=TR-1e=TR-1TRp(x2+x2′′+x5+x5′′)+TR-1TRb2+TR-1TRb5=p(x2+x2′′+x5+x5′′)+b2+b5=b2+b5(mod⁡p).TRp(x2+x2′′+x5+x5′′)+TRb2+TRb5(mod⁡q) is the same as TRp(x2+x2′′+x5+x5′′)+TRb2+TRb5, since TRp(x2+x2′′+x5+x5′′)+TRb2+TRb5 is a sufficiently short value [14].In thedec-Aggregation phase, any user can refuse to perform the CSA.reAgg algorithm, unless initial consents that have been obtained from patients allow the secondary research. Then the receiver cannot get the result. The receiver can get the result only if all users perform the CSA.reAgg algorithm. That means the receiver can get an aggregated value that he/she is seeking only by the unanimous consent of all fusers who have the data aggregated. That is the reason why we use the term “controlled” in theCSA protocol.


### 3.1. Security

We now analyze the security of our controlled secure aggregation protocol.First, we show that our encryptionCSA.Enc(pki,bi) is IND-CPA secure. Intuitively, the only difference between our encryption scheme CSA.Enc(pki,bi) and the GHV* homomorphic encryption scheme is how to generate a vector si∈Zqn. In the GHV* homomorphic encryption scheme; the vector si is chosen uniformly, but in our encryption scheme CSA.Enc(pki,bi), it is generated by computing si=hMi(ri) using a randomly chosen vector ri∈{0,1}m. Since every output of the Ajtai’s one-way function hMi:{0,1}m→Zqn is uniformly distributed over Zqn, a vector si=hMi(ri) from our encryption scheme is uniformly distributed over Zqn. Therefore, the security of our encryption scheme CSA.Enc(pki,bi) is the same as the GHV* homomorphic encryption scheme.Theorem 1.
Our encryption schemeCSA.Enc(pki,bi) provides IND-CPA if the GHV* homomorphic encryption scheme provides IND-CPA and every output of the Ajtai’s one-way function hMi:{0,1}m→Zqn is uniformly distributed over Zqn.Proof of Theorem1.
Formally, we show that if there exists an adversaryA breaking the IND-CPA security of our encryption scheme CSA.Enc(pki,bi), there exists a challenger C breaking the IND-CPA security of the GHV* homomorphic encryption scheme.
Let{pk=A,GHV*.params} be an instance given to C. C chooses a uniformly random matrix Mi∈Zqn×m and sends {pki=Ai=A,params=(GHV*.params,Mi)} to A.A chooses {b0,b1} and sends {b0,b1} to C. C outputs {b0,b1} and returns cj, where j∈{0,1}. C sends cj to A, and A outputs d∈{0,1}. Then C outputs d∈{0,1}.In our controlled secure aggregation protocolCSA, ciphertexts generated under distinct public key pairs can be aggregated. To decrypt the aggregated ciphertext c which is generated by ciphertexts of users Uij(1≤j≤|I|), each user Uij(1≤j≤|I|) needs to eliminate Aijsij from c and add GHV*.Enc(AR,0)=ARsi′′+pxi′′(mod⁡q) using the CSA.reAgg algorithm. Therefore, we should show that CSA.reAgg(c¯j-1,cij′,pkij,skij,AR) is secure.Theorem 2.
CSA.reAgg(c¯j-1,cij′,pkij,skij,AR) is an aggregation of secure ciphertexts if c¯j-1 is an aggregation of secure ciphertexts including the ciphertext cij which is one of a pair of the ciphertexts (cij,cij′).Proof of Theorem2.
Letc¯j=CSA.reAgg(c¯j-1, cij′, pkij, skij, AR) and c¯j-1=c′+cij=c′+Aijsij+pxij+bij, then
(9)c¯j=CSA.reAgg(c¯j-1,cij′,pkij,skij,AR)=c¯j-1-Aijsij+ARsij′′+pxij′′(mod⁡q)=c′+Aijsij+pxij+bij-Aijsij+ARsij′′+pxij′′(mod⁡q)=c′+ARsij′′+p(xij+xij′′)+bij(mod⁡q)=c′+GHV*.Enc(AR,bij)(mod⁡q).
Therefore,CSA.reAgg(c¯j-1,cij′,pkij,skij,AR) is the aggregation of the secure ciphertexts.In the fifth step of theCSA.reAgg algorithm, GHV*.Enc(AR,0) is added to be secure against an adversary A who can eavesdrop on our controlled secure aggregation protocolCSA. Assume that c¯j=c¯j-1-Aijsij(mod⁡q) in the fifth step ofCSA.reAgg(c¯j-1,cij′,pkij,skij,AR), then any adversary A who can eavesdrop on our controlled secure aggregation protocolCSA is able to get c¯j=c¯j-1-Aijsij(mod⁡q), c¯j-1, and cij=Aijsij+pxij+bij(mod⁡q). Then, A can compute the following:
(10)cij-c¯j-1+c¯j=Aijsij+pxij+bij-Aijsij(mod⁡q)=pxij+bij(mod⁡q)=pxij+bij=bij(mod⁡p).
Since pxij+bij is a sufficiently short value, pxij+bij(mod⁡q) is the same as pxij+bij [14]. Therefore, A can decrypt cij without the secret key skij.In thedec-Aggregation phase, after all the users Uij(1≤j≤|I|) eliminate Aijsij from c, the result is the same form as a ciphertext generated under the public key AR. Therefore, the receiver UR can decrypt it.


## 3.1. Security

We now analyze the security of our controlled secure aggregation protocol.First, we show that our encryptionCSA.Enc(pki,bi) is IND-CPA secure. Intuitively, the only difference between our encryption scheme CSA.Enc(pki,bi) and the GHV* homomorphic encryption scheme is how to generate a vector si∈Zqn. In the GHV* homomorphic encryption scheme; the vector si is chosen uniformly, but in our encryption scheme CSA.Enc(pki,bi), it is generated by computing si=hMi(ri) using a randomly chosen vector ri∈{0,1}m. Since every output of the Ajtai’s one-way function hMi:{0,1}m→Zqn is uniformly distributed over Zqn, a vector si=hMi(ri) from our encryption scheme is uniformly distributed over Zqn. Therefore, the security of our encryption scheme CSA.Enc(pki,bi) is the same as the GHV* homomorphic encryption scheme.Theorem 1.
Our encryption schemeCSA.Enc(pki,bi) provides IND-CPA if the GHV* homomorphic encryption scheme provides IND-CPA and every output of the Ajtai’s one-way function hMi:{0,1}m→Zqn is uniformly distributed over Zqn.Proof of Theorem1.
Formally, we show that if there exists an adversaryA breaking the IND-CPA security of our encryption scheme CSA.Enc(pki,bi), there exists a challenger C breaking the IND-CPA security of the GHV* homomorphic encryption scheme.
Let{pk=A,GHV*.params} be an instance given to C. C chooses a uniformly random matrix Mi∈Zqn×m and sends {pki=Ai=A,params=(GHV*.params,Mi)} to A.A chooses {b0,b1} and sends {b0,b1} to C. C outputs {b0,b1} and returns cj, where j∈{0,1}. C sends cj to A, and A outputs d∈{0,1}. Then C outputs d∈{0,1}.In our controlled secure aggregation protocolCSA, ciphertexts generated under distinct public key pairs can be aggregated. To decrypt the aggregated ciphertext c which is generated by ciphertexts of users Uij(1≤j≤|I|), each user Uij(1≤j≤|I|) needs to eliminate Aijsij from c and add GHV*.Enc(AR,0)=ARsi′′+pxi′′(mod⁡q) using the CSA.reAgg algorithm. Therefore, we should show that CSA.reAgg(c¯j-1,cij′,pkij,skij,AR) is secure.Theorem 2.
CSA.reAgg(c¯j-1,cij′,pkij,skij,AR) is an aggregation of secure ciphertexts if c¯j-1 is an aggregation of secure ciphertexts including the ciphertext cij which is one of a pair of the ciphertexts (cij,cij′).Proof of Theorem2.
Letc¯j=CSA.reAgg(c¯j-1, cij′, pkij, skij, AR) and c¯j-1=c′+cij=c′+Aijsij+pxij+bij, then
(9)c¯j=CSA.reAgg(c¯j-1,cij′,pkij,skij,AR)=c¯j-1-Aijsij+ARsij′′+pxij′′(mod⁡q)=c′+Aijsij+pxij+bij-Aijsij+ARsij′′+pxij′′(mod⁡q)=c′+ARsij′′+p(xij+xij′′)+bij(mod⁡q)=c′+GHV*.Enc(AR,bij)(mod⁡q).
Therefore,CSA.reAgg(c¯j-1,cij′,pkij,skij,AR) is the aggregation of the secure ciphertexts.In the fifth step of theCSA.reAgg algorithm, GHV*.Enc(AR,0) is added to be secure against an adversary A who can eavesdrop on our controlled secure aggregation protocolCSA. Assume that c¯j=c¯j-1-Aijsij(mod⁡q) in the fifth step ofCSA.reAgg(c¯j-1,cij′,pkij,skij,AR), then any adversary A who can eavesdrop on our controlled secure aggregation protocolCSA is able to get c¯j=c¯j-1-Aijsij(mod⁡q), c¯j-1, and cij=Aijsij+pxij+bij(mod⁡q). Then, A can compute the following:
(10)cij-c¯j-1+c¯j=Aijsij+pxij+bij-Aijsij(mod⁡q)=pxij+bij(mod⁡q)=pxij+bij=bij(mod⁡p).
Since pxij+bij is a sufficiently short value, pxij+bij(mod⁡q) is the same as pxij+bij [14]. Therefore, A can decrypt cij without the secret key skij.In thedec-Aggregation phase, after all the users Uij(1≤j≤|I|) eliminate Aijsij from c, the result is the same form as a ciphertext generated under the public key AR. Therefore, the receiver UR can decrypt it.


## 4. Secure Clinical Data Aggregation System

In this section, we provide an overview of our system and how it works.


### 4.1. System Overview

The proposed system environment consists of hospitals, an aggregator, and researchers. In our system, each hospital outsources its clinical data to cloud storage servers. Hospitals use the following hybrid method to store data when outsourcing their clinical research data in cloud servers: they make anonymous data publicly available in the cloud servers using anonymity techniques for deidentification in Section2.1. In addition, hospitals also store their encrypted numerical data together with the anonymous data for statistical accuracy.Suppose that there are4 hospitals, H1,H2,H3, and H4 that want to share their clinical data and have public and sescret key pairs (pk1,sk1),(pk2,sk2),(pk3,sk3), and (pk4,sk4) of ourCSA protocol, respectively. Suppose that there is an aggregator AGG and a researcher R who has a public and secret key pair (pkR,skR)=(AR,TR) of the GHV* homomorphic encryption scheme. The original clinical data of hospitals are shown in Table 4. Each hospital outsources its clinical data to cloud storage servers. That is, Hi stores deidentified nonsensitive data (such as zip code and age), sensitive data in the raw, and numerical data (such as age) using CSA.Enc(pki,Age) on cloud servers. Both anonymous and encrypted clinical data on cloud servers are shown in Table 5, where (c1,1,c1,1′) is an output of CSA.Enc(pk1,25),(c1,2,c1,2′) is an output of CSA.Enc(pk1,31), and so on.Table 4
Original clinical data.
Nonsensitive
Sensitive
Zip code
Age
Condition
H
1
13062
25
Heart disease
13035
31
Cancer
14850
45
Viral infection
H
2
13035
20
Heart disease
14850
23
Heart disease
14855
52
Viral infection
H
3
13062
35
Cancer
13035
22
Cancer
13062
52
Heart disease
H
4
13062
27
Heart disease
13062
33
Viral infection
14855
43
CancerTable 5
Anonymous and encrypted clinical data stored on cloud servers.
Nonsensitive
Sensitive
Ciphertext pair
Zip code
Age
Condition
CSA.Enc  (pk1,Age)
H
1
130**
<30
Heart disease
(
c
1,1
,
c
1,1
′
)
//25
130**
3*
Cancer
(
c
1,2
,
c
1,2
′
)
//31
1485*
≥40
Viral infection
(
c
1,3
,
c
1,3
′
)
//45
Nonsensitive
Sensitive
Ciphertext pair
Zip code
Age
Condition
CSA.Enc  (pk2,Age)
H
2
130**
<30
Heart disease
(
c
2,1
,
c
2,1
′
)
//20
1485*
<30
Heart disease
(
c
2,2
,
c
2,2
′
)
//23
1485*
≥40
Viral infection
(
c
2,3
,
c
2,3
′
)
//52
Nonsensitive
Sensitive
Ciphertext pair
Zip code
Age
Condition
CSA.Enc  (pk3,Age)
H
3
130**
3*
Cancer
(
c
3,1
,
c
3,1
′
)
//35
130**
<30
Cancer
(
c
3,2
,
c
3,2
′
)
//22
130**
≥40
Heart disease
(
c
3,3
,
c
3,3
′
)
//52
Nonsensitive
Sensitive
Ciphertext pair
Zip code
Age
Condition
CSA.Enc  (pk4,Age)
H
4
130**
<30
Heart disease
(
c
4,1
,
c
4,1
′
)
//27
130**
3*
Viral infection
(
c
4,2
,
c
4,2
′
)
//33
1485*
≥40
Cancer
(
c
4,3
,
c
4,3
′
)
//43When the researcherR wants to know the rough estimate of the age of the hospitals’ cancer patients, R can directly get the estimate data from the cloud servers. When R wants to figure out the average age of the hospitals’ cancer patients, R can ask the aggregator AGG for an aggregated age. AGG sums up the ages of cancer patients in each hospital, then totals the ages across hospitals. That is, AGG performs homomorphic additions to ciphertexts under the same public key, such as c1=c1,2,c1′=c1,2′,c3= GHV*.Add(c3,1,c3,2),c3′=GHV*.Add(c3,1′,c3,2′),c4=c4,3, and c4′=c4,3′. After performing homomorphic additions, AGG runs CSA.Agg((c1,c1′),(c3,c3′),(c4,c4′),{1,3,4}) to get an aggregated ciphertext c=c1+c3+c4. In order to allow R to know the aggregated age, each hospital in turn gives its consent. H1,H3, and H4 in turn performCSA.reAgg(c¯0=c,c1′,pk1,sk1,pkR),CSA.reAgg(c¯1,c3′,pk3,sk3,pkR) andCSA.reAgg(c¯2,c4′,pk4,sk4,pkR) to get c¯1,  c¯2, and c¯3, respectively. After the agreement procedure, R can get the aggregated ciphertext c¯3 under his/her public key. Then, R can get an average age of the cancer patients, 131/4=32.75, by performing GHV*.Dec(skR,c¯3)=b=31+35+22+43=131, that is, the sum of the age of the cancer patients.


### 4.2. Attack Model

For designing a secure clinical data aggregation system, the following conditions should be considered.(1)
(Anonymity) Adversaries should not exactly identify only one private individual after looking ciphertexts on cloud storage servers.(2)
(Confidentiality) Adversaries should not reveal any information from the encrypted numerical data on cloud storage servers.(3)
(External security) The third parties (external adversaries) should not know any information with information flow.(4)
(Internal security) Hospitals and researchers (internal adversaries) except the researcher who sends a request should not know any information with information flow.


### 4.3. Our System

Now, we propose our secure clinical data aggregation system (SCDA system hereafter). Let n be the security parameter. Then we choose other parameters which are used in ourSCDA system as follows:(i)
c=c(n)>0,(ii)
p is a positive integer by setting a prime number q=ω(p2n3c+1log⁡5n),(iii)
m=⌊8nlog⁡q⌋, and(iv)
β=1/(27n1+(3c/2)log⁡nlog⁡qqm) is a Gaussian parameter.Suppose that there arenH hospitals Hi(1≤i≤nH),nR researchers Rj(1≤j≤nR), and an aggregator AGG. We assume that the ith hospital Hi has nTi tuples and the relational database in the cloud servers hasnC numerical clinical data attributes.The building blocks of ourSCDA system are our controlled secure aggregation protocolCSA and the GHV* homomorphic encryption scheme GHV*. OurSCDA system consists of the following phases which are illustrated in Box 2:Preparation,Data Publication,Query,Aggregation,Consent, andAcquisition. In thePreparation phase, each hospital and each researcher generates a public key (pair) and a secret key. In theData Publication phase, each hospital encrypts its numerical clinical data with his/her public key pair and makes anonymous data using anonymity techniques for deidentification. Then each hospital stores them in the cloud servers. In theQuery phase, one of the researchers asks the aggregator AGG for an aggregated clinical data. In theAggregation phase, ciphertexts generated under distinct hospitals are aggregated. In theConsent phase, each hospital goes through the procedure for consent. In theAcquisition phase, the researcher can get the aggregated clinical data.Box 2:
SCDA Protocol.
Preparation. Each hospital Hi (1≤i≤nH) runs the CSA.Key(1n,1m,q) algorithm to get a public key pair
p
k
i
=
(
A
i
,
M
i
) and a secret key ski=Ti. Each researcher Rj(1≤j≤nR) runs the GHV*.Key(1n,1m,q) algorithm to
get a public keypkj=Aj and a secret key skj=Tj.
Data Publication. For all k (1≤k≤nC) and l (1≤l≤nTi), each hospital Hi (1≤i≤nH) runs the
CSA.Enc(pki,bi,k,l) algorithm to get a ciphertext pair (ci,k,l,ci,k,l′), where bi,k,l is the lth cell of the kth numeric
clinical data attribute of theith hospital Hi. Then each hospital Hi (1≤i≤nH) makes its data anonymous using
anonymity techniques for de-identification. Finally, each hospitalHi (1≤i≤nH) outsources its data in the cloud
servers.
Query. The jth researcher Rj sends a request for an aggregated data to the aggregator AGG. We assume that Rj is
interested in thekth attribute and |I| hospitals, Hi (i∈I), have the data in which Rj is interested. Each hospital Hi
(i∈I) has si tuples that meet the request, respectively.
Aggregation.  AGG retrieves all ciphertext pairs satisfying Rj's request. For each i∈I, AGG runs the
GHV
*.Add(ci,k,l1,…,ci,k,lsi) and GHV*.Add(ci,k,l1′,…,ci,k,lsi′) algorithm to get (ci,ci′). Then AGG runs the
CSA.Agg({(ci,ci′)}i∈I,I) algorithm to get c and {ci′}i∈I.
Consent.  AGG determines the order in which hospitals consented to Rj's request, then sends c to the first hospital
and(ci′,Aj) to each hospital Hi (i∈I). Each hospital Hi (i∈I) in turn performs the dec-Aggregation phase in
ourCSA protocol. If any hospital Hi (i∈I) does not want Rj to have the aggregated clinical data, it can deny the
request by simply not performing thedec-Aggregation phase.
Acquisition. After the consent procedure, the last hospital H|I| sends c-|I| to Rj. Rj runs the GHV*.Add(skRj,c-|I|)
to getb that is an aggregated clinical data.


## 4.1. System Overview

The proposed system environment consists of hospitals, an aggregator, and researchers. In our system, each hospital outsources its clinical data to cloud storage servers. Hospitals use the following hybrid method to store data when outsourcing their clinical research data in cloud servers: they make anonymous data publicly available in the cloud servers using anonymity techniques for deidentification in Section2.1. In addition, hospitals also store their encrypted numerical data together with the anonymous data for statistical accuracy.Suppose that there are4 hospitals, H1,H2,H3, and H4 that want to share their clinical data and have public and sescret key pairs (pk1,sk1),(pk2,sk2),(pk3,sk3), and (pk4,sk4) of ourCSA protocol, respectively. Suppose that there is an aggregator AGG and a researcher R who has a public and secret key pair (pkR,skR)=(AR,TR) of the GHV* homomorphic encryption scheme. The original clinical data of hospitals are shown in Table 4. Each hospital outsources its clinical data to cloud storage servers. That is, Hi stores deidentified nonsensitive data (such as zip code and age), sensitive data in the raw, and numerical data (such as age) using CSA.Enc(pki,Age) on cloud servers. Both anonymous and encrypted clinical data on cloud servers are shown in Table 5, where (c1,1,c1,1′) is an output of CSA.Enc(pk1,25),(c1,2,c1,2′) is an output of CSA.Enc(pk1,31), and so on.Table 4
Original clinical data.
Nonsensitive
Sensitive
Zip code
Age
Condition
H
1
13062
25
Heart disease
13035
31
Cancer
14850
45
Viral infection
H
2
13035
20
Heart disease
14850
23
Heart disease
14855
52
Viral infection
H
3
13062
35
Cancer
13035
22
Cancer
13062
52
Heart disease
H
4
13062
27
Heart disease
13062
33
Viral infection
14855
43
CancerTable 5
Anonymous and encrypted clinical data stored on cloud servers.
Nonsensitive
Sensitive
Ciphertext pair
Zip code
Age
Condition
CSA.Enc  (pk1,Age)
H
1
130**
<30
Heart disease
(
c
1,1
,
c
1,1
′
)
//25
130**
3*
Cancer
(
c
1,2
,
c
1,2
′
)
//31
1485*
≥40
Viral infection
(
c
1,3
,
c
1,3
′
)
//45
Nonsensitive
Sensitive
Ciphertext pair
Zip code
Age
Condition
CSA.Enc  (pk2,Age)
H
2
130**
<30
Heart disease
(
c
2,1
,
c
2,1
′
)
//20
1485*
<30
Heart disease
(
c
2,2
,
c
2,2
′
)
//23
1485*
≥40
Viral infection
(
c
2,3
,
c
2,3
′
)
//52
Nonsensitive
Sensitive
Ciphertext pair
Zip code
Age
Condition
CSA.Enc  (pk3,Age)
H
3
130**
3*
Cancer
(
c
3,1
,
c
3,1
′
)
//35
130**
<30
Cancer
(
c
3,2
,
c
3,2
′
)
//22
130**
≥40
Heart disease
(
c
3,3
,
c
3,3
′
)
//52
Nonsensitive
Sensitive
Ciphertext pair
Zip code
Age
Condition
CSA.Enc  (pk4,Age)
H
4
130**
<30
Heart disease
(
c
4,1
,
c
4,1
′
)
//27
130**
3*
Viral infection
(
c
4,2
,
c
4,2
′
)
//33
1485*
≥40
Cancer
(
c
4,3
,
c
4,3
′
)
//43When the researcherR wants to know the rough estimate of the age of the hospitals’ cancer patients, R can directly get the estimate data from the cloud servers. When R wants to figure out the average age of the hospitals’ cancer patients, R can ask the aggregator AGG for an aggregated age. AGG sums up the ages of cancer patients in each hospital, then totals the ages across hospitals. That is, AGG performs homomorphic additions to ciphertexts under the same public key, such as c1=c1,2,c1′=c1,2′,c3= GHV*.Add(c3,1,c3,2),c3′=GHV*.Add(c3,1′,c3,2′),c4=c4,3, and c4′=c4,3′. After performing homomorphic additions, AGG runs CSA.Agg((c1,c1′),(c3,c3′),(c4,c4′),{1,3,4}) to get an aggregated ciphertext c=c1+c3+c4. In order to allow R to know the aggregated age, each hospital in turn gives its consent. H1,H3, and H4 in turn performCSA.reAgg(c¯0=c,c1′,pk1,sk1,pkR),CSA.reAgg(c¯1,c3′,pk3,sk3,pkR) andCSA.reAgg(c¯2,c4′,pk4,sk4,pkR) to get c¯1,  c¯2, and c¯3, respectively. After the agreement procedure, R can get the aggregated ciphertext c¯3 under his/her public key. Then, R can get an average age of the cancer patients, 131/4=32.75, by performing GHV*.Dec(skR,c¯3)=b=31+35+22+43=131, that is, the sum of the age of the cancer patients.


## 4.2. Attack Model

For designing a secure clinical data aggregation system, the following conditions should be considered.(1)
(Anonymity) Adversaries should not exactly identify only one private individual after looking ciphertexts on cloud storage servers.(2)
(Confidentiality) Adversaries should not reveal any information from the encrypted numerical data on cloud storage servers.(3)
(External security) The third parties (external adversaries) should not know any information with information flow.(4)
(Internal security) Hospitals and researchers (internal adversaries) except the researcher who sends a request should not know any information with information flow.


## 4.3. Our System

Now, we propose our secure clinical data aggregation system (SCDA system hereafter). Let n be the security parameter. Then we choose other parameters which are used in ourSCDA system as follows:(i)
c=c(n)>0,(ii)
p is a positive integer by setting a prime number q=ω(p2n3c+1log⁡5n),(iii)
m=⌊8nlog⁡q⌋, and(iv)
β=1/(27n1+(3c/2)log⁡nlog⁡qqm) is a Gaussian parameter.Suppose that there arenH hospitals Hi(1≤i≤nH),nR researchers Rj(1≤j≤nR), and an aggregator AGG. We assume that the ith hospital Hi has nTi tuples and the relational database in the cloud servers hasnC numerical clinical data attributes.The building blocks of ourSCDA system are our controlled secure aggregation protocolCSA and the GHV* homomorphic encryption scheme GHV*. OurSCDA system consists of the following phases which are illustrated in Box 2:Preparation,Data Publication,Query,Aggregation,Consent, andAcquisition. In thePreparation phase, each hospital and each researcher generates a public key (pair) and a secret key. In theData Publication phase, each hospital encrypts its numerical clinical data with his/her public key pair and makes anonymous data using anonymity techniques for deidentification. Then each hospital stores them in the cloud servers. In theQuery phase, one of the researchers asks the aggregator AGG for an aggregated clinical data. In theAggregation phase, ciphertexts generated under distinct hospitals are aggregated. In theConsent phase, each hospital goes through the procedure for consent. In theAcquisition phase, the researcher can get the aggregated clinical data.Box 2:
SCDA Protocol.
Preparation. Each hospital Hi (1≤i≤nH) runs the CSA.Key(1n,1m,q) algorithm to get a public key pair
p
k
i
=
(
A
i
,
M
i
) and a secret key ski=Ti. Each researcher Rj(1≤j≤nR) runs the GHV*.Key(1n,1m,q) algorithm to
get a public keypkj=Aj and a secret key skj=Tj.
Data Publication. For all k (1≤k≤nC) and l (1≤l≤nTi), each hospital Hi (1≤i≤nH) runs the
CSA.Enc(pki,bi,k,l) algorithm to get a ciphertext pair (ci,k,l,ci,k,l′), where bi,k,l is the lth cell of the kth numeric
clinical data attribute of theith hospital Hi. Then each hospital Hi (1≤i≤nH) makes its data anonymous using
anonymity techniques for de-identification. Finally, each hospitalHi (1≤i≤nH) outsources its data in the cloud
servers.
Query. The jth researcher Rj sends a request for an aggregated data to the aggregator AGG. We assume that Rj is
interested in thekth attribute and |I| hospitals, Hi (i∈I), have the data in which Rj is interested. Each hospital Hi
(i∈I) has si tuples that meet the request, respectively.
Aggregation.  AGG retrieves all ciphertext pairs satisfying Rj's request. For each i∈I, AGG runs the
GHV
*.Add(ci,k,l1,…,ci,k,lsi) and GHV*.Add(ci,k,l1′,…,ci,k,lsi′) algorithm to get (ci,ci′). Then AGG runs the
CSA.Agg({(ci,ci′)}i∈I,I) algorithm to get c and {ci′}i∈I.
Consent.  AGG determines the order in which hospitals consented to Rj's request, then sends c to the first hospital
and(ci′,Aj) to each hospital Hi (i∈I). Each hospital Hi (i∈I) in turn performs the dec-Aggregation phase in
ourCSA protocol. If any hospital Hi (i∈I) does not want Rj to have the aggregated clinical data, it can deny the
request by simply not performing thedec-Aggregation phase.
Acquisition. After the consent procedure, the last hospital H|I| sends c-|I| to Rj. Rj runs the GHV*.Add(skRj,c-|I|)
to getb that is an aggregated clinical data.


## 5. Analysis

In this section, we analyze the security and efficiency in our protocol.


### 5.1. Secure Parameters

We follow parameters which are defined in ourSCDA system from Section 4.2. Let n be the security parameter, then other parameters are as follows:(i)
c=c(n)>0,(ii)
p≥n3c+1log⁡5n,(iii)
q≈p3 is a prime number,(iv)
m=⌊8nlog⁡q⌋, and(v)
β=1/27n1+(3c/2)log⁡nlog⁡qqm is a Gaussian parameter.Using the above parameters, a ciphertext pair is only six times as large as a plaintext becauseq≈p3 and the lengths of a plaintext and a ciphertext pair are mlog⁡2p bits and 2·mlog⁡2q bits, respectively. OurSCDA system supports nc additive operations in common with [14]. In theQuery phase of ourSCDA system, therefore, the number of including tuples in a request for an aggregated data must be less than nc. Table 6 provides examples of secure parameters.Table 6
Examples of secure parameters.
n
m
c
q
p
β
n
c
Plaintext
Ciphertext pair
128
30,865
1
1.39
×
1
0
30
1.12
×
1
0
10
2.00
×
1
0
-
9
128
37.86 KB
227.13 KB
128
69,705
3
1.18
×
1
0
68
4.91
×
1
0
22
4.33
×
1
0
-
16
2.10
×
1
0
6
193.07 KB
1.13 MB
256
70,910
1
4.21
×
1
0
34
3.48
×
1
0
11
2.70
×
1
0
-
10
256
99.90 KB
599.42 KB
256
159,688
3
9.39
×
1
0
77
9.79
×
1
0
25
7.31
×
1
0
-
18
1.68
×
1
0
7
506.64 KB
2.97 MB
512
159,760
1
1.01
×
1
0
39
1.00
×
1
0
13
3.77
×
1
0
-
11
512
253.55 KB
1.49 MB
512
359,509
3
5.90
×
1
0
87
1.81
×
1
0
29
1.28
×
1
0
-
19
1.34
×
1
0
8
1.25 MB
7.52 MB
1,024
354,736
1
2.01
×
1
0
43
2.72
×
1
0
14
5.41
×
1
0
-
12
1,024
0.61 MB
3.66 MB
1,024
798,622
3
3.08
×
1
0
97
3.13
×
1
0
32
2.29
×
1
0
-
21
1.07
×
1
0
9
3.09 MB
18.56 MB


### 5.2. Security

We now analyze that ourSCDA system is anonymous, confidential, and secure against external and internal adversaries.Theorem 3 (anonymity).
OurSCDA system is anonymous if the anonymity techniques which are used in ourSCDA system are anonymous.Proof of Theorem3.
We use anonymity techniques for deidentification, which guarantee anonymity. In ourSCDA system, each hospital outsources its clinical data to cloud storage servers using these techniques for researchers. Therefore, researchers, other hospitals, and the third party cannot identify any individual using ciphertexts on cloud storage servers.Besides using the anonymity techniques that are mentioned in Section2.2, we could use the technique that is used to make statistical database differentially private. In 2006, Dwork introduced the new concept, called “differential privacy,” which provides a strong privacy guarantee in statistical databases [31]. To achieve the differential privacy, we could add appropriately chosen random noise in statistical databases.Theorem 4 (confidentiality).
Our encrypted numerical data are confidential if theGHV* homomorphic encryption scheme is IND-CPA secure and every output of the Ajtai’s one-way function hMi:{0,1}m→Zqn is uniformly distributed over Zqn.Proof of Theorem4.
By Theorem1 in Section 3.1, the encrypted numerical data are confidential.Theorem 5 (external and internal security).
OurSCDA system is secure against external and internal adversaries if the anonymity techniques for deidentification are anonymous and the GHV* homomorphic encryption scheme is secure.Proof of Theorem5.
All clinical data outsourced on cloud storage servers are anonymous and confidential since all hospitals use the anonymity techniques for deidentification and theGHV* homomorphic encryption scheme. All transmitted data in ourSCDA system are encrypted by the GHV* homomorphic encryption scheme with fresh random numbers. Therefore, ourSCDA system is secure against external and internal adversaries if the anonymity techniques for deidentification are anonymous and the GHV* homomorphic encryption scheme is secure.


### 5.3. Efficiency

Table7 shows the complexity of ourSCDA system. In Table 7, parameters nH,nR,nC,nTi,I, and si follow in Box 2.Table 7
Complexity analysis of ourSCDA system.
Computation cost
Communication cost
Preparation.
O
(
n
H
)· CSA.Key + O(nR)· GHV*.Key
·
Data Publication.
O
(
n
C
·
n
H
·
n
T
)· CSA.Enc
O
(
n
C
·
n
H
·
n
T
·
|
c
|
)
Query.
·
·
Aggregation.
O
(
I
·
s
)· GHV*.Add
O
(
I
·
s
·
|
c
|
)
Consent.
O
(
I
)   · CSA.reAgg
O
(
I
·
|
c
|
)
Acquisition.
O
(
1
)· GHV*.Dec
·
LetnH be the number of hospitals, nR the number of researchers, nC the number of numeric clinical data attributes, nT an average of the number of tuples owned in the ith hospital Hi, I the number of hospitals such that the jth researcher Rj is interested, s an average of the number of tuples in the ith hospital Hi such that the jth researcher Rj is interested, and |c| the size of a ciphertext in the GHV* homomorphic encryption scheme.


### 5.4. Experimental Results

To demonstrate the efficiency of our system, we use MATLAB on a computer with an Intel(R) Core(TM) i3-2100 CPU (3.10 GHz) processor and 4 GB of RAM. Table8 gives our experimental results. We assume that there are 100 hospitals with 100 clinical data each. Each row in Table 8 represents the mean of 15 trials.Table 8
Experimental results of ourSCDA system.
n
m
q
p
Data Publication. (sec.)
Aggregation. (sec.)
Consent. (sec.)
Acquisition. (sec.)
128
30,865
1.39
×
1
0
30
1.12
×
1
0
10
72.571
0.895
330.070
3.267
128
69,705
1.18
×
1
0
68
4.91
×
1
0
22
213.052
1.888
1,244.058
11.260
256
70,910
4.21
×
1
0
34
3.48
×
1
0
11
199.752
1.768
1,290.020
11.941


### 5.5. Handling Overflows

In ourSCDA system, a numerical data is represented as bi,k,l∈Zpm (referred to as bi∈Zpm in this part). For handling overflows, we want to restrict bi∈Z2m, not bi∈Zpm. That is, bi∈Z2m is represented in binary string. For example, m=5, b1=27=[11011](2), and b2=17=[10001](2). In additive operation on the GHV* homomorphic encryption scheme, b1+b2=[11011]+[10001]=[21012]. Then we can decode b1+b2=[21012]=2×24+1×23+0×22+1×21+2×20=44 which is similar to the decoding method in binary string.As illustrated in Section5.1, p>nc because p≥n3c+1log⁡5n and the number of including tuples in a request for an aggregated data should be less than nc. If we use the above method (i.e., bi∈Z2m), then ourSCDA system has no overflow problem, because b1+⋯+bnc∈Zpm.


### 5.6. Long-Term Confidentiality

In the area of managing sensitive information, cryptographic long-term confidentiality is absolutely needed [11]. In 1996, Shor showed that the RSA cryptosystem is broken by quantum attacks [12]. And the DLP (Discrete Logarithm Problem) cryptosystem and ECC (Elliptic Curve Cryptography) which are important alternatives to the RSA cryptosystem are also broken by quantum attacks.In ourSCDA system, we use the GHV* homomorphic encryption scheme which is secure if the LWE problem is hard. The LWE problem is hard if the SVP (Shortest Vector Problem) is hard, and the SVP is known to be hard to quantum attacks. Therefore, ourSCDA system guarantees long-term confidentiality because all algorithms in ourSCDA system are secure against quantum attacks.


## 5.1. Secure Parameters

We follow parameters which are defined in ourSCDA system from Section 4.2. Let n be the security parameter, then other parameters are as follows:(i)
c=c(n)>0,(ii)
p≥n3c+1log⁡5n,(iii)
q≈p3 is a prime number,(iv)
m=⌊8nlog⁡q⌋, and(v)
β=1/27n1+(3c/2)log⁡nlog⁡qqm is a Gaussian parameter.Using the above parameters, a ciphertext pair is only six times as large as a plaintext becauseq≈p3 and the lengths of a plaintext and a ciphertext pair are mlog⁡2p bits and 2·mlog⁡2q bits, respectively. OurSCDA system supports nc additive operations in common with [14]. In theQuery phase of ourSCDA system, therefore, the number of including tuples in a request for an aggregated data must be less than nc. Table 6 provides examples of secure parameters.Table 6
Examples of secure parameters.
n
m
c
q
p
β
n
c
Plaintext
Ciphertext pair
128
30,865
1
1.39
×
1
0
30
1.12
×
1
0
10
2.00
×
1
0
-
9
128
37.86 KB
227.13 KB
128
69,705
3
1.18
×
1
0
68
4.91
×
1
0
22
4.33
×
1
0
-
16
2.10
×
1
0
6
193.07 KB
1.13 MB
256
70,910
1
4.21
×
1
0
34
3.48
×
1
0
11
2.70
×
1
0
-
10
256
99.90 KB
599.42 KB
256
159,688
3
9.39
×
1
0
77
9.79
×
1
0
25
7.31
×
1
0
-
18
1.68
×
1
0
7
506.64 KB
2.97 MB
512
159,760
1
1.01
×
1
0
39
1.00
×
1
0
13
3.77
×
1
0
-
11
512
253.55 KB
1.49 MB
512
359,509
3
5.90
×
1
0
87
1.81
×
1
0
29
1.28
×
1
0
-
19
1.34
×
1
0
8
1.25 MB
7.52 MB
1,024
354,736
1
2.01
×
1
0
43
2.72
×
1
0
14
5.41
×
1
0
-
12
1,024
0.61 MB
3.66 MB
1,024
798,622
3
3.08
×
1
0
97
3.13
×
1
0
32
2.29
×
1
0
-
21
1.07
×
1
0
9
3.09 MB
18.56 MB


## 5.2. Security

We now analyze that ourSCDA system is anonymous, confidential, and secure against external and internal adversaries.Theorem 3 (anonymity).
OurSCDA system is anonymous if the anonymity techniques which are used in ourSCDA system are anonymous.Proof of Theorem3.
We use anonymity techniques for deidentification, which guarantee anonymity. In ourSCDA system, each hospital outsources its clinical data to cloud storage servers using these techniques for researchers. Therefore, researchers, other hospitals, and the third party cannot identify any individual using ciphertexts on cloud storage servers.Besides using the anonymity techniques that are mentioned in Section2.2, we could use the technique that is used to make statistical database differentially private. In 2006, Dwork introduced the new concept, called “differential privacy,” which provides a strong privacy guarantee in statistical databases [31]. To achieve the differential privacy, we could add appropriately chosen random noise in statistical databases.Theorem 4 (confidentiality).
Our encrypted numerical data are confidential if theGHV* homomorphic encryption scheme is IND-CPA secure and every output of the Ajtai’s one-way function hMi:{0,1}m→Zqn is uniformly distributed over Zqn.Proof of Theorem4.
By Theorem1 in Section 3.1, the encrypted numerical data are confidential.Theorem 5 (external and internal security).
OurSCDA system is secure against external and internal adversaries if the anonymity techniques for deidentification are anonymous and the GHV* homomorphic encryption scheme is secure.Proof of Theorem5.
All clinical data outsourced on cloud storage servers are anonymous and confidential since all hospitals use the anonymity techniques for deidentification and theGHV* homomorphic encryption scheme. All transmitted data in ourSCDA system are encrypted by the GHV* homomorphic encryption scheme with fresh random numbers. Therefore, ourSCDA system is secure against external and internal adversaries if the anonymity techniques for deidentification are anonymous and the GHV* homomorphic encryption scheme is secure.


## 5.3. Efficiency

Table7 shows the complexity of ourSCDA system. In Table 7, parameters nH,nR,nC,nTi,I, and si follow in Box 2.Table 7
Complexity analysis of ourSCDA system.
Computation cost
Communication cost
Preparation.
O
(
n
H
)· CSA.Key + O(nR)· GHV*.Key
·
Data Publication.
O
(
n
C
·
n
H
·
n
T
)· CSA.Enc
O
(
n
C
·
n
H
·
n
T
·
|
c
|
)
Query.
·
·
Aggregation.
O
(
I
·
s
)· GHV*.Add
O
(
I
·
s
·
|
c
|
)
Consent.
O
(
I
)   · CSA.reAgg
O
(
I
·
|
c
|
)
Acquisition.
O
(
1
)· GHV*.Dec
·
LetnH be the number of hospitals, nR the number of researchers, nC the number of numeric clinical data attributes, nT an average of the number of tuples owned in the ith hospital Hi, I the number of hospitals such that the jth researcher Rj is interested, s an average of the number of tuples in the ith hospital Hi such that the jth researcher Rj is interested, and |c| the size of a ciphertext in the GHV* homomorphic encryption scheme.


## 5.4. Experimental Results

To demonstrate the efficiency of our system, we use MATLAB on a computer with an Intel(R) Core(TM) i3-2100 CPU (3.10 GHz) processor and 4 GB of RAM. Table8 gives our experimental results. We assume that there are 100 hospitals with 100 clinical data each. Each row in Table 8 represents the mean of 15 trials.Table 8
Experimental results of ourSCDA system.
n
m
q
p
Data Publication. (sec.)
Aggregation. (sec.)
Consent. (sec.)
Acquisition. (sec.)
128
30,865
1.39
×
1
0
30
1.12
×
1
0
10
72.571
0.895
330.070
3.267
128
69,705
1.18
×
1
0
68
4.91
×
1
0
22
213.052
1.888
1,244.058
11.260
256
70,910
4.21
×
1
0
34
3.48
×
1
0
11
199.752
1.768
1,290.020
11.941


## 5.5. Handling Overflows

In ourSCDA system, a numerical data is represented as bi,k,l∈Zpm (referred to as bi∈Zpm in this part). For handling overflows, we want to restrict bi∈Z2m, not bi∈Zpm. That is, bi∈Z2m is represented in binary string. For example, m=5, b1=27=[11011](2), and b2=17=[10001](2). In additive operation on the GHV* homomorphic encryption scheme, b1+b2=[11011]+[10001]=[21012]. Then we can decode b1+b2=[21012]=2×24+1×23+0×22+1×21+2×20=44 which is similar to the decoding method in binary string.As illustrated in Section5.1, p>nc because p≥n3c+1log⁡5n and the number of including tuples in a request for an aggregated data should be less than nc. If we use the above method (i.e., bi∈Z2m), then ourSCDA system has no overflow problem, because b1+⋯+bnc∈Zpm.


## 5.6. Long-Term Confidentiality

In the area of managing sensitive information, cryptographic long-term confidentiality is absolutely needed [11]. In 1996, Shor showed that the RSA cryptosystem is broken by quantum attacks [12]. And the DLP (Discrete Logarithm Problem) cryptosystem and ECC (Elliptic Curve Cryptography) which are important alternatives to the RSA cryptosystem are also broken by quantum attacks.In ourSCDA system, we use the GHV* homomorphic encryption scheme which is secure if the LWE problem is hard. The LWE problem is hard if the SVP (Shortest Vector Problem) is hard, and the SVP is known to be hard to quantum attacks. Therefore, ourSCDA system guarantees long-term confidentiality because all algorithms in ourSCDA system are secure against quantum attacks.


## 6. Conclusion

In this paper, we have proposed how to outsource clinical research data securely and how to control the outsourced data against potential breaches of privacy. We also were able to share accurate statistical patient data. To achieve this, we design the controlled secure aggregation protocol that enables a researcher to get aggregated results from outsourced ciphertexts of distinct researchers. Since our protocol is designed by using the lattice-basedGHV* homomorphic encryption, it guarantees long-term security against quantum computing attacks and is very efficient in computational overhead.



---

*Source: 381361-2014-05-18.xml*