Patent Document ID: 10102399
Application ID: 14497606
Patent Flag: 1

Claim One:
1. Computer-implemented method for securely evaluating at least part of a linear branching program, said program having a binary decision tree structure comprising one or more decision nodes and two or more end-label nodes, wherein a decision node is associated with a comparison operation between a user attribute and a threshold value, said method comprising: a processor in a secure server executing computer readable program code for transforming at least part of the comparison operations associated with said one or more decision node into one or more encrypted evaluation sequences on the basis of a first additive homomorphic cryptosystem, wherein an evaluation sequence of a decision node comprises a sequence of numbers in which an outcome of the comparison operation of a decision node is embedded, said processor in said secure server further executing computer readable program code for forming one or more encrypted comparison operations by combining one or more user attributes and one or more threshold values in the encrypted domain using one or more homomorphic computations; and a processor in a user device executing computer readable program code for evaluating said one or more evaluation sequences, said evaluating including detecting the presence of a predetermined number, preferably a zero, in a first evaluation sequence of a first node and determining a second decision node for evaluation or an index of an end-label on the basis of the detection of said predetermined number; wherein said computer readable program code for transforming at least part of said comparison operations further comprises: linking an encrypted user attribute [v j ] to a node index α j in order to form an indexed encrypted user attribute; combining the indexed encrypted user attribute [v αj ] with its associated encrypted threshold value [t j ] and a random blinding value [b j ] into an encrypted blinded node value [v αj −t j +b j ] on the basis of one or more homomorphic computations; comparing said blinded node value [v αj −t j +b j ] with a blinding value b j in the encrypted domain; embedding the outcome of said comparison in an evaluation sequence.