Abstract: Various embodiments include a coordinator node for coordinating a multiparty computation (MPC) on one or more datasets. The system comprises a plurality of client nodes, one or more datasets and a plurality of computation nodes. Client nodes may include at least one dataset and/or at least one computation node that can operate as a party to an MPC. The coordinator node is configured to receive a request for an MPC on one or more of the datasets from a requesting node, the MPC including the evaluation of at least one function by two or more computation nodes from different client nodes; determine a computation schedule for the MPC, the computation schedule indicating which client nodes of the plurality of client nodes are to participate in the MPC; send at least part of the determined computation schedule to at least one of the client nodes indicated in the determined computation schedule.

Abstract: There is provided a computer-implemented method of applying a first function to each data element in a first data set, the method comprising (i) determining whether each data element in the first data set satisfies a criterion, wherein the criterion is satisfied only if the result of applying the first function to the data element is equal to the result of applying a second first data set satisfies a criterion function to the data element; (ii) forming a compressed data set comprising the data elements in the first data set that do not satisfy the criterion; (iii) applying the first function to 10 each data element in the compressed data set; and (iv) forming an output based on the results of step (iii); wherein steps (i)-(iv) are performed using multiparty computation, MPC, techniques. A corresponding system and worker node are also provided.

Abstract: Some embodiments are directed to a computation device configured for batch-wise multiparty verification of a computation which has been performed multiple times. The computations being multiparty computations that are cryptographically shared between the computation device and multiple other computation devices. The computation device is configured to perform the computation a further time to obtain a randomizing computation on a randomizing set of values.

Abstract: Various embodiments include a first node for providing a function to a second node for evaluation, the first node configured to form a first plurality of garbled circuits for the function, each circuit being formed from a circuit representing the function and a respective set of wire keys and including one or more logic operations, one or more input wires for inputting data into the circuit and one or more output wires for outputting the result of the function, wherein each respective set of wire keys comprises a respective subset of wire keys for each input wire and each output wire, each subset of wire keys comprising a plurality of wire keys, each wire key in the plurality being associated with a possible value for the wire; and publish a first list of the first plurality of garbled circuits for the function for access by a plurality of second nodes.

Abstract: According to one aspect, there is provided a server for use in evaluating a monitoring function to determine if a trigger condition is satisfied. The server comprises a processing unit and a memory unit. The memory unit is for storing a current monitoring state Ss of the server or an encrypted current monitoring state S of the monitoring function, the current monitoring state Ss of the server relating to the current monitoring state S of the monitoring function that is based on an evaluation of one or more previous events. The processing unit is configured to receive an indication of a first event from a first client node and evaluate the monitoring function to determine if the first event satisfies the trigger condition.

Abstract: According to an aspect, there is provided a computer-implemented method of operating a first node. The first node has an algorithm for evaluating input data from another node, with the input data having a plurality of different attributes. The method comprises receiving, from a second node, a proposal for the evaluation of a first set of input data by the algorithm; estimating the performance of the algorithm in evaluating the first set of input data based on the proposal; and outputting, to the second node, an indication of the estimated performance of the algorithm. A corresponding first node is also provided.

Abstract: According to an aspect, there is provided a method of operating a first computing node to distribute a computation output, the method comprising: determining a first random mask; providing the first random mask as a private input to a computation by a first evaluator node and a second evaluator node; receiving, from each of the first evaluator node and the second evaluator node, a respective masked computation output, wherein each masked computation output is a function of an output of the computation and the first random mask; if the received respective masked computation outputs match, determining the output of the computation from the received masked computation output and the first random mask; and sending information to the first evaluator node and the second evaluator node to enable the first evaluator node and the second evaluator node to determine the output of the computation from the respective masked computation output.

Abstract: According to one aspect, there is provided a server for use in evaluating a monitoring function to determine if a trigger condition is satisfied. The server comprises a processing unit and a memory unit. The memory unit is for storing a current monitoring state Ss of the server or an encrypted current monitoring state S of the monitoring function, the current monitoring state Ss of the server relating to the current monitoring state S of the monitoring function that is based on an evaluation of one or more previous events. The processing unit is configured to receive an indication of a first event from a first client node and evaluate the monitoring function to determine if the first event satisfies the trigger condition.

Abstract: Some embodiments are directed to a hash tree computation device. The hash tree computation device computes a top hash of a hash tree. A hash preimage of a leaf node of the hash tree comprises a type of the leaf node. A hash preimage of an internal node of the hash tree comprises a type count comprising a number of descendants of the internal node having a given type. The hash tree computation device computes the top hash by computing hashes of a current node and of its ancestors, where a hash of an ancestor is computed based on its type count, the type count being computed from types or type counts of its descendants.

Abstract: Some embodiments are directed to a data sampling device for obtaining a sample of records from a remote dataset satisfying a private criterion using multi-party computation. One or more sample providing devices store respective subdatasets of the remote dataset. The data sampling device determine a candidate size for a sample providing device; requests the sample providing device to determine a candidate sample of the candidate size from the subdataset of the sample providing device; perform a multi-party computation with the sample providing device to obtain a set of indices of records from the candidate sample satisfying the private criterion; sample a subset of the set of indices; and obtains from the sample providing device records of the candidate sample corresponding to the subset of the set of indices.

Abstract: Various embodiments described herein relate to a system for providing file access while keeping both the accessing client and storage server from gaining any information about file contents or access patterns which they are not authorized to obtain. According to various embodiments, a key server instructs the storage server to retrieve a list of files, shuffle and re-encrypt the files in the list, and then send the list to the client. According to some embodiments, the key server also provides the client with information used to access the requested file from the list, re-encrypts the files in the lists again, reshuffles the list, and transmits the list back to the storage server to be recommitted to storage.

Abstract: Some embodiments are directed to a dealer device for batch-wise provisioning of preprocessing information for a multiparty computation and an evaluator device for batch-wise distributed verification with one or more other evaluator devices of the preprocessing information. The preprocessing information comprises multiple random values and multiple message authentication codes for blinding and integrity checking respectively in the multi-party computation. The multiple random values and a set of proof values together define a checking polynomial. The dealer device computes proof values wherein the checking polynomial is identical to zero. The evaluator device obtains secret-shares of the random values, proof values, and message authentication codes.

Abstract: According to an aspect, there is provided a first node for use in a system, wherein the first node is configured to determine a plurality of keys for enabling a computation by a plurality of worker nodes in the system, wherein the computation comprises a plurality of computation parts, wherein the plurality of computation parts comprises one or more types of computation part, and wherein an output from one computation part to another computation part is a shared block; and publish the determined plurality of keys for access by at least one input node in the system, the plurality of worker nodes, and at least one recipient node in the system; wherein the plurality of keys comprises a computation part prove key for each part of the computation; a computation part verification key for each part of the computation; a shared block commitment generation key for each shared block; an input commitment generation key for each input node and computation part combination; and an output commitment generation key for each

Abstract: Some embodiments are directed to a data retrieval device 210 for data-obliviously copying a subarray of a first array to a second array. The length of the second array is more than one and less than the length of the first array. The length of the subarray is at most the length of the second array. For each first element at a first index in the first array, the data retrieval device selects a second index in the second array for the first index in the first array; data-obliviously computes a choice bit indicative of whether to copy the first element to the second index in the second array; and replaces a second element at the second index in the second array by a replacement element, the replacement element being data-obliviously set to the first element or the second element based on the choice bit.

Abstract: According to an aspect, there is provided a first node for evaluating an event using a function. A corresponding computer-implemented method of operating a first node to 5 evaluate an event using a function is also provided. The function is evaluated by two parties using garbled circuits, with each party garbling a circuit representing the function, and evaluating the circuit garbled by the other party.

Abstract: According to one aspect, there is provided a server for use in evaluating a monitoring function to determine if a trigger condition is satisfied. The server comprises a processing unit and a memory unit. The memory unit is for storing a current monitoring state (Ss) of the server or an encrypted current monitoring state (S) of the monitoring function, the current monitoring state (Ss) of the server relating to the current monitoring state (S) of the monitoring function that is based on an evaluation of one or more previous events. The processing unit is configured to receive an indication of a first event from a first client node and evaluate the monitoring function to determine if the first event satisfies the trigger condition.

Abstract: Various embodiments include a coordinator node for coordinating a multiparty computation (MPC) on one or more datasets. The system comprises a plurality of client nodes, one or more datasets and a plurality of computation nodes. Client nodes may include at least one dataset and/or at least one computation node that can operate as a party to an MPC. The coordinator node is configured to receive a request for an MPC on one or more of the datasets from a requesting node, the MPC including the evaluation of at least one function by two or more computation nodes from different client nodes; determine a computation schedule for the MPC, the computation schedule indicating which client nodes of the plurality of client nodes are to participate in the MPC; send at least part of the determined computation schedule to at least one of the client nodes indicated in the determined computation schedule.

Abstract: Some embodiments are directed to location-tracking system (100) comprising a location database (120) configured to receive a plurality of location updates from a plurality of tracking devices (112, 113), the plurality of location updates indicating the location of one or more objects, the location updates being stored encrypted with a cryptographic database encryption-key (130), multiple location-analysis devices execute a multi-party computation protocol on the encrypted location updates using a stored key-share, thus jointly computing a location-analysis result secret-shared among the multiple location analysis devices.

Abstract: Some embodiments are directed to a requesting device and a data device configured for multi-party computation to select a close record from a database. The data device performs a filtering of its candidate records by selecting candidate records from the database for which a received set of similarity values for a target record are close to a set of similarity values for a candidate record. For one or more selected candidate records, the requesting device and the data device performing a multiparty computation protocol to jointly compute a second closeness measure between the target record and the selected candidate record.

Abstract: Some embodiments are directed to a computation system for learning a classifier from a data set and associated classification data. The system comprises multiple data devices and multiple computation devices. The data set and associated classification data is stored across the multiple data devices. Classifier parameters of the classifier are learned iteratively from the data set. The learning comprises computing local error terms for the classifier from the associated classification data and from classifier results obtained from applying the classifier with the current classifier parameters to the local part of the data set, and providing the local error term as a private input to the multiple computation devices for a multi-party computation among the multiple computation devices.