Anti-collusion client-server method and system for homomorphically encrypted data

Abstract

The present invention relates to a client-server system implementing a client, a calculation server and a service provider delegating, to the calculation server, an operation to be performed in the homomorphic domain on confidential data from the client. The system can be protected from possible collusions of a first type between the calculation server and the service provider by virtue of an HSMSP module with which the latter is provided. The HSMSP module contains the homomorphic cryptosystem of the service provider and is suitable for decrypting, for the service provider, the result of an operation performed by the calculation server. The system can be protected from possible collusions of a second type between the calculation server and the client by virtue of an HSMCL module with which the latter is provided. The HSMCL module contains the homomorphic cryptosystem of the client and is suitable for decrypting, for the client, the result of an operation performed by the calculation server.

Description

[0001]ANTI-COLLUSION CLIENT-SERVER METHOD AND SYSTEM FOR HOMOMORPHOUSLY ENCRYPTED DATA DESCRIPTION TECHNICAL FIELD The present invention relates to the field of homomorphic encryption. It finds particular application in the field of confidential computing and in that of the confidential creation / query of a database hosted by a remote server. STATE OF THE PRIOR ART The development of cloud computing combined with the confidentiality constraints of certain data have led to the rise of homomorphic cryptography. In a conventional application context, a client wishing to perform an operation on confidential data encrypts this data using the public key of a recipient's homomorphic cryptosystem, and transmits it to a remote computing server (CS).This computation server performs the operation in the homomorphic domain on the encrypted data and transmits the result obtained to the recipient. The recipient then only has to decrypt the result using the private key of its homomorphic cryptosystem to obtain the clear result. Here, a homomorphic cryptosystem is understood to mean a public key-private key pair allowing homomorphic encryption and decryption to be carried out. This configuration of delegation of computation from the client to a computation server CS, however, presents risks of collusion between the different entities involved. 41118 FR EA-T 2 A first case of collusion is illustrated in Fig. 1 in which a CL client, a CS computation server and a recipient of the result, here a service provider SP, are schematically represented. It is assumed that the CS computation server and the service provider SP are honest but curious.5 The CL client wishing to perform an operation f on confidential data. c encrypts them to 110 using the public key FHE . pk of the homomorphic cryptosystem ! FHE. pk , FHE . sk ∀ from the recipient SP, and transmits them to the calculation server CS. This performs the operation in 120 in the homomorphic domain on the encrypted data, namely on FHE. pk ! data c ∀ . The 10th result f ! FHE.pk ! data c ∀ ∀ # FHE . pk ( res c ) is transmitted at 130 to the recipient SP who decrypts them at 140 using his private key to obtain the result in clear text. A first type of collusion is likely to occur between the calculation server CS and the recipient SP: the calculation server can in fact transmit 15 the encrypted data FHE directly. pk ! data c ∀ to the recipient, in which case the latter can access the data in clear text cby decrypting them with the private key FHE . sk . However, these data are confidential and must under no circumstances be transmitted to the recipient of the result (service provider). 20 A second type of collusion is illustrated in Fig. 2, the entities involved in the configuration shown being identical to those in Fig. 1. It is assumed here that the client CL and the computation server CS are honest but curious. In this configuration, the recipient of the result is none other than the client CL, the service provider SP providing the computation server CS 25 with the operation f (for example an inference operation or a search operation in a confidential database of SP) to be performed in the homomorphic domain. The operation f is confidential with respect to the computation server CS and the homomorphic cryptosystem ! FHE. pk ', FHE . sk ' ∀is that of the client CL. The service provider, SP, transmits in 210, to the calculation server CS, the expression of the operation f in question in the homomorphic domain, i.e. 5 FHE . pk '( f ). When the CL client transmits confidential data to the calculation server in 220 c encrypted using the public key FHE . pk ' , the latter performs in 230 the operation in the homomorphic domain on the encrypted data, namely FHE. pk ' ! data c ∀ . The FHE result . pk '( res c ) is returned to the CL client at 240 which decrypts them at 250 using its private key to obtain the result in clear text res c. Collusion may occur between the client CL and the computing server CS in that the latter transmits to the former the encrypted operation, FHE . pk '( f ) , the client CL then being able to discover the operation f which is delegated to the server CS by the service provider SP. Thus, in the case of a search operation 15 in a confidential database, for example a biometric database encrypted by FHE . pk '( f ), the client may have access to the plaintext content of the database in question. Various measures have been considered in the state of the art to guard against the risks of collusion between entities of a client-server system operating on homomorphically encrypted data. Thus the article by J. Li et al. entitled “A lattice-based homomorphic proxy re-encryption scheme with strong anti-collusion for cloud computing” published in Sensors, 2021, vol. 21, no. 1, 288, pp.1-20 proposes a re-encryption technique using a proxy server, each entity having a public encryption key, a public evaluation key, and a secret decryption key. However, this solution has the disadvantage of being complex to implement. 41118 FR EA-T 4 The article by D. Natarajan et al. entitled “CHEX-MIX: Combining homomorphic encryption with trusted execution environments for two-party oblivious inference in the Cloud” published in Cryptology ePrint Archive (2021), pp. 1-21 describes a two-party inference method in the Cloud, with the service provider SP transmitting the parameters of the inference model in the homomorphic domain to an SGX enclave of the computation server CS, and the client CL transmitting the confidential homomorphically encrypted data to the computation server CS for processing inside the enclave. The CL client decrypts the result with its private key.The presence of the enclave within the computing server 10 CS makes it possible to avoid collusions of the second type described above. This solution is however not immune to side channel attacks or the insertion of backdoors in the enclave code. The object of the present invention is therefore to propose a client-server system making it possible to avoid the risks of collusion between the 15 different entities of this system while remedying the drawbacks of the state of the art, in other words which is simple and robust to the aforementioned attacks.DISCLOSURE OF THE INVENTION The present invention is defined by a client-server system 20 comprising a client, a calculation server and a service provider, said service provider delegating to the calculation server an operation to be performed on confidential data of the client, the calculation server being adapted to perform said operation on the confidential data, encrypted by means of the public key of a homomorphic cryptosystem, said client-server system 25 being original in that the service provider, respectively the client, is equipped with a hardware security module (HSM). SP , HSM CL) containing said homomorphic cryptosystem and adapted to decrypt the result of the operation by means of the private key of said homomorphic cryptosystem to transmit it to the service provider, respectively to the client. Advantageously, the client is adapted to encrypt said confidential data by means of the public key of the homomorphic cryptosystem and transmit them thus encrypted to the calculation server. According to a first embodiment, the hardware security module equips said client and the service provider transmits to the calculation server the parameters of the operation to be carried out, encrypted by means of the public key of the homomorphic cryptosystem.According to a second embodiment, the service provider is equipped with the hardware security module and the calculation server hosts a database encrypted using the public key of the homomorphic cryptosystem, the operation being a primitive providing an indication of presence or absence of the confidential data in the database, the service provider returning to the calculation server an access code to store the data in the database if the indicator indicates an absence in the database. In this case, to request confidential data in the database, a third-party client transmits to the calculation server a request encrypted using the public key of the homomorphic cryptosystem, said request being evaluated in the homomorphic domain, the result of the request then being transmitted to the hardware security module to be decrypted there using the secret key of the homomorphic cryptosystem.25 According to a variant of the second embodiment, the service provider is equipped with the hardware security module and the calculation server hosts a database encrypted using the public key of a second homomorphic cryptosystem distinct from the homomorphic cryptosystem stored in the hardware security module. 41118 FR EA-T 6 In this case, the client transmits to the calculation server the confidential data encrypted using the public key of the second homomorphic system and the calculation server performs the operation in the homomorphic domain of the second homomorphic system, the calculation server then performing an encryption switch of the result of the operation to obtain a result encrypted in the first homomorphic system.To request confidential data in the database, a third-party client can transmit to the calculation server a request encrypted using the public key of the second homomorphic cryptosystem, said request then being evaluated by the server in the homomorphic domain of the second homomorphic system, then being subject to an encryption switch to the first homomorphic system, the encrypted result of the request then being transmitted to the security hardware module to be decrypted there using the secret key of the first homomorphic cryptosystem. The homomorphic cryptosystem is preferably an FHE cryptosystem. BRIEF DESCRIPTION OF THE DRAWINGS Other characteristics and advantages of the invention will appear on reading a preferred embodiment of the invention, made with reference to the attached figures, among which: FIG.1, already described, represents a first type of collusion between a service provider's server and a computing server in a client-server architecture; 25 Fig. 2, already described, represents a second type of collusion between a client and a computing server in a client-server architecture; 41118 FR EA-T 7 Fig. 3 schematically represents an anti-collusion client-server system of the first type, according to a first embodiment of the invention; Figs. 4A and 4B schematically represent the creation and 5 interrogation of a private database using a client-server system according to the first embodiment of the invention; Figs. 5A and 5B schematically represent the creation and interrogation of a private database using a client-server system according to a variant of the first embodiment of the invention; 10 Fig.6 schematically represents an anti-collusion client-server system of the second type, according to a second embodiment of the invention; Fig. 7 schematically represents an anti-collusion client-server system of the second type, according to a variant of the second embodiment15 of the invention. DETAILED DESCRIPTION OF PARTICULAR EMBODIMENTS We consider in the following a client-server system having a basic configuration identical to that described previously, in other words20 comprising a client CL, a service provider SP delegating an operation f (in the homomorphic domain) to a calculation server CS. In all cases, the client transmits confidential data, data, to the calculation server. c , encrypted using the public key of a homomorphic cryptosystem, whether that of the service provider ! FHE. pk , FHE . sk ∀ or its own cryptosystem 25 ! FHE. pk ', FHE . sk ' ∀ .The idea behind the present invention is to add a hardware security module (sometimes also called a security transaction box) or HSM (Hardware Security Module), certified TTP (Trusted Third Party) 41118 FR EA-T 8 to the service provider (to avoid collusion of the first type) or to the client (to avoid collusion of the second type), this HSM module being the only element of the system able to have access to the private key of the homomorphic cryptosystem used to encrypt the client's data (prevention of collusion of the first type) or to encrypt the parameters of the operation delegated by the service provider (prevention of collusion of the second type).Thus, in all cases, the entity receiving the encrypted information (confidential data to which the operation applies, or parameters of the confidential operation) cannot directly access the private key of the homomorphic system 10 and use it for purposes other than decrypting said information. In particular, collusion of the first type is avoided in that the service provider SP cannot use the private key FHE . sk to decrypt the encrypted confidential data FHE. pk. ! data c ∀that the calculation server could transmit to it. Even assuming that the service provider is malicious, it will not be able to transmit the private key FHE . sk to the calculation server so that the latter can decrypt them. Similarly, collusion of the second type is avoided in that the client cannot use the private key FHE . sk to decrypt the parameters of the operation (e.g., the parameters of the inference model or the search operation) that the calculation server could transmit to it. Even assuming that the client is malicious, it will not be able to transmit its private key FHE . sk to the calculation server so that the latter can decrypt the parameters in question. Fig. 3 schematically represents an anti-collusion client-server system of the first type, according to a first embodiment of the invention. In this embodiment, the recipient of the result of the operation f on the client's confidential data, datac , namely the service provider SP has an HSM (Hardware Security Module), noted HSM SP . 41118 FR EA-T 9 recalls that an HSM module is a module for generating, storing and protecting cryptographic keys as well as executing cryptographic primitives using these keys. This module can be in the form of an electronic card plugged into a computer or in the form of an external box. This module is chosen to be TTP certified, in other words it is authorized to carry out cryptographic operations as a trusted third party. The HSM module SP generates the public and private key pair of the homomorphic cryptosystem ! FHE. pk , FHE . sk ∀ , the public key is shared with the CL client and the CS calculation server. As in Fig. 1, the CL client wishing to perform an operation f on confidential data cencrypts them in 310 using the public key FHE . pk of the homomorphic cryptosystem and transmits them to the CS calculation server. The latter performs the operation in 320 in the homomorphic domain on the encrypted data, and the result f ! FHE. pk ! data c ∀ ∀ # FHE . pk ( res c ) is transmitted at 330 to the HSM module which decrypts them using the private key FHE . sk stored there. At step 340, the result is provided in clear or encrypted form (denoted ∃ res c % ) to the service provider SP. This encryption can be a classic asymmetric encryption (non-homomorphic) or a symmetric encryption. The presence of the HSMSP module prevents any collusion between the computing server CS and the service provider SP since the latter no longer has access to the decryption key FHE . sk. Preferably, the HSM module SPensures, before providing the decryption result to SP, that the latter corresponds to the expected format of the operation f . To this end, we can use so-called verifiable or VC (Verifiable Computing) calculation functions to prove that the operation f has been carried out correctly. This measure prevents the HSM module from SP is used as a decryption oracle, i.e. it decrypts any message transmitted to it in order to obtain information on the FHE key. sk. The anti-collusion client-server system according to the first embodiment of the invention can be used in the context of creating and querying a DB database as illustrated in Figs.4A and 4B. The operation f is used to identify whether confidential information is already present in the DB database. Thus, for example, the result could be res c# 0 if confidential information is absent and res c #1 if this information is already present in a record in the database. When a client wants to create a new record in the database, it transmits in 410 the encrypted information FHE . pk ( data c ) to the calculation server, hosting the database. This is assumed to be stored in encrypted form by the public key of the homomorphic cryptosystem, i.e. FHE . pk ( DB ) . The calculation server evaluates at 420 the function f in the homomorphic domain and determines whether the information is present there. The function f can be, for example, a PIR (Private Information Retrieval) protocol primitive. The result of the evaluation in the homomorphic domain, i.e. f ! FHE.pk ( data c ) ∀ # FHE . pk ! res c ∀ , is transmitted at 430 to the HSMSP module of the 20 service provider SP. The HSM module SPdecrypts the result using the private key FHE . sk stored there and provides SP at 440 with the record presence / absence indicator, res c . Optionally, the HSM module SP encrypts this indicator using the public key of a classic asymmetric (non-homomorphic) cipher or the secret key of a symmetric cipher before providing it, ∃ res c % to SP. The service provider SP can then return at 450 to the calculation server CS, an access code (for example a hash value) in addition to the presence / absence indicator. Depending on the type of application, the access code and the indicator can be transmitted in clear or encrypted form (by conventional encryption) to the calculation server. If the indicator indicates an absence of the record, the database DB can be updated by storing the information data cto the address encoded by the access code. Once the database is created, a CL client can query it by transmitting in 460 to the CS calculation server which hosts it a request encrypted using the public key of the homomorphic system, i.e. FHE. pk ! req c ∀ . The CS calculation server performs the operation f on the request req c to assess in 10,470 the response in this area, namely FHE.pk ! rep c ∀ # f ! FHE . pk ! req c ∀ ∀ The response is transmitted in 480, to the HSM module SP , which decrypts it using the private key FHE . sk it contains. This can transmit it in clear or encrypted form ( ∃ rep c %) using conventional encryption (asymmetric non-homomorphic or symmetric) to the service provider SP, in 490. 15 According to a variant, the database DB hosted by the calculation server CS can be encrypted using (the public key) a homomorphic cryptosystem distinct from that stored in the HSM module SP . More precisely, we will note ! FHE. pk1, FHE . sk 1 ∀ the first cryptosystem associated with the 20 calculation server and ! FHE. pk2, FHE . sk 2 ∀ the second cryptosystem associated with the HSM module SP of the service provider. The creation of the DB database according to this variant of the anti-collusion client-server system is illustrated in Fig. 5A. The client CL encrypts using the public key FHE. pk1the confidential information data c and transmits it in 510 to the CS calculation server whose database is itself stored in encrypted form by the key FHE. pk 1The 41118 FR EA-T 12 computing server also has a switching key As before, the calculation server evaluates in 520 the function f on the input data c in the homomorphic domain to determine whether this 5 information is present in a record of the database. The result of this evaluation f ! FHE.pk 1 ! data c ∀ ∀ # FHE . pk1( res c ) is then subject, in 525, to a switching of encryption in the homomorphic domain by means of the switching key KS 12 # FHE.pk 2 ! FHE . sk 1 ∀. Various key switching techniques are known from the state of the art. 10 A description of these can be found in the article by A. Kim et al. entitled “Revisiting homomorphic encryption schemes for finite fields” published in International Conference on the Theory and Application of Cryptology and Information Security. Springer, Cham, 2021. p.608-639. The result of the key switching, FHE. pk2( res c ) is then transmitted at 530 to the HSM module SP . The HSM module SP decrypts this result using the private key of the second cryptosystem it contains and provides in 540 a clear indicator, res c , to SP. Alternatively, the HSM module SP may provide this indicator to SP in a numerical form, ∃ res c %, using conventional encryption (non-homomorphic, asymmetric or symmetric). As previously, the service provider SP can then return at 550 to the calculation server CS, an access code (for example a hash value) in addition to the presence / absence indicator. 25 The query of the database DB according to the second variant is illustrated in Fig.5B. A client CL can query the database DB by transmitting at 560 to the calculation server CS, a request encrypted using the public key of the first 41118 FR EA-T 13 homomorphic system, i.e. FHE. pk 1 ! req c ∀ . The CS calculation server performs in 570 the operation f on the request req c in the homomorphic domain, and obtains the encrypted answer FHE.pk 1 ! rep c ∀ # f ! FHE . pk 1 ! req c ∀ ∀ . It then performs a 575 encryption switch of the response thus obtained using the 5 switching key KS 12, to get FHE.pk 2 ! rep c ∀ The response is transmitted at 580 to the HSM module. SP , who decrypts it using the private key, FHE. pk 2 , of the second cryptosystem it contains. This can transmit it in clear or encrypted form ( ∃ rep c % ) using conventional encryption (asymmetric non-homomorphic or symmetric) to the10 service provider SP, at 590. Alternatively, according to a third variant (not shown), the database may be encrypted using FHE.pk2, the confidential information encrypted FHE.pk 1 ! data c ∀ transmitted by the client in Fig.5A then first undergoing encryption switching by means of KS 12 , 15 before evaluation by the function f . Similarly, the encrypted query FHE.pk 1 ! req c ∀ transmitted by the client in Fig. 5B may first be subject to encryption switching by means of KS 12before the evaluation of the function f . 20 Those skilled in the art will understand that it is then possible to share the same database between two separate service providers, the first operating as described in relation to Figs. 4A and 4B and the second as described in relation to Figs. 5A and 5B. To do this, it is sufficient for the HSM module SP from the first service provider transmits the switching key 25 KS 12 # FHE.pk 2 ! FHE . sk 1 ∀ to the CS calculation server, hosting the database BD encrypted with the key of the first cryptosystem FHE. pk1. Conversely, if the database 41118 FR EA-T 14 is encrypted with the key of the second cryptosystem, it will be sufficient for the first service provider to transmit the switching key KS 21 # FHE.pk 1 ! FHE . sk 2 ∀ to the calculation server. In all cases, the presence of the HSM module SPallows to avoid collusion between the calculation server and each of the two service providers. The risk of collusion of the second type between client and calculation server can be avoided by adopting a client-server system according to a second embodiment, as shown in Fig.6. 10 In this embodiment, the service provider SP delegates to the calculation server CS the operation f to be carried out on the confidential data of the client, data c . This operation, for example an inference model in an artificial intelligence application, must also remain confidential with respect to the calculation server. 15 The risk of collusion is avoided here in that the client has an HSM module, hereinafter referred to as HSM CL , containing the homomorphic cryptosystem !FHE. pk ', FHE . sk ' ∀ associated with the client. The HSM module CLcan be presented in the form of an electronic card plugged into the customer's computer or an external box. It is suitable for calculating homomorphic cryptographic primitives and is advantageously TTP certified, like HSM SP . The parameters of the operation f (for example those of an inference model) are transmitted in encrypted form by the service provider SP to the calculation server, at 610. When a client CL wishes to have the operation performed on its confidential data, data c , he transmits them, in 615, in encrypted form, FHE. pk ' ! data c ∀ to the calculation server. This performs in 620 the operation f 41118 FR EA-T 15 in the homomorphic domain and returns, in 630, the result HSM module CL . The HSM module CL decrypts the result using the private key FHE . sk ' of the homomorphic cryptosystem it contains and transmits it in cleartext, res c, to the 5 CL client. If applicable, the HSM module CL can re-encrypt the result obtained using classical encryption (asymmetric non-homomorphic or symmetric) before transmitting it, ∃ res c % , to the client who then decrypts it using the corresponding private or secret key. 10 Fig. 7 represents an anti-collusion client-server system of the second type, according to a variant of the second embodiment of the invention. In this variant, the HSM module CL The client uses a separate cryptosystem from that of the service provider. More precisely, we note here !FHE. pk '1, FHE . sk ' 1 ∀ the first cryptosystem associated with the HSM module CL and 15 ! FHE. pk '2, FHE . sk ' 2 ∀ the second cryptosystem associated with the calculation server (or, advantageously, an HSM module SP not shown). The computing server or the HSM module SP, when present, additionally transmits the KS switching key ' 21# FHE. pk ' 1 ! FHE . sk ' 2 ∀ The service provider SP transmits in 710, in encrypted form by 20 FHE. pk '2, the parameters of the operation f to be performed, to the calculation server. When a client CL wishes to have the operation performed on its confidential data, data c , he transmits them, in 715, in encrypted form, FHE.pk ' 1 ! data c ∀ to the computing server. The HSM module CL additionally transmits the KS switching key ' 12# FHE. pk ' 2 ! FHE . sk ' 1 ∀ to the computing server. 25 At 720, the computing server first performs an encryption switch from FHE. pk ' ! dat KS ' 1 a c ∀ using the switching key 12. It then calculates the operation f in the homomorphic domain and obtains the 41118 FR EA-T 16 result This result is then subject to a reverse encryption commutation using the commutation key KS ' , which leads to the result ch ' 21 iffré FHE.pk 1 ! res c ∀ The result thus obtained is transmitted in 740 to the HSM module CL which performs the decryption of the private key FHE. s ' 5 mo k 1 which it stores and provides the result in clear, res c , to the client, in 750. Alternatively, after decryption, the HSM module CL can re-encrypt the result res c using classical encryption (asymmetric non-homomorphic or symmetric) before transmitting it, ∃ res c % to the client who decrypts it with the corresponding private key or secret key.

Claims

41118 FR EA-T 17 CLAIMS 1. Client-server system comprising a client, a calculation server and a service provider, said service provider delegating to the calculation server an operation to be performed on confidential data of the client, the calculation server being adapted to perform (320, 620, 720) said operation on the confidential data, encrypted by means of the public key of a homomorphic cryptosystem, characterized in that the service provider, respectively the client, is equipped with a hardware security module (HSM SP , HSM CL) containing said homomorphic cryptosystem and adapted to decrypt the result of the operation by means of the private key of said homomorphic cryptosystem to transmit it (340, 640, 740) to the service provider, respectively to the client. 15 2. Client-server system according to claim 1, characterized in that the client is adapted to encrypt said confidential data by means of the public key of the homomorphic cryptosystem and transmit them thus encrypted to the calculation server (310, 615,715). 20 3. Client-server system according to claim 2, characterized in that, the hardware security module equipping said client, the service provider transmits (610) to the calculation server the parameters of the operation to be carried out, encrypted by means of the public key of the homomorphic cryptosystem. 4.Client-server system according to claim 2, characterized in that the service provider is equipped with the hardware security module and the calculation server hosts a database encrypted using the public key of the homomorphic cryptosystem, the operation being a primitive. 41118 FR EA-T 18 providing an indication of the presence or absence of the confidential data in the database, the service provider returning to the calculation server an access code to store the data in the database if the indicator indicates an absence in the database.

5. Client-server system according to claim 4, characterized in that, to request confidential data in the database, a third-party client transmits to the calculation server an encrypted request (460) using the public key of the homomorphic cryptosystem, said request being evaluated (470) 10 in the homomorphic domain, the result of the request then being transmitted (480) to the security hardware module to be decrypted there using the secret key of the homomorphic cryptosystem. 6.Client-server system according to claim 1, characterized in that the service provider is equipped with the hardware security module and the calculation server hosts a database encrypted using the public key of a second homomorphic cryptosystem distinct from the homomorphic cryptosystem stored in the hardware security module.

7. Client-server system according to claim 6, characterized in that the client transmits to the calculation server the confidential data encrypted using the public key of the second homomorphic system and the calculation server performs the operation in the homomorphic domain of the second homomorphic system, the calculation server then performing an encryption switch of the result of the operation to obtain a result encrypted in the first homomorphic system.

8. Client-server system according to claim 7, characterized in that to request confidential data in the database, a client. 41118 FR EA-T 19 third party transmits to the calculation server an encrypted request (560) by means of the public key of the second homomorphic cryptosystem, said request being evaluated (570) by the server in the homomorphic domain of the second homomorphic system, then being the subject of an encryption switch (575) to 5 the first homomorphic system, the encrypted result of the request then being transmitted (580) to the hardware security module to be decrypted there by means of the secret key of the first homomorphic cryptosystem.

9. Client-server system according to one of the preceding claims10 characterized in that the homomorphic cryptosystem is an FHE cryptosystem.

Images