A recurring problem in encrypted data sharing: Alice encrypted some data to herself, and now wants Bob to be able to read it — but she does not want to decrypt it and re-encrypt it to Bob's key, because that exposes the plaintext at the moment of handoff and may require her to be online. Proxy and homomorphic re-encryption solve this by transforming the ciphertext directly, key to key, without it ever being decrypted.

US10778657B2, “Schemes of homomorphic re-encryption,” granted to Nokia Technologies Oy on September 15, 2020, claims methods for exactly this. Classified under H04L 9/008 (homomorphic encryption) with H04L 63/0464 and key-agreement codes, it covers re-encrypting from one key to another while the data stays encrypted throughout.

“Method and apparatus are disclosed for homomorphic re-encryption schemes in a system comprising a cloud service provider (CSP), a third authorized party (TAP), a data requestor (DR) and a plurality of data providers (DPs).”— U.S. Patent No. 10,778,657 source

The claim does not describe a simple two-party handoff; it describes a four-role architecture, and the roles are the point. Claim 1 sits at the cloud service provider: in response to a request from the third authorized party, it obtains ciphertexts from a plurality of data providers “wherein each data provider is configured to homomorphically encrypt its data,” analyzes those ciphertexts to obtain an analyzed result, and sends that result to the TAP — “wherein the third authorized party is configured to re-encrypt the analyzed result with at least a secret key of the third authorized party, such that a data requestor (DR) is configured to decrypt the re-encrypted analyzed result with a secret key of the data requestor.” The four entities are explicitly “separate entities,” so no single party sees both the inputs and the cleartext output.

The cryptographic heart is the final limitation of claim 1, and it is specific: “the re-encryption is based on a proxy re-encryption (PRE) scheme where a secret key corresponding to the homomorphic encryption is a product of the secret key of the third authorized party and the secret key of the data requestor.” That product-of-two-secrets construction is what lets the TAP re-key a ciphertext toward the data requestor without ever being able to decrypt it alone — neither the TAP's key nor the DR's key suffices by itself, only their combination. It is the mechanism that makes “transform without opening” true rather than aspirational.

The dependent claims name the actual cryptosystem and the computation. Claim 4 (and again claim 9) ties the homomorphic layer to the “Paillier cryptosystem,” the standard additively-homomorphic scheme — which is consistent with claim 3's disclosure that the analysis “further comprises aggregating the cipher texts” so that “the decrypted analyzed result comprises a sum or a product of the plurality of data providers' data.” In other words, the cloud is doing privacy-preserving aggregation: summing or multiplying many providers' encrypted values, then handing the encrypted aggregate down a re-encryption chain to a recipient who alone can open it. Claim 10 shifts the vantage point to the TAP itself, adding an eligibility check on the data requestor before any re-encryption happens — and claim 14 lets the TAP cache an encrypted analyzed result and re-encrypt it later for a second, separately-vetted requestor, so one expensive aggregation can serve many recipients without redoing the homomorphic work.

The mechanism, read from the claim, relies on a re-encryption key — a special token that lets an intermediary (a proxy, a cloud) transform a ciphertext under one key into a ciphertext under another. Crucially, that token does not let the intermediary decrypt anything; it only enables the transformation. The plaintext exists only at the true endpoints — the data providers who encrypt their inputs and the data requestor who decrypts the aggregate.

The choice of Paillier is not incidental, and it is worth understanding why it fits. Paillier is additively homomorphic: given encryptions of two values, anyone can compute an encryption of their sum without the key. That is exactly the operation claim 3 needs when it aggregates ciphertexts so “the decrypted analyzed result comprises a sum… of the plurality of data providers' data.” A fully homomorphic scheme would be overkill — and far slower — for what this system actually does, which is privacy-preserving aggregation rather than arbitrary computation. Pairing an additively homomorphic cryptosystem with a proxy-re-encryption layer keyed to a product of two secrets gives a clean division of labor: the cloud sums encrypted contributions it cannot read, and the re-encryption chain hands the encrypted sum to a recipient the cloud never has to trust. The patent's specificity here — naming Paillier, naming a product-of-secret-keys PRE, naming sum-or-product aggregation — is what distinguishes a defensible claim from a vague gesture at “homomorphic re-encryption.”

Why this matters operationally is delegation at scale. Encrypted cloud storage, encrypted analytics over many contributors, encrypted content distribution — all involve handing protected data to new recipients over time. Without re-encryption, every new recipient means the owner must decrypt and re-encrypt, which is both a security exposure and an availability burden. The Paillier-plus-PRE construction here pushes that work to an untrusted proxy safely, and the eligibility and caching claims show it engineered for a real multi-tenant service rather than a single exchange.

Per the desk's discipline: issued grant (B2), not an application; a scheme/method claim, not a product. Nokia's telecommunications and networking context makes secure data delegation a natural fit, but the patent is the technique.

For the reader mapping homomorphic-adjacent cryptography, re-encryption is a quietly important branch. It is not about computing on ciphertext so much as moving ciphertext between trust domains without opening it — a primitive that secure sharing, key rotation, and access delegation all lean on. The specific contribution here — a product-of-secret-keys PRE bolted onto Paillier aggregation across four separated roles — is a concrete, claimable instance of that idea, with its own real patent history.