Okay, so hello everybody. I'm gonna be your last speaker today in this room about trust-based adaptive access control architecture. My name is David Halles, and I work as a principal software engineer. Seriously, guys? So I work as a principal software engineer for Red Hat. I'm in my ninth year there. I also am a PhD student and researchers, at the Maserich University in Bernow-Czech Republic, in the lab of software architectures and information systems. And I'm also an alumni of this school. You've probably seen those ducks outside on the corridor. This one with David text on it in the 2016 year is mine. My PhD research, which come on, Jim. Yes, but it's not for you. It's for the recording. So my research at the university is about trust-based adaptive safety in autonomous ecosystems, which I'm gonna talk about a little bit more. So what are software ecosystems? So if we combine multiple systems into one big unit, we can call them systems of systems or ecosystems. It's some kind of evolution as we are creating more complex and more complex structures. And of course, such systems can provide much more than a single system. Ecosystems can provide more than a system. So if you think about an analogy from buildings, so an architecture of a regular house could be a software system. Then the architecture of an ecosystems could be like a city with all these plans of every individual buildings inside. So this is what I'm researching. This is the main focus. Of course, if we bring autonomy to the topic, so we don't talk about software ecosystems, but autonomous ecosystems or autonomous software or cyber physical ecosystems, we can get much more higher degree of autonomy as we have multiple actors in the world who are working together, collaborating or competing. Member systems can join or leave at any time. So context changes are producing a lot of unpredictable situations and a lot of uncertainty, which brings to the main topic of my research is the safe and secure behavior of such systems. We're gonna look into something that's really a really small focus field of this research, ecosystem coordination. By coordination, I mean, for example, if you have a set of cars in a multi-lane highway, you can coordinate them to move them in a single lane, reducing aerodynamic resistance, basically vehicle platooning. This can be called as an autonomous ecosystem of self-driving cars moving in one lane. So we can do ecosystems coordination in two different ways. One is sending messages. So we can ask these autonomous vehicles to talk to each other and have some implicitly implemented features that can react to these messages that they send. This is relatively safe because you have some pre-trained stuff that you already know it in advance, but it doesn't really give you flexibility of uncertain situations, which we are looking into more is sharing software, so sending some kind of code, something executable between autonomous systems which receivers can execute. Obviously, it's not that safe as sending messages because you can execute stuff, but it brings you the opportunity to have new features on the fly. For example, if you have these vehicles here, it's enough if one has the smart agent or the software module for platooning, it can share the software module with the other vehicles which don't even support this feature and after everything's working fine, they can move into one platoon even though they didn't have this supported feature before. Of course, running a third-party software module on your autonomous vehicle in privileged mode is kind of a bad idea. I guess everybody can agree here that we shouldn't do that, but if it's a bad idea, it can be still fun. So our view of how to make it safe is to use the concept of trust. And by trust, I don't really mean the trust as you know in software engineering in general with trusted computing, trusted execution, or key pairs, encryption, and the trust in HTTPS certificates. I mean more like trust as in human psychology or in philosophy, where you have some kind of relationship between a trustee and a trustee, and the trustee is having some kind of vulnerabilities by trusting the trustee. So we are trying to model something in this area. And somebody smarter than me said that reputation-based trust can be effective for securing communication, and our belief is that we can also use it for interactions, not just any kind of interaction, even physical interaction, not just communications. So our idea is to use trust as a decision factor in real-time evaluation. We already know that this trust will be not binary. So I'm not sure about the representation yet, but in a simple solution with binary, true-false-trust-not-trust, you can have a lot of very, very dangerous false-positive situations. So dual solution is definitely not something what we want. We are also looking into reputation, which is we interpret reputation in a way that trust assessed by other actors, basically gossiping. So one, let's say, autonomous vehicle has an interaction with another one, it has a bad experience, and it shares with others. Basically the same as people gossip about other people, which is not nice, but in autonomous ecosystems it might be useful for us. So to calculate trust, if I say number, it might be a number, so we can go with that. So we would use this external reputation on these smart agents, software modules. We can use static analysis to find some kind of vulnerabilities there. The important part is, which is not my research, but I'm gonna use it as an input, is predictive simulation using digital twins. And based on the result of these digital twins, we can do live compliance checking, which I will explain later. So is anybody unfamiliar here with digital twins? Okay, so a digital twin in our case can model anything from the physical world. Basically it's a digital representation of a physical object. In our case, the physical object can be the software module. Doesn't have to be, but I will explain why it was our solution. As you see it on the picture, what we do with predictive simulation is that in a simulated world, we run ahead of time and run some kind of simulations on the digital twin. And the smart agent, which is running in software, in case of software, the exact same stuff, in the real world, you can compare these two things and based on that, you can assess some kind of trustworthiness, how much the model itself is trustworthy based on the predictive simulations and also how the two differ from each other, which is the live compliance checking that I was talking about. So I really don't know how the trust would be. My best guess in our papers, we talk about the percentage, but more and more research is pointing towards a vector of different aspects, so maybe like five or six percentages based on some kind of metrics. But I'm pretty sure that we would like to go with this smart agent digital twin bundle with some digital signature because it gives us some extra safety. So if we talk about digital twins, this is our generic idea that we would verify the digital signature. If it fails, we don't care about the bundle. If it passes, we do static analysis. Again, if it fails, we don't care about the bundle. Then we verify the digital twin on some preset simulations. If it fails, we not just reject the bundle, but we also propagate the trust score to the world, telling others that this might be some untrustworthy software module or smart agents. Then we do some predictive simulations and execute it and do the life compliance check based on those results. This was a simplified thing and I would like to show you kind of the whole architecture, which looks like this, which is kind of complex, but we'll go into this more a little bit later. What it does actually, so it does predictive simulation of some scenarios using the digital twin. So you have some reality and you can have some multiple scenarios in the future based on that reality and you can do all the simulations with the digital twin. Compare the simulations with the results, that's the life compliance check. Based on that, we can calculate that trust score in which case it can be a number, let's say 45%. And based on the score, we can set up a decision tree that would allow us to expose certain features to this smart agent or on the other hand conceal those features. Basically some kind of access control based on how much we can trust this module based on reputation and other metrics. So again, looking at this, we have some external reputation coming from other vehicles. We have the smart agent and digital twin coming to some kind of gatekeeper. We verify that digital twin on some preset simulations. Then we load it to the simulator. We load it, the smart agent to the sandbox and these two entities work in tandem. Calculate some kind of comparison that goes to the trust aggregator that creates a trust score. And based on the trust score, the sandbox basically has or not has access to certain features on the vehicles platform. But, which might be interesting for you, software engineers not really working with automotive and let's say different technologies in the cloud. If you squint on this a little bit more, what this architecture resembles you? You have some rules. You have some role. And based on the rules and the roles, you have some access. What if I say Kubernetes RBAC is something similar? And what if we could implement something trust based in Kubernetes? So instead of RBAC, we could do something like T-BAC, which would basically implement a similar architecture in the cloud. I mean, it would probably totally useless in software environments. But I see it as a viable way of doing a proof of concept. And I heard some rumors that there is a team at Red Hat who tries to run containers on vehicles. Okay, somebody is shaking his head so it might be not true. So it would be probably useless in a real cluster where you're running it in the cloud some services because you might not be able to run some kind of simulations. But in some edge computing cases, it might be useful. So that's our vision how and why we would like to run it in Kubernetes at some point. So to wrap it up, there is some future work that we are looking into. So based on this, we are trying to swap the smart agents with a pair of sensors. So we could calculate trust on sensors and we can trust or not trust the sensors and based on that believe or not what the sensors say. Another approach is to use digital twins of autonomous vehicles and extend this architecture for a whole ecosystem. So we could simulate other cars, calculate their trust score and behave accordingly. So it wouldn't be just inside one vehicle but the architecture would be extended among multiple ones. And the last one is that we just submitted a paper and it's not yet accepted, is trustworthy execution in an answer-worthy way. So let's flip the concept that the smart agent wouldn't trust the execution environment where it's running. We had some initial discussions with people who understand blockchain and this might be an unsolvable problem because the vehicle manufacturer might have some god-like power on your smart agent but there are still ways how to detect that such thing can happen. So stay tuned for that. It might have some interesting results. And last but not least, I would like to mention that my supervisor will have a talk tomorrow at five o'clock or actually I will do it because she twisted her ankle today. So if she recovers then check out her talk otherwise see me tomorrow as well. Thank you. Yeah, I try to make it fast because dinner validation. Which one? This one? Yeah, sorry I cannot hear you. Because that would fail on any other vehicle. This is an architecture that has some kind of static analysis so it doesn't really make sense because each of them would... Yeah, well the point is that everybody would implement this framework. They would have the same kind of static analysis so they could catch the same issue. Anyway, the question was why the static analysis isn't notifying the aggregator. So the question is about how the aggregator gets protected from spamming from false positives and false negatives. So the results are actually not coming from the smart agent but the simulator that runs the smart agent. So the smart agent cannot really spam it. Yeah. Yeah, the aggregator gets a message from an existing component that's also under R control. No, no, no. Yeah? Yeah, so the question was about track record and regarding the static analysis that we might get some interesting reputation if from a certain vendor we have failing static analysis. We weren't really looking into specific vendors and track records but this is an interesting aspect, thank you. Yeah, go ahead, just please be louder because I cannot hear from the AC. So the question was about GPG and trust chains that the way it resembles what we have with GPG and trust chain. No, we were actually trying to get around this topic of trust chain and static kind of trust. So our approach is trying to be dynamic and we try to avoid and throw away everything that was interpreted as trust in software engineering and computing. Any more questions? Please? Yeah, so the question was about vulnerabilities and attack surface in specifically in the trust aggregator in the trust gate. Well, the trust gate isn't really in that shape yet that I can talk more about the details. So it's just a high level thing. Regarding the trust aggregator, there are the some research with some results on how to do countermeasures against such attacks. Yeah, so the trust aggregation and the calculation isn't really my research. My focus is more on this part than the left. Okay, I guess thank you for your attention.


That's a brilliant ball, it's a decent take, and it's a championship side, hit the front against their National League opponents, and that is the quality with which they can unlock you. Once again, and the goal so similar to the opener, the run from Mark Kondes, the coolest of finishes, and the ball with lead by two goals to do.


My great-grandfather used to cut hair as a living. He took care of the family that way. Out of that inspiration, I felt compelled to carry on that tradition. My name is Lillian Lam. I'm an owner stylist here at the V-Studios salon. I was an assistant for about two years. I worked my way up until I was a manager for a salon. My weakest flaw was cutting hair for me. I decided to go work for a barber shop. That added on more and opened more exposure and opened up more doors for me. About 10 years ago, I've actually opened a five-station salon in Sacramento. It was really a hard time to open a business, but I did it anyway. Then decided that after three years, I wanted to move into the city in San Francisco. When I opened my salon, what domain, what name do I want? My wife, my partner says, you know, you're the one who do everything. Why don't you just name it after yourself? I was really happy to see that it was actually available, so I jumped on it. So this is it. This is my name. It's me who I wanted to brand. This is my space. I love to set my space and make it really relaxing and inviting and warm, welcoming to some guests coming in. This is where I have all of my colors. This is the Japanese shears. This is usually what I use to cut on my clients, as well as my clippers. These are my tools. And this crew path, you know, there's a lot of stylists that just mainly focus on something where it's just as colorist or, you know, barber or just someone just strictly styles. For me, I'm very universal. I like to have open doors for all. How are you? We're still growing out the hair, right? Yes, still growing out the hair. So you still need to continue the undercut? Yes, that's exactly what I would like to do. I love all my clients. I right now have people, female and male.  As more of my guests, some of them become close friends. I couldn't ask for anybody different. They're so amazing. I'm a mom. I have a 17-year-old, 14, and soon will be 13.  It was definitely a lot of challenges, but every day I feel like there was a good challenge. You find some common, you know, balances that you can figure out.  I learned to make sure that it's only 10% of my life. The 90% is family. It's my kids. It's my wife. It's my dogs. That's the 90% of it, which makes me feel the 10% of my work life flourishes. I've used GoDaddy before. I had my website back in 2008. Once I opened my studio here and worked for myself back in March 2017, it's when I decided I remember GoDaddy. I remember the website they helped build for me back then. It was great. So that was the first thing that popped in my mind, because once I signed on, I figured out how easy everything was. GoDaddy really break it down really very plain and simple. Do you want people to be able to book online at this feature? Do you want someone to link to your social media at this feature?  It's just the one less thing that I have to worry about.  Having that flexibility is really amazing, because I can say that I was there. I didn't miss out because mom is at work. I really do think that if you put out what you really want, the right clients or guests will walk into that door. It is what you put out there and it's what you accept.


Okay, Ravi you won your game today after five draws. How does it feel? Yeah, it's a relief because I kept messing up winning positions So I was a bit worried it would happen again today, but yeah, I didn't just nice. Yeah You feel you had it under control most of the way Yeah, after she played at five it was probably not a great move and After that, I think it was almost lost already. I don't know It just seemed like her position was so difficult after that and Then she had also low time. So yeah, it was it was fine. It felt comfortable. Yeah, okay. Let's look at the game Ravi you played h3 in this choco pianissimo position. What happened next? I Forgot what she played next Yeah, I guess it's the main move I mean she like there are lots of options. You can also play bishop e6, so I don't know Bishop e7 for I didn't think it makes a huge difference Yeah, after h6 I played d4 played d4. Yeah, which I played before it was quite strange because I played it in one of my last games and She was like taking her time here. So yeah, maybe she missed the game or something because I was a bit worried Like because she doesn't really play a5 so much and I didn't prepare it hugely So I was a bit worried that she looked to the game But then it turned out she probably hadn't so okay. Yeah, got a bit lucky. That was a bonus. Yeah Okay, so you she retreated. I guess the main line instead of d4 is probably like just take it I mean instead of d4 is probably like knight d2. Oh, I see. Yeah Knight d2. Yeah, and then bishop e6, bishop b5. Yeah Bishop b5. Yeah, and there's like loads of moves here It's a bit of a rile of pairs really once you get bishop b5 in, isn't it? Yeah I guess blacks plans sometimes like bishop e7, knight e7, knight e6 and then kick the bishop with c6 Yeah, okay, but yeah, I played d4 straight away. So he played d4 because like yeah, I hadn't I Have only prepared this one like not the other one. So even if she had some prep I'll spot. I was just like, yeah And then bishop e6. Yeah, bishop e7 is also a move and I forgot what to do. Okay. I mean, I still do the same thing But if we do what happened the game bishop e3 Shall I use this? Bishop d2 and in this position, I forgot what to do because I well, I still don't know because I haven't checked my file yet But in the game I played bishop e3 with the bishop on b6 Maybe it's the same. Maybe it's not who knows Yeah, you prepared this some time ago and you've forgotten. No, I've prepared it this morning I was too busy watching the win would the Australian open Yeah Yeah, and here probably the Main Ways to do that. I mean the most critical ways to do this and she gets the two bishops like 93 Takes and this is the game. I had to play in Mickey Adams Okay, he played d5 probably c6 is tined with more accurate. Where was that? What was this? It was a London classic Yeah, I don't know. Yeah, I just had this position. Anyway, but she played bishop e7 and I couldn't remember what to do But I felt like bishop e3 was the right move and Instead of bishop e3, I didn't know like what else I can even do. So, yeah and this Happened Yeah, and I take c2 x2. Yeah, I was kind of I didn't really know how to evaluate the position because she has two bishops I've given away my dark square bishop But you have a big center. I have this end to have ideas like Queen d3 and e5 So it's a bit difficult for us to deal with. Yeah, so she played knight h5. I thought knight h7 was interesting too To like trade the knight on f3 maybe right and like get out of the e5 motive Here I didn't well. I didn't know what I was gonna do. I guess one idea is like Knight bd2 maybe and Then night g5 to take and go knight f3. Yeah, but then Yeah, I don't know if I want my knight on f3 or c3 Yeah, it's another line. Yeah, I don't know But I take five got play yeah And here it well it first I was a bit worried because it looks quite scary like she's going queen f6 knight f4 Yeah, because you haven't got a dark square bishop now. Yeah, kind of difficult isn't it? Yeah, um I probably spent too much time here on knight c3 instead of Queen d2. I was looking at this stupid line with e5 and No, wait, sorry wrong line from instead of opting I see three right now for oh Sorry here. Yeah, yeah for you for and then Queen d2 And then queen f6 you five And she takes I was looking at this wow And then maybe takes and here I have a choice because I can play Queen d3 Yeah, or just take on e5 well I can play Queen d3 whenever I want I guess Yeah, yeah quite sharp. Yeah, and maybe Queen c6 is fast Queen d3 yeah Queen d3 g6 And Now I can take yeah, but she has fish page three It's a bit scary. Yeah. Yeah. I was just like I I mean Sometimes you just don't want to deal with this stuff like yeah, even if it's probably objectively best Yeah, I'd spent already like 25 minutes. I was like and can be bothered and I saw Queen d2 And it was just easier just play a move that looks right genuinely. Yeah. Yeah, this is this is it Here she plays Five is really bad move. Yeah g6 horribly weakened. Yeah. Yeah, but it's okay instead of f5 What does she do? So I'm the first obvious one is to go Queen f6 anyway. Yeah, but here e5 and Good thing now. I know the nice one f4. Yeah, so she can go Queen f4 My deal was Queen d3 g6 Knight c3 Let's see three. Okay, then knight e2 to chase the Queen around well rookie for even rookie for yeah She pieces are weird. Oh, sorry.  Yeah Yeah, um hard to evaluate that as no, yeah Yeah, but I think I have some control here. I don't know maybe I'm wrong but um, but this was a Yeah, but instead of f5, maybe she should play I was also looking at c5 To try and get the bitch from the game because in the game The bishop was just completely out of it. Like it didn't really play a part But I thought maybe I should have a small match after knight c3 takes Knight takes bring the rook into d1 But I don't think she's doing bad here at all like even though she has a pawn in d6. She has two bishops Yeah Like I don't know Doesn't have to be the end of the world. No, I know exactly But maybe she should have something better as well. I don't know. Oh check when I go Okay, not to worry. Yeah, we'll just look at what do you play f5? Yeah, that's really surprised Very very risky isn't it and probably horrible basically so you then react while you've developed Yeah, I mean there were other options, but I didn't see anything. We're just developing. Yeah. Yeah, very natural move Okay, I don't know what she wants, but you weren't worried about this capture on Oh, no, could you do took with a bishop because she did yeah looking at bishop takes h3 But it's not even a move So into your rook f8 rook f8. Yeah, I don't I don't know like I think it's just really really bad Yeah, I genuinely like if she doesn't play rook f8 or bishop g6 Yeah, yeah, like this bishop is just so bad. It is. Um, yeah Okay Well, and it's just playing itself now. Yeah, like 97s are any big threat. Yeah Yeah, I don't know. Yeah, I didn't really know what she could do Yeah, I mean that's maybe she missed this just simply plonking the knight on e7 a couple of moves. Yeah It's easy to miss, isn't it when it's not so that's true because if if it wasn't like if she could play c6 and I take on b6 say yeah queen takes b6 Then she's probably Well, not Maybe not completely equal, but she has counterplay. Yeah Um Yeah, that moves it. All right. Yes. Yeah.  Yeah. Um, it's bad news, isn't it? I hear here I was planning g4 originally And the point is like knight of 6 knight h4 You know she takes on e4. I have an i g6 And I can take when I fade with check Yeah, um, but here I think bishop e8 might be okay. Okay, and if knight of 4 then she can take Yeah, um So again, this was something that I didn't really want to deal with. Um, Yeah, so instead I played just bishop c2, which I think is simple. Yeah, because the point is now I'm threatening 97 and queen d3 Well, like not queen d3 straight away, but there are a lot of lines where queen d3 comes in handy Um And you're just not bothered by bishop takes h3 which comes next because you've got so much Because her king is just weaker the king is so weak. Yeah, this is not threatening anything Yeah, 97 now for queens out again. Yeah, yeah, um Yeah, and it's gone now completely gone. That's anything like if there was nothing I think I looked at it But the an engineer wasn't offering anything of any any great note the fact that you can get two knights attacking g6 Yeah, it's a thing, isn't it? Yeah. Um, I mean rook f6 was try, but I probably can just take And if knight takes king h1 All right Okay, because like knight g6 just comes like this doesn't really help. Oh, sorry. King g12. King g1's probably fine, but king g2 um, yeah And like Yeah, she can designs. Yeah, that's all I ever know. Yeah. Okay. Thanks very much. No worries


Hello, everyone. In this talk, I will present our work about functional encryption, which allows the computation of so-called attribute-weighted sum. This is a joint work with Michelle Abdelha and Hotec Wee. Let me first motivate the notion of attribute-weighted sum. Consider a database with four fields or attributes. Each record in a database corresponds to a particular person. It contains some demographic information, such as gender, age, and whether he or she smokes. It also contains some sensitive information of whether he or she got cancer. With this toy database, we may want to count the number of smokers who is older than age 40 and got cancer. This can be presented in this form. It is the sum of five quantities. Each cement corresponds to one record in the database. It equals one if the corresponding record comes from a person with cancer who is a smoker and older than age 40. We can consider this as a weighted sum of values in the sensitive field cancer. The weight for each cement is computed by evaluating the function f on the corresponding three public attributes, gender, smoker, and age. So we call this attribute-weighted sum. If we use xi and zi to represent the public and the sensitive values in the ith record respectively, we can write the function in this compact form. To allow a party to compute an attribute-weighted sum without leaking the sensitive data zi, we can use the functional encryption for attribute-weighted sum. In such a crypto system, we encrypt xi zi with xi being public and zi being protected and issue a secret key for the function f to the party. The decryption is required to recover the attribute-weighted sum and reveal nothing else about zi. We will formalize the security a bit later. Before that, we want to first motivate another important notion in this setting. For a database, the number of attributes and their data types are determined when the database was established. However, the number of records will constantly increase after that. Namely, xi and zi are small and have bounded size, while the number of records n is larger and unbounded. When we protect the sensitive data in the database by functional encryption for attribute-weighted sum, this means that n probably grows larger and larger after a secret key for f is issued. Therefore, we require that a secret key should be able to decrypt the ciphertext for any a priori unbounded n. This is called unbounded slot for short in this work. Furthermore, in the above, we have zi being Boolean variable and a function f being Boolean function. We will actually consider a more general form, where zi is a vector over larger field and the product becomes inter-product operation. This allows us to capture more applications, such as computing average salaries of a particular group of people. Even with the one-slot case, this notion covers a set of classical and newly introduced functionalities. Now, let me be more formal about the security notion. We call that we want a secret key for f to only leak the attribute-weighted sum with respect to xi, zi, and f, but keep other information on zi secret. This is formalized as the simulation-based security against unbounded collusion. The adversary is allowed to see the mass public key, one ciphertext, and unbounded number of secret keys. We show two keys here as an example. They can recover the attribute-weighted sum regarding f and g respectively. The security means that the adversary's view is indistinguishable with the one on the lower row, where the ciphertext does not contain any information about zi, and the attribute-weighted sum with respect to f and g is embedded into the corresponding key. The solid lock and the key on the upper row refer to real ciphertext and a secret key. The hollow lock and the key on the lower row refer to the simulated ciphertext and a secret key. We note that decrypting the simulated ciphertext using the simulated key gives the value embedded in the key. Our main result is an FE scheme for attribute-weighted sum with selective simulation-based security from K-linear assumption in the prime-order by linear group. It also satisfies the unbounded slot requirement, that is, a secret key can be used to decrypt a ciphertext for any n. We also mention that our proposed scheme is expressive in the sense that it allows the function f, which defines the weight, to be an arithmetic branching program, which covers many important function classes, such as nc1 and the log space. Besides that, our ciphertext size is independent of the size of public attribute xi. Technically, we build a one-slot scheme first, and bootstrap this basic scheme to support n-slot. This talk will focus on the bootstrap part. Let me begin with a brief sketch of our one-slot scheme. It is based on the partial hiding-predict encryption by we, which basically corresponds to the same function, but review whether the result is zero or not, rather than the actual value. We inherit the expressiveness and the security guarantee from we's predict encryption. We also make an optimization so that the ciphertext size is independent of the size of public attribute x, and our bootstrapping technique described later preserves this feature. With this basic one-slot scheme, we are ready to show how to build a scheme supporting unbounded n. Along the way, we will always concern about correctness, security, and unbounded slot feature. For simplicity, we will give an example for three-slot case, where x1, x2, x3 are public, z1, z2, z3 are secret. Here f is the function supported by the one-slot scheme. A naive bootstrapping works like this. We encrypt xi, zi in each slot using the one-slot encryption algorithm, and the secret key is exactly the same as the one-slot secret key. Namely, the ciphertext for three-slot case consists of three sub ciphertexts. The sub ciphertext i corresponds to slot i. Using the secret key to decrypt the sub ciphertext 1, we get a partial decryption result for slot 1 according to the correctness of basic one-slot scheme. Then we can do the same for sub ciphertext 2 and sub ciphertext 3. Decrypting up all partial decryption results for all three slots gives us the attribute-weighted sum, and the scheme indeed satisfies the correctness. Furthermore, this scheme supports a bounded slot. Recall that we decrypt all sub ciphertexts using the same secret key, and this procedure can continue if we have more sub ciphertexts. However, this is insecure at all. Partial decryption results immediately leak intermediate summands of attribute-weighted sum. Remember we only want to review the sum of them. To fix the issue, we introduce correlated randomness wi into sub ciphertext i, and the randomness r in each key so that all partial decryption result contain a mask wi times r and hide all summands. We notice that the randomness r is crucial to support unbounded collusion. For this, we need to slightly extend the basic one-slot scheme to capture the newly introduced w and r. Here, w is considered to be a secret like z and r is public in some form. Fortunately, the function is still an arithmetic branching program. To serve as the building block, we need some technical modification, but we don't give the details here. To check the correctness, we know that the decryption works as warm-up scheme 1. We use the secret key to decrypt each sub ciphertext one by one and sum up all the partial decryption results. By the relation of wi, we can see that all wi r will be cancelled out, and the attribute-weighted sum will be correctly reviewed. Namely, the warm-up scheme 2 is correct. Again, the schemes support unbounded number of slots for the same reason. Let us see how the newly introduced wi times r in each partial decryption result can hide each summand. Technically, the value is recovered in the exponent. The dh assumption allows us to change wi times r to wi prime, which is fresh for each key and has the same restriction as wi. Then, a direct statistical argument can show that the three partial decryption results are identically distributed like this, which can be simulated only using the knowledge of the final attribute-weighted sum instead of every summand. This suffices to prove that only the sum is leaked. However, this does not work well with the warm-up scheme 2, especially with the unbounded slot requirement. We only have a single secret key for all three sub ciphertexts, which has no room to embed all three partial decryption results. In general, we must embed n values in a single secret key of the basic one-slot scheme. In another word, it seems to be true that the warm-up scheme 2 only leaked the sum, but further ideas are required in order to make the proof work. The first idea is to split the previous statistical argument into several hybrids by which we gradually collect partial sum. In our example, we have three slots, so two hybrids are sufficient. In general case, where we have n-slot, m-1 hybrid are used. By hybrid zero, we just rewrite the first partial decryption result by the restriction of wi and do some rearrangement. In hybrid 1, we use the entropy of w2 to collect the partial sum involving the first two slots, that is x1, z1, and x2, z2. Here we again need the help of DDH. Similarly, in the hybrid 2, we use the entropy of w3 to pick the last cement and get the final sum, which involves all three slots. This finished the argument and the resulting distribution is actually identical to our one-shot argument shown before. How can this new strategy help us? And how can we carry out the strategy in the proof? Observe that each hybrid only involves two slots. This means we only need to have two places to embed the two corresponding partial decryption results. This motivates our second idea. To accommodate the two partial decryption results involved in each hybrid, we employ two independent copies of the basic one-slot scheme. This means we need to generate two sets of fresh masked public secret key pairs. In the talk, we just use a subscript 1 and 2 to indicate ciphertext and a secret key from the two copies respectively. Now, the secret key consists of two sub-keys. Sub-key 1 is from the first copy and the sub-key 2 is from the second copy, but both of them are generated for the same f and r. Roughly, sub-key 1 is used to embed the partial decryption result of the first slot, while sub-key 2 is used to embed another partial decryption result depending on the hybrid. Accordingly, sub-ciphertext 1 for x1 and z1 is generated using the first copy of the basic one-slot scheme. Sub-ciphertext 2 and 3 are created using the second copy. Let me sketch how the proof actually works with our two ideas. We switch sub-ciphertext 1 and sub-key 1 to the simulated form. This follows from the simulation-based security of the first copy of one-slot scheme. By this, we embed the partial decryption result for the first slot to the sub-key 1. Then, we can deal with the remaining slot one by one. We switch sub-ciphertext 2 and sub-key 2 to the simulated form so that we embed the second partial decryption result into the secret key. This follows from the simulation-based security of the second copy and the independence of the two copies of the basic scheme. Then, we can carry out the argument of moving from hybrid 0 to hybrid 1, which collects the partial sum involving the first two slots. Then, we switch sub-ciphertext 2 and sub-key 2 back to the real form. Note that sub-ciphertext 2 does not contain z2 anymore, which has been embedded into partial sum in sub-key 1. And it is crucial to switch back to the real-ciphertext and the secret key since we can now reuse sub-key 2 to handle sub-ciphertext 3 with an analog strategy. Namely, we switch sub-ciphertext 3 and sub-key 2 into simulated form and embed the partial decryption result for the third slot into sub-key 2 again. With this, the argument for moving from hybrid 1 to hybrid 2 allows us to reach the final attribute weighted sum and embed it into sub-key 1. Switching all sub-ciphertext and sub-keys from the second copy back to the real one, we get a simulated ciphertext and a simulated secret key for our three-slot scheme. The simulated ciphertext does not contain any information about the i, and the attribute weighted sum is now embedded into sub-key 1. For this, only sub-ciphertext and sub-key from the first copy is in the simulated form, while all remaining sub-ciphertext and sub-keys from the second copy are real. And this is our actual final scheme. In general n-slot case, we have n sub-ciphertexts. Sub-ciphertext 1 encrypts the first slot using the first copy of one slot scheme, while all remaining slots are handled using the second copy. The secret key will always have two sub-keys from the two copies respectively. Let me summarize this talk. In this work, we study functional encryption for attribute weighted sum. We give a construction in the primordial bilinic group with simulation-based security. A key feature is that we consider the so-called unbounded slot feature, which requires that a secret key can be used to decrypt the ciphertext for any n. In this talk, we sketched how to get in one slot scheme as basis, and bootstrap this to the n-slot scheme. We can also adapt our n-slot scheme to the multi-client setting, where each xi and zi is encrypted by different parties and the corruption of parties is also considered. Finally, we leave several open problems. First, our scheme only achieves selective security. It is generally desirable to have an adaptively secure scheme. Then, by using the bilinic group, we have to restrict the domain size to be polynomial, so that we can use brute force discrete log algorithm to recover the final attribute weighted sum. It would be interesting to have a lattice-based scheme so that we can get rid of this restriction. Finally, our multi-client scheme requires all parties to negotiate a fresh correlated randomness for each encryption. It would make the scheme more practical to allow them to reuse the randomness in the future. Thank you for your attention.