How to use Real-Ideal model in a specific scenario (two party with cloud)

Question

I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their input independently and then each one outsources the encrypted data to the cloud, independently. Afterward, the cloud performs homomorphic encryption on the encrypted data received from Alice and Bob and sends the result just to Alice.

My protocol is designed in the semi-honest model, and the cloud will not be able to learn anything about the parties' inputs nor the final result. Each party should not learn about another party.

My questions are:

1. In this protocol, how should I use the real / ideal model paradigm to prove the protocol's security?

2. Should I consider the cloud as a party who does not have any input and output?

3. Can I consider the following cases for the security proof of this protocol like this?

   a. Alice is corrupted

   b. Bob is corrupted

   c. Cloud is corrupted

4. For case c in quesetion 3, how should the simulator simulate? The cloud will only see the encrypted data?

Answer 1

In this protocol, how should I use the real / ideal model paradigm to prove the protocol's security?

This question is too vague. Security in the real-ideal paradigm is defined as "for every adversary, there exists a simulator, such that the views are indistinguishable." So you have to do that.

Should I consider the cloud as a party who does not have any input and output?

It receives/sends messages in the protocol, so you must do this.

Can I consider the following cases for the security proof of this protocol like this?

Yes, but if these are the only cases you consider, then you are only proving security against a single corruption. In an $n$-party protocol, generally you would want to consider all cases of $n-1$ corrupt parties.

Your protocol is probably not secure against an adversary who corrupts both Alice & the cloud. I am inferring from your description that Alice has the decryption key to the encryption scheme, so when colluding with the cloud she can get Bob's input in the clear.

For case c in quesetion 3, how should the simulator simulate? The cloud will only see the encrypted data?

The view of the cloud consists of the ciphertexts from the parties. You have to construct a simulator which generates something indistinguishable, given only the party's output from the functionality (this is the requirement for semi-honest security). In this case, I guess the cloud party gets no output from the functionality. So, given no information about the honest party's inputs, can you generate something that looks like encryptions of their inputs? Sure, just encrypt dummy stuff and use CPA security to argue that this simulation is indistinguishable.