A privacy-preserving data aggregation method

Abstract

The present invention discloses a data aggregation method for protecting privacy, including: 1. Parameter generation stage: the system generates public parameters and forwards them to all users through a cloud server; 2. Key generation stage: the user executes the Diffie-Hellman key generation algorithm to generate two pairs of keys, and forwards the public key pair to other users through the cloud server; 3. Key sharing stage: the user uses the threshold Shamir secret sharing algorithm to share his own private key, uses the AES symmetric encryption algorithm to encrypt the private key share, and forwards the ciphertext to other users through the cloud server; 4. Encrypted data stage: the user encrypts data using a double mask encryption technology, and sends the ciphertext and random number to the cloud server and the next user respectively; 5. Aggregation decryption stage: the cloud server decrypts the ciphertext to obtain the sum of the data of all online users. This method can not only reduce the resource overhead of the user end, but also support user disconnection.

Description

Technical Field

[0001] The present invention relates to information security technology, and in particular to a data aggregation method for protecting privacy. Background Art

[0002] With the popularity of mobile devices, data aggregation has become increasingly important. Using data aggregation technology, cloud servers can collect and analyze a large amount of user data to make correct decisions. However, simple data aggregation may infringe on user privacy, so privacy-preserving data aggregation is a current research hotspot. Although many privacy-preserving data aggregation methods have been proposed, most of them use public key cryptographic algorithms, which results in high overhead and is not suitable for practical applications. In addition, mobile devices may cause users to disconnect due to failures and other reasons. In 2017, Bonawitz et al. (Practical Secure Aggregation for Privacy-Preserving Machine Learning, ACM CCS 2017) designed a data aggregation method to protect user privacy using a double-mask encryption method. Although the scheme supports user disconnection, the method uses a centralized model that requires users to interact frequently with cloud servers, resulting in high resource overhead on the user side. Therefore, how to ensure the efficiency of data aggregation methods when users are offline is becoming increasingly important. Summary of the invention

[0003] In order to overcome the deficiencies of the prior art, the present invention provides a privacy-preserving data aggregation method, so as to reduce the resource overhead of the user end, support user disconnection, and ensure the high efficiency of data aggregation even when the user is offline.

[0004] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme:

[0005] A privacy-preserving data aggregation method of the present invention is characterized in that it is applied in a network environment consisting of a cloud server and N users, and comprises the following steps:

[0006] Step 1: Parameter generation phase:

[0007] Step 1.1: Given the security parameter λ, the number of users N and the threshold value t, select a prime number q with a length of 2λ and determine the q-factorial cyclic group Let generator Define a hash function F and a prime number p of length λ;

[0008] Step 1.2: The cloud server will publish parameters Send to the i-th user u i∈U, where U represents the set of all users;

[0009] Step 2: Key generation phase:

[0010] Step 2.1, the i-th user u i The Diffie-Hellman key generation algorithm is executed according to the public parameters params to generate two pairs of keys (pk i ,sk i ) and (pk′ i ,sk′ i ), where pk i ,pk′ i represents the i-th user u i ∈U’s two public keys, sk i ,sk′ i represents the i-th user u i ∈U, then the i-th user u i ∈U sends its own public key pair (pk i ,pk i ') sent to the cloud server;

[0011] Step 2.2: The cloud server receives public key pairs sent by at least t users. After that, the user set consisting of at least t users is recorded as U1, and

[0012] Let S i =(u i ,pk i ,pk′ i ) represents the i-th user u i List of public keys;

[0013] The cloud server lists at least t users' public keys Forward to all users in user set U1;

[0014] Step 3: Key sharing phase:

[0015] Step 3.1, the i-th user u i ∈U1 receives the public key list After that, determine whether |U1|≥t is satisfied. If so, execute step 3.2; otherwise, the method terminates; where |U1| represents the number of users in the user set U1;

[0016] Step 3.2, the i-th user u i ∈U1 uses the threshold Shamir secret sharing algorithm to share its own private key sk i Share in user set U1 and generate private key shares Among them, sk i,j Indicates that the private key sk i Distribute to the jth user u j The secret value of

[0017] Step 3.3, the i-th user u i ∈U1 uses the AES symmetric encryption algorithm to encrypt the private key share Encrypt and send the encrypted ciphertext Forwarded to all other users in the user set U1 by the cloud server, according to the i-th user u i Another private key sk′∈U1 i And except for the i-th user u i ∈U1, the other k-th user u k ∈U1’s public key pk′ k , use the Diffie-Hellman key exchange algorithm to generate a shared key i,k And used as the encryption key in the AES symmetric encryption algorithm; c i,j represents the i-th user u i ∈U1 and the jth user u j ∈U1 uses the AES symmetric encryption algorithm to encrypt the private key share Encrypted ciphertext, u j ∈U1_u i Indicates that the user set U1 except the i-th user u i Other j-th users outside ;

[0018] Step 3.4: The cloud server collects the ciphertext sets sent by at least t users. The user set consisting of at least t users is denoted as U2, and Then the ciphertext set Forward to all users in user set U2;

[0019] Step 4: Data encryption phase:

[0020] Step 4.1, the i-th user u i ∈U2 receives the ciphertext set sent by the cloud server After that, determine whether |U2|≥t is satisfied. If so, execute step 4.2; otherwise, the method terminates; where |U2| represents the number of users in the user set U2;

[0021] Step 4.2, any i-th user u i ∈U2 and the jth user u j ∈U2 uses its own key (pk i ,sk i ) and (pkj ,sk j ), using the Diffie-Hellman key exchange algorithm to calculate the shared key k i,j , and the shared key k i,j As input to the hash function F;

[0022] Step 4.3: Processing of user messages:

[0023] Step 4.3.1: Assume that the users in the user set U2 have been sorted according to certain rules and the sorting results are known to both the cloud server and the users. Let the index sorting of all users in the user set U2 be and

[0024] Step 4.3.2: The cloud server first sends the i1th user Send an initial random number

[0025] Step 4.3.3, i1th user Pick a random number And send a confirmation signal Signal = 0 to all other users in the user set U2 in turn; if the i2th user When receiving the signal, the confirmation signal is set to Signal = 1, indicating that the i2th user Online; otherwise, continue to resend to the next user until the i1th user Until receiving the confirmation signal Signal = 1;

[0026] Step 4.3.4: Assume that the i2th user The confirmation signal Signal = 1 is returned, then the i1th user Will send ciphertext to the cloud server, wherein Indicates the i1th user Owned message, and send the sum of random numbers To the i2th user in, Indicates the i1th user and the i j Users The shared key between them; mod means remainder, \ means except, ∧ means and; represents the set of integer domains {0,1,...,p-1};

[0027] Step 4.3.5, each user in the user set U2 performs message processing according to the process of step 4.3.3-step 4.3.4 until the last online user in the user set U2 sends the sum of his / her ciphertext and random number to the cloud server;

[0028] Step 4.4: The cloud server collects the sum R of the ciphertexts sent by at least t users and the random number sent by the last online user, and records the corresponding users as user set U3, and And the sum of random numbers The cloud server notifies all users in the user set U3 of the users included in the user set U3;

[0029] Step 5: Aggregation and decryption phase:

[0030] Step 5.1, the i-th user u i After receiving the user set U3, ∈U3 determines whether |U3|≥t is satisfied. If so, step 5.2 is executed; otherwise, the method terminates;

[0031] Step 5.2: For the offline user u j ∈U2\U3, the i-th online user u i ∈U3 uses AES symmetric encryption algorithm to decrypt the offline user u j ∈U2\U3 ciphertext of private key share And the decrypted private key share Sending to the cloud server;

[0032] Step 5.3: The cloud server collects the private key shares sent by at least t users and reconstructs the private key of the offline user u using the threshold Shamir secret sharing algorithm. j ∈U2\U3's private key The cloud server then uses the reconstructed private key With the i-th online user u i ∈U3’s public key pk i , using the Diffie-Hellman key exchange algorithm to generate a shared key Used to eliminate disconnected users u j ∈U2\U3 generated mask value;

[0033] The cloud server uses formula (1) to obtain the final aggregate value

[0034]

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] 1. The present invention designs an improved double-layer mask encryption technology, that is, a ring structure is used to process user data. Compared with the existing method using double-layer mask encryption technology, the present invention not only protects user data, but also reduces the interaction between the cloud server and the user, thereby reducing the resource overhead of the user end.

[0037] 2. The present invention adopts the Diffie-Hellman key exchange algorithm and the threshold Shamir secret sharing algorithm as the underlying structure. The Diffie-Hellman key exchange algorithm is used to generate a shared key and used as the first mask in the double-layer mask encryption technology, and the threshold Shamir secret sharing algorithm is used to share the private key. The combination of the two enables the present invention to tolerate user disconnection.

[0038] 3. The present invention conducts a comprehensive security analysis of user data. Even if the cloud server colludes with any group of less than t users, it will not obtain any private data about other users unless something is inferred from the aggregated results. In addition, the utility of the present invention has been demonstrated through a large number of experiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a system model diagram of the present invention;

[0040] Figure 2 is a flow chart of the method of the present invention;

[0041] Figure 3a It is a schematic diagram of the total calculation overhead of the present invention when the disconnection rate is 0%;

[0042] Figure 3b It is a schematic diagram of the total calculation overhead of the present invention when the disconnection rate is 10%;

[0043] Figure 3c It is a schematic diagram of the total calculation overhead of the present invention when the disconnection rate is 20%;

[0044] Figure 3d It is a schematic diagram of the total calculation overhead of the present invention when the disconnection rate is 30%;

[0045] Figure 4a It is a schematic diagram of the total communication overhead of the present invention when the drop rate is 0%;

[0046] Figure 4b It is a schematic diagram of the total communication overhead of the present invention when the drop rate is 10%;

[0047] Figure 4c It is a schematic diagram of the total communication overhead of the present invention when the drop rate is 20%;

[0048] Figure 4dIt is a schematic diagram of the total communication overhead of the present invention when the disconnection rate is 30%. DETAILED DESCRIPTION

[0049] In this embodiment, see Figure 1 , a privacy-preserving data aggregation method is applied in a network environment consisting of a cloud server and N users. In this embodiment, the process mainly includes: parameter generation stage, key generation stage, key sharing stage, data encryption stage, aggregation decryption stage, see Figure 2 , and includes the following steps:

[0050] Step 1: Parameter generation phase:

[0051] Step 1.1: Given the security parameter λ, the number of users N and the threshold value t, select a prime number q with a length of 2λ and determine the q-factorial cyclic group Let generator Define a hash function F: {0,1} * →{0,1} 2λ and a prime number p of length λ;

[0052] Step 1.2: The cloud server will expose the parameters Send to the i-th user u i ∈U, where U represents the set of all users;

[0053] Step 2: Key generation phase:

[0054] Step 2.1, the i-th user u i Execute the Diffie-Hellman key generation algorithm based on the public parameters params and generate two pairs of keys (pk i ,sk i ) and (pk′ i ,sk′ i ), where pk i ,pk′ i represents the i-th user u i ∈U’s two public keys, sk i ,sk′ i represents the i-th user u i ∈U, then the i-th user u i ∈U sends its own public key pair (pk i ,pk′ i ) is sent to the cloud server. In this embodiment, the first pair of keys (pk i ,sk i ) is used to generate the secret input value of the hash function F, and the second pair of keys (pk′ i ,sk′ i) is used to generate the encryption key of the AES symmetric encryption algorithm;

[0055] Step 2.2: The cloud server receives public key pairs sent by at least t users. After that, the user set consisting of at least t users is recorded as U1, and

[0056] Let S i =(u i ,pk i ,pk′ i ) represents the i-th user u i List of public keys;

[0057] The cloud server will list at least t users' public keys Forward to all users in user set U1;

[0058] Step 3: Key sharing phase:

[0059] Step 3.1, the i-th user u i ∈U1 receives the public key list After that, determine whether |U1|≥t is satisfied. If so, execute step 3.2; otherwise, the method terminates; where |U1| represents the number of users in the user set U1;

[0060] Step 3.2, the i-th user u i ∈U1 uses the threshold Shamir secret sharing algorithm to share its own private key sk i Share in user set U1 and generate private key shares Among them, sk i,j Indicates that the private key sk i Distribute to the jth user u j The secret value of

[0061] Step 3.3, the i-th user u i ∈U1 uses the AES symmetric encryption algorithm to encrypt the private key share Encrypt and send the encrypted ciphertext Forwarded to all other users in the user set U1 through the cloud server, where according to the i-th user u i Another private key sk′∈U1 i And except for the i-th user u i ∈U1, the other k-th user u k ∈U1’s public key pk′ k , use the Diffie-Hellman key exchange algorithm to generate a shared key i,k And used as the encryption key in the AES symmetric encryption algorithm; c i,jrepresents the i-th user u i ∈U1 and the jth user u j ∈U1 uses the AES symmetric encryption algorithm to encrypt the private key share Encrypted ciphertext, u j ∈U1_u i Indicates that the user set U1 except the i-th user u i Other j-th users outside ;

[0062] Step 3.4: The cloud server collects the ciphertext sets sent by at least t users The user set consisting of at least t users is denoted as U2, and Then the ciphertext set Forward to all users in user set U2;

[0063] Step 4: Data encryption phase:

[0064] Step 4.1, the i-th user u i ∈U2 receives the ciphertext set sent by the cloud server After that, determine whether |U2|≥t is satisfied. If so, execute step 4.2; otherwise, the method terminates; where |U2| represents the number of users in the user set U2;

[0065] Step 4.2, any i-th user u i ∈U2 and the jth user u j ∈U2 uses its own key (pk i ,sk i ) and (pk j ,sk j ), using the Diffie-Hellman key exchange algorithm to calculate the shared key k i,j , and the shared key k i,j As input to the hash function F;

[0066] Step 4.3: User message processing is performed as follows:

[0067] Step 4.3.1: Assume that the users in the user set U2 have been sorted according to certain rules and the sorting results are known to both the cloud server and the users. Let the index sorting of all users in the user set U2 be and

[0068] Step 4.3.2: The cloud server first sends the i1th user Send an initial random number

[0069] Step 4.3.3, i1th user Pick a random number And send a confirmation signal Signal = 0 to all other users in the user set U2 in turn; if the i2th user When a signal is received, the confirmation signal is set to Signal = 1, indicating that the i2th user Online; otherwise, continue to resend to the next user until the i1th user Until receiving the confirmation signal Signal = 1;

[0070] Step 4.3.4: Assume that the i2th user The confirmation signal Signal = 1 is returned, then the i1th user Will send ciphertext To the cloud server, where Indicates the i1th user Owned message, and send the sum of random numbers To the i2th user in, Indicates the i1th user and the i j Users The shared key between them; mod means remainder, \ means except, ∧ means and; represents the set of integer domains {0,1,...,p-1};

[0071] Step 4.3.5: Each user in the user set U2 processes the message according to the process of step 4.3.3-step 4.3.4 until the last online user in the user set U2 sends the sum of his / her ciphertext and random number to the cloud server; in this embodiment, steps 4.3.3-step 4.3.4 are generalized. Generally, assuming that the current i-th user k Users It has received the random number R' sent by the previous user. k Users Pick a random number Send ciphertext To the cloud server, where Indicates the i k Users Owned message, and send the sum of random numbers To the next user. Repeat this process until the last user in set U2 completes the encryption operation, and the user sends both the ciphertext and the sum of the random numbers to the cloud server;

[0072] Step 4.4: The cloud server collects the sum R of the ciphertexts sent by at least t users and the random number sent by the last online user, and records the corresponding users as user set U3, and And the sum of random numbers The cloud server informs all users in the user set U3 of the users included in the user set U3;

[0073] Step 5: Aggregation and decryption phase:

[0074] Step 5.1, the i-th user u i After receiving the user set U3, ∈U3 determines whether |U3|≥t is satisfied. If so, step 5.2 is executed; otherwise, the method terminates;

[0075] Step 5.2: For the offline user u j ∈U2\U3, the i-th online user u i ∈U3 uses AES symmetric encryption algorithm to decrypt the offline user u j ∈U2\U3's private key share ciphertext And the decrypted private key share Sent to the cloud server; In this embodiment, the encryption key in the AES symmetric encryption algorithm is the private key sk′ of the online user i∈U3 i and the public key pk′ of the offline user k∈U2\U3 k The shared key generated by the Diffie-Hellman key exchange algorithm i,k , so the online user i∈U3 can decrypt and obtain the private key share

[0076] Step 5.3: The cloud server collects the private key shares sent by at least t users and uses the threshold Shamir secret sharing algorithm to reconstruct the offline user u j ∈U2\U3's private key The cloud server then uses the reconstructed private key With the i-th online user u i ∈U3’s public key pk i , using the Diffie-Hellman key exchange algorithm to generate a shared key Used to eliminate disconnected users u j ∈U2\U3 generated mask value;

[0077] The cloud server uses formula (1) to obtain the final aggregate value

[0078]

[0079] The correctness, security, and computation and communication overhead of the present invention are further described below:

[0080] a) Correctness:

[0081] From the following formula, we can see that this solution meets the correctness:

[0082]

[0083] b) Security:

[0084] The scheme of the present invention can achieve privacy under the semi-honest model, because in this case the collusion between the cloud server and some users is the most aggressive adversary, but as long as the number of colluding parties is less than the threshold value t, it can ensure that the privacy data of the honest party will not be leaked. First, each user encrypts data through the double-layer mask encryption technology. Assuming that the cloud server colludes with any t-1 users to infer the input of the remaining N-t+1 honest users, since the first layer of mask is calculated by all users through the Diffie-Hellman key exchange algorithm, the privacy data of the honest party will not be leaked as long as there is an honest user in this scheme. Secondly, if a user is offline during the execution of the scheme, the cloud server uses the private key share sent by the surviving user to reconstruct the private key of the offline user, thereby eliminating the first layer of mask of the user. However, even if the cloud server eliminates the first layer of mask of the user, due to the protection of the second layer of mask, the cloud server cannot obtain the privacy data of the offline user. Finally, if a user is offline due to network delay, the cloud server mistakenly believes that the user is offline, which causes the cloud server to know the user's first-layer mask. Similarly, since the cloud server does not know the random number selected by the user, data privacy is also protected.

[0085] Performance Analysis:

[0086] The method of Bonawitz et al. in 2017 is called PSAML. The overhead of the two methods is compared below. The experimental code is written in Java, compiled on the IntelliJ IDEA integrated development environment, and run on a Windows 10 system. The PC configuration is Intel(R) Core(TM) i7-6700 CPU and RAM 16GB.

[0087] User data is generated by a random number generator Random(); an AES symmetric encryption algorithm with a key length of 128 bits is used; and SHA-256 is used as a hash function. The present invention considers user dropout rates of 0%, 10%, 20% and 30% respectively. A dropout rate of 0% indicates that no user drops out of the system. Similarly, a dropout rate of 10%, 20% and 30% respectively indicates the ratio of the number of users dropped out to the total number of users during the operation of the system.

[0088] c) Computational overhead:

[0089] Figure 3a The total computational overhead of the method of the present invention and PSAML when the disconnection rate is 0% is given. Figure 3b The total computational overhead of the method of the present invention and PSAML when the disconnection rate is 10% is given. Figure 3c The total computational overhead of the method of the present invention and PSAML when the disconnection rate is 20% is given. Figure 3d The total computational overhead of the method of the present invention and PSAML when the disconnection rate is 30% is given.

[0090] d) Communication overhead:

[0091] Figure 4a The total communication overhead of the method of the present invention and PSAML when the drop rate is 0% is given. Figure 4b The total communication overhead of the method of the present invention and PSAML when the drop rate is 10% is given. Figure 4c The total communication overhead of the method of the present invention and PSAML when the drop rate is 20% is given. Figure 4d The total communication overhead of the method of the present invention and PSAML when the disconnection rate is 30% is given.

Claims

1. A privacy-preserving data aggregation method, Its feature is that it is applied to the cloud server and In a network environment consisting of 10 users, the following steps are included: Step 1: Parameter generation phase: Step 1.1: Given security parameters , Number of users and threshold , choose a length of 2 Prime number ,Sure Factorial cyclic group , let the generator , define a hash function and the length is Prime number ; Step 1.2: The cloud server will publish parameters Send to the i-th user ,in, Represents the set of all users; Step 2: Key generation phase: Step 2.1, the i-th user According to the public parameters Execute the Diffie-Hellman key generation algorithm and generate two pairs of keys and ,in, represents the i-th user The two public keys of represents the i-th user The two private keys of the ith user Your public key Send to cloud server; Step 2.2: The cloud server receives at least Public key pair sent by user After that, at least The user set composed of users is recorded as ,and ; make represents the i-th user List of public keys; The cloud server will at least List of public keys for each user Forward to user collection All users in; Step 3: Key sharing phase: Step 3.1: The i-th user Received public key list After that, determine whether , if satisfied, execute step 3.2; otherwise, the method terminates; where, Represents a user collection The number of users in Step 3.2: i-th user Use Threshold The secret sharing algorithm uses a private key In user collection Share it in and generate private key shares ,in, Indicates that the private key Distribute to the jth user The secret value of Step 3.3, the i-th user Use AES symmetric encryption algorithm to encrypt the private key Encrypt and send the encrypted ciphertext Forwarded to the user collection by the cloud server All other users in, where, according to the i-th user Another private key And except for the i-th user Other Users The public key , using the Diffie-Hellman key exchange algorithm to generate a shared key And used as the encryption key in the AES symmetric encryption algorithm; represents the i-th user With the jth user Use AES symmetric encryption algorithm to encrypt the private key The encrypted ciphertext, Represents a user collection Except for the i-th user Other Users; Step 3.4: The cloud server collects at least The set of ciphertexts sent by users , will at least The user set composed of users is recorded as ,and , and then the ciphertext set Forward to user collection All users in; Step 4: Data encryption phase: Step 4.1: i-th user Receive the ciphertext set sent by the cloud server After that, determine whether , if satisfied, execute step 4.2; otherwise, the method terminates; where, Represents a user collection The number of users in Step 4.2: Any i-th user and the jth user According to the use of its own key and , using the Diffie-Hellman key exchange algorithm to calculate the shared key , and the shared key As input to the hash function F; Step 4.3: Processing of user messages: Step 4.3.1: Assume user set The users in have been sorted according to certain rules and the sorting results are known to both the cloud server and the users. The order of the subscripts of all users in is ,and ; Step 4.3.2: The cloud server first sends Users Send an initial random number ; Step 4.3.3, Users Pick a random number , and sends a confirmation signal Give the user set in turn All other users in Users When a signal is received, the confirmation signal is set to , indicating the Users Online; otherwise, continue to resend to the next user until the Users Receive confirmation signal until; Step 4.3.4: Assume Users Returned confirmation signal , then Users Will send ciphertext to the cloud server, wherein, Indicates Users Owned message, and send the sum of random numbers To Users ;in, Indicates Users and Users A shared key between Indicates the remainder, Indicates that except means and; Represents the set of integer domains ; Step 4.3.5, User Collection Each user in the message processing follows the process of step 4.3.3-step 4.3.4 until the user set The last online user in sends the sum of his / her ciphertext and random number to the cloud server; Step 4.4: The cloud server collects at least The sum of the ciphertext sent by the user and the random number sent by the last online user , and record the corresponding users as user sets ,and , and the sum of random numbers ; The cloud server collects users The users included in the user set are informed All users in; Step 5: Aggregation and decryption phase: Step 5.1: i-th user Receive user collection After that, determine whether , if satisfied, execute step 5.2; otherwise, the method terminates; Step 5.2: For disconnected users , the i-th online user Use AES symmetric encryption algorithm to decrypt offline users Ciphertext of private key share , and the decrypted private key share Sending to the cloud server; Step 5.3: The cloud server collects at least The private key share sent by each user and using the threshold Secret Sharing Algorithm to Reconstruct Disconnected Users Private key ; Then the cloud server reconstructs the private key With the i-th online user The public key , using the Diffie-Hellman key exchange algorithm to generate a shared key , used to eliminate disconnected users the generated mask value; The cloud server uses formula (1) to obtain the final aggregate value : (1)。

Images