A multi-server security aggregation system and method based on homomorphic chameleon hashing

Abstract

A multi-server secure aggregation system and method based on homomorphic chameleon hashing utilizes a bulletin board system maintained by a trusted third party to output, download, and collect data. Public-key encryption and secret sharing ensure data security. Homomorphic chameleon hashing is used to verify aggregation and ensure integrity. This creates a non-interactive secure aggregation model that eliminates the need for secure channels between clients and multiple servers. This system boasts a simple, easy-to-implement architecture, is secure and verifiable, and further improves communication efficiency.

Description

Technical Field

[0001] The present invention relates to the field of data privacy protection, and in particular to a secure aggregation method in federated learning. Background Art

[0002] Federated learning is a distributed machine learning framework that allows clients to upload model parameters to jointly train the model, rather than directly uploading private training data. This protects the privacy of the client's original data to a certain extent, but research has shown that attackers can still infer the original training data through uploaded model gradients.

[0003] To protect the security of client-side private parameters, current research has proposed secure aggregation protocols. This allows the server to obtain global model parameters in federated learning without leaking individual client-side private parameters. Furthermore, to prevent malicious tampering of aggregation results, verifiable secure aggregation protocols are gaining increasing attention. However, this requires transmitting additional verification information in addition to private parameters. Furthermore, to reduce the number of times clients submit information, non-interactive aggregation is employed, but this often requires establishing a secure channel between each client and each server. In reality, a multi-server model is essential, but client devices are often mobile phones or IoT devices, making establishing secure channels between clients and multiple servers expensive and difficult to achieve. Summary of the Invention

[0004] In response to the above situation, the present disclosure provides a multi-server security aggregation system and method based on homomorphic chameleon hashing, which can achieve the goal of not requiring the establishment of a secure channel between the client and multiple servers, while reducing the information transmitted for verification and improving communication efficiency.

[0005] The multi-server security aggregation system provided by the present disclosure includes: a client, a server, a trusted third party and a bulletin board maintained by the trusted third party, wherein:

[0006] The bulletin board serves as a data exchange intermediary for all participants. All data output by participants is uploaded to the bulletin board, and the required data is downloaded from the bulletin board.

[0007] A trusted third party is responsible for generating the homomorphic chameleon hash public parameters and distributing them to all participants;

[0008] The client generates a homomorphic chameleon random number and calculates the homomorphic chameleon hash value of its own private input. Based on additive homomorphic secret sharing, it generates secret sharing shares of its own private input and homomorphic chameleon random number for different servers, encrypts the two with the server's public key to generate ciphertext, and outputs the ciphertext and the homomorphic chameleon hash value.

[0009] The server generates its own public-private key pair and publishes the public key; decrypts the collected ciphertext, aggregates the secret shares of each client, and outputs the aggregated result;

[0010] The system is publicly verifiable. Any party can use the aggregation results published on the bulletin board and the homomorphic chameleon hash public parameters and homomorphic chameleon hash values ​​to secretly reconstruct the aggregation results and verify the aggregation results based on the homomorphism of the chameleon hash function.

[0011] Furthermore, the system includes a cryptographic component running on the client, the server, and the trusted third party, and the cryptographic component includes:

[0012] Public key encryption module, used to generate the server's public and private key pairs, encrypt messages sent by the client, and decrypt them on the server side;

[0013] The additive homomorphic secret sharing module is used to generate secret shares of its own private input and homomorphic chameleon random numbers based on additive homomorphic secret sharing, and distribute them to the server; perform secret aggregation on the server side; and secretly reconstruct the aggregation results;

[0014] The homomorphic chameleon hash module is used to generate homomorphic chameleon hash public parameters and homomorphic chameleon hash values, and to verify the aggregation results based on the homomorphism of the chameleon hash function.

[0015] Furthermore, the system is non-interactive.

[0016] The present disclosure also provides a multi-server security aggregation method based on homomorphic chameleon hashing that can be applied to any of the above systems, including the following steps:

[0017] Public parameter generation: A trusted third party generates the public parameters of the homomorphic chameleon hash and distributes them to all participants;

[0018] Key generation: The server generates its own public-private key pair and publishes the public key;

[0019] Input sharing generation: The client generates a homomorphic chameleon random number and calculates the homomorphic chameleon hash value of its private input. Based on additive homomorphic secret sharing, it generates secret sharing shares of its private input and homomorphic chameleon random number for different servers. The two are encrypted using the server's public key to generate ciphertext, and the ciphertext and homomorphic chameleon hash value are output.

[0020] Aggregation: The server decrypts the received ciphertext, aggregates the secret shares received from each client, and outputs the aggregated result;

[0021] Verification: Using the aggregation results published on the bulletin board and the homomorphic chameleon hash public parameters and homomorphic chameleon hash value, the aggregation results are secretly reconstructed, and the aggregation results are verified based on the homomorphism of the chameleon hash function;

[0022] The data output by all participants are output to the bulletin board, and the required data are downloaded from the bulletin board.

[0023] Furthermore, the method also includes the step of packaging the client's private input parameters into a single large integer.

[0024] Furthermore, the RSA public key encryption algorithm is used for public-private key pair generation, public key encryption, and ciphertext decryption.

[0025] Furthermore, the additive homomorphic secret sharing adopts the Shamir secret sharing method for generating secret sharing shares, secret aggregation, and secret reconstruction of the aggregation results.

[0026] Furthermore, the homomorphic chameleon hash algorithm based on the discrete logarithm hypothesis is used to generate aggregate verification information and verify the aggregated results, specifically including:

[0027] Public parameter generation: CH.Gen(1 κ )→(CHpp=(p,G,g,h),TD=α), where 1 k is a security parameter; CHpp is a public parameter; TD is a trapdoor; g is a cyclic group of order p The generator of ; h is the group element, is the set of integers modulo p;

[0028] Hash value calculation: CH.Hash((p,G,g,h),x,r)→(ch=g x h r ), where ch is the hash value, x is the message to be hashed, and r is a random number.

[0029] The hash algorithm also satisfies: for any given x and x′, for any r, r′=(x′+αr) / α can be found to satisfy: CH.Hash(CHpp,x,r)=CH.Hash(CHpp,x′,r′); and: CH.Hash(CHpp,x1+x2,r1+r2)=CH.Hash(CHpp,x1,r1)·CH.Hash(CHpp,x2,r2)

[0030] For the aggregation result, verify CH.Hash(CHpp, y, r) = Π i∈[1，n] ch iIs it true? y, r are the aggregation results, and n is the number of clients.

[0031] The multi-server secure aggregation system and method provided by the present disclosure transmits and obtains data through a bulletin board system maintained by a trusted third party, and then uses additive homomorphic secret sharing and public key encryption to ensure the security and correctness of information transmission and aggregation between clients and multiple servers. As a result, the client and server no longer rely on establishing a secure channel, making the system architecture simpler and easier to implement. Secondly, homomorphic chameleon hashing is used for aggregation verification to ensure the integrity of the aggregation. Compared with currently commonly used verification schemes, this method reduces the number of group elements that need to be submitted and transmitted, reducing the communication burden. This achieves a simple, secure, and efficient comprehensive optimization solution for the multi-server aggregation system. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, wherein like reference numerals generally represent like components throughout the exemplary embodiments of the present disclosure.

[0033] Figure 1 Shows a schematic structural diagram of an embodiment of a security aggregation system according to the present disclosure;

[0034] Figure 2 A flow chart of an embodiment of a security aggregation method according to the present disclosure is shown. DETAILED DESCRIPTION

[0035] The preferred embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although preferred embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0036] The present disclosure provides a security aggregation system mainly for multi-server federated learning scenarios.

[0037] Adversary Model: Assuming all clients execute the protocol honestly, the adversary can control at most t-1 servers (t is the secret sharing threshold). Its goals are twofold: 1) infer the private model parameters (e.g., gradients) of the honest clients; 2) force the honest clients to accept a forged aggregation result.

[0038] Accordingly, secure aggregation must ensure the security of honest clients' private model parameters, preventing them from being inferred by adversaries, and ensure aggregation integrity, preventing honest clients from accepting forged aggregation results. Furthermore, in the real world, clients participating in training may experience disconnections due to poor network conditions or low battery, and we also want to minimize the impact of such situations.

[0039] Specifically, taking the medical auxiliary diagnosis scenario as an example, as shown in the attached Figure 1 As shown, the National Health Commission, as a trusted third party, organizes m hospitals / medical institutions S j (j=1,..m) and medical equipment C for n patients i (i=1,...n) for joint training, the patient's medical device (client), hospital / medical institution (server) and the National Health Commission (trusted third party) form a multi-server federated learning system. To prevent hospitals / medical institutions from colluding to tamper with the aggregated results of federated learning and to improve the efficiency of system interaction, the features of the secure aggregation system constructed in this embodiment are as follows:

[0040] (1) The system bulletin board is used as a bridge for data transmission, that is, the data output by all participants are uploaded to the bulletin board, and the required data are downloaded from the bulletin board.

[0041] The bulletin board is maintained by a trusted third party, and all users (clients / servers) can upload or download all data on the bulletin board. In this embodiment, the client and server output and obtain data through the bulletin board, and then ensure data security through means such as secret sharing and public key encryption, thereby eliminating the need to establish a secure channel between the client and server.

[0042] (2) A trusted third party generates a homomorphic chameleon hash public parameter pp and distributes it to all participants.

[0043] (3) Client C i :Generate a homomorphic chameleon random number, calculate the homomorphic chameleon hash value of your own private input; and based on additive homomorphic secret sharing, generate secret sharing shares of your own private input and homomorphic chameleon random number for different servers respectively, and encrypt the two with the public key to generate ciphertext {ct i,j} j∈[1,m] , output the ciphertext and the homomorphic chameleon hash value.

[0044] (4) Server S j : Generate your own public-private key pair and publish the public key; decrypt the collected ciphertexts of each client with your own private key; also based on additive homomorphic secret sharing, secretly aggregate the secret sharing shares of each client and output the aggregated result y j .

[0045] (5) The system is publicly verifiable. Any of the participants can use the aggregation results and homomorphic chameleon hash public parameters and homomorphic chameleon hash values ​​issued on the bulletin board to secretly reconstruct the aggregation results, verify the aggregation results based on the homomorphism of the chameleon hash function, and output the verification results.

[0046] In this embodiment, the above-mentioned security aggregation function of the system is completed by the cryptographic components running on the client, server and trusted third party. The computing modules included include:

[0047] Public key cryptography modules (PKE.KGen, PKE.Enc, PKE.Dec), meeting IND-CPA security (i.e., indistinguishability from chosen-plaintext attacks)

[0048] In order to implement client C i With server S j The public key encryption module is used for secure communication between client C i Will be sent to S j Message m i,j , use S j The public key pk j Encryption is performed to obtain only the server S j The ciphertext ct that can be decrypted i,j ; After receiving the ciphertext, the server uses its private key sk j Decryption completed.

[0049] Specifically including submodules:

[0050] PKE.KGen(1 k )→(sk,pk): with security parameter 1 k As input, output a pair of public and private key (sk, pk);

[0051] PKE.Enc(pk,m)→ct: takes the public key pk and the message m as input and produces the ciphertext ct;

[0052] PKE.Dec(sk,ct)→m: Decrypts the message m using the private key sk and the ciphertext message ct.

[0053] ●Additive homomorphic secret sharing module (SS.Share, SS.Eval, SS.Recon)

[0054] To prevent an adversary from inferring the client's private model parameters or maliciously tampering with the aggregation results, this module is used to decompose the client's private parameters and verification information, generate secret sharing shares for different servers, perform secret aggregation on the server side, and secretly reconstruct the aggregation results. It specifically includes submodules:

[0055] Secret sharing shares are generated with secret value x i and threshold t and server set {S j} j∈[1,mk As input, for each server S j Generate secret shares , where j∈[1,m];

[0056] Aggregation of secret sharing, given a set of secrets shared with the same server S j Secret Share Output an aggregate share y j ;

[0057] SS.Recon(t,{y j} j∈T )→y: secret reconstruction, given a threshold t, and a series of aggregate shared values ​​y j , where j satisfies When |T|≥t, the output Otherwise y=⊥.

[0058] Homomorphic Chameleon Hash Module

[0059] Used to generate aggregate verification information and verify the aggregated results. As a preference, in this embodiment, based on the existing Chameleon Hash algorithm, a simplified Chameleon Hash function (Chameleon-Hash) (CH.Gen, CH.Hash, CH.HashCheck, CH.Adapt) is defined, specifically including:

[0060] CH.Gen(1 k )→(CHpp,TD): Take the security parameter as input and output the public parameter CHpp and the trapdoor TD;

[0061] CH.Hash(CHpp,x,r)→ch: takes the public parameter CHpp, the message to be hashed x and the random number r as input, and outputs ch;

[0062] CH.HashCheck(CHpp,m,r,ch)→0 / 1: If the verification passes, output 1; if the verification fails, output 0;

[0063] CH.Adapt(TD,x,r,ch,x′)→r′: Using trapdoor TD, hash value hash, original message x, original random number r, and new message x′, a new random number r′ can be output such that CH.HashCheck(CHpp,x′,r′,hash)=1.

[0064] Compared with general hash functions, the chameleon hash function required in this disclosure needs to satisfy the chameleon property in addition to collision resistance, that is, for any given x and x′, for any r, we can find:

[0065] r'←CH.Adapt(TD,x,r,hash,x′)

[0066] CH.Hash(CHpp,x,r)=CH.Hash(CHpp,x′,r′).

[0067] That is, the chameleon hash function must meet the following requirements: correctness, computational indistinguishability of r (r is generated randomly or through CH.Adapt(·)), and collision resistance. In addition, it is also required to be homomorphic, that is, CH.Hash(CHpp,x1+x2,r1+r2)=CH.Hash(CHpp,x1,r1)·CH.Hash(CHpp,x2,r2)

[0068] (6) As a preference, this embodiment adopts a non-interactive mode, that is, the client only needs to submit information once, thereby avoiding the impact of clients participating in training being disconnected during the training.

[0069] Attachment Figure 2 A flowchart of an exemplary embodiment of an aggregation method applicable to the multi-server security aggregation system is provided. The flowchart includes the following steps:

[0070] S101, public parameter generation:

[0071] Given security parameter 1 κ , a trusted third party (the National Health Commission in the hospital scenario) runs the Chameleon Hash public parameter generation algorithm CH.Gen(1 κ )→CHpp, generate homomorphic chameleon hash public parameter CHpp, and distribute it to all participants.

[0072] S102, key generation:

[0073] Given security parameter 1 κ, server S j Run the generation algorithm PKE.KGen(1 κ ), generate your own public and private key pair (pk j ,sk j ), and the public key pk j Make it public.

[0074] S103, input sharing generation:

[0075] Given the secret sharing algorithm threshold t, public parameter CHpp and server public key list {pk j} j∈[1,m] The client randomly selects a homomorphic chameleon random number, generates a private input secret sharing share and a homomorphic chameleon random number secret sharing share for different servers, calculates the homomorphic chameleon hash value of the private input, and encrypts the two with the server's public key based on the additive homomorphic secret sharing algorithm to generate a ciphertext, and outputs the ciphertext and the homomorphic chameleon hash value.

[0076] The specific steps include:

[0077] (1) Generate private input x using the additive homomorphic secret sharing algorithm i For each server j} j∈[1,m] Secret sharing share

[0078] (2) Randomly extract the chameleon random number r i , calculate the private input x i The homomorphic chameleon hash value ch i ←CH.Hash(CHpp,x i ,r i );

[0079] (3) Generate the chameleon random number r using the additive homomorphic secret sharing algorithm i For each server j} j∈[1,m] Secret sharing share

[0080] (4) For j∈[1,m], use server S j The public key pk j , generate the corresponding ciphertext

[0081] (5) Output ciphertext {ct j,j} j∈[1,m] and Chameleon hash value ch i .

[0082] S104, polymerization

[0083] The server decrypts the ciphertext sent to itself with its own private key, and also uses the additive homomorphic secret sharing algorithm to aggregate and output the collected secret sharing shares of each client.

[0084] The specific steps include:

[0085] (1) Server S j According to your own private key sk j , for the collected client ciphertext {ct i,j} i∈[1,n] Decrypt and get where i∈[1,n];

[0086] (2) Using the additive homomorphic secret sharing algorithm, the secret sharing aggregate value is calculated and

[0087] (3) Output (y j ,r j ).

[0088] S105, verification:

[0089] The aggregation result published on the bulletin board and the homomorphic chameleon hash public parameters and the homomorphic chameleon hash value are used to secretly reconstruct the aggregation result, and the aggregation result is verified based on the homomorphism of the chameleon hash function.

[0090] That is, according to the given public parameter CHpp, threshold t, the collected client chameleon hash value {ch i} i∈[1,n] , and the shared aggregate value output by the server and in And |T| ≥ t, the homomorphism of the Chameleon hash function is used for verification, which includes the following steps:

[0091] (1) Using the secret reconstruction algorithm of additive homomorphic secret sharing, we can recover y←SS.Recon(t,{y j} j∈T ) and r←SS.Recon(t,{r j} j∈T );

[0092] (2) Using the homomorphism of the Chameleon hash algorithm to verify the equation CH.Hash(CHpp,y,r)=П i∈[1,n] ch i whether it is established;

[0093] (3) If the above equation holds, output y; otherwise, output ⊥.

[0094] Preferably, the public key encryption in this embodiment uses the RSA public key encryption algorithm. Alternatively, DH / ECDSA / ECDH / SM2 algorithms, or other public key encryption algorithms that comply with IND-CPA security may also be considered.

[0095] Preferably, the additive homomorphic secret sharing in this embodiment adopts Shamir's t-out-of-n secret sharing scheme.

[0096] In addition, considering that the private model parameters of the client in federated learning are generally high-dimensional (10K) small integer (3-byte) vectors, this embodiment preferably packages such vectors into a single large integer, which is suitable for additive homomorphic secret sharing and homomorphic chameleon hashing.

[0097] Preferably, this embodiment adopts a homomorphic chameleon hash algorithm based on the discrete logarithm hypothesis, including:

[0098] ● Common parameter generation CH.Gen(1 κ )→(CHpp=(p,G,g,h),TD=α), where g is is the generator of a cyclic group of order p, h is a group element h=g α ,

[0099] ●Hash value generation CH.Hash((p,G,g,h),x,r)→(ch=g x h r ),in

[0100] ●Hash verification CH.HashCheck((p,G,g,h),x,r,ch)→0 / 1, if ch=g x h r Then output 1, otherwise output 0;

[0101] ●CH.Adapt((p,G,g,h),α,x,r,ch,x′)→r′, where r′=(xx′+αr) / α.

[0102] It can be seen that the chameleon hash satisfies the correctness, homomorphism, collision resistance and indistinguishability properties based on the assumption of discrete logarithms.

[0103] Analysis of the polymerization effect of exemplary embodiments:

[0104] Correctness of the aggregation result. When all participants execute the protocol honestly, according to the correctness of the additive homomorphic secret sharing algorithm, it can be concluded that In addition, based on the homomorphism of the Chameleon hash algorithm, it can be guaranteed that CH.Hash(CHpp,y,r)=Π i∈[1,n] ch i The equation is established and the output is successful

[0105] Honest client input parameter x i The security is based on the assumption of discrete logarithms and the security of secret sharing algorithms.

[0106] Verifiability of aggregation results. Verifiability is achieved based on the homomorphism and collision resistance of the Chameleon hash algorithm.

[0107] Smaller client communication load. The present disclosure utilizes the homomorphic chameleon hash algorithm to implement aggregation verification. The client only needs to upload 3 group elements to the server, which is 1 less group element than the article NIVA that adopts this multi-server mode, thus reducing the communication burden. In addition, the aggregation method described in the present disclosure is applicable to a multi-server aggregation system that does not have a secure channel but obtains data through a bulletin board. However, in fact, it is also applicable to an aggregation system in which a secure channel exists between the client and multiple servers. For such a system, the verification method described in the present disclosure also reduces the group elements uploaded by the client. In addition, the present disclosure adopts a non-interactive secure aggregation method. During the entire process, the client only needs to submit data once, which can greatly save communication bandwidth.

[0108] The above technical solutions are only exemplary embodiments of the present invention. For those skilled in the art, it is easy to make various types of improvements or modifications based on the application methods and principles disclosed in the present invention, and are not limited to the methods described in the above specific embodiments of the present invention. Therefore, the methods described above are only preferred and do not have a restrictive meaning.

Claims

1. A multi-server security aggregation system based on homomorphic chameleon hashing, comprising: Client, server, trusted third party and the bulletin board they maintain, including: The bulletin board serves as a data exchange intermediary for all participants. All data output by participants is uploaded to the bulletin board, and the required data is downloaded from the bulletin board. A trusted third party is responsible for generating the homomorphic chameleon hash public parameters and distributing them to all participants; The client generates a homomorphic chameleon random number and calculates the homomorphic chameleon hash value of its own private input. Based on additive homomorphic secret sharing, it generates secret sharing shares of its own private input and homomorphic chameleon random number for different servers, encrypts the two with the public key to generate ciphertext, and outputs the ciphertext and the homomorphic chameleon hash value. The server generates its own public-private key pair and publishes the public key; decrypts the collected ciphertext, aggregates the secret shares of each client, and outputs the aggregated result; The system is publicly verifiable. Any party can use the aggregation results published on the bulletin board and the homomorphic chameleon hash public parameters and homomorphic chameleon hash value to secretly reconstruct the aggregation results and verify the aggregation results based on the homomorphism of the chameleon hash function. The system includes a cryptographic component running on the client, the server, and the trusted third party, and the cryptographic component includes: Public key encryption module, used to generate the server's public and private key pairs, encrypt messages sent by the client, and decrypt them on the server side; The additive homomorphic secret sharing module is used to generate secret shares of its own private input and homomorphic chameleon random numbers based on additive homomorphic secret sharing, distribute them to the server, perform secret aggregation on the server side, and secretly reconstruct the aggregation results; Homomorphic Chameleon Hash module, used to generate homomorphic Chameleon Hash public parameters and homomorphic Chameleon Hash values, and verify the aggregation results based on the homomorphism of the Chameleon Hash function; The system is non-interactive.

2. A multi-server security aggregation method based on homomorphic chameleon hashing that can be used in the system of claim 1, comprising the following steps: Public parameter generation: A trusted third party generates the public parameters of the homomorphic chameleon hash and distributes them to all participants; Key generation: The server generates its own public-private key pair and publishes the public key; Input sharing generation: The client generates a homomorphic chameleon random number and calculates the homomorphic chameleon hash value of its own private input; Based on additive homomorphic secret sharing, different servers generate their own secret sharing shares of private input and homomorphic chameleon random numbers, encrypt the two with the public key to generate ciphertext, and output the ciphertext and homomorphic chameleon hash value; Aggregation: The server decrypts the received ciphertext, aggregates the secret shares received from each client, and outputs the aggregated result; Verification: Any party uses the aggregation results published on the bulletin board and the homomorphic chameleon hash public parameters and homomorphic chameleon hash value to secretly reconstruct the aggregation results and verify the aggregation results based on the homomorphism of the chameleon hash function; The data output by all participants are output to the bulletin board and the required data are downloaded from the bulletin board.

3. The multi-server security aggregation method according to claim 2, characterized in that: It also includes a step to package the client's private input parameters into a single large integer.

4. The multi-server security aggregation method according to claim 2, characterized in that: The RSA public key encryption algorithm is used for public-private key pair generation, public key encryption, and ciphertext decryption.

5. The multi-server security aggregation method according to claim 3, characterized in that: The additive homomorphic secret sharing adopts the Shamir secret sharing method for generating secret sharing shares, secret aggregation, and secret reconstruction of the aggregation result.

6. The multi-server security aggregation method according to claim 4, characterized in that: The homomorphic chameleon hashing algorithm filled with the Pedersen vector commitment scheme based on the discrete logarithm hypothesis is used to generate aggregate verification information and verify the aggregation results, specifically including: Public parameter generation: Where 1κ is the security parameter; CHpp is the public parameter; TD is the trapdoor; g is a cyclic group of order p Generator of; h is a group element, h=g α , is the set of integers modulo p; Hash value calculation: Among them, ch is the hash value, x is the message to be hashed; r is a random number, The hash algorithm also satisfies: for any given x and x′, for any r, r′=(x−x′+αr) / α can be found such that: CH.Hash(CHpp,x,r)=CH.Hash(CHpp,x′,r′); and: CH.Hash(CHpp,x1+x2,r1+r2) =CH.Hash(CHpp,x1,r1)·CH.Hash(CHpp,x2,r2) For the aggregation result, verify CH.Hash(CHpp,y,r)=Π i∈[1,n] ch i Is it true? y, r are the aggregation results, and n is the number of clients.

Images