An efficient and scalable security aggregation method based on secret sharing

Abstract

The present invention relates to the field of data security technology, and more specifically to an efficient and highly scalable security aggregation method based on secret sharing. The method comprises: setting preferred constraints, and obtaining global constraints for constructing an undirected graph in FastSecAgg+ based on the preferred constraints; constructing the FastSecAgg+ protocol, including a key distribution phase, a secret share generation phase, and a recovery aggregation update phase; and functionally extending the FastSecAgg+ protocol, including: in the key distribution phase, before each user generates a key pair, adding a fixed number of empty users, thereby updating the undirected graph; in the updated undirected graph, nodes corresponding to empty users are empty nodes, and nodes corresponding to exiting users are exit nodes; and in the recovery aggregation update phase, users who join midway are assigned to empty nodes or exit nodes of the user group. The FastSecAgg+ protocol and its extended protocol have low communication and computational costs.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a highly efficient and scalable security aggregation method based on secret sharing. Background Art

[0002] Federated learning allows sensitive data to be stored on the client side to train a shared model, but sharing models still raises privacy concerns. Secure aggregation is a key algorithm for securing federated learning. It aggregates client model updates without leaking information about individual client updates. Secure aggregation protocols are designed to provide strong privacy guarantees in federated learning and have therefore been a hot research topic.

[0003] Existing security aggregation protocols for privacy protection in federated learning have high communication and computational costs. In addition, most security aggregation protocols based on secret sharing are robust to users dropping out midway but not to users joining midway, which increases the user's waiting time and increases the communication and computational costs of the secret sharing-based security aggregation protocols. Summary of the Invention

[0004] In order to solve the technical problem of how to reduce the communication and computing costs of a secret sharing-based security aggregation protocol, the present invention aims to provide an efficient and highly scalable security aggregation method based on secret sharing. The technical solution adopted is as follows:

[0005] Setting a preferred constraint condition, wherein the preferred constraint condition is: dividing the user nodes in the undirected graph into a preset number of user groups, and connecting the nodes according to the user nodes in the user groups; obtaining a global constraint condition for constructing the undirected graph in the FastSecAgg+ protocol based on the preferred constraint condition;

[0006] The FastSecAgg+ protocol includes: a key distribution phase, in which each user generates a key pair, and the server constructs an undirected graph based on the public key in the received user key pair and the global constraint, and distributes the public keys of the users connected to the user in the undirected graph to each user; a secret share generation phase, in which each user generates a secret share and a reserve secret share for the number of public keys received; and a recovery aggregation update phase, in which the aggregate information of all users is reconstructed based on the secret share and reserve secret share corresponding to the user.

[0007] The FastSecAgg+ protocol is functionally expanded, including: before each user generates a key pair in the key distribution phase, a fixed number of empty users is added to update the undirected graph; the nodes corresponding to the empty users in the updated undirected graph are empty nodes, and the nodes corresponding to the exited users are exit nodes; in the recovery aggregation update phase, users who join midway are assigned to the empty nodes or exit nodes of the user group.

[0008] Preferably, the global restriction condition for constructing an undirected graph in the FastSecAgg+ protocol obtained according to the preferred restriction condition is specifically:

[0009] Obtain the restriction conditions for constructing an undirected graph in an existing security aggregation protocol, and combine the restriction conditions and the preferred restriction conditions as global restriction conditions for constructing an undirected graph in a FastSecAgg+ protocol.

[0010] Preferably, the value of the preset number is specifically k(G)+1, where k(G) is the connectivity of the constructed undirected graph.

[0011] Preferably, the aggregate information secret shares sent to the server by two users in the user group during the recovery aggregation update phase are added together to form the aggregate information secret shares of all users, and the two users constitute the user group.

[0012] Preferably, the connecting of nodes according to user nodes in the user group is specifically as follows:

[0013] The user nodes of each user group are connected to k(G) user nodes outside the user group, and the user nodes of the same user group cannot be connected to the same user node.

[0014] Preferably, after each user generates a secret share and a preliminary secret share corresponding to the number of received public keys, the secret share generation stage further includes:

[0015] The user's public key is used to encrypt the user's corresponding secret share and preliminary secret share, and the encrypted secret share and preliminary secret share are sent to the server. The received encrypted secret share and preliminary secret share are then forwarded to the user corresponding to the public key used for encryption.

[0016] Preferably, the reconstructing of aggregate information of all users based on the secret shares and the preliminary secret shares corresponding to the users is specifically as follows:

[0017] Any user is denoted as the target user. The target user decrypts all the encrypted secret shares it receives using the private key in the key pair corresponding to the target user, and adds the decrypted secret shares to the target user's secret shares to obtain the secret shares of the aggregated information of the target user and its neighboring users. The secret shares of the aggregated information corresponding to each user can then be obtained and sent to the server. The server receives the secret shares of the aggregated information and requests the user to send the preliminary secret shares of users who have withdrawn midway. The secret shares or preliminary secret shares are added according to the user group to obtain the secret shares of all user information, and the aggregated information of all users can be reconstructed.

[0018] Preferably, after assigning users who joined midway to empty nodes or exiting nodes, the recovery aggregation update phase further includes:

[0019] For a user h who joins midway, send the public key of user h to the users connected to user h, and at the same time, send the public key of the user connected to user h and the number of users N connected to user h. h Sent to user h; after receiving the information, the user generates N h secret shares, N h The secret share is encrypted with the public key and sent to the server.

[0020] Preferably, the FastSecAgg+ protocol further includes:

[0021] At the beginning of the protocol, the user uses a homomorphic hash function to hash each piece of information, and then sends the hash value to the server. The server distributes rewards based on the number of hash values ​​received from users.

[0022] The embodiments of the present invention have at least the following beneficial effects:

[0023] To reduce the communication and computational costs of a secret-sharing security aggregation protocol, this invention combines the conditions for constructing a user communication network with SecAgg+ to obtain global constraints for constructing an undirected graph. The undirected graph construction method is addressed through a special undirected graph connection method. When constructing the FastSecAgg+ protocol, the FastSecAgg protocol's handling of users who drop out midway is modified. By generating a preliminary secret share on the client side, the acceptable user dropout rate is significantly increased. When expanding the functionality of the FastSecAgg+ protocol, empty nodes are reserved on the undirected graph for users who join midway, making the FastSecAgg+ protocol robust to users who join midway and achieving lower communication and computational costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 This is a method flow chart of a highly efficient and highly scalable security aggregation method based on secret sharing of the present invention. DETAILED DESCRIPTION

[0026] To further illustrate the technical means and effectiveness of the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effectiveness of a highly efficient and scalable security aggregation method based on secret sharing proposed by the present invention. In the following description, different references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0027] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0028] The following describes in detail a specific solution of a highly efficient and scalable security aggregation method based on secret sharing provided by the present invention with reference to the accompanying drawings.

[0029] Example:

[0030] The specific implementation scenario of the present invention is: the method of using an undirected graph to connect users to reduce communication costs while ensuring security is used on the existing security aggregation protocol to form a new protocol FastSecAgg+, so that the newly constructed protocol can have both lower computing cost and lower communication cost.

[0031] See also Figure 1 , which shows a flow chart of a research method for an efficient and highly scalable security aggregation method based on secret sharing provided by an embodiment of the present invention, the method comprising the following steps:

[0032] Step 1: Set the preferred restriction conditions, which are: divide the user nodes in the undirected graph into a preset number of user groups, and connect the nodes according to the user nodes in the user groups; obtain the global restriction conditions for constructing the undirected graph in the FastSecAgg+ protocol based on the preferred restriction conditions.

[0033] The FastSecAgg+ protocol's undirected graph construction includes four global constraints. In FastSecAgg+, if a user's neighboring nodes are compromised, the attacker will still obtain a sufficient number of secret shares of the user's information to recover. If the undirected graph loses connectivity due to node exits, or if a node's neighboring nodes experience excessive disconnection, the server will be unable to recover aggregated information. Therefore, the undirected graph construction in FastSecAgg+ must comply with the same three constraints (E1, E2, and E3) as existing security aggregation protocols.

[0034] Among them, constraint E1 is specifically: there cannot be too many controlled neighbor nodes. Constraint E2 is specifically: when some clients go offline, the connectivity of the entire graph can still be guaranteed, that is, there are no isolated nodes. Constraint E3 is specifically: there cannot be too many offline neighbor nodes, otherwise there will not be enough neighbor nodes to reconstruct the secret. The nature of secret sharing determines that the common secret of k clients needs to be decrypted by at least t clients, where 1≤t≤k. Then, t and k that meet constraints E1, E2, and E3 are solved. The solution process is a well-known technology. For example, the paper entitled Secure Single-Server Aggregation with (Poly)Logarithmic by Bell et al. discloses the process of solving t and k.

[0035] The preferred restriction condition E4 is specifically as follows: user nodes in the undirected graph are evenly divided into a preset number of user groups, nodes are connected according to the user nodes in the user groups, user nodes of each user group are connected to other user nodes outside the user group, and user nodes of the same user group cannot be connected to the same user node.

[0036] In this embodiment, the preset number is set to k(G)+1, where k(G) is the connectivity of the constructed undirected graph. The value of k(G) can be set by the implementer based on the security and user exit robustness requirements in the specific implementation scenario, and its value varies depending on the number of user nodes. That is, the nodes of the undirected graph G are evenly divided into k(G)+1 user groups. Nodes in each user group can only connect to k(G) nodes outside of their user group, and nodes in the same user group cannot connect to the same node.

[0037] It should be noted that the preferred restriction condition does not affect the calculation of t and k in the undirected graph, but only affects the connection method of the undirected graph. Therefore, the calculation method of t and k is the same as that in the prior art.

[0038] Step 2, constructing the FastSecAgg+ protocol includes: a key distribution phase, in which each user generates a key pair, and the server constructs an undirected graph based on the public key in the received user key pair and the global restriction conditions, and distributes the public keys of the users connected to the user in the undirected graph to each user; a secret share generation phase, in which each user generates a secret share and a preliminary secret share for the number of public keys received; and a recovery aggregation update phase, in which the aggregate information of all users is reconstructed based on the secret share and preliminary secret share corresponding to the user.

[0039] Specifically, a FastSecAgg+ protocol is constructed, and the process of the protocol includes a key distribution phase, a secret share generation phase, and a recovery aggregation update phase.

[0040] In the first round of key distribution, each user generates a key pair, consisting of their public and private keys, and sends it to the server. The server then waits for a sufficient number of public keys to be received. Based on the public keys in the received user key pairs and the global constraints, the server constructs an undirected public key graph and distributes the public keys of all users connected to it in the graph to each user. The method for constructing the undirected graph is described in step 1 and will not be further elaborated here.

[0041] In the second round, key shares are generated as follows: each user generates secret shares and preliminary secret shares for the number of public keys received, encrypts the secret shares and preliminary secret shares corresponding to the user using the user's public key, and sends the encrypted secret shares and preliminary secret shares to the server. The server waits to receive the encrypted secret shares and preliminary secret shares sent by enough users, and then forwards the received encrypted secret shares and preliminary secret shares to the user corresponding to the public key used for encryption.

[0042] In the third round, the aggregation update is restored as follows: any user is recorded as the target user. The target user decrypts all the encrypted secret shares it receives using the private key in the key pair corresponding to the target user. The decrypted secret shares are added to the target user's secret shares to obtain the secret shares of the aggregated information of the target user and its neighbor users. The secret shares of the aggregated information corresponding to each user can then be obtained and sent to the server. The server receives the secret shares of the aggregated information and requests the user to send the preliminary secret shares of the users who dropped out midway. The secret shares or preliminary secret shares are added according to the user group to obtain the secret shares of all user information, and the aggregated information of all users can be reconstructed.

[0043] Further details about FastSecAgg+ are as follows:

[0044] Members: users 1, 2, ..., N and the server;

[0045] Public parameters: update length L, input domain Z R , protocol key parameter pp←KA.param(λ), the finite field F of the primitive N roots of the uniform ω shared by FastShare secret q , construct the security parameters σ and η used in the undirected graph, and allow the number of users D to exit midway; input: u i ∈ ZLR (for each user i); Output: z∈ ZLR (for the server).

[0046] 1. Communication round 0, i.e. key distribution:

[0047] For user i:

[0048] (1) Generate a key pair (pk i ,sk i )←KA.gen(pp);

[0049] (2) Send pk i Give it to the server and proceed to the next round.

[0050] For Servers:

[0051] (1) Wait for at least ND users to reply (remember the reply user set is ); otherwise terminate;

[0052] (2) Generate an undirected graph (G, t, k) ← GenerateGraph(|C0|, σ, η), where G is an undirected graph with n nodes and regularity k. G (i) represents the set of k nodes adjacent to i (its neighbors). NS p represents the pth user group;

[0053] (3) All pk sent by user i belonging to C0 i Forward to N G (i) Then proceed to the next round.

[0054] 2. Communication round 1, generating secret shares:

[0055] For user i:

[0056] (1) Receive list{(j,pk j )} j∈NG(i) ;

[0057] (2) Input u i ∈ZLR is divided into vector, so The length of is at most S, and the length of others is S;

[0058] (3) By {(j,[uti] j )} j∈NG(i)∪{i,i'} ←FastShare(uti,N G (i)∪{i,i'}) for Compute |N (by using independent private randomness for each t) G (i)|+2 secret shares. User i’s secret share for user j is expressed as

[0059] (4) For each user j∈N G (i) Calculate the encrypted secret share: ci→j ←AE.enc(k i,j ,i||j||sh i→j ), where k i,j =KA.agree(sk i ,pk j );

[0060] (5) By adding addressing information i, j as metadata, all encrypted information {c i→j} j∈NG(i) and prepare secret share sh i→i' Send to the server;

[0061] (6) Store all received information and the values ​​generated in this round and then proceed to the next round.

[0062] For Servers:

[0063] (1) Wait for at least ND users to reply (remember the reply user set is );

[0064] (2) Send encrypted information {c j→i} j∈NG(i)∩C1 , and then enter the next round.

[0065] 3. Communication round 2, i.e., resuming aggregate updates:

[0066] For user i:

[0067] 1) Receive the encrypted information list sent by the server {c j→i} j∈NG(i)∩C1 ;

[0068] (2) For each user j∈N G(i) ∩C1 decrypts the encrypted information (i'||j'||sh j→i )←Dec(sk i ,c j→i )Then assert (i=i')∧(j=j');

[0069] (3) Calculate F q The sum of the secret shares on i =∑ j∈NG(i)∩C1 sh j→i ;

[0070] (4) Send sh i To the server.

[0071] For Servers:

[0072] (1) Wait for at least ND users to reply (remember the reply user set is );

[0073] (2) Screen the users q∈C0-C2 who need to be restored and quit, where Q is the set of users who need to be restored;

[0074] (3) For each user q∈Q, send a recovery request (q) to each user i∈NG(q)∩C2.

[0075] 4. Communication round 3, i.e., resuming aggregate updates:

[0076] For user i:

[0077] (1) Receive a recovery request (q);

[0078] (2) Send sh i→q To the server.

[0079] For Servers:

[0080] (1) Wait for the user to respond;

[0081] (2) For each user q∈C0-C2, sh q =sh q→q’ +∑ i∈NG(q)∩C1 sh i→q , if sh q If it is not computable, it is ⊥;

[0082] (3) For each NS p ,calculate If sh p If it is not computable, then it is ⊥. Let SH be a computable sh p A collection of

[0083] (4) Run the reconstruction program for {z t ,⊥}←FastRecon({(p,shtp)} p∈SH ), where sht p It is the tth sh p Parameters;

[0084] (5) If all t reconstruction procedures return ⊥, the protocol is terminated;

[0085] (6) Output the aggregation result z.

[0086] Then, the computing and communication costs of FastSecAgg+ users and servers are analyzed, including user computing cost, user communication cost, server computing cost, and server communication cost.

[0087] The user calculation cost is: O(mloglogn). Each user needs to calculate logn secret shares Decrypt and encrypt received logn secret shares and calculate the sum of the received secret shares

[0088] The user communication cost is O(m+logn). Each user sends and receives logn–1 secret shares. Send the total secret share of the user group information, which is composed of F q In addition, each user must send at most logn-1 secret shares to the server for recovery

[0089] Server computation cost: O(mloglogn). The server first recovers the lost aggregate information secret share through FastRecon The second step is logn shared inverses

[0090] Server communication cost: O(nm+n log n). The server's communication cost is n times that of each user.

[0091] It should be noted that the undirected graph construction problem is solved through a special undirected graph connection method. The issue of user withdrawal is addressed by generating a preliminary secret share on the client side, significantly improving the acceptable user withdrawal rate. The details of FastSecAgg+ are also explained. FastSecAgg+ consists of three phases: key distribution, secret share generation, and recovery of aggregate updates.

[0092] Step three, expand the functionality of the FastSecAgg+ protocol, including: before each user generates a key pair in the key distribution phase, add a fixed number of empty users, and then update the undirected graph; in the updated undirected graph, the nodes corresponding to the empty users are empty nodes, and the nodes corresponding to the exited users are exit nodes; in the recovery aggregation update phase, assign users who join midway to empty nodes or exit nodes.

[0093] It should be noted that general secret-sharing-based security aggregation protocols are robust to users dropping out mid-process, but not to users joining mid-process. Robustness to mid-process user joining allows new users to join longer, eliminating the need for some late-joining users to wait for the next protocol execution, thus reducing user waiting time. The present invention improves FastSecAgg+ to be robust to mid-process user joining. This operation utilizes server and user waiting time to handle mid-process user joining, resulting in a shorter overall protocol execution time.

[0094] In order to allow the aggregation protocol to reserve empty nodes in the undirected graph and to allow users to join midway during the subsequent processing of the protocol, the server generates an undirected graph with a larger number of nodes than the number of users during the key distribution phase. In communication round 2, which is the waiting time in the recovery aggregation update phase, the server and some users perform some additional operations to handle users who join midway.

[0095] Specifically, in the key distribution phase, the server increases the number of users by a fixed value A when generating an undirected graph and then updates the undirected graph. The added users are empty users. The server sends the public keys of the users connected to user i in the undirected graph to user i, and sends the number of users N connected to user i. i Among them, the number of users N i Including the increased fixed value A and the non-empty number of users n. At the end of the key distribution phase, the server starts collecting the public keys of users who join in the process.

[0096] In the secret share generation phase, user i generates N after receiving the information. i secret shares and 1 reserve secret share, the reserve secret share and N i The secret shares are encrypted with the public key and sent to the server to be transmitted to the corresponding connected users, and the remaining unused secret shares are saved.

[0097] In communication round 2, i.e., the aggregation update phase, the server waits for a period of time to obtain enough secret shares of aggregated information. During this period, the server joins process 4. In process 4, the server assigns users who join midway to an empty node or an exit node of the user group.

[0098] The user group selection principle is that the group has insufficient regular users, but can be supplemented by adding users who join during the process, and all users in the group, except for those who have exited, have sent aggregated information to the server. This principle is designed to reduce the number of exiting users that need to be restored later and to allow users in slower-responding groups to continue computing. To reduce the amount of computation required, empty nodes are allocated by filling a user group with empty or exiting users before moving to another user group.

[0099] For a user h who joins midway, send the public key of user h to the users connected to user h, and at the same time, send the public key of the user connected to user h and the number of users N connected to user h. h Sent to user h. After receiving the information, the user generates N h secret shares, N h The secret shares are encrypted with the public key and sent to the server to be transmitted to the corresponding connected users.

[0100] After receiving user h's public key, the users connected to user h select a remaining secret share, encrypt it with user h's public key, and send it to the server for transmission to user h. Finally, user h and the users in his or her user group re-enter communication round 2.

[0101] The detailed information after the FastSecAgg+ protocol is extended is as follows:

[0102] The members, public parameters, inputs, and outputs are the same as those in the details of FastSecAgg+ before the function expansion.

[0103] 1. Communication round 0, i.e. key distribution:

[0104] For user i: the same as in communication round 0 in the detailed information of FastSecAgg+ before the function expansion.

[0105] For Servers:

[0106] (1) Same as the detailed information of FastSecAgg+ before the function expansion;

[0107] (2) The server begins to receive and store the public keys of users who join the process, and the set of users who join the process is denoted as H.

[0108] (3) Generate an undirected graph (G, t, k) ← GenerateGraph(|C0|+E,σ,η);

[0109] (4) All pk sent by user i belonging to C0 i Forward to N G (i)(empty user's pki Then enter the next round.

[0110] For user h who joins midway:

[0111] (5) Generate a key pair (pk h ,sk h )←KA.gen(pp), then wait to enter procedure 4*.

[0112] 2. Communication round 1, generating secret shares:

[0113] For user i:

[0114] (1) is the same as (1)-(3) in communication round 1 in the detailed information of FastSecAgg+ before functional expansion;

[0115] (2) For each user j∈N whose pk is not empty G(i) , calculate the encryption secret share: c i→j ←AE.enc(k i,j ,i||j||sh i→j ), where k i,j =KA.agree(sk i ,pk j ), store the remaining unencrypted secret share;

[0116] (3) is the same as (5)-(6) in the communication round 1 in the detailed information of FastSecAgg+ before the function expansion.

[0117] For Servers:

[0118] (4) is the same as (1)-(2) in the communication round 1 in the detailed information of FastSecAgg+ before the function expansion;

[0119] For user h who joins midway:

[0120] (5) Generate a key pair (pk h ,sk h )←KA.gen(pp), then wait to enter procedure 4*.

[0121] 3. Communication round 2, i.e., resuming aggregate updates:

[0122] For user i: the same as in communication round 2 in the detailed information of FastSecAgg+ before the function expansion.

[0123] For Servers:

[0124] (1) Wait for at least ND users to reply (remember the reply user set is During the waiting period, the server, the user h who joins midway, and the user s in the user group selected by the server enter program 4*;

[0125] (2) is the same as (2)-(3) in communication round 2 in the detailed information of FastSecAgg+ before the function expansion.

[0126] 4. Communication Round 3, i.e., recovery of aggregate update: This is the same as Communication Round 3 in the detailed information of FastSecAgg+ before the function expansion.

[0127] 5. Procedure 4*, i.e. user joins midway:

[0128] For user s:

[0129] (1) Receive list{(j,pk j )} j∈NG(s)∩H ;

[0130] (2) Using the remaining secret shares in communication round 2, user s’s secret share for user j is expressed as

[0131] (3) For each user j∈N G(s) ∩H, calculate the encryption secret share: c s→j ←AE.enc(k s,j ,i||j||sh s→j ), where k s,j =KA.agree(sk s ,pk j );

[0132] (4) By adding addressing information s, j as metadata, all encrypted information {c s→j} j∈NG(s)∩H Send to the server, and then re-enter communication round 2.

[0133] For Servers:

[0134] (1) Waiting for the appropriate user group NP r Appear;

[0135] (2) Assign the user h who joins midway to NP r In an empty node or exit node;

[0136] (3) For all users h∈H, the pk h Forward to N G (h)∩C2; all users s∈NP r -E pk s Forward to N G (s)∩H;

[0137] (4) Wait for the user to respond;

[0138] (5) Send encrypted information {c s→h} s∈NG(h)∩C2 ;

[0139] (6) To all users s∈NP r -E Send encrypted message {c h→s} h∈NG(s)∩E ;

[0140] (7) After processing all users who join midway or after the waiting time has expired and there is no suitable user group, continue the communication round 2. User h joins midway:

[0141] (8) Perform the operations of user i in communication round 1, and then enter communication round 2 as user i.

[0142] It should be noted that the cost of mid-joining users is analyzed. Specifically, the additional cost of implementing robust mid-joining users is the cost of normal users in the user group selected by the server and the server entering program 4*. All other costs are constant. Assuming that the number of users entering program 4* is n', the computational cost for additional users is O(mloglogn'), and the computational cost for the server is O(1); the communication cost for additional users is O(mlogn'), and the communication cost for the server is O(mn'+n'logn'). The computational complexity and communication complexity of the entire protocol are the same as those of FastSecAgg+.

[0143] Furthermore, the user reward distribution function implements a reward distribution mechanism within the secure aggregation protocol based on the amount of information they contribute to the aggregation process. In a semi-honest scenario, users can send their contributed information to the server, which then distributes the reward. This embodiment of the present invention only considers the protocol design for the case where users with malicious intent to reward others but who do not wish to influence the server's aggregation results are involved. A user reward distribution solution based on homomorphic hashing is proposed within the FastSecAgg+ protocol.

[0144] Specifically, at the beginning of the protocol, users hash each message using a homomorphic hash function and then send the hash value to the server. The server then distributes rewards based on the number of user hash values ​​it receives. During verification, during the aggregation phase, the server simply adds up the hash values ​​of all users' messages to see if they match the hash value of the final aggregated message.

[0145] Details of the FastSecAgg+ protocol with reward distribution functionality include:

[0146] The members, public parameters, inputs, and outputs are the same as those in the details of FastSecAgg+ before the function expansion.

[0147] 1. Communication round 0, i.e. key distribution:

[0148] For user i:

[0149] (1) Generate a key pair (pk i ,sk i )←KA.gen(pp);

[0150] (2) For each unit data hdi∈ user i dataset H i , perform hash thdi←T(hdi); tH i ={th0i,th1i,…};

[0151] (3) Send pk i 、tH i Give it to the server and proceed to the next round.

[0152] For the server: Same as in Communication Round 0 in the details of FastSecAgg+ before the function expansion.

[0153] 2. Communication round 1, generating secret shares:

[0154] Same as the communication round 1 in the detailed information of FastSecAgg+ before the function expansion.

[0155] 3. Communication round 2, i.e., resuming aggregate updates:

[0156] Same as the communication round 2 in the detailed information of FastSecAgg+ before the function expansion.

[0157] 4. Communication round 3, i.e., resuming aggregate updates:

[0158] For user i:

[0159] (1) Same as in communication round 3 in the detailed information of FastSecAgg+ before function expansion.

[0160] For Servers:

[0161] (1) Same as (1) to (5) in communication round 0 in the detailed information of FastSecAgg+ before the function expansion;

[0162] (2) Calculate the hash value of z, tz←T(z);

[0163] (3) Calculate tz' = ∑ i∈C2 ∑ d∈tHi thdi;

[0164] (4) Assert tz' = tz, otherwise terminate the protocol;

[0165] (5) Output aggregation result z;

[0166] (6) For each user i∈C2, according to |tH i |Distribute rewards.

[0167] It should be noted that the cost of the protocol considering user reward distribution is analyzed. Specifically, the computational complexity of computing the homomorphic hash for a user is O(dm), where d is the average number of units of data each user owns. The additional communication cost for the user to send the hash value is O(d). The server has the computational cost of computing the hash value of the aggregated information, O(m), and the computational cost of computing the hash sum is O(dn), so the additional computational cost for the server is O(m+dn). The additional communication cost for the server to receive the hash value is O(dn). The server computational complexity of the entire protocol is O(mloglogn+n), which is otherwise the same as FastSecAgg+.

[0168] In summary, to reduce the communication and computational costs of a secret-sharing-based security aggregation protocol, the present invention combines the conditions for constructing a user communication network with SecAgg+ to obtain global constraints for constructing an undirected graph. The undirected graph construction method is addressed through a special undirected graph connection method. When constructing the FastSecAgg+ protocol, the FastSecAgg protocol's handling of users who drop out midway is modified. By generating a preliminary secret share on the client side, the acceptable user dropout rate is greatly increased. When expanding the functionality of the FastSecAgg+ protocol, empty nodes are reserved on the undirected graph for users who join midway, making the FastSecAgg+ protocol robust to users who join midway and resulting in lower communication and computational costs.

[0169] In order to avoid the time spent waiting for the next round of protocol execution when users join the middle of the security aggregation protocol and to ensure that rewards can be safely distributed according to the amount of information provided by users during information aggregation, the user mid-joining function and user reward distribution function have been added to the FastSecAgg+ protocol.

[0170] The FastSecAgg+ protocol is a novel security aggregation protocol based on secret sharing. It performs well in terms of practicality, computational cost, and communication cost. It is robust to user exits and has the lowest computational and communication costs among security aggregation protocols based on secret sharing.

[0171] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. An efficient and highly scalable security aggregation method based on secret sharing, characterized in that: include: Setting a preferred constraint condition, wherein the preferred constraint condition is: dividing the user nodes in the undirected graph into a preset number of user groups, connecting the nodes according to the user nodes in the user groups, connecting the user nodes of each user group with k(G) user nodes outside the user group, and user nodes in the same user group cannot connect to the same user node; obtaining a global constraint condition for constructing the undirected graph in the FastSecAgg+ protocol based on the preferred constraint condition; wherein k(G) is the connectivity of the constructed undirected graph; The construction of FastSecAgg+ protocol includes: a key distribution phase, including each user generating a key pair, the server constructing an undirected graph based on the public key in the received user key pair and the global restriction condition, and distributing the public keys of the users connected to it in the undirected graph to each user; a secret share generation phase, including each user generating a secret share and a preliminary secret share for the number of public keys received, encrypting the secret share corresponding to the user using the received public key, sending the encrypted secret share and the preliminary secret share to the server, and the server forwarding the received encrypted secret share to the user corresponding to the public key used for encryption; a recovery aggregation update phase, including reconstructing the aggregate information of all users based on the secret share and preliminary secret share corresponding to the user, and converting any one of the secret shares into a whole. Each user is recorded as the target user. The target user decrypts all the encrypted secret shares it receives using the private key in the key pair corresponding to the target user. The decrypted secret shares are added to the target user's secret shares to obtain the secret shares of the aggregated information corresponding to each user and send it to the server. The server receives the secret shares of the aggregated information. For users who quit midway, the server adds the sum of the secret shares related to the quitting user returned by users connected to the quitting user in the undirected graph and the reserved share of the quitting user to obtain the secret share of the aggregated information corresponding to the quitting user. For each user group, the server adds the secret shares of the aggregated information corresponding to the users in the group to obtain the aggregated result of the user group, and reconstructs the aggregated information of all users based on the aggregated result of the user group. The FastSecAgg+ protocol is functionally expanded, including: before each user generates a key pair in the key distribution phase, a fixed number of empty users is added to update the undirected graph; the nodes corresponding to the empty users in the updated undirected graph are empty nodes, and the nodes corresponding to the exited users are exit nodes; in the recovery aggregation update phase, users who join midway are assigned to the empty nodes or exit nodes of the user group.

2. The efficient and highly scalable security aggregation method based on secret sharing according to claim 1, characterized in that: The global restriction conditions for constructing an undirected graph in the FastSecAgg+ protocol obtained according to the preferred restriction conditions are specifically: Obtain the restriction conditions for constructing an undirected graph in an existing security aggregation protocol, and combine the restriction conditions and the preferred restriction conditions as global restriction conditions for constructing an undirected graph in a FastSecAgg+ protocol.

3. The efficient and highly scalable security aggregation method based on secret sharing according to claim 1, characterized in that: The specific value of the preset number is k(G)+1.

4. The efficient and highly scalable security aggregation method based on secret sharing according to claim 1, characterized in that: The aggregate information secret shares sent to the server by all users in the user group during the recovery aggregation update phase are added together to form the aggregate information secret shares of all users.

5. The efficient and highly scalable security aggregation method based on secret sharing according to claim 1, characterized in that: After assigning users who joined midway to empty nodes or exiting nodes, the recovery aggregation update phase further includes: For a user h who joins midway, send the public key of user h to the users connected to user h, and at the same time, send the public key of the user connected to user h and the number of users N connected to user h. h Sent to user h; after receiving the information, the user generates N h secret shares, N h The secret share is encrypted with the public key and sent to the server.

6. The efficient and highly scalable security aggregation method based on secret sharing according to claim 1, characterized in that: The FastSecAgg+ protocol also includes: At the beginning of the protocol, the user uses a homomorphic hash function to hash each piece of information, and then sends the hash value to the server. The server distributes rewards based on the number of hash values ​​received from users.

Images