Distributed record security aggregation method and system

Abstract

A distributed record security aggregation method and system, in order to align the ID between the clients, each client performs private ID sum processing, so that each client obtains the union set of all IDs in the distributed system, then each client uses Lagrange polynomial interpolation technology for secure record sharing processing, and secretly shares the local record to other clients, finally each client performs private record retrieval processing to all other clients, thereby retrieving the required record aggregation without leaking its own ID and data record, and without obtaining any additional information other than the aggregated record. The present application is based on Shamir secret sharing technology, and ingeniously designs a private record retrieval algorithm compatible with PSU protocol, which can protect the security of ID and record at the same time.

Description

Technical Field

[0001] This invention relates to a technology in the field of information security, specifically a distributed record secure aggregation method and system for a distributed record aggregation framework. Background Technology

[0002] Federated representation learning is a typical distributed record aggregation framework. To improve the performance of representation learning, it is necessary to fully utilize overlapping records between different clients to complete model training, while protecting the security of data records and record IDs. Existing technologies provide data security through secure record aggregation, but this process requires aligning record IDs between clients before exchanging data records. During ID alignment and record exchange, the central server and clients may use the interacting data to infer the client's local ID and record.

[0003] Existing secure aggregation protocols based on Private Set Intersection (PSI) guarantee the security of client IDs and protect the security of client records. However, each client, knowing the public IDs, can only aggregate global records for those public IDs; therefore, this technology exposes the client's set of public IDs, and records corresponding to partially overlapping IDs among clients are not aggregated, resulting in poor aggregation performance. Existing secure aggregation protocols based on Private Set Union (PSU) do not expose the security of client IDs. For each ID, all clients use the secure aggregation protocol to complete the global aggregation of records corresponding to that ID. However, in this technology, each client obtains aggregated records for all IDs, meaning that even aggregated records that the client does not need are obtained, which is unacceptable from both a security and performance perspective. Summary of the Invention

[0004] This invention addresses the aforementioned shortcomings of existing technologies by proposing a distributed record security aggregation method and system that can simultaneously protect the security of IDs and records. This protocol is based on Shamir secret sharing technology and cleverly designs a private record retrieval algorithm compatible with the PSU protocol. By using a better PSU protocol and designing a more efficient private record retrieval algorithm, the system performance of the protocol can be improved.

[0005] This invention is achieved through the following technical solution:

[0006] This invention relates to a distributed record aggregation framework, comprising: a central server and... A number of clients, for integers ,definition Client Have a set of IDs and corresponding records This constitutes a local dataset. IDs from different clients may overlap, meaning for... ,have For the client Each ID This indicates that the ID In the client Local records. All clients communicate data through the central server, enabling any client to... For each local ID Able to obtain the global record of this ID That is, to obtain the average value of all local records corresponding to this ID in the entire distributed system, which is the global record. in: For indicator functions, when If the value is "true", the return value is 1; otherwise, the return value is 0.

[0007] The aforementioned distributed record aggregation, while ensuring that each client can correctly complete the desired record aggregation, can tolerate any other client. Even if multiple clients collude with each other, they cannot obtain the client's ID and any information about the corresponding records. The specific steps include:

[0008] To align client IDs, each client performs a private ID union operation, resulting in a union of all IDs in the distributed system. Then, each client uses Lagrange multinomial interpolation for secure record sharing, secretly sharing its local records with other clients. Finally, each client performs a private record retrieval operation with all other clients, thus retrieving the required record aggregation without revealing its own ID and data records or obtaining any additional information beyond the aggregated records.

[0009] The aforementioned private ID union processing refers to: client First, use a collision-resistant hash function (such as SHA256) to hash the local ID. Mapping to a finite field For ease of description, we will still use ID. This represents its hash value. Assuming the number of built-in client IDs is public, we will focus on the scenario where all clients have the same number of IDs, represented as: .

[0010] Step 1) Each client Use its ID Represented as And randomly select a degree with a maximum value of 1. polynomial Then extract the polynomial. The front of the reversed Laurent series expansion A higher-order term, and used Represent the sum of these terms using a length of . vector The coefficients of these terms are obviously: and They are equivalent.

[0011] Step 2) Any two clients Use a key negotiation protocol (such as the Diffie-Hellman key exchange protocol) to privately negotiate a paired random seed. Then each client Local vectors corresponding mask vector The result is sent to the central server, where: PRG() is a pseudo-random number generation algorithm; the central server calculates the sum of the mask vectors. Then, the calculation results were... Shared with all clients, so the central server and all clients receive... And it is unknown which single one .

[0012] Step 3) Each client The rational function reconstruction algorithm is used to obtain the desired result. and polynomial and ,in: For polynomials The least common multiple of, i.e. , The root is the union of all IDs. Therefore, this client Through the Factoring will yield the result. .

[0013] The rational function reconstruction algorithm described herein is implemented using, but is not limited to, the methods described by Victor Shoup. 2009 in “A computational introduction to number theory and algebra” (2nd ed.). Cambridge University Press.

[0014] For simplicity, let the union of all IDs in the system be... ,in The total number of IDs. After the union of private IDs, the set is... It is publicly available globally.

[0015] The aforementioned secure record sharing process includes:

[0016] Step ① When the client ID exists in The record aggregation task to be processed is The client is known. The local record is The client Add "Unit Element 1" to each of its local records, i.e., ID. Records Expanding to dimensions vector For the client No ID The client generates a dimension of A vector of "all zeros" is used to virtually represent the local record for that ID. In summary: for any Client For ID The local extended record is Its extended record dimension is .

[0017] From the record aggregation task, it can be found that when the client... Able to obtain extended record summation At that time, the ID can be completed directly. Global record aggregation.

[0018] Step ②, to securely complete record aggregation, involves each client using Lagrange polynomial interpolation to secretly share local records with other clients. Specifically, this is done by: given security parameters... In this case, select the partitioning parameters For any Client Distribute local extended records evenly Divided into Each dimension is subvectors ;at this time That is: .make To from a finite field Choose any These are several distinct elements, exposed to both the server and the client. To ensure the security of local records, for any... Client Independently and uniformly from Selected from Random noise Then construct a degree of And the variable is unit polynomial , making .

[0019] The Lagrange polynomial interpolation technique refers to the following: according to the Lagrange interpolation rules, the above polynomial is expressed as... Then, for any Client calculate At point Calculate the value at the specified location and send it. client Send to client Data Client Local aggregation of data received from all clients ,have to At this point, for any , It is a global record aggregation In the client The secret sharing.

[0020] Preferably, since all communication between clients is forwarded through the central server, to prevent local records from leaking to the central server, the sent local records can be scrambled during communication. Specifically, this includes: during the private ID merge processing phase, each pair of clients... A built-in random seed The seed is private to the server. When the client... Want to send At that time, the client Upload The data is sent to the central server, and then the central server forwards it directly. Client By execution Data obtained after decryption .

[0021] Similarly, in the subsequent private record retrieval processing steps, all communication between clients is also scrambled through the steps described above.

[0022] The aforementioned private record retrieval process refers to: after local record sharing, each client obtains a secret shared global record aggregation of all IDs. At this point, each client... To other clients Send a search request from the client. To the client After the client responds accordingly, Recover the required record aggregation from the received response, specifically including:

[0023] Step 1, for the client Each local ID The client independently and evenly receives from In the middle Random noise Then, for any Client Construct a degree of Search polynomial ,satisfy .because The elements are distinct, and the retrieval polynomial is... It is uniquely written as: .

[0024] Step 2: For any and Client Calculate this A retrieval polynomial At point The value is evaluated at the specified location and sent to the client. client To complete ID Global record aggregation, sent to the client Search .

[0025] Step 3, Client Calculate the retrieval vector after receiving it. and local data vector The inner product as a response The data is then masked by the central server and sent to the client. .

[0026] The masking process mentioned above refers to: preventing clients from using the masking mechanism. The central server infers the missing record information from the received responses. Independent and uniform generation random variables And construct a degree of noise polynomial , making and but The central server receives the client's... response When using At point The evaluation at the point is used as a pair The mask, generating the information after the mask. And forwarded to the client It is a polynomial At point The evaluation at point. Note that for any and , It is a degree polynomial, Is the degree as The polynomial. Therefore It is a degree A single-variable polynomial. Because Since they are all different, the client can use the Lagrange interpolation rule. able to receive One response The polynomial is restored in the middle. .

[0027] Step 4, for Client Calculate the response polynomial At point The value at point is obtained. Therefore, for all Client For each ID Repeat the above steps to obtain the ID. Record aggregation Then, complete the global record aggregation task. Technical effect

[0028] This invention, based on Shamir secret sharing, designs a private record retrieval algorithm compatible with the PSU protocol. Compared to existing secure record aggregation protocols that only protect data security but have low aggregation performance, or those that have high aggregation performance but leak data security, this invention provides theoretically sound security guarantees for the client's local ID and data records. It can fully utilize overlapping data records between clients, resulting in optimal aggregation performance. This method can be directly applied to federated representation learning tasks, significantly improving the aggregation performance of existing protocols while protecting client ID privacy and data security. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the distributed record aggregation framework system of the present invention;

[0030] Figure 2 This is a schematic diagram illustrating the relationship between online computation time, offline retrieval generation time, and the number of processes in the embodiment;

[0031] Figure 3 This is a schematic diagram illustrating the effect of the embodiment, depicting a comparison of the time consumption of various parts of the security record aggregation protocol under different tasks;

[0032] In the figure: a) TransE@FB15k, b) DeepWalk@cora, c) NCF@MovieLens-100k, d) DeepWalk@CiteSeer, e) AutoEncoder@Soybean, f) LightGCN@MovieLens-1M, g) SVD@MovieLens-1M, h) NCF@MovieLens-1M. In the figure, gray represents online computation time, white represents communication time, and black represents model training time. Different stripes correspond to different safety factors. Detailed Implementation Example 1

[0033] like Figure 1 As shown, this embodiment relates to a secure distributed record aggregation framework system, including: a central server and... A distributed framework consisting of 1 client, where: each client Local dataset The system contains several IDs and their corresponding records. The central server coordinates and controls each client to perform security record aggregation based on the Security Record Aggregation Protocol (SecRA).

[0034] Through specific practical experiments, Theoretical explanation is given within the framework of this architecture: Considering that the system contains The IDs and their distribution across the three clients are: .

[0035] This embodiment first performs a private ID union process to make the server and all clients aware of the entire ID set. Meanwhile, the server does not know which IDs are built into each client, and each client does not know which IDs are built into other clients.

[0036] Then, through secure record sharing, i.e., the client appends unit elements or zero elements to the local record, making... Each client Records that generate the following masks And share to the client. : ,in: It is independent and uniform mask noise. Each client Aggregate the mask records received from all clients to obtain

[0037] Finally, the process involves retrieving and processing private records, which will explain the client's actions. How to obtain aggregated records of interest At the same time, no ID was leaked. The privacy of the records. The aggregation of records for the remaining clients and IDs can be done similarly. Client Mask noise and and send the encoded retrieval ,in: Upon receiving the retrieval Client calculate And sent to the client through the central server. The central server received Then, using locally generated random noise and And forward it to client 1, where: .

[0038] From the above equation, it can be seen that adding random noise... and The purpose is to prevent the client Learn about from the received response Any information. Through Client get Then, calculate the ID. Global records are aggregated into . Example 2

[0039] This embodiment relates to applying the aforementioned distributed record aggregation protocol to a federated representation learning task. The federated representation learning system includes... There are three distributed clients and one central coordination server. Each client has some built-in data, and the same entities exist in the data across different clients. In the federated representation learning system, for any client... The client Built-in entity collection and corresponding data Local dataset Entities between different clients may overlap, i.e., there exists... ,have The client trains a feature representation or embedding for each local entity using a machine learning model; these same entities may correspond to different embeddings. For the client... Each entity Indicates client For this entity Embeddings trained locally. All clients communicate these embeddings through a central server, enabling clients to... For each local entity able to obtain entities The global embedding is obtained by averaging the total number of local embeddings for that entity across the entire distributed record aggregation framework system. Specifically, the client... Want to obtain the physical object Global embedding .

[0040] In the federated representation learning task, the "entity" built into the client corresponds to the "ID" in the distributed record aggregation framework system, and "embedding" corresponds to "record". Directly executing the distributed record aggregation protocol can help the distributed representation learning system complete the embedding aggregation task. Therefore, the federated representation learning task is a special application of the distributed record aggregation framework system considered in this invention.

[0041] This embodiment evaluates the performance and efficiency of the SecRA protocol in tasks such as knowledge graphs, recommender systems, social networks, and clustering in federated representation learning through the following methods.

[0042] To ensure a more representative evaluation, several classic datasets were used as a foundation for each learning task, focusing on typical performance metrics. Specifically, for knowledge graphs, the Kinship, WN18, and FB15k datasets were used, with MRR as the metric. For recommender systems, the Last.FM and MovieLens datasets were considered, along with the NDCG metric. For social network tasks, the Citeseer, Cora, and Wikipedia datasets were selected, with MicroF1 as the metric. For clustering tasks, three classification datasets—SPECT Heart, Soybean, and Census Income—were used, along with standard mutual information (NMI) as the metric. Each dataset was randomly split into training and test sets. In the federated learning environment, the training set was further non-uniformly and non-independently partitioned among each client. Furthermore, multiple classic models were used for evaluation for each learning task: TransE, RotatE, and NoGE for knowledge graphs; SVD, NCF, and LightGCN for recommender systems; LINE, DeepWalk, and node2vec for social networks; and PCA and autoencoders for clustering.

[0043] For these tasks, the practicality and efficiency of the SecRA protocol are verified by comparing different aggregation protocols. The aggregation protocols considered include: Entire: Embedsions of all entities are trained centrally on the entire training data; Single: In a distributed system, each client trains its local entity embeddings using local data without aggregation; EmbAvg: For each entity, the server prompts the client that owns that entity to upload its local embedding, then the server aggregates these embeddings and returns them to the client for the next round of training. Note that in this setup, the server knows each client's entity set and local embeddings, and the privacy of entities and embeddings is not protected; PSI: The server only aggregates the embeddings of entities commonly owned by all clients and sends the aggregation results back to the client for the next round of training; SecRA ( By keeping the decimal point The local embedding is quantized using the bit depth, and then the quantized embedding is aggregated using the proposed SecRA protocol.

[0044] The experimental environment considered was as follows: each client was executed on a single machine with an Intel® Xeon® Gold5118 CPU @2.30GHz and 12 cores and 48 threads. The embedding for each client was trained on an NVIDIA GeForce3090 GPU with 24GB of RAM. In all federated learning settings, a finite field size of [size missing] was selected for SecRA. .

[0045] The experimental results for different learning tasks are recorded in Table 1. Table 1 shows that all protocols involving embedding aggregation (i.e., EmbAvg, PSI, and SecRA) outperform Single in all tasks, demonstrating the effectiveness of aggregated embeddings. Within each task, for different datasets, the SecRA protocol shows a significant performance improvement over Single. For example, in knowledge graphs, RotatE on Kinship improved by 25.01%, NoGE on WN18 and RotatE on FB15k improved by 100.67% and 25.05% respectively; in recommender systems, MF improved by 39.02% and 32.94% on Last.FM and MovieLens-100k respectively, and NCF improved by 74.94% on MovieLens-1M; in social networks, LINE improved by 18.99% on Citeseer, node2vec improved by 13.40% on Cora, and LINE improved by 12.15% on Wiki; in multi-view classification and clustering, PCA improved by 99.18% on SPECT, AutoEncoder improved by 16.60% on Soybean, and PCA improved by 85.71% on Census Income.

[0046] Of all the protocols, EmbAvg achieves the best performance because it does not incur any aggregation performance penalty. Note that the SecRA protocol also does not incur any additional aggregation performance penalty, but it does incur a slight quantization penalty due to the quantization from the real field to the finite field. For example, compare the different protocols in Table 1. The results of SecRA and EmbAvg show that SecRA performs well in certain tasks. There is some performance loss at lower speeds. At 6, the highest performance loss was for LINE on Citeseer, at 13.17% and 9.59% respectively; for At p=10, PCA clustering on SPECT suffers the most severe performance loss, at 7.40%; when p=8 or 10, the performance loss for all tasks can be reduced to within 5%. Furthermore, across all precision parameter choices, the SecRA protocol consistently outperforms the PSI setting. For example, in NoGE on the knowledge graph WN18, SecRA achieves a 59.87% performance improvement over PSI.

[0047] Table 1 shows the utility performance of the learning task under different settings. Except for the Entire protocol, all other protocols are implemented on N=3 clients.

[0048] To evaluate the efficiency of the SecRA protocol, the task execution time of different protocols on different datasets was measured. This evaluation focuses on a cross-silo FL scenario and assumes a communication bandwidth of 680 Mbps between the client and server (see the m3.large instance on AWS EC2). Furthermore, in the SecRA implementation, index generation, encoding, and decoding processes are computed in parallel using 20 processors. Table 2 shows the execution time of one round of global training in a federated environment with N=5 clients. Table 2 shows that SecRA incurs a longer execution time compared to EmbAvg. This is mainly due to the additional computations performed by SecRA: 1) encoding queries; and 2) encoding, sharing, and decoding of embedded data. Among the percentage increase in execution time between SecRA and EmbAvg, the percentage increase in LightGCN execution time on MovieLens-1M is the smallest, because the training time significantly exceeds the offline computation and encoding time. SecRA shows the most significant percentage increase in Census Income on PCA, due to the shorter training time and the large number of entities. In general, SecRA significantly increases the execution time of shallow models with short training times, such as TransE, PCA, and SVD; on the other hand, the additional execution time of SecRA is negligible for deep models such as LightGCN and AutoEncoder, especially on large datasets.

[0049] Furthermore, as shown in Table 2, PSI's execution time is slightly longer than EmbAvg's. This is because PSI requires additional time to construct the mask to protect embedding privacy. SecRA also takes longer to complete one round of training compared to PSI. SecRA is slower than PSI on shallow models but achieves comparable runtime on deep models (e.g., on deep models LightGCN and AutoEncoder, SecRA's speedup is less than 5% lower than PSI). Although SecRA's runtime is longer than PSI, SecRA achieves better aggregation performance and provides a higher level of security.

[0050] It is also noted that the execution time of SecRA increases with the increase of the security parameter T. As shown in Table 2, the execution time of SecRA also increases as T increases from 1 to 2. Furthermore, the increase in execution time of SecRA with T is more significant when the dataset and entity set are larger. As shown in Table 2, for running SVD tasks in a recommender system, the execution time increases by 12.15% on the MovieLen100k dataset as T increases from 1 to 2, and by 36.74% on the larger MovieLens-1M dataset.

[0051] Table 2 shows the execution time (in seconds) for one round of global training. For the federated learning setup (except Entire), all experiments were conducted on N = 5 clients.

[0052] To further improve the execution efficiency of the aggregation protocol, we will further optimize the system-level efficiency and measure the detailed execution time of each part in each round.

[0053] Multi-process parallelization: This involves systematically optimizing the SecRA protocol to improve operational efficiency. Many encoding computations in the SecRA protocol are independent of model training, such as query generation; these operations can be computed offline. Furthermore, since offline and online computations between different entities are independent within each client, these processes can be executed concurrently to accelerate the process. Additionally, because the indexing and encoding processes for each entity are independent, multi-processing can be used to handle different entity embedding computations simultaneously, allowing for the processing of more entities concurrently. Figure 2 As shown, when training the LightGCN model on the MovieLens-1M dataset, the offline and online computation time decreases linearly as the number of processes increases.

[0054] Complexity Assessment: This section analyzes the specific execution time consumption of the SecRA protocol, including offline and online phases. The main operation in the offline phase is computation of encoded queries. The online phase includes training local embeddings, encoding and decoding of local embeddings, and communication between clients. The time consumption of each part of SecRA under different tasks is shown below. Figure 3 As shown, gray represents online computation time, white represents communication time, and black represents model training time. Different stripes also correspond to different security coefficients. Overall, the time consumption of protocol execution is summarized as follows:

[0055] Training cost: Training time depends on the size of the dataset, the batch size, and the model size. For fair comparison, the batch size is fixed for each task. Since LightGCN is the most complex model and the MovieLens1M dataset is the largest, its training time is the longest. Figure 3 As shown.

[0056] Computational overhead: From Figure 3 It was observed that, for fixed safety parameters Online calculation time (green section) increases with the number of clients. It increased from 5 to 20 and then decreased.

[0057] Communication overhead: From Figure 3 It can be seen that for a fixed number of clients, as Increase( (This will decrease accordingly), while communication costs (orange portion) increase. For fixed... Communication costs increase Increase. Furthermore, for Figure 3 All tasks in the online phase have relatively low communication overhead compared to the computation and training time in the online phase.

[0058] Offline Time Cost: The offline time cost was measured for the LightGCN task on MovieLens-1M and the AutoEncoder task on Soybean, as shown in Table 3. For fixed security parameters... Offline time varies with the number of clients Increase with the increase; fixed number of clients The larger T is, the longer the offline execution time. It was also observed that for both tasks, the training time was significantly longer than the offline time. Therefore, thanks to the parallel optimization of index generation and embedding training, the cost of offline computation time is negligible compared to local training and does not increase the overall execution time of SecRA.

[0059] Table 3 shows the detailed timelines for LightGCN on MovieLens1M and AutoEncoder on Soybean for offline and training operations.

[0060] To provide more detailed experiments to support the results, for Figure 3 Table 4-11 details the execution time of the eight tasks in SecRA, providing detailed numerical results for both offline and online times in each table. Overall, these results are in line with expectations; however, some special cases exist for certain tasks. For example, in DeepWalk, the offline time cost decreases as the number of clients increases, which is due to differences in the number of entities and data within the tasks.

[0061] Table 4 shows a detailed breakdown of the SecRA execution time during a single round of TransE training on FB15k.

[0062] Table 5 shows a detailed breakdown of the SecRA execution time during a single round of DeepWalk training on Cora.

[0063] Table 6 shows a detailed breakdown of SecRA execution time during a single round of NCF training on MovieLen-100k.

[0064] Table 7 shows a detailed breakdown of the SecRA execution time during a single round of DeepWalk training on Citeseer.

[0065] Table 8 shows a detailed breakdown of the SecRA execution time during a single round of training on Soybean for Autoencode.

[0066] Table 9 shows a detailed breakdown of the SecRA execution time during a single round of training of LightGCN on MovieLens-1M.

[0067] Table 10 shows a detailed breakdown of the SecRA execution time during a single round of SVD training on MovieLens-1M.

[0068] Table 11 shows a detailed breakdown of SecRA execution time during a single round of NCF training on MovieLens-1M.

[0069] Compared to current secure record aggregation protocols, which either offer data security but suffer from poor aggregation performance, or offer high aggregation performance but risk data security breaches, this invention provides theoretical security guarantees for client-side local IDs and records. Furthermore, compared to centralized aggregation (where the server owns all client data), it incurs almost no performance loss. As an application, the SecRA protocol can provide security guarantees for general federated representation learning problems. Experiments have demonstrated that compared to machine learning protocols with no (or weak) security guarantees, SecRA's performance loss is negligible (less than 5%); and when training deeper models on larger datasets, SecRA exhibits negligible computational latency. This indicates that SecRA can improve the system performance of machine learning protocols while providing security guarantees.

[0070] The above-described specific implementations can be partially adjusted by those skilled in the art in different ways without departing from the principles and purpose of the present invention. The scope of protection of the present invention is defined by the claims and is not limited to the above-described specific implementations. All implementation schemes within the scope of the claims are bound by the present invention.

Claims

1. A secure record aggregation method for a distributed record aggregation framework, characterized in that, By embedding several IDs and their corresponding records in each client, each client performs a private ID union process, enabling each client to obtain the union of all IDs in the system. Then, each client uses Lagrange polynomial interpolation technology to perform secure record sharing, secretly sharing local records with other clients. Finally, each client performs private record retrieval processing with all other clients, that is, retrieving the record aggregation it needs without revealing its own ID or obtaining any additional information other than the aggregated records. The aforementioned distributed record aggregation framework includes: a central server and A number of clients, for integers ,definition Client Have a set of IDs and corresponding records The local dataset is constructed; IDs from different clients may overlap, i.e., for... ,have For the client Each ID This indicates that the ID In the client Local records; all clients communicate data through a central server, enabling any client to... For each local ID Able to obtain the global record of this ID That is, to obtain the average value of all local records corresponding to this ID in the entire distributed system, which is the global record. in: For indicator functions, when If the value is "true", the return value is 1; otherwise, the return value is 0.

2. The secure record aggregation method for a distributed record aggregation framework according to claim 1, characterized in that, The aforementioned private ID union processing refers to: client First, use a collision-resistant hash function to store the local ID. Mapping to a finite field Specifically, this includes: Step 1) Each client Use its ID Represented as And randomly select one with the largest degree. polynomial Then extract the polynomial. The front of the inverted Laurent series expansion A higher-order term, and used Represent the sum of these terms using a length of vector Describing coefficients and and equivalence; Step 2) Any two clients Use a key exchange protocol to privately negotiate a paired random seed. Then each client Local vectors corresponding mask vector The result is sent to the central server, where: PRG() is a pseudo-random number generation algorithm; the central server calculates the sum of the mask vectors. Then, the calculation results were... Shared with all clients, so that the central server and all clients can obtain... And it is unknown which single one ; Step 3) Each client The rational function reconstruction algorithm is used to obtain the desired result. and polynomial and ,in: For polynomials The least common multiple of, i.e. , The root is the union of all IDs. Therefore, this client Through the Factoring yields .

3. The secure record aggregation method for a distributed record aggregation framework according to claim 2, characterized in that, The aforementioned secure record sharing process includes: Step ① When the client ID exists in The record aggregation task to be processed is The client is known. The local record is The client Add "Unit Element 1" to each of its local records, i.e., ID. Records Expanding to dimensions vector For the client No ID The client generates a dimension of A vector of all zeros is used to virtually represent the local record for that ID; for any Client For ID The local extended record is Its extended record dimension is M is the number of IDs; Step ②, to securely complete record aggregation, involves each client using Lagrange polynomial interpolation to secretly share local records with other clients. Specifically, this is done by: given security parameters... In this case, select the partitioning parameters For any Client Distribute local extended records evenly Divided into Each dimension is subvectors ;at this time That is: ;make To from a finite field Choose any These are distinct elements, exposed to both the server and the client; to ensure the security of local records, for any... Client Independently and uniformly from Selected from random noise Then construct a degree of And the variable is unit polynomial , making .

4. The secure record aggregation method for a distributed record aggregation framework according to claim 3, characterized in that, The Lagrange polynomial interpolation technique refers to: expressing a unit polynomial as follows, according to the Lagrange interpolation rule: Then, for any Client calculate At point Calculate the value at the specified location and send it. client Send to client Data Client Local aggregation of data received from all clients ,have to At this point, for any , It is a global record aggregation In the client The secret sharing.

5. The secure record aggregation method for a distributed record aggregation framework according to claim 4, characterized in that, Since all communication between clients is forwarded through the central server, to prevent local records from leaking to the central server, the local records sent during communication are scrambled. Specifically, this includes: during the private ID merge processing phase, each pair of clients... A built-in random seed The seed is private to the server; when the client... Want to send At that time, the client Upload The data is sent to the central server, and then the central server forwards it directly. Client By execution Data obtained after decryption .

6. The secure record aggregation method for a distributed record aggregation framework according to claim 5, characterized in that, The aforementioned private record retrieval processing refers to: after local record sharing, each client obtains a secret shared global record aggregation of all IDs, at which point each client... To other clients Send a search request from the client. To the client After the client responds accordingly, Recover the required record aggregation from the received response, specifically including: Step 1, for the client Each local ID The client independently and evenly receives from In the middle random noise Then, for any Client Construct a degree of Search polynomial ,satisfy ;because If the elements are distinct, then the retrieval polynomial is used. ; Step 2: For any and Client Calculate this A retrieval polynomial At point The value is evaluated at the specified location and sent to the client. client To complete ID Global record aggregation, sent to the client Search ; Step 3, Client Calculate the retrieval vector after receiving it. and local data vector The inner product as a response The data is then masked by the central server and sent to the client. ; Step 4, for Client Calculate the response polynomial At point The value at point is obtained. Therefore, for all Client For each ID Repeat the above steps to obtain the ID. Record aggregation Then, complete the global record aggregation task.

7. The secure record aggregation method for a distributed record aggregation framework according to claim 6, characterized in that, The masking process mentioned above refers to: preventing clients from using the masking mechanism. The central server infers the missing record information from the received responses. Independent and uniform generation random variables And construct a degree of noise polynomial , making and but The central server receives the client's data. response When using At point The evaluation at the point is used as a pair The mask, generating the information after the mask. And forwarded to the client ,in: It is a polynomial At point Evaluation at point; For any and , It is a degree polynomial, Is the degree as The polynomial; therefore It is a degree A single-variable polynomial; because They are all different, therefore, according to the Lagrange interpolation rule, the client... able to receive One response The polynomial is restored in the middle. .

Images