Secure aggregation method based on secret sharing and key homomorphic pseudo-random function
By adopting a secure aggregation method based on secret sharing and key homomorphic pseudo-random functions in federated learning, the problems of high computational overhead and many communication rounds in the prior art are solved, and efficient gradient aggregation and robust user management are achieved.
Patent Information
- Application Number
- CN202510183807.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-02-19
- Publication Date
- 2025-04-15
AI Technical Summary
The existing secure aggregation method in federated learning has problems such as excessive computational overhead and excessive communication rounds, which is difficult to effectively support users' joining and users' disconnection.
A secure aggregation method based on secret sharing and key homomorphic pseudo-random functions is adopted, and the gradient data is masked by key homomorphic pseudo-random functions, and the secret sharing technology is used to manage the key to ensure the correctness and robustness of the aggregation.
By reducing computational overhead and communication interaction, the efficiency of gradient aggregation in federated learning is improved, ensuring robustness and security when users are disconnected or joined.
Smart Images
Figure CN119834976A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of data security, and in particular to a security aggregation method based on secret sharing and key homomorphic pseudo-random functions. Background Art
[0002] With the rapid development of big data and artificial intelligence technology, how to effectively use data scattered on different devices for training has become one of the key challenges to improve machine learning performance. Traditional centralized learning methods usually rely on gathering all data to a central server for processing, which not only consumes a lot of network bandwidth, but also may bring the risk of data privacy leakage. In order to solve these problems, Federated Learning (FL) as an emerging distributed machine learning method has gradually received widespread attention.
[0003] The core idea of federated learning is to distribute the model training process to each participating device, with the data retained locally and only model updates (such as gradients) transmitted to the central server. This approach can effectively avoid centralized processing of personal data, thereby significantly reducing the risk of data leakage. However, although federated learning can significantly reduce the risk of data leakage, there are still potential privacy threats. For example, the uploaded gradient information may contain traces that help reconstruct local data, or cause the global model to be damaged through attacks by malicious participants. Therefore, how to further enhance the privacy protection mechanism in federated learning has become the current research focus.
[0004] To this end, secure aggregation technology came into being. Secure aggregation ensures the privacy of gradients during upload and aggregation by cryptographic means. Specifically, the participants encrypt the gradients of their local calculations and then send the encrypted gradients to the server for aggregation. Since the encrypted gradients cannot be directly decrypted, the server cannot access the gradient information of any single participant, which effectively prevents data leakage. Existing aggregation schemes often use technologies such as homomorphic encryption or secret sharing, so that the server cannot identify the data content of individual devices even when performing aggregate calculations. The property of homomorphic encryption that can be calculated on secret data makes it a powerful solution to the security problem of federated learning, especially in the context of secure aggregation technology. Compared with schemes based on homomorphic encryption, schemes based on secret sharing have less overhead and are not affected by the noise associated with differential privacy techniques, making them a good choice for solving privacy problems in federated learning. In the article "Practical Secure Aggregation for Privacy-Preserving Machine Learning", Google researchers Bonawitz et al. proposed a novel double-masking scheme, which cleverly used the key agreement protocol to generate offsettable masks to complete secure data aggregation, and combined with secret sharing to solve the problems of user disconnection and delay, thereby improving the robustness of the federated learning scheme.
[0005] Nevertheless, the above-mentioned classic double-mask scheme and its subsequent work, such as the improvements made by Bell et al. in the 2020 article "Secure Single-Server Aggregation with (Poly) Logarithmic Overhead", all have high round complexity and the need to repeat initialization for each aggregation, resulting in a lot of computational and communication overhead. The "Flamingo: Multi-Round Single-Server Secure Aggregation with applications to Private Federated Learning" proposed by Ma et al. in 2023 can perform multiple aggregation operations after one initialization, but it also requires graph generation before each aggregation, and its efficiency also has room for further optimization. In addition, it does not seem to support the addition of new users very well. Due to its double-mask characteristics, it also incurs high computational overhead in the process of handling disconnected users.
[0006] Patent CN 116015595 A proposes a data security aggregation method for smart meters, which uses KHPRF encryption to protect the confidentiality of user data and adds Gaussian distributed noise to resist differential attacks. However, a trusted third party is introduced in the solution, and only a simple aggregation function is implemented; the solution proposed in patent CN 116388967A is also a security aggregation method suitable for smart grids. The solution expands the module of dynamic user management and uses a random exchange method to distribute keys to eliminate the reliance on trusted third parties. Summary of the invention
[0007] The purpose of the present invention is to propose a secure aggregation method based on secret sharing and key homomorphic pseudo-random functions to solve the technical problems of excessively high computational overhead and excessively high communication rounds faced by data secure aggregation under current federated learning.
[0008] Specifically, the present invention provides a security aggregation method based on secret sharing and key homomorphic pseudo-random function, comprising the following steps:
[0009] Initialization phase, sending phase, aggregation phase and management phase;
[0010] Initialization phase: distribute the client encryption key and the server decryption key through a series of communications;
[0011] Sending phase: Each client generates ciphertext through modular homomorphic operations based on the current time period, the current online user set, the encryption key obtained in the initialization phase, and the user's private data, and sends it to the server;
[0012] Aggregation phase: The server adds up the received ciphertexts to obtain the overall ciphertext; if there is no change in the number of users, it only needs to use the initialized decryption key to decrypt and obtain the sum of the user data;
[0013] Management stage: In the first three stages, if there is a client delay, disconnection, or a new user joins, it will be automatically processed to ensure the smooth completion of the above stages.
[0014] A storage medium stores instructions and data for implementing a secure aggregation method based on secret sharing and key homomorphic pseudo-random functions.
[0015] A security aggregation device based on secret sharing and key homomorphic pseudo-random functions comprises: a processor and the storage medium; the processor loads and executes instructions and data in the storage medium to implement a security aggregation method based on secret sharing and key homomorphic pseudo-random functions.
[0016] The beneficial effects provided by the present invention are: by masking the gradient data with a mask constructed by a key homomorphic pseudo-random function, the correctness of the secure aggregation is ensured by utilizing its homomorphic characteristics, a large amount of computational overhead is reduced, and communication interactions are minimized to the maximum extent, thereby improving the efficiency of gradient aggregation in federated learning. The key management uses secret sharing technology, which can not only complete the initialization setting of key generation, but also realize the sharing and reconstruction of keys, thereby ensuring the correct completion of aggregation under user disconnection and delay, and improving the robustness and applicability of the present invention. In summary, the present invention is an efficient secure aggregation solution, which is suitable for various scenarios and has a lightweight user management module. Therefore, while ensuring the security and accuracy of the aggregation results, it can also ensure the robustness of the solution when users are disconnected or new users join, as well as the security under malicious server behavior. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] Figure 1 It is a schematic diagram of the process of the method of the present invention;
[0018] Figure 2 It is an abstract schematic diagram of the secure aggregation method for federated learning scenarios of the present invention;
[0019] Figure 3 It is a schematic diagram of the working of the hardware device of an embodiment of the present invention. DETAILED DESCRIPTION
[0020] To make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described below with reference to the accompanying drawings.
[0021] Before formally describing the present invention, the scheme of the present invention is first generally described for easy understanding.
[0022] Please refer to Figure 1 , a secure aggregation method based on secret sharing and key homomorphic pseudo-random function provided by the present invention includes: an initialization phase, a sending phase, an aggregation phase and a management phase;
[0023] Initialization phase: distribute the client encryption key and the server decryption key through a series of communications;
[0024] Regarding the initialization phase, the present invention provides an embodiment as follows:
[0025] Embodiment 1:
[0026] Each client P in the client set A (|A|=N) i Generate a random number ss locally i , and use it as the secret value for (t,N) secret sharing. All the shared values obtained are And the shared value Send to client Pj ; Client P i will receive from all other clients P j Add the shared values to get the encryption key:
[0027] Please refer to Figure 2 In addition, L Decryptors (decryptors) need to be randomly selected from the client, that is, set D. Responsible for receiving the shared value of the encryption key and the mask reconstruction work in the subsequent stage. The client will then perform two secret sharing in the Decryptors set. First, P i Need to t Do it again (t d ,L) Secret sharing, all the shared values obtained are And send the corresponding value to the corresponding Decryptor. Decryptors will use the formula: The mask is reconstructed in the user management module, where is a constant related to the set of online Decryptors; secondly, the client P i 0 (t d ,L) Secret sharing, all the shared values obtained are And send the corresponding value to the corresponding Decryptor. Decryptors will use the formula:
[0028] The user management module detects and defends malicious behavior when a malicious server exists. is a constant related to the online Decryptors set; finally, each client will generate its own random number ss i Sent to the server, the server uses the following formula:
[0029]
[0030] The sum of random numbers is calculated and used for decryption operations in the subsequent aggregation phase.
[0031] The communication interactions between the above clients are all forwarded by the server, so key negotiation is required before sending all messages, and the negotiated session key is used to encrypt the messages to be sent.
[0032] The above key negotiation may adopt a traditional key exchange scheme, such as Diffie-Hellman key exchange, or may adopt a quantum-resistant key exchange, such as Kyber exchange.
[0033] At the same time, the key homomorphic pseudo-random function F is made public. And the following properties of the key homomorphic pseudo-random function are used: where t,t d ,N,L and random number ss i The value ranges of are all public parameters and will be made public before the protocol starts.
[0034] Sending phase: Each client generates ciphertext through modular homomorphic operations based on the current time period, the current online user set, the encryption key obtained in the initialization phase, and the user's private data, and sends it to the server;
[0035] Regarding the sending stage, the present invention provides an embodiment as follows:
[0036] Embodiment 2:
[0037] The server announces the client set U (|U|=n) selected from the full set A in the current aggregation round. t ), used to calculate the LIC value. Client P in set U i Using the public U, we can calculate according to the Lagrange basis polynomials That is, let x = 0 in the Lagrange basis polynomial. Therefore, LIC is a constant related to the current set of online clients. Then, using LIC and the encryption key s generated in the initialization phase, i and timestamp x t Calculate the mask: Therefore, the calculation formula of the ciphertext is: i =m i +mask i mod Where m i The private data of users that need to be aggregated in federated learning. is the modulus. Then P i The ciphertext c i Send to the server.
[0038] Aggregation phase: The server adds up the received ciphertexts to obtain the overall ciphertext; if there is no change in the number of users, it only needs to use the initialized decryption key to decrypt and obtain the sum of the user data;
[0039] Regarding the polymerization stage, the present invention provides an embodiment as follows:
[0040] Embodiment three:
[0041] After receiving the ciphertext sent by all users, the server calculates:
[0042] C=∑ i∈U c i ,
[0043] Then, using S generated in the initialization phase, the timestamp x of this aggregation t Calculate the mask required for decryption: MASK = F S (x t ),
[0044] And decrypt to get the aggregate value of the user's private data:
[0045] The proof process of its correctness is:
[0046]
[0047] Due to the homomorphic nature of secret sharing, i After secret sharing, the sum of the shared values held by each client is s i is the shared value of S, so we have
[0048] Management stage: In the first three stages, if there is a client delay, disconnection, or a new user joins, it will be automatically processed to ensure the smooth completion of the above stages.
[0049] Regarding the management stage, the present invention provides an embodiment as follows:
[0050] Embodiment 4:
[0051] When the management phase deals with honest servers, this application handles user disconnections and new users joining as follows:
[0052] User offline: The offline client set is Q. That is, when the honest server does not receive the ciphertext of any client in the client set Q within the specified time range, the server sends the client set U\Q that is still online to all Decryptors. At this time, Decryptors calculate the mask fragments of all online clients based on the shared value of the client encryption key they hold.
[0053] For example, for a Decryptor numbered k, k∈D, it needs to calculate: That is to calculate the shared value of the mask of all clients in the current online user set U\Q. This is because when a sufficient number of Decryptors are online, it can be calculated:
[0054]
[0055] Where D' is the set of currently online Decryptors, because the present invention also allows Decryptors to be offline. Since all clients have secretly shared the encryption key with the Decryptors in the set D during the initialization phase, as long as the number of online Decryptors is greater than or equal to the threshold t d The above mask can be reconstructed correctly.
[0056] A client that fails to send a message to the server within the specified time, regardless of the reason, is considered offline. According to the key homomorphic property of the key homomorphic pseudo-random function, the part of the mask of the offline user will cause the final mask to fail to be correctly offset. Therefore, in order to correctly aggregate the privacy data of other users who are still online, the present invention can reconstruct the masks of all online users. Also due to the characteristics of the key homomorphic pseudo-random function, the present invention can reconstruct the masks of all online users only once instead of one by one.
[0057] It should be noted that the solution of the present invention is also safe when the user's message is delayed by the server. This is because the present invention does not reconstruct the mask of the user whose message is delayed. Therefore, even if the server receives the user's ciphertext later, it cannot obtain any information about the user's private data from it.
[0058] User Join:
[0059] Since the present invention has distributed the encryption keys of all clients in set A during the initialization phase, as long as the ciphertext message received by the server belongs to a client in set A, it can be aggregated and decrypted like a normal solution without additional operations.
[0060] This is due to the characteristics of the Lagrange interpolation method. Specifically, as long as the user is in the legal user set A (initializing secret sharing), and a sufficient number of users (any number in [t, N]) participate in the reconstruction, the formula can be used. This is one of the reasons why our solution can perform multiple aggregations without having to reinitialize because the client set participating in each training is different.
[0061] If a new client P other than A e To join, he needs to request the random number sharing value of other clients from the server to build his own encryption key s e . And use your own encryption key s e Secret sharing is performed, and the shared value is forwarded to Decryptors through the server. Through the above operations, other old clients do not need to update their encryption keys and can participate in subsequent aggregation rounds.
[0062] As another embodiment, if the management stage deals with a malicious server, the malicious server processing process is specifically as follows:
[0063] Embodiment five:
[0064] User offline:
[0065] When the malicious server does not receive the ciphertext of any client in the client set Q within the specified time range, the server sends the client set U\Q that is still online to all Decryptors. Decryptors reconstruct the masks of all clients in the set based on the received online client set.
[0066] Unlike honest servers, malicious servers may send inconsistent sets to different Decryptors.
[0067] The possible attacks in this process are as follows:
[0068] For a specific client i, the server may request some Decryptors to reconstruct the sum of the masks of the set U\Q that includes client i, and request other Decryptors to reconstruct the sum of the masks of the set U\Q' that does not include client i, where Q-Q'=i, that is, the difference between the sets Q and Q' is client i. In this way, even if the present invention reconstructs the sum of the masks of all online clients at once instead of the masks of a single client, the present invention can still calculate the mask of client i based on the difference between the mask sums obtained by the above two reconstructions, and then obtain its plaintext m i .
[0069] In order to defend against the above malicious attacks, most of the existing work uses the "signature + voting" method to perform a round of cross-checking. After enough Decryptors reach a consensus on the current set of offline clients or online clients, further reconstruction operations are performed.
[0070] The solution of the present invention does not use signatures and voting to introduce additional interaction rounds, but adopts a method of adding verification values to verify possible malicious operations and defend against attacks.
[0071] If no malicious server provides inconsistent offline client sets to Decryptors, the check values of enough Decryptors will be automatically eliminated during the aggregation process; if there is indeed malicious attack behavior, the check values based on inconsistent offline client sets provided by Decryptors cannot be eliminated. In this way, the malicious server can only get "reconstructed mask + uneliminated check value", which means that it cannot complete the correct reconstruction operation, thus achieving the purpose of defending against malicious attacks.
[0072] Decryptors calculate the masked shards of all online clients based on the shared value of the client encryption key they hold. At the same time, they need to calculate a check value, which is also in the form of a pseudo-random function based on key homomorphism. The key is related to the shared value of 0. The key is that its input is the hash value of the set of offline users Q. For example, for a certain Decryptor j , j∈D, the test value of a disconnected user i that needs to be calculated is as follows:
[0073]
[0074] In the solution of the present invention, what needs to be recovered is the masks of all online clients. By using the key homomorphic property of KHPRF, Decryptors can recover the sum of their masks at once, and the same is true for the check value. Therefore, Decryptor j Compute a total test value:
[0075]
[0076] That is to calculate the sharing value and verification value of the mask of all clients in the current online user set U\Q.
[0077] (1) If all online Decryptors receive a consistent set of offline clients, the above check values can be "automatically offset" during the aggregation process. The correctness proof is as follows:
[0078]
[0079] Or, according to the actual situation, each Decryptor restores the sum of the masks of all online users, and the check value can be eliminated after aggregation. Its correctness is as follows:
[0080]
[0081] Where D' is the set of currently online Decryptors, because the present invention also allows Decryptors to be offline. Since all clients have secretly shared the encryption key with the Decryptors in the set D during the initialization phase, as long as the number of online Decryptors is greater than or equal to the threshold t d The above mask can be reconstructed correctly.
[0082] (2) If the Decryptors receive inconsistent sets of disconnected clients, as long as one or more Decryptors, here we assume that the Decryptor numbered Z receives a set Q' that is different from the other Decryptors, the inputs in the above correctness proof are not exactly the same, and the sum of the check values is a random number instead of zero, which will cause the check value elimination to fail, and then cause the reconstruction to fail. The possible verification process is as follows:
[0083]
[0084] A client that fails to send a message to the server within the specified time, regardless of the reason, is considered offline. According to the key homomorphic property of the key homomorphic pseudo-random function, the part of the mask of the offline user will cause the final mask to fail to be correctly offset. Therefore, in order to correctly aggregate the privacy data of other users who are still online, the present invention can reconstruct the masks of all online users. Also due to the characteristics of the key homomorphic pseudo-random function, the present invention can reconstruct the masks of all online users only once instead of one by one.
[0085] It should be noted that the solution of the present invention is also safe when the user's message is delayed by the server. This is because the present invention does not reconstruct the mask of the user whose message is delayed. Therefore, even if the server receives the user's ciphertext later, it cannot obtain any information about the user's private data from it.
[0086] Embodiment six:
[0087] See also Figure 3 , Figure 3 It is a schematic diagram of the working of the hardware device of an embodiment of the present invention, and the hardware device specifically includes: a security aggregation device 401 based on secret sharing and key homomorphic pseudo-random function, a processor 402 and a storage medium 403.
[0088] A security aggregation device 401 based on secret sharing and key homomorphic pseudo-random functions: The security aggregation device 401 based on secret sharing and key homomorphic pseudo-random functions implements the security aggregation method based on secret sharing and key homomorphic pseudo-random functions.
[0089] Processor 402: The processor 402 loads and executes instructions and data in the storage medium 403 to implement the security aggregation method based on secret sharing and key homomorphic pseudo-random function.
[0090] Storage medium 403: The storage medium 403 stores instructions and data; the storage medium 403 is used to implement the security aggregation method based on secret sharing and key homomorphic pseudo-random function.
[0091] The key points of the present invention are:
[0092] Mask construction scheme of key homomorphic pseudo-random function: The privacy protection method of the present invention utilizes the homomorphic characteristics of key homomorphic pseudo-random functions to construct a symmetric mask encryption scheme, which avoids the huge computational overhead of public key homomorphic encryption while also minimizing communication rounds and communication interactions between local users, thereby improving the efficiency of the entire training.
[0093] Lightweight disconnection processing method based on secret sharing: Considering the problems such as user disconnection delay that make it impossible to ensure the correct aggregation and privacy leakage, this solution uses two rounds of secret sharing to complete key generation and key sharing, so that when the user is disconnected or delayed, the server can reconstruct the mask of the online client to ensure the correct aggregation, which improves the robustness of the aggregation scheme. This solution reduces the complexity of reconstructing the mask to a constant level by sharing the key to a certain number of Decryptors, greatly reducing the communication and computing overhead of disconnection processing.
[0094] Therefore, the beneficial effects of the present invention are: by masking the gradient data with a mask constructed by a key homomorphic pseudo-random function, the correctness of the secure aggregation is ensured by utilizing its homomorphic characteristics, a large amount of computational overhead is reduced, and communication interactions are minimized to the maximum extent, thereby improving the efficiency of gradient aggregation in federated learning. The key management uses secret sharing technology, which can not only complete the initialization setting of key generation, but also realize the sharing and reconstruction of keys, thereby ensuring the correct completion of aggregation under user disconnection and delay, and improving the robustness and applicability of the present invention. In summary, the present invention is an efficient secure aggregation solution, which is suitable for various scenarios and has a lightweight user management module. Therefore, while ensuring the security and accuracy of the aggregation results, it can also ensure the robustness of the solution when users are disconnected or new users join, as well as security under malicious server behavior.
[0095] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims
1. A secure aggregation method based on secret sharing and key homomorphic pseudo-random function, characterized in that: include: Initialization phase, sending phase, aggregation phase and management phase; Initialization phase: distribute the client encryption key and the server decryption key through a series of communications; Sending phase: Each client generates ciphertext through modular homomorphic operations based on the current time period, the current online user set, the encryption key obtained in the initialization phase, and the user's private data, and sends it to the server; Aggregation phase: The server adds up the received ciphertexts to obtain the overall ciphertext; if there is no change in the number of users, it only needs to use the initialized decryption key to decrypt and obtain the sum of the user data; Management stage: In the first three stages, if there is a client delay, disconnection, or a new user joins, it will be automatically processed to ensure the smooth completion of the above stages.
2. A secure aggregation method based on secret sharing and key homomorphic pseudo-random function as claimed in claim 1, characterized in that: The specific process of the initialization phase is as follows: Each client P in the client set A (|A|=N) i Generate a random number ss locally i , and use it as the secret value for (t,N) secret sharing. All the shared values obtained are And the shared value Send to client P j ; Client P i will receive from all other clients P j Add the shared values to get the encryption key:
3. A secure aggregation method based on secret sharing and key homomorphic pseudo-random function as claimed in claim 2, characterized in that: The initialization phase also includes: Randomly select L Decryptors from the client as set D; set D is responsible for receiving the shared value of the encryption key and the mask reconstruction work in the subsequent stage; The client will then perform two secret sharing operations in set D; first, P i Will s i Do it again (t d ,L) Secret sharing, all the shared values obtained are And send the corresponding value to the corresponding Decryptor; Decryptor uses the formula: The mask is reconstructed in the user management module, where is a constant related to the online set D; secondly, the client P i 0 (t d ,L) Secret sharing, all the shared values obtained are And send the corresponding value to the corresponding Decryptor; Decryptors use the formula: Malicious behavior detection and defense are performed during the management phase when malicious servers exist. is a constant related to the online set D; Finally, each client will generate its own random number ss i Sent to the server, the server uses the following formula: The sum of random numbers is calculated and used for decryption operations in the subsequent aggregation phase.
4. A secure aggregation method based on secret sharing and key homomorphic pseudo-random function as claimed in claim 1, characterized in that: During the initialization phase, all communication interactions between clients are forwarded through the server. Key negotiation is performed before all messages are sent, and the negotiated session key is used to encrypt the messages to be sent. The key negotiation uses Diffie-Hellman key exchange and Kyber exchange, and the key homomorphic pseudo-random function F is disclosed at the same time.
5. A secure aggregation method based on secret sharing and key homomorphic pseudo-random function as claimed in claim 3, characterized in that: The specific process of the sending phase is as follows: The server announces the client set U (|U|=n) selected from the full set A in the current aggregation round. t ), used for calculation of LIC value; Client P in set U i Using the public U, we can calculate according to the Lagrange basis polynomials Then, the encryption key s generated in the initialization phase is used by LIC. i and timestamp x t Calculate the mask: The calculation formula of the ciphertext is: Where m i The private data of users that need to be aggregated in federated learning. is the modulus; then P i The ciphertext c i Send to the server.
6. A secure aggregation method based on secret sharing and key homomorphic pseudo-random function as claimed in claim 5, characterized in that: The specific process of the aggregation stage is as follows: After receiving the ciphertext sent by all users, the server calculates: C = ∑ i∈U c i ; Then, using S generated in the initialization phase, the timestamp x of this aggregation t Calculate the mask required for decryption: MASK = F S (x t ), And decrypt to get the aggregate value of the user's private data:
7. A secure aggregation method based on secret sharing and key homomorphic pseudo-random function as claimed in claim 6, characterized in that: The process of handling user disconnection in the management phase is as follows: Suppose the set of offline clients is Q. When the honest server does not receive the ciphertext from any client in the client set Q within the specified time range, the server sends the set of clients that are still online, U\Q, to all Decryptors. At this time, Decryptors calculate the mask fragments of all online clients based on the shared value of the client encryption key they hold.
8. A secure aggregation method based on secret sharing and key homomorphic pseudo-random function as claimed in claim 7, characterized in that: The process of handling user joining in the management stage is as follows: If a new client P other than A e To join, it needs to request the random number sharing value of other clients from the server to build its own encryption key s e ; and use your own encryption key s e Secret sharing is performed and the shared value is forwarded to Decryptors via the server.
9. A storage medium, characterized in that: The storage medium stores instructions and data for implementing a secure aggregation method based on secret sharing and key homomorphic pseudo-random functions as described in any one of claims 1 to 8.
10. A secure aggregation device based on secret sharing and key homomorphic pseudo-random functions, characterized in that: include: Processor and storage medium; the processor loads and executes instructions and data in the storage medium to implement a secure aggregation method based on secret sharing and key homomorphic pseudo-random function as described in any one of claims 1 to 8.