Threshold report transmission method and system based on threshold aggregation report protocol

Abstract

A threshold report transmission method, system, medium and device based on a threshold aggregation report protocol, in the method, each server generates a local seed, and an auxiliary server generates two copied shuffling result shares by using a shuffling function, and generates two random value shares by using an exclusive or homomorphic pseudo-random function; calculating preprocessing OT association according to shuffling result sharing and random value sharing, wherein each server calculates a mask value share according to a local seed; the client reconstructs a mask value according to the mask value share, blind processing is conducted on input data through the mask value, the calculation server conducts random sorting on blind input through a secret sharing shuffling protocol, and an input table and a random value after shuffling are generated; the calculation server converts Boolean sharing of the input table and the random value into corresponding arithmetic sharing according to the preprocessing OT association; and the computing server generates a threshold encryption key based on the random number of each bit in arithmetic sharing, and encrypts the blind input to obtain a chained ciphertext.

Description

Technical Field

[0001] This invention relates to the field of data privacy protection technology, and in particular to a threshold report transmission method, system, medium and device based on a threshold aggregation report protocol. Background Technology

[0002] In the era of big data, threshold reporting has become a key technology in data processing and analysis, especially important in distributed systems such as web services, where it can extract group-level features from a large number of dispersed data sources. For example, system vendors often analyze logs from clients to identify crash events, thereby guiding system updates and mitigating backdoor risks. Each user uploads their local measurements to a reporting server, which then identifies frequently occurring data items, known as heavy hitters. However, direct access to users' personal data raises serious privacy concerns; a malicious server could infer user behavior from uploaded logs. To strike a balance between utility and privacy, secure aggregation techniques for heavy hitter detection have emerged. These techniques allow servers to aggregate user input but cannot access the plaintext data of individual users, ensuring that attackers can only obtain the final statistical results and not further information. Although existing methods have made progress on privacy issues, two key challenges remain to be addressed.

[0003] The first problem is that existing threshold reporting protocols remain vulnerable to attacks by malicious servers, meaning servers could manipulate or tamper with statistical results. In fact, centralized trust models inevitably lead to the non-ignoring leakage of private inputs. Therefore, most researchers employ a dual-server architecture to address the problem of improper centralized behavior and establish a distributed trust model. However, the dual-server model still cannot fully guarantee system robustness. For example, in a dual-server aggregation like Prio, a malicious reporting server could claim not to have received data from certain clients, thus biasing the final statistical results. In contrast, in asymmetric server architectures like Popstar, malicious behavior by a random server can lead to inaccurate reporting results. Although the recent study Vogue points out that recurrence detection relies on multi-party computation (MPC), it still lacks robustness. Aggressive attackers can still manipulate reporting results by denying receiving client input. Therefore, the robustness of the reporting scheme is a key property for resisting aggressive attackers and ensuring accurate acquisition of recurrence items.

[0004] The second challenge lies in designing a lightweight, one-off client protocol. This is especially important in distributed environments because client devices are often unstable or experience connection drops. Protocols requiring extensive communication or multiple rounds of interaction can easily exceed client bandwidth limits, leading to low participation rates. Existing solutions like Popstar rely on OPRF (Transparent Pseudo-Random Function) interactions with a random server, resulting in a computational complexity of O(log n). Subsequently, the client must also compute the threshold ciphertext locally and upload it through an anonymous proxy, further increasing the computational and communication burden. Some recent studies have used MPC-based frameworks to reduce client load. However, these methods often neglect scalability and robustness when handling large input sizes.

[0005] To address the aforementioned issues, there is an urgent need for a threshold aggregation protocol that can guarantee data privacy while simultaneously being efficient, robust, and having low client-side overhead, in order to support practical deployment and anti-attack requirements.

[0006] The information disclosed in the background section is only for enhancing the understanding of the background of this invention, and therefore may contain information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0007] This invention provides a threshold report transmission method, system, medium, and device based on a threshold aggregation report protocol, which solves the problems of low transmission efficiency, poor robustness of threshold aggregation reports, and high client overhead in the prior art.

[0008] A threshold report transmission method based on a threshold aggregation report protocol includes:

[0009] Each server generates a local seed, and the server includes one auxiliary server and two computing servers;

[0010] The auxiliary server uses a shuffle function to generate two copies of the shuffle result for sharing, and uses an XOR homomorphic pseudo-random function to generate two copies of the random value for sharing.

[0011] Calculate the preprocessed OT association based on the shuffle result sharing and the random value sharing, and send the preprocessed OT association to the two computing servers;

[0012] Each server calculates a mask value share based on the local seed and sends the mask value share to the corresponding client;

[0013] The client reconstructs the mask value based on the mask value share, uses the mask value to perform blinding processing on the input data to obtain blinded input, and transmits the blinded input to all the servers;

[0014] The computing server uses a secret sharing shuffling protocol to randomly sort the blinded inputs, generating a shuffled input table and random values.

[0015] The computing server converts the Boolean sharing of the input table and the random value into the corresponding arithmetic sharing based on the preprocessed OT association;

[0016] The computing server generates a threshold encryption key based on the random number of each bit in the arithmetic sharing, and uses the threshold encryption key to encrypt the blinded input to obtain chained ciphertext.

[0017] In the threshold report transmission method based on the threshold aggregation report protocol, after receiving the preprocessed OT association, the computing server jointly verifies the correctness of the preprocessed OT association through a consistency check.

[0018] In the threshold report transmission method based on the threshold aggregation report protocol, the mask value share has three parts, two of which are held by two servers, and the third server holds the hash value of the third mask value share.

[0019] In the threshold report transmission method based on the threshold aggregation report protocol, the client reconstructs the mask value by selecting a majority of the mask value shares after receiving the mask value shares.

[0020] In the threshold report transmission method based on the threshold aggregation report protocol, after receiving the blinded input, the server performs a consistency check on the blinded input and discards any inconsistent blinded inputs.

[0021] In the threshold report transmission method based on the threshold aggregation report protocol, during the conversion process, the auxiliary server generates Beaver triples and updates the preprocessed OT association. The computing server verifies the Beaver triples and the updated OT association. After the verification is successful, the computing server uses bitwise multiplication to convert the Boolean sharing to the arithmetic sharing.

[0022] In the threshold report transmission method based on the threshold aggregation report protocol, the method by which the calculation server generates the threshold encryption key includes:

[0023] Generate four polynomials of degree t for each bit;

[0024] A selector is constructed using shared multiplication, and the polynomial is selected using the selector to generate the threshold encryption key.

[0025] A system for implementing the method includes:

[0026] A server is used to generate a local seed. The server includes an auxiliary server and two computing servers. The auxiliary server generates two copies of the shuffle result sharing using a shuffle function and generates two copies of the random value sharing using an XOR homomorphic pseudo-random function. The auxiliary server calculates a preprocessed OT association based on the shuffle result sharing and the random value sharing, and sends the preprocessed OT association to the two computing servers. Each server is also used to calculate a mask value share based on the local seed.

[0027] A client is configured to receive the mask value share, reconstruct the mask value based on the mask value share, perform blinding processing on the input data using the mask value to obtain blinded input, and transmit the blinded input to all the servers.

[0028] The computing server uses a secret sharing shuffling protocol to randomly sort the blinded input, generating a shuffled input table and random values; the computing server converts the Boolean sharing of the input table and the random values ​​into a corresponding arithmetic sharing based on the preprocessed OT association; the computing server generates a threshold encryption key based on the random number of each bit in the arithmetic sharing, and uses the threshold encryption key to encrypt the blinded input to obtain chained ciphertext.

[0029] A computer storage medium including computer instructions that, when run on a computer, cause the computer to perform the method.

[0030] An electronic device, the electronic device comprising:

[0031] Memory, processor, and computer programs stored in memory and executable on the processor, wherein,

[0032] The processor implements the method when executing the program.

[0033] Compared with existing technologies, this invention has the following advantages: This invention proposes a distributed XOR homomorphic pseudorandom function generator based on secret-shared shuffling. This generator supports shared input and shared output, and can be used for concurrent computation. More attractively, it inherits the robustness and information security of the secret-shared shuffling primitive. A three-party computation framework based on replicated secret sharing (RSS) is proposed, which not only maintains robustness but also improves practical efficiency by nearly one-third. Furthermore, this framework is robust, guaranteeing output delivery and input inclusion. In other words, even in the event of an active attacker launching an in-protocol denial-of-service (DoS) or biased attack, the correctness of the reported results can be ensured.

[0034] A robust and efficient threshold reporting scheme is proposed, enabling one-time interactive client communication via a lightweight protocol. In terms of total runtime, this method is 6 times faster than state-of-the-art centralized schemes when processing long input bits, while maintaining lower client communication load. Attached Figure Description

[0035] Various other advantages and benefits of the present invention will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiments below. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. It is obvious that the drawings described below are merely some embodiments of the invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. Furthermore, the same reference numerals denote the same parts throughout the drawings.

[0036] In the attached diagram:

[0037] Figure 1 A flowchart of a threshold report transmission method based on a threshold aggregation report protocol provided in an embodiment of the present invention.

[0038] The present invention will be further explained below with reference to the accompanying drawings and embodiments. Detailed Implementation

[0039] Specific embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While specific embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0040] It should be noted that certain terms are used in the specification and claims to refer to specific components. Those skilled in the art will understand that different terms may be used to refer to the same component. This specification and claims do not distinguish components based on differences in terminology, but rather on differences in function. The terms "comprising" or "including" used throughout the specification and claims are open-ended and should be interpreted as "comprising but not limited to." The following descriptions are preferred embodiments for carrying out the invention; however, these descriptions are for the purpose of understanding the general principles of the specification and are not intended to limit the scope of the invention. The scope of protection of this invention is determined by the appended claims.

[0041] To facilitate understanding of the embodiments of the present invention, further explanations and descriptions will be provided below with reference to the accompanying drawings and specific embodiments. The accompanying drawings do not constitute a limitation on the embodiments of the present invention.

[0042] like Figure 1 As shown, the threshold report transmission method based on the threshold aggregation report protocol includes the following steps:

[0043] Each server generates a local seed, and the server includes one auxiliary server and two computing servers;

[0044] The auxiliary server uses a shuffle function to generate two copies of the shuffle result for sharing, and uses an XOR homomorphic pseudo-random function to generate two copies of the random value for sharing.

[0045] Calculate the preprocessed OT (blind transformation) association based on the shuffle result sharing and the random value sharing, and send the preprocessed OT association to the two computing servers;

[0046] Each server calculates a mask value share based on the local seed and sends the mask value share to the corresponding client;

[0047] The client reconstructs the mask value based on the mask value share, uses the mask value to perform blinding processing on the input data to obtain blinded input, and transmits the blinded input to all the servers;

[0048] The computing server uses a secret sharing shuffling protocol to randomly sort the blinded inputs, generating a shuffled input table and random values.

[0049] The computing server converts the Boolean sharing of the input table and the random value into the corresponding arithmetic sharing based on the preprocessed OT association;

[0050] The computing server generates a threshold encryption key based on the random number of each bit in the arithmetic sharing, and uses the threshold encryption key to encrypt the blinded input to obtain chained ciphertext.

[0051] In a preferred embodiment of the threshold report transmission method based on the threshold aggregation report protocol, after receiving the preprocessed OT association, the computing server jointly verifies the correctness of the preprocessed OT association through a consistency check.

[0052] In a preferred embodiment of the threshold report transmission method based on the threshold aggregation report protocol, the mask value share has three parts, two of which are held by two of the servers, and the third server holds the hash value of the third mask value share.

[0053] In a preferred embodiment of the threshold report transmission method based on the threshold aggregation report protocol, the client reconstructs the mask value by selecting a majority of the mask value shares after receiving the mask value shares.

[0054] In a preferred embodiment of the threshold report transmission method based on the threshold aggregation report protocol, after receiving the blinded input, the server performs a consistency check on the blinded input and discards any inconsistent blinded inputs.

[0055] In a preferred embodiment of the threshold report transmission method based on the threshold aggregation report protocol, during the conversion process, the auxiliary server generates Beaver triples and updates the preprocessed OT association. The computing server verifies the Beaver triples and the updated OT association. After successful verification, the computing server converts the Boolean sharing to the arithmetic sharing using bitwise multiplication.

[0056] In a preferred embodiment of the threshold report transmission method based on a threshold aggregation report protocol, the method by which the computing server generates the threshold encryption key includes:

[0057] Generate four polynomials of degree t for each bit;

[0058] A selector is constructed using shared multiplication, and the polynomial is selected using the selector to generate the threshold encryption key.

[0059] A system for implementing the method includes:

[0060] A server is used to generate a local seed. The server includes an auxiliary server and two computing servers. The auxiliary server generates two copies of the shuffle result sharing using a shuffle function and generates two copies of the random value sharing using an XOR homomorphic pseudo-random function. The auxiliary server calculates a preprocessed OT association based on the shuffle result sharing and the random value sharing, and sends the preprocessed OT association to the two computing servers. Each server is also used to calculate a mask value share based on the local seed.

[0061] A client is configured to receive the mask value share, reconstruct the mask value based on the mask value share, perform blinding processing on the input data using the mask value to obtain blinded input, and transmit the blinded input to all the servers.

[0062] The computing server uses a secret sharing shuffling protocol to randomly sort the blinded input, generating a shuffled input table and random values; the computing server converts the Boolean sharing of the input table and the random values ​​into a corresponding arithmetic sharing based on the preprocessed OT association; the computing server generates a threshold encryption key based on the random number of each bit in the arithmetic sharing, and uses the threshold encryption key to encrypt the blinded input to obtain chained ciphertext.

[0063] A computer storage medium including computer instructions that, when run on a computer, cause the computer to perform the method.

[0064] An electronic device, the electronic device comprising:

[0065] Memory, processor, and computer programs stored in memory and executable on the processor, wherein,

[0066] The processor implements the method when executing the program.

[0067] In one embodiment, this solution is applied to a log threshold reporting scenario in a distributed system. The client collects abnormal or crash events locally and maps these events to an identifier in a preset event set, thereby generating reporting data where only values ​​at the corresponding identifier positions are valid, and values ​​at other positions are invalid. The client splits the reported data based on a random perturbation mechanism, generating at least two data components, which are then sent to different aggregation nodes. Simultaneously, the client generates verification information to indicate that the reported data meets preset format constraints, enabling the aggregation nodes to verify data validity without parsing the specific event content. After successful verification, each aggregation node accumulates the received data components and performs a synthesis operation to obtain the statistical result of the corresponding event. When the statistical result of an event exceeds a preset threshold, the event is identified as a high-frequency event and output for system analysis. Through this technical solution, effective identification of high-frequency events is achieved without directly obtaining the specific abnormal event content from the client, thereby reducing the risk of user data leakage while ensuring the accuracy of threshold reporting results and system availability.

[0068] In one embodiment, the method includes: an auxiliary server generating a shuffle result share and a random value share; then calculating a preprocessed OT association; each server sending a calculated mask value share to the corresponding client; the client reconstructing the mask value and blinding the input data to obtain a blinded input; the calculation server randomly sorting the blinded input to generate an input table and random values; the calculation server converting the Boolean share of the input table and random values ​​into an arithmetic share; and the calculation server generating a threshold encryption key based on the random number of each bit, using the threshold encryption key to encrypt the blinded input. This invention utilizes the preprocessed OT association, Beaver triples, and mechanisms such as shuffling, transformation, and key chain generation to effectively achieve single-round client interaction, secure ciphertext construction, and robust statistical identification. To securely identify recurring terms, this invention modifies the traditional MPC protocol into an efficient three-party framework. Furthermore, this invention proposes an XOR homomorphic pseudo-random function (PRF) generator to determine the randomness of the input share. For complex computational circuits, this invention combines preprocessing computation with locally invisible correlations to accelerate online computation. Specifically, this invention allocates one server as an auxiliary server to generate correlations that support robust online computation. Finally, this invention also introduces a "player elimination framework" to ensure successful output delivery.

[0069] In one embodiment, after obtaining the chained ciphertext, the computing server sends the shared portion of the chained ciphertext to the auxiliary server. The auxiliary server performs a consistency verification on the shared portion. If the verification fails, the auxiliary server broadcasts a command message and then enters the player elimination stage. If the verification passes, the auxiliary server combines the shared portion and restores it to plaintext form.

[0070] Figure 1 This embodiment provides a flowchart of a threshold report transmission method based on a threshold aggregation report protocol. The embodiment provides a threshold report transmission method based on a threshold aggregation report protocol, including:

[0071] S100, each server generates a local seed, and the server includes one auxiliary server and two computing servers.

[0072] For example, the auxiliary server is referred to as S1, and the two computing servers are referred to as S2 and S3 respectively. The generated local seed is denoted as and , i,j,k∈[1,3], and i≠j≠k, s ij and s ik Server S iFor server S j and server S k The generated local seed.

[0073] S110, the auxiliary server uses the shuffle function. Two copies of the shuffle result are generated and shared, and two random values ​​are generated and shared using an XOR homomorphic pseudo-random function.

[0074] For example, the XOR homomorphic pseudo-random function is based on the function The function is defined as follows:

[0075]

[0076] in, Represents binary strings The uth column, This indicates the concatenation of binary strings. It is a bitwise XOR operation. This refers to the number of bits in the input data, especially the data input from the client. Use the function... The motivation stems from the following key observations:

[0077]

[0078]

[0079]

[0080] Where n is the number of clients in the system, and the symbol is... This indicates a bitwise NOT operation. It is a random permutation on the column. For the data input by the z-th client, [ ]1 refers to The share is secretly shared with server 1.

[0081] It is important to note that It is a surjective function that maintains XOR homomorphism. However, if random permutations are used... Information leakage may still occur. To address this issue, this invention also employs a shuffling function. The bit string is reordered in a privacy-preserving manner. If the input data consists entirely of zeros, this invention will reorder the bit string in the function call. Previously, the invert operation was applied. And repeat this process. Combined with the shuffle function. To ensure security, this invention constructs a multi-layered surjective function, randomly distributed in space. superior.

[0082] S120 calculates the preprocessed OT association based on the shuffle result sharing and random value sharing, and sends the preprocessed OT association to the two computing servers.

[0083] For example, after receiving the preprocessed OT association, the compute server jointly verifies the correctness of the preprocessed OT association through a consistency check. Only after the consistency check passes will the next step be performed.

[0084] S130: Each server calculates the mask value share based on the local seed and sends the mask value share to the corresponding client.

[0085] For example, the mask value share has three copies, two of which are held by two servers, and the third server holds the hash value of the third mask value share.

[0086] Specifically, server To the client The share of the transmitted mask value is represented as follows:

[0087]

[0088] in, For mask value, , and For three mask value shares, For mask value share The hash value.

[0089] S140, the client reconstructs the mask value based on the mask value share, uses the mask value to perform blinding processing on the input data, obtains the blinded input, and transmits the blinded input to all servers.

[0090] For example, the client uses the following formula to blind the input data:

[0091]

[0092] in, For the client The original input data, This is for blind input.

[0093] In an embodiment of the present invention, after receiving the mask value shares, the client reconstructs the mask value by selecting the majority of the mask value shares.

[0094] S150, the computing server uses a secret sharing shuffling protocol to randomly sort the blinded input, generating a shuffled input table and random values.

[0095] For example, after receiving blinded input, the server performs a consistency check on the blinded input and discards inconsistent blinded input.

[0096] Therefore, after the consistency check and discarding of the blinded input, the computing server obtains a consistent blinded input, and can then call the shuffle function. Randomly reorder the consistent blinded input to generate a shuffled input table. and corresponding random values Specifically, the input table Independent of the blind input, these input tables will be stored in the auxiliary server S1, while the computing server... and The input table will be obtained. and .

[0097] S160, the computing server converts the Boolean share of the input table and random values ​​into the corresponding arithmetic share based on the preprocessed OT association.

[0098] For example, during the conversion process, the auxiliary server S1 generates Beaver triples and updates the preprocessed OT associations. The compute server verifies the Beaver triples and the updated OT associations. After the verification is successful, the compute server uses bitwise multiplication to convert Boolean sharing to arithmetic sharing.

[0099] Specifically, let Represents the shuffling function The vth row of the shuffle table used. Indicated by server and server Boolean sharing of jointly held shares This represents the corresponding randomness generated by the XOR homomorphic pseudo-random function, which is determined by the set of servers. Hold. To help the server. Conversion and sharing, server Execution function This is used to update the preprocessed OT association, thereby obtaining the local OT association.

[0100] because It is also an untrusted server, therefore it needs to be... and Additional validation is performed to ensure the correctness of the generated local OT associations. Specifically, if the following equation holds, the local OT association can be considered correct with overwhelming probability:

[0101]

[0102] in, ∈ From a finite field The value t is selected randomly. v and q v For about The random correlation coefficient, For random offsets, For input table The bits.

[0103] Once verification is successful, the server can be overwhelmedly certain of the correctness of these local OT associations. The computation server will then discard the last half of the set. and Then, the computing server continues the conversion from Boolean sharing to arithmetic sharing using bitwise multiplication. Specifically, Act as an OT server and call functions. To execute the bitwise multiplication protocol.

[0104] On the server and The verification process between them is as follows: server First, let's start with finite fields. Generate a random offset For the input table Each bit OT association also includes two sets and The two satisfy the following relationship: The superscript i indicates that server S i Hold, or conversely, by server S j hold.

[0105] After bitwise multiplication, the server and Arithmetic sharing can be obtained Then, the computing server uses the following equation to transform the shared data:

[0106]

[0107] in, Indicates arithmetic sharing. for The o-th bit, For server S j Holding Arithmetic sharing of the o-th bit, For servers S1 and S i Holding Arithmetic sharing of the o-th bit, For server Sj Holding Boolean sharing of the o-th bit, For servers S1 and S i Holding Boolean sharing of the o-th bit, For server S i and S j Holding Boolean sharing of the o-th bit, For servers S1 and S j Holding Boolean sharing of the o-th bit.

[0108] Arithmetic sharing and Boolean sharing satisfy the following:

[0109]

[0110] However, if the server If the attack is malicious, fairness cannot be guaranteed. To address this issue, the computing server will execute functions in parallel. and .

[0111] Finally, the computation server obtains arithmetic sharing in the form of addition sharing, as shown below:

[0112] server get ;

[0113] server get ;

[0114] server get .

[0115] in, This is the z-th row of the shuffle table. To be The result obtained after inputting the XOR homomorphic pseudo-random function Held by servers S1 and S2 A secret share, Held by servers S1 and S2 A secret share, Held by server S2 Another secret share, Held by server S2 Another secret share, Held by servers S1 and S3 A secret share, Held by servers S1 and S3 A secret share, Held by server S3 Another secret share, Held by server S3 Another secret share.

[0116] S170, the computing server generates a threshold encryption key based on the random number of each bit in the arithmetic sharing, and uses the threshold encryption key to encrypt the blinded input to obtain chained ciphertext.

[0117] For example, the distributed homomorphic pseudo-random function used in the embodiments of the present invention is denoted as The computing server can utilize blind input. and distributed homomorphic pseudorandom functions They jointly compute the chain of ciphertext required.

[0118] The calculated chain-like ciphertext structure includes:

[0119]

[0120] in, The identifier used for chain key derivation. For secret sharing of polynomials of degree t, It is a ciphertext, in which each (for The next tag is encrypted using a key derived from the previous polynomial secret share, along with its corresponding polynomial secret share. The encrypted result includes the client input, where d is the number of threshold prefix encryption attempts, C is... (the meaning of the parameters needs to be supplemented; the above formula shows...) (This is C here).

[0121] In an embodiment of the present invention, the method for calculating the threshold encryption key generated by the server includes:

[0122] Generate four polynomials of degree t for each bit;

[0123] A selector is constructed using shared multiplication, and the selector is used to select a polynomial to generate a threshold encryption key.

[0124] Specifically, let Indicates table sharing In line s', the calculation server calculates based on random values. For each prefix bit, the threshold encryption key is calculated d times. The computation server first locally calculates four [keys] for each input bit. A polynomial of order X. Specifically, the server Calculate the set of polynomials:

[0125]

[0126] in, and From the server and The polynomials derived from the held key correspond to respectively The case where the bit is 1 or 0.

[0127] Due to polynomials and random bits Since these are all secretly shared values, the server must choose the appropriate polynomial without revealing their values. To address this, the present invention utilizes shared multiplication to construct a simple selector. The selector Allow server based on Efficiently calculate the value or Sharing. Definition For the protocol, the server As an OT server The evaluation is conducted on the server. For example, the servers jointly compute. On the assessment:

[0128] server enter and

[0129] server enter and

[0130] at last, Will Add to its output to obtain ,and Will Add to its output to obtain .

[0131] It is important to note that the selector A large number of Beaver triples are required. To reduce computational complexity, this invention delegates the generation of these triples to a server. Then, the server and The correctness of these triples can be verified using triple sacrifice. Since the generation and verification of these triples are independent of the shared input values, they can be computed offline in advance.

[0132] However, the calculation results In each layer, only the current bit is considered, not the complete prefix of the input. Therefore, this invention first uses a length of... The input is divided into Each segment contributes to the construction of the prefix encryption key through linear combination. To mitigate the risk of combinational errors, this invention employs two different linear constructions: Used to derive the prefix key for each layer. For efficient key propagation, this method enhances security while maintaining computational efficiency. These are random sampled values ​​used for protection. , It is a random polynomial of order t.

[0133] After obtaining the chained ciphertext, the computing server records the shared portion of the chained ciphertext as... The data is sent to the auxiliary server, which performs a consistency verification on the shared data. If the verification fails, the auxiliary server broadcasts the command information and then enters the player elimination phase. If the verification passes, the auxiliary server combines the shared data and restores it to plaintext form.

[0134] auxiliary server The consistency of the received shared portion is verified by evaluating the following equation. The key homomorphic pseudo-random function may introduce a bit noise for each addition operation. Therefore, during blinding, this invention left-shifts the input bit string so that the consistency check can skip these noise bits.

[0135]

[0136] in, The shared portion of the chained ciphertext of computing server S3, which is recorded by the auxiliary server.

[0137] If the equation does not hold, the server An accusation message will be broadcast:

[0138]

[0139] in, and They are respectively and The hash value.

[0140] Then the player elimination phase begins. Conversely, if the results are the same, The ciphertext will be revealed by combining and restoring the shared portions to plaintext form.

[0141] In practice, input data may exceed 256 bytes or more. To improve scalability, this invention modifies the XOR homomorphic pseudorandom function from a bijective mapping to a surjective mapping. This adjustment reduces computational overhead, especially for the most expensive operations. However, this operation introduces additional communication costs, which increase linearly with the size of the pseudo-random function output. To address this issue, this invention reduces the output bit length through the following steps:

[0142] Each server derives a copy from the local seed. Bit initialization vector ,in For safety parameters;

[0143] Input messages are divided into A block, denoted as Each block is Bit;

[0144] Server initialization And iteratively calculate ;

[0145] Finally, the server reveals the output. .

[0146] Although the surjectivity of the modified XOR homomorphic pseudorandom function may lead to collisions, the probability of collisions remains negligible. Specifically, by applying birthday bounds, for a 128-bit pseudorandom function... The output shows that the probability of a collision is approximately [value missing]. This is acceptable and suitable for actual deployment.

[0147] This invention also provides a threshold report transmission system based on a threshold aggregation report protocol, the system comprising:

[0148] The server is used to generate a local seed. The server includes one auxiliary server and two computing servers. The auxiliary server generates two copies of the shuffle result sharing using a shuffle function and generates two copies of the random value sharing using an XOR homomorphic pseudo-random function. The auxiliary server calculates the preprocessed OT association based on the shuffle result sharing and the random value sharing, and sends the preprocessed OT association to the two computing servers. Each server is also used to calculate the mask value share based on the local seed.

[0149] The client receives the mask value share, reconstructs the mask value based on the mask value share, performs blinding processing on the input data using the mask value, obtains the blinded input, and transmits the blinded input to all servers;

[0150] The computing server uses a secret-sharing shuffling protocol to randomly sort the blinded input, generating a shuffled input table and random values. The computing server converts the Boolean sharing of the input table and random values ​​into the corresponding arithmetic sharing based on the preprocessed OT association. The computing server generates a threshold encryption key based on the random number of each bit in the arithmetic sharing, and uses the threshold encryption key to encrypt the blinded input to obtain chained ciphertext.

[0151] Furthermore, a three-party framework consisting of one auxiliary server and two computation servers was constructed. The auxiliary server does not participate in the final aggregation computation, but is only responsible for generating strong consistency preprocessing correlations offline (such as shuffling result sharing, random value sharing, and OT correlation), thereby separating complex nonlinear operations (such as Boolean to arithmetic sharing conversion) from the online stage. This role separation not only improves the computational efficiency of the online stage (actual speedup of nearly 1 / 3), but more importantly, it introduces a "player elimination" fault tolerance mechanism—when a computation server behaves abnormally, the auxiliary server can initiate an accusation through consistency verification and remove it, ensuring that even if there is an active malicious party, the system can still correctly output the aggregation result, achieving input consistency and output delivery. Traditional PRFs rely on trusted third parties or expensive OPRF interactions, while this invention designs a distributed XOR homomorphic pseudo-random function that supports shared input and shared output. This function combines shuffling and bit-inverting operations to achieve surjective mapping under an information-theory-secure secret sharing model, ensuring both the unpredictability of the blinding mask and avoiding the single point of failure risk brought by a centralized random source. More importantly, its XOR homomorphic property allows blinded inputs from multiple clients to be directly superimposed on the server without revealing individual information, laying the foundation for efficient aggregation later. Clients only need to perform one operation: receiving mask shares, locally reconstructing the mask, blinding the input, and uploading. This eliminates the need for multiple rounds of interaction with the server or complex cryptographic operations (such as OPRF or homomorphic encryption). The mask value is distributed through a secret sharing among the three parties, and the client only needs to perform a simple XOR operation to complete the blinding process. The communication overhead is constant and independent of the input dimension. This design significantly reduces resource requirements for unstable terminal devices (such as mobile clients) and significantly improves participation rate and availability in actual deployments. By using an auxiliary server to pre-generate and verify OT associations and Beaver triples, high-communication-overhead nonlinear operations (such as AND gates) are moved to the offline stage. In the online stage, the computation server only needs to perform local bitwise multiplication and addition to complete the conversion from Boolean sharing to arithmetic sharing, greatly reducing the number of online communication rounds and computation latency. This mechanism is particularly suitable for handling long bit string inputs (such as URLs or crash logs), achieving high scalability while maintaining security.

[0152] A threshold encryption key is dynamically generated based on the randomness of each bit in the arithmetic sharing, and a chained ciphertext structure is constructed, ensuring that only servers with sufficient share can decrypt the aggregation result. Simultaneously, a left-shift operation is introduced into the consistency check to skip low-bit noise that might be introduced by the homomorphic PRF, ensuring the robustness of the verification logic. If an inconsistency is detected, the system automatically triggers a player elimination process to prevent malicious servers from manipulating statistical results by selectively discarding data.

[0153] Although embodiments of the present invention have been described above in conjunction with the accompanying drawings, the present invention is not limited to the specific embodiments and application fields described above. The specific embodiments described above are merely illustrative and instructive, and not restrictive. Those skilled in the art can make many other forms based on the guidance of this specification and without departing from the scope of protection of the claims of the present invention, and all of these are within the scope of protection of the present invention.

Claims

1. A threshold report transmission method based on a threshold aggregation report protocol, characterized in that, Includes the following steps: Each server generates a local seed, and the server includes one auxiliary server and two computing servers; The auxiliary server uses a shuffle function to generate two copies of the shuffle result for sharing, and uses an XOR homomorphic pseudo-random function to generate two copies of the random value for sharing. Calculate the preprocessed OT association based on the shuffle result sharing and the random value sharing, and send the preprocessed OT association to the two computing servers; Each server calculates a mask value share based on the local seed and sends the mask value share to the corresponding client; The client reconstructs the mask value based on the mask value share, uses the mask value to perform blinding processing on the input data to obtain blinded input, and transmits the blinded input to all the servers; The computing server uses a secret sharing shuffling protocol to randomly sort the blinded inputs, generating a shuffled input table and random values. The computing server converts the Boolean sharing of the input table and the random value into the corresponding arithmetic sharing based on the preprocessed OT association; The computing server generates a threshold encryption key based on the random number of each bit in the arithmetic sharing, and uses the threshold encryption key to encrypt the blinded input to obtain chained ciphertext.

2. The threshold report transmission method based on the threshold aggregation report protocol according to claim 1, characterized in that, Preferably, after receiving the preprocessed OT association, the computing server jointly verifies the correctness of the preprocessed OT association through a consistency check.

3. The threshold report transmission method based on the threshold aggregation report protocol according to claim 1, characterized in that, The mask value share has three parts, two of which are held by the two servers, and the third server holds the hash value of the third mask value share.

4. The threshold report transmission method based on the threshold aggregation report protocol according to claim 1, characterized in that, After receiving the mask value shares, the client reconstructs the mask value by selecting a majority of the mask value shares.

5. A threshold report transmission method based on a threshold aggregation report protocol according to claim 1, characterized in that, After receiving the blinded input, the server performs a consistency check on the blinded input and discards any inconsistent blinded inputs.

6. A threshold report transmission method based on a threshold aggregation report protocol according to claim 1, characterized in that, During the conversion process, the auxiliary server generates Beaver triples and updates the preprocessed OT association. The computing server verifies the Beaver triples and the updated OT association. After successful verification, the computing server uses bitwise multiplication to convert the Boolean sharing to the arithmetic sharing.

7. A threshold report transmission method based on a threshold aggregation report protocol according to claim 1, characterized in that, The method by which the computing server generates the threshold encryption key includes: Generate four polynomials of degree t for each bit; A selector is constructed using shared multiplication, and the polynomial is selected using the selector to generate the threshold encryption key.

8. A system for implementing the method according to any one of claims 1-7, characterized in that, It includes: A server is used to generate local seeds, and the server includes an auxiliary server and two computing servers; The auxiliary server uses a shuffle function to generate two copies of the shuffle result for sharing, and uses an XOR homomorphic pseudo-random function to generate two copies of the random value for sharing. The auxiliary server calculates the preprocessed OT association based on the shuffle result sharing and the random value sharing, and sends the preprocessed OT association to the two calculation servers; each server is also used to calculate the mask value share based on the local seed. A client is configured to receive the mask value share, reconstruct the mask value based on the mask value share, perform blinding processing on the input data using the mask value to obtain blinded input, and transmit the blinded input to all the servers. The computing server uses a secret sharing shuffling protocol to randomly sort the blinded input, generating a shuffled input table and random values; the computing server converts the Boolean sharing of the input table and the random values ​​into a corresponding arithmetic sharing based on the preprocessed OT association; the computing server generates a threshold encryption key based on the random number of each bit in the arithmetic sharing, and uses the threshold encryption key to encrypt the blinded input to obtain chained ciphertext.

9. A computer storage medium, characterized in that, The storage medium includes computer instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-7.

10. An electronic device, characterized in that, The electronic device includes: Memory, processor, and computer programs stored in memory and executable on the processor, wherein, When the processor executes the program, it implements the method as described in any one of claims 1-7.

Images