Data security aggregation method, device and computer equipment supporting fault tolerance

Abstract

This application relates to a fault-tolerant data security aggregation method, apparatus, and computer device. The method includes: an aggregator generating and broadcasting public system parameters based on a high-performance elliptic curve cryptography system; collecting public keys from each participant to generate a global public key set and broadcasting it; each participant negotiating a shared session key with the other participants based on their own private key and the global public key set; generating mask data with global XOR cancellation properties through a pseudo-random function XOR operation; filling the original data into the corresponding anonymous sequence number array positions, filling the rest with zeros, and XORing it with the mask to generate an encrypted vector, which is then uploaded; the aggregator XORing all encrypted vectors bit-by-bit to cancel the mask and restore the plaintext set; if some participants time out and disconnect, the aggregator broadcasts a disconnection list, collects the mask recovery shares of online participants to generate a residual mask, and cancels it to restore the plaintext set of online participants. This method can improve data aggregation efficiency and system robustness.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data security aggregation method, apparatus and computer equipment that supports fault tolerance. Background Technology

[0002] Data aggregation refers to the collection of data from one or more data sources and processing by a central aggregator for statistical analysis. This technology is widely used in scenarios involving sensitive data, such as automatic power dispatch and load balancing in smart grids, patient health monitoring, and mobile computing. While data aggregation can significantly improve data utilization efficiency, without effective privacy protection mechanisms, sensitive information such as users' activity trajectories, social attributes, religious beliefs, and health conditions may still be analyzed, profiled, or tracked by malicious actors during the aggregation process. Therefore, how to protect individuals' raw data from leakage while achieving statistical analysis functions has become a key issue in the development of data aggregation technology.

[0003] To address the aforementioned risks, secure data aggregation aims to achieve aggregated calculations and statistical analysis of multi-source data without disclosing the original data of participating parties. This requirement is prevalent in scenarios where service providers collect and aggregate statistical information from large-scale user groups, encompassing both basic statistical tasks such as mean, variance, and histograms, and model training processes in federated learning for large-scale distributed participants. These scenarios typically share the following characteristics: the system consists of a high-performance central server and a large number of resource-constrained clients; clients usually interact with the server only through a single communication link; and disconnections are common during protocol execution due to network fluctuations, heterogeneous devices, and unstable online status. Therefore, ensuring data privacy, aggregation correctness, and system fault tolerance simultaneously in a large-scale, highly dynamic, and high-disconnection-rate environment becomes the core issue that secure data aggregation needs to address.

[0004] The paper "Learning with Privacy at Scale" (Apple Differential Privacy Team, 2017) proposes a local differential privacy scheme for end-user data collection. Its core approach is not to directly upload raw data to the server, but rather to encode, crop, and randomly perturb the data locally on the user's device before sending the perturbed result to the server. The server can only see the statistical records after probability perturbation and cannot directly reconstruct the true input of a single user, but it can recover the overall distribution characteristics under large sample conditions. To further reduce the risk of association, the scheme also incorporates engineering mechanisms such as scenario-based collection, limiting the number of daily reports, and removing device identifiers and IP information. Algorithms such as CMS, HCMS, and SFP are designed for frequency estimation and repetition term discovery, used for statistical tasks such as emoji usage and Safari preferences. This type of method is easy to deploy and highly engineered, but because privacy protection relies on noise injection, it leads to a loss of statistical accuracy, limiting its application in high-precision aggregation or model training scenarios.

[0005] The paper "Practical Secure Aggregation for Privacy-Preserving Machine Learning" (Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017: 1175–1191) proposes the classic SecAgg secure aggregation protocol. The core of this method involves clients negotiating random seeds pairwise to generate paired symmetric masks. Each client's uploaded local vector is superimposed with positive and negative masks related to other clients. After all client updates are summed on the server, the masks automatically cancel each other out due to symmetry, and the server only obtains the overall aggregate value, unable to recover any single input. To address participant disconnections, SecAgg also introduces secret sharing and recovery assistance information to eliminate residual masks even after some clients have exited. This scheme has become a representative work in federated learning secure aggregation; however, it still relies on seed negotiation, auxiliary material distribution, and disconnection recovery processes between clients. In large-scale, high-disconnection-rate scenarios, the communication and implementation complexity remains high, which is precisely the focus of subsequent improvements to secure aggregation schemes.

[0006] In summary, existing data security aggregation methods still have shortcomings in terms of accuracy, computational overhead, communication load, and fault tolerance, making it difficult to simultaneously meet the practical needs of large-scale, highly dynamic scenarios. Therefore, it is necessary to design an efficient and fault-tolerant data security aggregation method that reduces communication and computational overhead while decreasing dependence on the online status and interaction rounds of participating parties, thereby improving the overall availability and scalability of the system. Summary of the Invention

[0007] Therefore, it is necessary to provide a data security aggregation method, apparatus, and computer equipment that supports fault tolerance in response to the above-mentioned technical problems.

[0008] A fault-tolerant data security aggregation method is provided, wherein the aggregator can communicate with a random server and multiple data holders, and each participant obtains a unique and confidential anonymous sequence number through the random server. The method includes: The aggregator generates public system parameters based on a high-performance elliptic curve cryptography system and broadcasts them to all participants. It receives public keys generated and uploaded by each participant based on the public system parameters, collects all public keys, generates a global public key set, and broadcasts it to all participants. Each participant, based on its own private key and the global public key set, negotiates with all other participants to generate a session key shared between each other. Then, based on all the session keys it holds, it generates mask data by XORing the pseudo-random function values. The mask data has global XOR cancellation properties. Each participant fills the original input data into the array position corresponding to its own anonymous sequence number, fills the remaining positions of the array with zero values, and then performs full encryption of the mask data and the array through bit-by-bit XOR operation to generate an encryption vector and upload it to the aggregator. The aggregator receives the encrypted vectors uploaded by all participants, performs a bitwise XOR aggregation operation on all encrypted vectors, and uses the global XOR cancellation property of the mask data to cancel the mask data, thus restoring the original plaintext set of input data of all participants. If the aggregator does not receive the encryption vectors from some participants within a preset timeout period, it broadcasts the list of offline participants to all online participants. After receiving the mask recovery share uploaded by each online participant, it performs bitwise XOR aggregation to obtain the residual mask. The aggregation result of the online participants' encryption vectors is canceled by the residual mask to restore the original plaintext set of input data from all online participants.

[0009] A fault-tolerant data security aggregation device is provided, the device being applied to an aggregator that is communicatively connected to a random server and multiple data holders, the device comprising: The parameter generation and broadcasting module is used to generate public system parameters based on the high-performance elliptic curve cryptography system and broadcast them to all participants. The public key collection module is used to receive the public keys generated and uploaded by each participant based on the public system parameters, collect all public keys, generate a global public key set, and broadcast it to all participants. The encryption vector receiving module is used to receive encryption vectors uploaded by each participant. The encryption vectors are obtained by the participants generating mask data based on the session key and encrypting the original input data. The aggregation and decryption module is used to perform bitwise XOR aggregation operations on all encrypted vectors, and use the global XOR cancellation property of the mask data to cancel the mask data and restore the original plaintext set of input data of all participants. The disconnection handling module is used to broadcast the list of disconnected participants to all online participants when the encryption vector of some participants is not received within a preset timeout period, and to receive the mask uploaded by each online participant to recover the share. The residual mask cancellation module is used to perform bitwise XOR aggregation on the mask recovery share to obtain the residual mask. The residual mask is then used to cancel the aggregation result of the online participants' encryption vectors to restore the original plaintext set of input data for all online participants.

[0010] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps: The aggregator generates public system parameters based on a high-performance elliptic curve cryptography system and broadcasts them to all participants. It receives public keys generated and uploaded by each participant based on the public system parameters, collects all public keys, generates a global public key set, and broadcasts it to all participants. Each participant, based on its own private key and the global public key set, negotiates with all other participants to generate a session key shared between each other. Then, based on all the session keys it holds, it generates mask data by XORing the pseudo-random function values. The mask data has global XOR cancellation properties. Each participant fills the original input data into the array position corresponding to its own anonymous sequence number, fills the remaining positions of the array with zero values, and then performs full encryption of the mask data and the array through bit-by-bit XOR operation to generate an encryption vector and upload it to the aggregator. The aggregator receives the encrypted vectors uploaded by all participants, performs a bitwise XOR aggregation operation on all encrypted vectors, and uses the global XOR cancellation property of the mask data to cancel the mask data, thus restoring the original plaintext set of input data of all participants. If the aggregator does not receive the encryption vectors from some participants within a preset timeout period, it broadcasts the list of offline participants to all online participants. After receiving the mask recovery share uploaded by each online participant, it performs bitwise XOR aggregation to obtain the residual mask. The aggregation result of the online participants' encryption vectors is canceled by the residual mask to restore the original plaintext set of input data from all online participants.

[0011] The aforementioned fault-tolerant data security aggregation method, apparatus, and computer equipment, by obtaining a unique and confidential anonymous sequence number for each participant, can guarantee the anonymity of the participants' identities and prevent direct association between data and participants. By generating and broadcasting public system parameters of a high-performance elliptic curve cryptography system through an aggregator, and by unifying the key negotiation standard, the consistency and security of key negotiation can be improved, and the communication load of participants can be reduced. By having participants negotiate a shared session key pairwise based on their private keys and the global public key set, and by generating mask data with global XOR cancellation properties using a pseudo-random function value XOR, data privacy protection can be achieved, laying the foundation for plaintext recovery. By having participants encrypt and generate encrypted vectors and upload them, and the aggregator performing bit-by-bit XOR aggregation operations to cancel the mask, the plaintext sets of all participants can be quickly recovered, improving aggregation efficiency. By handling participant disconnection cases through the aggregator, residual masks are generated and canceled using mask recovery shares, improving the fault tolerance capability of the scheme and adapting to unstable network scenarios. The embodiments of this invention can achieve efficient data aggregation and rapid recovery after any participant disconnection while ensuring data anonymity and privacy security, balancing aggregation efficiency and system robustness. Attached Figure Description

[0012] Figure 1 This is a system model topology diagram in one embodiment; Figure 2 This is a schematic diagram of a threat model structure for one embodiment; Figure 3 This is a flowchart illustrating a data security aggregation method that supports fault tolerance in one embodiment; Figure 4 This is a schematic diagram outlining the principle of data security aggregation in one embodiment, wherein, Figure 4 (a) is a schematic diagram of local data encryption and mask overlay by the participants. Figure 4 (b) is a schematic diagram of global data aggregation and mask cancellation in the aggregator; Figure 5 This is a schematic diagram of shared key generation in one embodiment; Figure 6 This is a diagram illustrating the scenario where a participant disconnects in one embodiment; Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0014] The method of the present invention is applied to include Each participating party ( ), 1 aggregator 1 random server The system, the system topology is as follows Figure 1 As shown, the functions of each entity are as follows: Aggregator ( ): Collects input data from each participant while ensuring anonymity, and assists each participant in generating session keys.

[0015] Random server ( Assigning a unique sequence number to each participant is fundamental to achieving anonymity. If the protocol employs a grouping optimization method, the random server is responsible for randomly grouping the participants.

[0016] Participants ( Low-resource intelligent sensing devices that hold input data And provide it anonymously to the aggregator.

[0017] In terms of network connectivity, there is a two-way communication channel between the aggregator and each participant, and a one-way communication channel between the random server and each participant. The participants do not need to know about each other's existence, so there is no need to establish communication.

[0018] It should be noted that this invention employs a semi-honest model, meaning that all entities will not deviate from the established protocol flow, will not intentionally interrupt protocol execution, and will not tamper with the calculation results at any stage, but will attempt to infer the privacy of other entities based on the information they receive. A schematic diagram of the threat model is shown below. Figure 2 As shown, any participating party Aggregator Random server All conform to the behavior described in the semi-honest model above. Aggregator Can be used with any The parties involved conspired to attempt to analyze the remaining... The privacy information of non-colluding participants (i.e., attempts to analyze the correspondence between participants and input data). The introduction of the random server, which does not collude with the aggregator, is a strong assumption. The role of the random server can be undertaken by a trusted institution or hardware provider. In this invention, the random server exits the protocol after grouping and distributing sequence numbers to the participants, and never accesses any participant's plaintext or ciphertext data throughout the entire process.

[0019] In one embodiment, such as Figure 3 As shown, a fault-tolerant data security aggregation method is provided. The aggregator can communicate with a random server and multiple data holders. Each participant obtains a unique and confidential anonymous sequence number through the random server. The method includes the following steps: Step 302: The aggregator generates public system parameters based on the high-performance elliptic curve cryptography system and broadcasts them to all participants. It receives the public keys generated and uploaded by each participant based on the public system parameters, collects all public keys, generates a global public key set, and broadcasts it to all participants.

[0020] The public system parameters are fundamental cryptographic parameters built upon the high-performance elliptic curve cryptography system, which are followed by the aggregator and all participants, and serve as the unified basis for subsequent key negotiation. The global public key set is a collection of all participants' public keys generated by the aggregator based on the public system parameters, used by all participants for session key negotiation.

[0021] It is understandable that by generating and broadcasting system parameters in a unified manner through an aggregator, all participants can conduct subsequent key operations based on a unified cryptographic standard, ensuring the consistency and effectiveness of key negotiation. At the same time, the aggregator centrally collects and broadcasts public keys without direct interaction between participants, which can significantly reduce the communication load of participants, adapt to the devices of participants with limited resources, and lay the foundation for the generation of subsequent pairwise session keys, which is conducive to improving the efficiency of the overall key negotiation process.

[0022] Step 304: Each participant, based on its own private key and global public key set, negotiates with all other participants to generate a session key shared between each other. Then, based on all the session keys it holds, it generates mask data by XORing the pseudo-random function values. The mask data has the property of global XOR cancellation.

[0023] The session key is a symmetric key shared only between the two corresponding participants, generated through negotiation between the participants' private keys and the public keys of other participants. It is the core basis for constructing the mask data. The pseudo-random function value is a pseudo-random value obtained by the participants using the session key and performing a pseudo-random function operation. The mask data is the data obtained by XORing the pseudo-random function values ​​corresponding to all the participants' session keys. Its global XOR cancellation property means that the result of a bitwise XOR operation on the mask data generated by all participants is zero.

[0024] It is understandable that generating a shared session key through pairwise negotiation can ensure the confidentiality of the key and prevent the leakage of a single key from causing the overall privacy protection to fail. Constructing mask data with global XOR cancellation properties based on the session key and pseudo-random function value can provide a secure privacy protection carrier for subsequent data encryption. At the same time, the XOR cancellation property of the mask lays the mathematical foundation for the aggregator to restore plaintext data without a key. This simplifies the decryption process of the aggregator while protecting the data privacy of the participants, which is conducive to improving the efficiency of data aggregation.

[0025] Step 306: Each participant fills the original input data into the array position corresponding to its own anonymous sequence number, fills the remaining positions of the array with zero values, and then performs full encryption of the mask data and the array through bit-by-bit XOR operation to generate an encryption vector and upload it to the aggregator.

[0026] An anonymous sequence number is a unique and confidential identifier assigned to each participant by the random server. Known only to the corresponding participant, it serves as the basis for locating the data storage location. An array is a fixed-length data structure constructed by the participants to carry the original input data, matching the total number of participants. An encryption vector is a ciphertext data structure obtained by XORing the original input data (located by the anonymous sequence number) with the masked data; it is the core data uploaded by the participants to the aggregator.

[0027] As can be understood, this step fills the original input data into the array position corresponding to the anonymous sequence number, and fills the remaining positions with zero values. This enables data position binding. Combined with the confidentiality of the anonymous sequence number, it can prevent the aggregator from associating plaintext data with specific participants, thus ensuring data anonymity. By performing full XOR encryption on the array through mask data, the original input data can be transmitted in encrypted form throughout the process, effectively preventing data from being stolen or tampered with during transmission and ensuring data transmission security. Generating an encrypted vector for unified uploading allows the aggregator to process data based on a fixed format, which is beneficial to improving the aggregator's data reception and processing efficiency.

[0028] Step 308: The aggregator receives the encrypted vectors uploaded by all participants, performs bitwise XOR aggregation on all encrypted vectors, and uses the global XOR cancellation property of the mask data to cancel the mask data, thus restoring the original plaintext set of input data of all participants.

[0029] Bitwise XOR aggregation is a process where the aggregator performs a bitwise XOR operation on the corresponding values ​​in the encrypted vectors uploaded by all participants. The original input data plaintext set is the overall set of the original input data of all participants obtained by the aggregator after canceling the mask data, preserving the original information of each participant's data.

[0030] It is understandable that the aggregator performs bitwise XOR aggregation operations on the encrypted vector, directly canceling the mask data by utilizing the global XOR cancellation property of the mask data. This eliminates the need for complex ciphertext calculation algorithms, significantly reducing the aggregator's computational overhead and improving the speed of plaintext reconstruction. Furthermore, it directly reconstructs the original plaintext set of all participants' input data, rather than a single aggregated statistical value. This allows the aggregator to efficiently perform arbitrary non-encrypted function operations in the plaintext domain, expanding the application scenarios of data aggregation and enhancing the utilization value of data. Moreover, throughout the entire reconstruction process, the aggregator remains unaware of the correspondence between the data and the participants, continuously ensuring data anonymity.

[0031] Step 310: If the aggregator does not receive the encryption vectors of some participants within the preset timeout period, it broadcasts the list of offline participants to all online participants. After receiving the mask recovery share uploaded by each online participant, it performs bitwise XOR aggregation to obtain the residual mask. The aggregation result of the online participants' encryption vectors is canceled by the residual mask to restore the original plaintext set of input data of all online participants.

[0032] The list of disconnected participants is a list of participants determined by the aggregator based on the received encryption vectors, who failed to upload encryption vectors within a preset timeout period. The mask recovery share is data generated by online participants based on their shared session key with disconnected participants, used to assist the aggregator in eliminating residual masks. Residual masks are mask data left behind due to some participants disconnecting and not participating in global mask XOR cancellation; this is the core factor preventing the direct reconstruction of the encrypted vector aggregation results from online participants.

[0033] It is understandable that by broadcasting the list of offline participants, the aggregator enables online participants to accurately know which participants need to participate in the recovery process. Online participants generate and upload mask recovery shares, allowing the aggregator to quickly restore the residual mask without re-executing the entire key negotiation and data encryption process. This effectively reduces the communication and computational overhead of offline recovery. By using the residual mask to offset the aggregation results of the online participants' encrypted vectors, the aggregator can accurately restore the original plaintext set of input data from all online participants, even when any number of participants are offline. This improves the fault tolerance and robustness of the data security aggregation solution, adapting to real-world application scenarios with network fluctuations and unstable device online status. At the same time, it can still ensure the anonymity of online participants' data during the recovery process, and the privacy protection capability will not be degraded due to offline recovery.

[0034] In the aforementioned fault-tolerant data security aggregation method, each participant obtains a unique and confidential anonymous sequence number, ensuring the anonymity of the participants and preventing direct association between data and participants. The aggregator generates and broadcasts public system parameters of a high-performance elliptic curve cryptosystem, unifying key negotiation standards, thus improving the consistency and security of key negotiation and reducing the communication load on participants. Participants negotiate a shared session key based on their private keys and the global public key set, and generate mask data with global XOR cancellation properties using a pseudo-random function value, achieving data privacy protection and laying the foundation for plaintext recovery. Participants encrypt and upload encrypted vectors, and the aggregator performs bit-by-bit XOR aggregation to cancel the mask, quickly restoring the plaintext sets of all participants and improving aggregation efficiency. The aggregator handles participant disconnection by using mask recovery shares to generate residual masks and cancel them out, enhancing the scheme's fault tolerance and adapting to unstable network scenarios. This embodiment of the invention can achieve efficient data aggregation and rapid recovery after any participant disconnection while ensuring data anonymity and privacy security, balancing aggregation efficiency and system robustness.

[0035] In one embodiment, generating public system parameters based on a high-performance elliptic curve cryptography system includes: selecting an additive cyclic group of order with a preset value constructed based on a FourQ elliptic curve; randomly selecting generators from the additive cyclic group; and using the additive cyclic group and generators as core parameters to constitute the public system parameters. The FourQ elliptic curve employs extended distorted Edwards coordinates to accelerate elliptic curve addition operations. In this embodiment, using a FourQ elliptic curve to construct an additive cyclic group and selecting generators to form public system parameters, while simultaneously utilizing extended distorted Edwards coordinates to accelerate operations, significantly improves the execution speed of elliptic curve-related operations, reduces computational overhead in key generation and negotiation processes, and provides efficient cryptographic underlying support for the overall secure aggregation process.

[0036] In one embodiment, each participant, based on its own private key and the global public key set, negotiates with all other participants to generate a shared session key between each other. This process includes: each participant randomly selecting a large integer within the order of an additive cyclic group as its private key; performing FourQ elliptic curve scalar multiplication on the generators in the public system parameters to obtain its own public key; and each participant extracting the public keys of all other participants from the global public key set, sequentially performing FourQ elliptic curve scalar multiplication on its own private key and the public key of each of the other participants to obtain a shared session key that corresponds one-to-one with each of the other participants, thus forming its own session key set. In this embodiment, the participants generate private and public keys based on FourQ elliptic curve scalar multiplication and negotiate the corresponding shared session keys accordingly. This ensures the security and uniqueness of the session key distribution, reduces the risk of leakage during key transmission, and makes the key generation and negotiation process more adaptable to the operating environment of resource-constrained terminal devices.

[0037] In one embodiment, generating mask data by XORing pseudo-random function values ​​based on all session keys held by the user includes: selecting HMAC-SHA256 as the pseudo-random function; sequentially extracting each shared session key from the user's session key set as the key for the pseudo-random function; using monotonically increasing non-cryptographic information as input to the pseudo-random function; sequentially performing pseudo-random function operations to obtain the pseudo-random function values ​​corresponding to each shared session key; and performing a bitwise XOR operation on all pseudo-random function values ​​to generate mask data, wherein the non-cryptographic information used in each generation of mask data is unique. In this embodiment, using HMAC-SHA256 as the pseudo-random function, combined with non-repeating monotonically increasing non-cryptographic information for XOR operation and mask data generation, can enhance the randomness and anti-cracking capability of the mask data, ensure that each mask is unique, improve the security of data encryption, and simultaneously ensure that the mask as a whole has stable and reliable global XOR cancellation characteristics.

[0038] In one embodiment, when the original input data is multidimensional, each participant concatenates the multidimensional data sequentially into one-dimensional binary data and then fills it into the array position corresponding to its own anonymous sequence number. After the aggregator restores the original input data plaintext set, it extracts the corresponding one-dimensional binary data from the original input data plaintext set and restores it to the multidimensional original input data by reversing the concatenation process. In this embodiment, concatenating the multidimensional original input data into one-dimensional binary data for transmission and restoration can unify the data processing format, simplify the encryption process of the participants and the parsing process of the aggregator, improve the adaptability in multidimensional data scenarios, and ensure that various types of structured data can be stably accessed by the aggregation system.

[0039] In one embodiment, the mask data and the array are then fully encrypted using a bitwise XOR operation to generate an encryption vector. This process includes: generating a mask vector of the same length as the array; sequentially performing a bitwise XOR operation on the value at each position in the array and the corresponding mask value in the mask vector to obtain the encrypted array; and then using the encrypted array as a whole to generate an encryption vector, where each position in the encryption vector corresponds one-to-one with the anonymous sequence number of the participant. In this embodiment, generating a mask vector of the same length as the array and then XORing it bitwise to form an encryption vector achieves uniform and complete encryption of the original data, ensuring a strict correspondence between the data position and the anonymous sequence number, further enhancing data anonymity, and making the subsequent aggregation operations of the aggregator more regular and efficient.

[0040] In one embodiment, the mask recovery share is generated by the online participant based on its shared session key with each offline participant. This includes: the online participant extracting its shared session key with each offline participant, performing calculations on non-cryptographic information using a pseudo-random function, and then performing a bitwise XOR operation on all the results to obtain the mask recovery share; the non-cryptographic information is consistent with the non-cryptographic information used when generating the mask data. In this embodiment, the online participant uses the same non-cryptographic information as the mask generation to generate the mask recovery share, ensuring the accuracy and consistency of the residual mask calculation, making the plaintext restoration result more reliable in offline scenarios, and improving the stability and execution efficiency of the fault recovery process.

[0041] In one embodiment, the method further includes: when the number of participants exceeds a preset threshold, a random server randomly divides all participants into multiple groups, independently assigns a unique and confidential anonymous sequence number to each participant in each group, and the sequence number spaces of each group are independent of each other; participants in each group only negotiate to generate a shared session key between each pair of participants in the group based on the public key set broadcast by the aggregator, and participants in different groups do not establish session keys or interact with each other; each group independently performs encryption vector generation, aggregation decryption, and disconnection recovery steps, and the aggregator summarizes and integrates the original input data plaintext sets obtained from each group to obtain a global plaintext set of the original input data of all participants.

[0042] In this embodiment, randomly grouping and independently assigning sequence numbers and key negotiation to the excessive number of participants can significantly reduce the system's computational and communication pressure in large-scale participation scenarios, improve the overall protocol's scalability, and ensure that each group operates independently and securely, making the system adaptable to high-concurrency application scenarios with a large number of participants.

[0043] Specifically, in this scheme, the computational cost of each participant and the number of participants are... This is relevant. During the initialization phase, each participant needs to execute... The public key operation is used to calculate the session key with other participants; during the data aggregation phase, the participants... In calculating the mask function At that time, it is necessary to calculate Secondary hash function. In calculating vectors... At that time, it is necessary to calculate The secondary mask function is equivalent to calculating The hash function is calculated a certain number of times; during the disconnection recovery phase, the number of times each participant calculates the hash function is also a certain number. Level. Therefore, the number of participants. This will significantly impact the overall computational cost. This solution supports a grouping optimization method, as detailed below: During the initialization phase, the random server will The participants are randomly divided into Group, group The set of subscripts of the participating parties is The number of participants is Random servers are grouped. Each participant Assign a unique serial number ,satisfy Then, the participants within each group establish a shared key using the ECDH key exchange algorithm, and participants in different groups do not need to establish keys between each other. During the data aggregation phase and the offline recovery phase, each group executes the protocol independently, so that the aggregator obtains the plaintext data set of each group's participants while ensuring the anonymity of the data within the group.

[0044] In the group optimization method, group The computational overhead of each participating party during the initialization phase is as follows: Reduce to The computational overhead during the data aggregation and offline recovery phases is reduced from... Reduce to Furthermore, if the number of participants in each group is appropriately selected, the optimized grouping protocol can still withstand aggregators and... The parties involved conspired.

[0045] In one specific embodiment, this scheme comprises three phases: an initialization phase, a data aggregation phase, and a disconnection recovery phase. In the initialization phase, each participant obtains a unique sequence number and negotiates to generate a session key between each other. In the data aggregation phase, each participant uses its session key to generate a mask, fills the input data into the position indicated by its own sequence number, and protects the data with the mask. The aggregator obtains the above data and, while ensuring anonymity, removes the mask to obtain the original input data of each participant. In the disconnection recovery phase, online participants help the aggregator remove the mask left behind due to the disconnection of some participants, restoring the input data of the remaining online participants.

[0046] A schematic diagram illustrating the principle of data security aggregation is shown below. Figure 4 As shown, where, Figure 4 (a) is a schematic diagram of local data encryption and mask overlay by the participants. Figure 4 (b) is a schematic diagram of global data aggregation and mask cancellation in the aggregator, with a random server. For each participant Assign a random sequence number The serial number is unique, that is .like Figure 4 As shown in (a), the participating parties Input data Put into array The Middle Set the position to 0, and the rest to 0. Then combine the entire array with the mask. Perform a bitwise XOR operation to protect privacy, and obtain And sent to the aggregator .like Figure 4 As shown in (b), the aggregator calculates... .

[0047] The mask function used in this scheme It has properties And capable of resisting aggregators and any The participants colluded, meaning the aggregator was unable to calculate the remaining... The array provides a mask for any of the non-colluding parties, thereby protecting their privacy. The The location saves the participants' information. Input data Because the aggregator does not know the identities of the participating parties. Serial number Therefore, the correspondence between the input data and the participants cannot be determined, ensuring data anonymity and achieving privacy-preserving data aggregation. The aggregator ultimately obtains the plaintext set of all input data. This allows for further execution of arbitrary business calculations. The symbols involved in this scheme are shown in Table 1.

[0048] Table 1 Symbol Table

[0049] The purpose of this invention is to provide a data privacy aggregation method based on symmetric masks. It employs a FourQ elliptic curve-based key negotiation and HMAC mask construction mechanism to improve existing mask generation and implementation methods, thereby reducing aggregation computational overhead and enhancing applicability in resource-constrained scenarios. Simultaneously, it introduces a divide-and-conquer aggregation strategy, grouping participants or the aggregation process to reduce online communication load during protocol execution. This ensures data anonymity, aggregation integrity, and tolerance for disconnections while achieving efficient recovery and direct utilization of the aggregation results.

[0050] (1) Initialization phase The initialization phase mainly involves two steps: sequence number allocation and session key generation. To ensure data integrity, this scheme uses the SHA256 hash function to generate a message authentication code. Assume a sending entity needs to transmit data over a network channel at a certain time. Then use SHA256 to generate 256-bit message authentication code Generate data Then send. The receiving entity will Disassembled into and The process consists of two parts: calculating the SHA256 message authentication code for the former and comparing it with the latter. If the comparison results are not equal, it indicates that data integrity has been compromised during communication, and the sender needs to retransmit the data. This scheme employs the above strategy in all network communications. To simplify the protocol formula, it is not explicitly written out. part.

[0051] In the first step of the initialization phase, the aggregator sends system parameters to each participant. A random server is then assigned to each participant. Assign a unique serial number ,satisfy The random server sends the data through a secure channel. Send to the participants , guarantee except The serial number is unknown to any other participant or aggregator.

[0052] The second step involves key generation by each participant with the assistance of an aggregator. This scheme uses the Elliptic Curve Diffie-Hellman (ECDH) key exchange algorithm to establish a shared key and employs the FourQ curve for higher performance. The bottleneck of elliptic curve cryptography lies in calculating scalar multiplication at a point on the curve, which incurs significant performance overhead when the scalar value is large. FourQ achieves the fastest elliptic curve addition to date through extended distorted Edwards coordinates, the curve expression of which is: ,in: ; Number of points on the curve , It is a 246-bit prime number. The FourQ curve passes through two self-similar states. Accelerate scalar multiplication of points on a curve. Assume the desired calculation is... There will always be 、 , Thus Transform into: ; Therefore, large scalar multiplication operations It is decomposed into multiple smaller scalar operations, thereby improving computational performance. In practical applications, the computational performance of the FourQ curve is 4 to 5 times that of the NIST P-256 curve and 2 to 3 times that of the Curve25519 curve, while providing a 128-bit security level.

[0053] Key generation steps are as follows Figure 5 As shown: ① Aggregator Based on the FourQ curve, the order is selected as... addition cyclic group and in Randomly select generators , constitute public parameters ② The aggregator will disclose parameters. Broadcast to all participating parties. ③ All participating parties Randomly select private key ④ Each participating party calculates its own public key using FourQ elliptic curve multiplication. ⑤ All participating parties public key ⑥ After collecting all the public keys from the participants, the aggregator forms a public key set. And broadcast to all participating parties. ⑦ All participating parties pass Obtain the remaining participants public key The result is obtained by elliptic curve multiplication. Session key Finally, the session key set is obtained. .

[0054] (2) Data aggregation stage This solution achieves privacy protection through the design of a special mask structure. Specifically, each participating party... Use the session key set obtained during the initialization phase. Extract each session key sequentially. Thus from the pseudo-random function family Select the appropriate pseudo-random function from Construct the mask function as shown in the following equation. .in, This is non-password information, used in each call. Use different To ensure safety, For safety parameters. Masking function. It has properties ; ; To date, all participating parties Session keys have been established between each pair of users. （ ） Secretly obtain your own unique serial number It has been determined. The calculation method. Based on this, this solution presents a privacy-preserving data aggregation algorithm, enabling the aggregator to... Obtaining the input data of each participant without knowing the correspondence between each input data and the participants. The plaintext set. The specific process is shown in Algorithm 1 in Table 2, with each participant... Generate vectors The structure is as follows: ; in, ; To ensure safety, all participating parties Each call At that time, the non-password information entered The differences should be different, thus making The output values ​​are different. It refers to Previous call The total number of times the function is called.

[0055] This solution supports participants using multidimensional data as their initial input. , The dimensions of the data. Multidimensional data is concatenated to obtain... Treating it as a large integer yields one-dimensional input data. .

[0056] Then, each participating party vector Sent to the aggregator. The aggregator receives it. and calculate : ; Ultimately, the aggregator obtains a vector. The aggregator is unaware of the participating parties. Unique serial number Thus, the plaintext of the input data can be obtained without knowing the correspondence between the input data and the participants. If If the data is a one-dimensional image after stitching, it will be restored by reversing the stitching process described above. Dimensional raw input data If a participant has multiple sets of data that need to be aggregated, Algorithm 1 can be executed repeatedly until all data has been aggregated. Table 2 Pseudocode for Algorithm 1

[0057] (3) Disconnection recovery phase This solution is robust even if any number of participants go offline, meaning the aggregator can still receive input data from the remaining online participants without knowing the correspondence between the input data and the participants, thus ensuring the anonymity of the online participants' data. "Going offline" refers to the aggregator failing to receive a data packet from a participant after a network communication timeout. This can be further divided into two scenarios: Figure 6 As shown: Disconnection during non-data aggregation phase and disconnection during data aggregation phase. The disconnection recovery phase is only used when any number of participants disconnect during the data aggregation phase.

[0058] Disconnection during the non-data aggregation phase refers to any number of participants disconnecting during the pre-execution or initialization phase of the protocol. In this case, the aggregator and the remaining online participants consider the disconnected participants to be non-existent and discard all established session keys with the disconnected participants. Therefore, the protocol does not need to enter the disconnection recovery phase. Disconnection during the data aggregation phase refers to the aggregator failing to receive vectors from some participants. However, the vectors of the remaining participants have already been received, and the aggregator cannot remove the mask, so the disconnection recovery phase needs to be initiated. The specific process is shown in Algorithm 2 in Table 3. Let the set of indices of the disconnected participants be... The set of online participants' indices is The aggregator receives and calculate : ; in, It is the XOR of the mask values ​​used by all participants who disconnected: ; quilt The data was obscured, preventing the aggregator from recovering it. The values ​​should be the same as those used when running Algorithm 1 previously, before calling Algorithm 1. The total number of function calls. Therefore, each online participant... It requires the use of its own session keys and those of all parties involved in the disconnection. To jointly generate And send it to the aggregator, the specific steps are as follows: All participating parties Use session key set ,calculate And send it to the aggregator, For the previously called Total number of functions: ; Aggregator Calculation Protected mask ,calculate You can get the first The plaintext data at each location is denoted as Aggregator By performing the above operations, you can obtain the plaintext vector of the input data (the input data of the disconnected participant is 0 in the vector). Table 3 Pseudocode for Algorithm 2

[0059] The computational and communication complexity of the method of this invention are analyzed: This scheme does not involve any public-key cryptographic operations in the data aggregation stage, requiring only hash and XOR operations, thus exhibiting good computational performance, with a total time complexity of O(n log n). The total time complexity after parallel optimization is As shown in Table 4. A detailed analysis follows: During the initialization phase, the aggregator is only used for data transfer, and its computational overhead is negligible. Each participant needs to perform computations... Multiplication on a quadratic elliptic curve has a time complexity of O(n log n). , Where is the key length. Quadratic elliptic curve multiplication can be performed in parallel, reducing the time complexity to O(n). .

[0060] During the data aggregation phase, each call to the mask function... Requires execution hash operations and Second-rate XOR operation of bit length ( It is also equal to (output bit length), time complexity is If no participant disconnects during this phase, then all participants... Need to call Second-rate and carry out Second-rate The time complexity of the bit-length XOR operation is O(n log n). At the same time, calculation Second-rate There is no synchronization or mutual exclusion relationship between them; by using parallel computing for optimization, the time complexity can be reduced to [missing value]. Aggregator Processing data from each participant requires... Second-rate The XOR operation of bit length has a total of Data from each participant needs to be processed, with a time complexity of O(n). . Data from each participant can be processed in parallel, and with parallel computing optimization, the time complexity can be reduced to [value missing]. .

[0061] If any number of participants go offline during the data aggregation phase, the protocol enters the offline recovery phase. At this time, online participants need to execute... The time complexity of hashing and XOR operations is O(n). After parallel optimization, it can be reduced to The aggregator needs to execute... The time complexity of the XOR operation is O(n). After parallel optimization, it can be reduced to Therefore, the disconnection of a participant does not affect the overall time complexity.

[0062] Table 4 Computational Complexity Table

[0063] The communication overhead in this scheme measures the communication overhead sent and received by a single participant or aggregator during protocol execution. The communication complexity of each participant in the scheme is... The communication complexity of the aggregator is As shown in Table 5.

[0064] During the initialization phase, each participant needs to send a message to the aggregator. Bit's public key (required separately) Bit message authentication code, total (bits), in this scheme The aggregator then needs to provide each participant with [information / resources]. send The remaining participants in the bit public key (containing) (Bit message authentication code). Therefore, the amount of data sent and received by a single participant during the initialization phase is... Communication complexity The aggregator's data transmission and reception volume is... Bits, communication complexity If a broadcast channel exists that allows the aggregator to distribute the same data to all participants, the amount of data sent and received is reduced to [a certain value]. Bits, communication complexity .

[0065] During the data aggregation phase, each participant needs to send data to the aggregator. Bit data (including) (Bit message authentication code), the aggregator does not actively send data. Therefore, in In the case of one participant, the amount of data sent and received by each participant is [missing information]. Bits, communication complexity The aggregator's data transmission and reception volume is... Bits, communication complexity .

[0066] If any number of participants go offline during the data aggregation phase, the protocol enters the offline recovery phase. At this point, the aggregator needs to send a message to each participant. 2 Bit's list of offline nodes (including Bit message authentication code). This represents the number of offline nodes. Each participant needs to send... Bit data (including) (Bit message authentication code) helps the aggregator remove the mask. Therefore, the aggregator's data transmission and reception volume is... Bit data, communication complexity If a broadcast channel exists, the amount of data transmitted and received is reduced to [amount missing]. Bits, communication complexity remains The amount of data sent and received by a single participant is... Bits, communication complexity is .

[0067] Table 5 Communication Complexity Table

[0068] The effectiveness of this invention was verified through experiments. The test phase of this scheme assumed one-to-one communication between the aggregator and each participant. The test results are shown in Table 6. Each participant needs to calculate [the required computation] during the initialization phase. The calculation of the session key takes 3.250 milliseconds; a single participant needs to calculate the key during the data aggregation phase. Secondary masking function The computation time was 0.578 milliseconds; the total time for session key generation and mask calculation by all participants was 108.671 milliseconds, which is the performance bottleneck of this scheme. This is because this step involves public-key cryptography operations and frequent hash operations, and because the maximum number of parallel threads in the test environment is 16, while in the real environment, the calculations of each participant are executed in full parallel. The test environment cannot fully simulate the characteristics of the real environment, so the total time is high. In the data aggregation stage, the aggregator only needs 6.889 milliseconds to decrypt the data, because the aggregator only needs to perform XOR operations and does not involve any cryptographic primitives. In the disconnection recovery stage, each participant jointly recovers the mask (calculating mask shares to help the aggregator recover). The process involves hash operations, taking a total of 85.601 milliseconds. During the disconnection recovery phase, the aggregator only needs to perform an XOR operation to decrypt the data, taking a total of 9.268 milliseconds. The total execution time of this solution is only 210.429 milliseconds, demonstrating good computational performance. During protocol execution, the aggregator sends only 0.314713 MB of data and receives only 8.198547 MB ​​of data, demonstrating good communication performance.

[0069] Table 6 Test Results

[0070] The aforementioned efficient data aggregation scheme replaces the dual-mask design in traditional SecAgg-like schemes with a single-mask cancellation mechanism, reducing mask generation and computational overhead by approximately half. Building upon this, the scheme incorporates ECDH key negotiation and constructs symmetric masks using a FourQ elliptic curve and HMAC approach. Specifically, FourQ achieves the fastest elliptic curve addition currently available through extended distorted Edwards coordinates, further enhancing computational performance in the aggregation phase. Simultaneously, the scheme employs a divide-and-conquer strategy, dividing participating users into multiple groups, where mask generation and local aggregation are performed separately within each group. This reduces the mask length and communication load required for each group, and global data aggregation is achieved through inter-group result aggregation. Finally, by implementing differentiated disconnection handling mechanisms at different stages, the scheme possesses strong fault tolerance, ensuring that the aggregator can correctly recover the input data from the remaining online participants even if any number of participants disconnect.

[0071] It should be understood that, although Figure 3 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 3At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0072] In one embodiment, a fault-tolerant data security aggregation apparatus is provided, the apparatus being applied to an aggregator that is communicatively connected to a random server and multiple data holders, the apparatus comprising: The parameter generation and broadcasting module is used to generate public system parameters based on the high-performance elliptic curve cryptography system and broadcast them to all participants. The public key collection module is used to receive the public keys generated and uploaded by each participant based on the public system parameters, collect all public keys, generate a global public key set, and broadcast it to all participants. The encryption vector receiving module is used to receive encryption vectors uploaded by each participant. The encryption vectors are obtained by the participants generating mask data based on the session key and encrypting the original input data. The aggregation and decryption module is used to perform bitwise XOR aggregation operations on all encrypted vectors, and use the global XOR cancellation property of the mask data to cancel the mask data and restore the original plaintext set of input data of all participants. The disconnection handling module is used to broadcast the list of disconnected participants to all online participants when the encryption vector of some participants is not received within a preset timeout period, and to receive the mask uploaded by each online participant to recover the share. The residual mask cancellation module is used to perform bitwise XOR aggregation on the mask recovery share to obtain the residual mask. The residual mask is then used to cancel the aggregation result of the online participants' encryption vectors to restore the original plaintext set of all online participants' input data.

[0073] Specific limitations regarding the fault-tolerant data security aggregation device can be found in the limitations of the fault-tolerant data security aggregation method described above, and will not be repeated here. Each module in the aforementioned fault-tolerant data security aggregation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0074] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a fault-tolerant data security aggregation method. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0075] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0076] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method described above.

[0077] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0078] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data security aggregation method supporting fault tolerance, characterized in that, The aggregator can communicate with a random server and multiple data-holding participants. Each participant obtains a unique and confidential anonymous sequence number through the random server. The method includes: The aggregator generates public system parameters based on a high-performance elliptic curve cryptography system and broadcasts them to all participants. It receives public keys generated and uploaded by each participant based on the public system parameters, collects all public keys, generates a global public key set, and broadcasts it to all participants. Each participant, based on its own private key and the global public key set, negotiates with all other participants to generate a session key shared between each other. Then, based on all the session keys it holds, it generates mask data by XORing the pseudo-random function values. The mask data has global XOR cancellation properties. Each participant fills the original input data into the array position corresponding to its own anonymous sequence number, fills the remaining positions of the array with zero values, and then performs full encryption of the mask data and the array through bit-by-bit XOR operation to generate an encryption vector and upload it to the aggregator. The aggregator receives the encrypted vectors uploaded by all participants, performs a bitwise XOR aggregation operation on all encrypted vectors, and uses the global XOR cancellation property of the mask data to cancel the mask data, thus restoring the original plaintext set of input data of all participants. If the aggregator does not receive the encryption vectors from some participants within a preset timeout period, it broadcasts the list of offline participants to all online participants. After receiving the mask recovery share uploaded by each online participant, it performs bitwise XOR aggregation to obtain the residual mask. The aggregation result of the online participants' encryption vectors is canceled by the residual mask to restore the original plaintext set of input data from all online participants.

2. The method according to claim 1, characterized in that, The parameters for generating the public system based on the high-performance elliptic curve cryptography system include: An additive cyclic group with a preset order is selected based on the FourQ elliptic curve. Generators are randomly selected from the additive cyclic group. The additive cyclic group and generators are used as core parameters to constitute the public system parameters. The FourQ elliptic curve uses extended distorted Edwards coordinates to accelerate elliptic curve addition operations.

3. The method according to claim 2, characterized in that, Each participant, based on its own private key and the aforementioned global public key set, negotiates with all other participants to generate a session key that is shared between each other, including: Each participant randomly selects a large integer within the order range of the addition cyclic group as its private key, and performs operations on the generators in the public system parameters using FourQ elliptic curve scalar multiplication to obtain its own public key; Each participant extracts the public keys of all other participants from the global public key set, and sequentially performs operations on its own private key with the public keys of each other participant using FourQ elliptic curve scalar multiplication to obtain a shared session key that corresponds one-to-one with each of the other participants, thus forming its own session key set.

4. The method according to claim 1, characterized in that, Based on all the session keys held by oneself, a mask data is generated by XORing the values ​​of a pseudo-random function, including: HMAC-SHA256 is selected as the pseudo-random function, and each shared session key is extracted sequentially from its own session key set as the key for the pseudo-random function; The monotonically increasing non-cryptographic information is used as the input to the pseudo-random function, and the pseudo-random function values ​​corresponding to each shared session key are obtained by sequentially processing the pseudo-random function. Perform a bitwise XOR operation on all pseudo-random function values ​​to generate the mask data, wherein the non-cryptographic information used in each generation of mask data is unique.

5. The method according to claim 1, characterized in that, When the original input data is multidimensional data, each participant concatenates the multidimensional data into one-dimensional binary data in sequence, and then fills it into the array position corresponding to its own anonymous sequence number. After the aggregator restores the original plaintext set of input data, it extracts the corresponding one-dimensional binary data from the original plaintext set of input data and restores it to the multi-dimensional original input data by reversing the splicing process.

6. The method according to claim 1, characterized in that, The mask data and the array are then fully encrypted using a bitwise XOR operation to generate an encryption vector, including: The mask data is generated into a mask vector of equal length with the same length as the array. The value at each position in the array is XORed with the mask value at the corresponding position in the mask vector in turn to obtain the encrypted array. The encrypted array is used as a whole to generate an encrypted vector, and the position of the encrypted vector corresponds one-to-one with the anonymous sequence number of the participant.

7. The method according to claim 1, characterized in that, The mask recovery share is generated by the online participants based on their own shared session key with each offline participant, including: Online participants extract their shared session key with each offline participant, perform operations on non-cryptographic information using a pseudo-random function, and then perform a bitwise XOR operation on all the results to obtain the mask recovery share; the non-cryptographic information is consistent with the non-cryptographic information used when generating the mask data.

8. The method according to claim 1, characterized in that, The method further includes: When the number of participants exceeds a preset threshold, the random server randomly divides all participants into multiple groups, and independently assigns a unique and confidential anonymous sequence number to each participant in each group. The sequence number spaces of each group are independent of each other. Participants within each group negotiate and generate shared session keys between each other based solely on the set of public keys broadcast by the aggregator. Participants in different groups do not establish session keys or exchange data with each other. Each group independently performs encryption vector generation, aggregation decryption, and disconnection recovery steps. The aggregator summarizes and integrates the original input data plaintext sets obtained from each group to obtain the global plaintext set of the original input data of all participants.

9. A data security aggregation device supporting fault tolerance, characterized in that, The device is used in an aggregator that can communicate with a random server and multiple data-holding participants. The device includes: The parameter generation and broadcasting module is used to generate public system parameters based on the high-performance elliptic curve cryptography system and broadcast them to all participants. The public key collection module is used to receive the public keys generated and uploaded by each participant based on the public system parameters, collect all public keys, generate a global public key set, and broadcast it to all participants. The encryption vector receiving module is used to receive encryption vectors uploaded by each participant. The encryption vectors are obtained by the participants generating mask data based on the session key and encrypting the original input data. The aggregation and decryption module is used to perform bitwise XOR aggregation operations on all encrypted vectors, and use the global XOR cancellation property of the mask data to cancel the mask data and restore the original plaintext set of input data of all participants. The disconnection handling module is used to broadcast the list of disconnected participants to all online participants when the encryption vector of some participants is not received within a preset timeout period, and to receive the mask uploaded by each online participant to recover the share. The residual mask cancellation module is used to perform bitwise XOR aggregation on the mask recovery share to obtain the residual mask. The residual mask is then used to cancel the aggregation result of the online participants' encryption vectors to restore the original plaintext set of input data for all online participants.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

Images