Publicly verifiable data security aggregation methods, apparatus, and computer equipment

Abstract

This application relates to a publicly verifiable data security aggregation method, apparatus, and computer device. The method includes: obtaining system public parameters, global verification parameters, threshold encryption public keys, and secret shares allocated to each user issued by a trusted initializer; forwarding the user's initial signature to neighboring users; aggregating the partial signatures generated by neighbors based on their secret shares to obtain intermediate signatures; users then supplementing their own secret shares to generate the final signature; synchronously aggregating the encrypted data of all online users with the final signatures to obtain the data aggregation result and aggregation signature; if a user goes offline during the aggregation process, collecting partial decryption results from the decryption committee; restoring the offline user's verification and correction information after reaching a threshold; and publicly disclosing the aggregation result, aggregation signature, global verification parameters, and verification and correction information. This method can protect the privacy of user input in federated learning and defend against collusion attacks between the aggregation server and malicious users.

Description

Technical Field

[0001] This application relates to the field of secure aggregation technology, and in particular to a publicly verifiable data secure aggregation method, apparatus and computer device. Background Technology

[0002] Secure aggregation is a core technology in federated learning for protecting the data privacy of participating parties. Its basic goal is to hide the specific updates made by any participant during the aggregation server's computation of the model's updated aggregation values, thereby reducing the risk of training data inversion caused by gradient leakage. Currently, the most representative work is a practical secure aggregation protocol based on dual masks and threshold secret sharing. This protocol constructs paired and individual masks among participating parties and recovers the gradient sum using the cancellation relationship of the masks during the aggregation process; simultaneously, it uses a threshold secret sharing mechanism to handle participant disconnection issues, ensuring that the protocol can still execute smoothly under certain failure conditions. Subsequently, researchers have conducted numerous improvements focusing on reducing communication overhead, improving disconnection tolerance, and enhancing security in malicious scenarios.

[0003] However, current research on secure aggregation primarily focuses on hiding individual updates, while security requirements in federated learning extend beyond privacy protection. In actual aggregation processes, malicious aggregation servers may tamper with aggregation results, selectively discard updates from specific participants, or even inject backdoors into the global model or manipulate training directions, compromising model integrity and usability. Malicious participants may also submit forged or anomalous updates to interfere with model convergence and collude with the aggregation server, further exacerbating system risks. Furthermore, participant devices may dynamically exit the aggregation process due to network fluctuations, battery depletion, or other reasons, requiring protocols to possess strong fault tolerance. Therefore, how to protect participant update privacy while simultaneously ensuring the verifiable correctness of the aggregation process and results has become a crucial issue in secure aggregation research. Verifiable secure aggregation technology was proposed against this backdrop. By introducing a verifiable mechanism, it enables participants or external verifiers to confirm whether the server faithfully executes the aggregation operation, thus balancing data privacy, computational integrity, and robustness in practical deployment.

[0004] Currently, significant progress has been made in addressing the verifiability issue of secure aggregation in federated learning. VerifyNet utilizes bilinear pairing and homomorphic hashing to verify aggregation results, but relies on a trusted third party for key distribution and requires multiple rounds of user interaction. VeriFL combines commitment mechanisms and zero-knowledge proofs to reduce verification communication overhead to a constant level independent of model dimensionality, but its security still rests on the assumption of an honest but curious aggregation server. VFL (Vertical Federated Learning) uses secret sharing and bilinear pairing for user-side verification, capable of detecting malicious server tampering with aggregation results. Verifiable aggregation protocols are constructed based on homomorphic encryption and commitment mechanisms to verify aggregation correctness without the need for a trusted third party. LightVeriFL uses constant-size homomorphic hashing and commitment functions for lightweight verification and supports single-time aggregation hash recovery for offline users. Armadillo combines two-layer key-message homomorphic encryption and batch inner product zero-knowledge proofs to achieve robust single-server secure aggregation with input verification capabilities within three rounds of communication. Overall, the above work has made improvements in verification efficiency, input validity and fault tolerance, but most of them are geared towards honest but curious or only malicious server models.

[0005] For internal collusion scenarios, mPVAS, for the first time, achieves publicly verifiable secure aggregation without a trusted third party, under a model that allows aggregators to collude arbitrarily with malicious users. This scheme achieves constant-time public verification based on commitment-based aggregation signatures and is further extended to mPVAS-IV, supporting malicious user identification, and mPVAS-UD, addressing user availability changes. eVTPA balances online efficiency, public verifiability, and fault tolerance. BVDFed considers both Byzantine robustness and aggregation verifiability in differential privacy federated learning. A secure aggregation scheme combining verifiable secret sharing and vector homomorphic hashing is constructed, possessing both verifiability and robustness. While the above research further enhances the adaptability of non-compliant participants in verifiable secure aggregation, certain limitations remain: mPVAS-like schemes rely heavily on a collaborative structure for signature generation, and there is still overhead pressure between protocol interaction and participation scaling; mPVAS-UD primarily handles pre-declared user unavailability scenarios and struggles to directly support dynamic disconnections during the aggregation process; eVTPA relies on honest third-party servers to participate in the verification or recovery process.

[0006] In summary, existing verifiable secure aggregation solutions have not yet simultaneously addressed three key requirements: first, ensuring public verifiability under a strong non-compliant participant model where aggregators and malicious users can collude internally; second, improving the protocol's scalability without significantly increasing the interaction burden on participants; and third, supporting dynamic user disconnection during aggregation execution without requiring re-initialization or reliance on additional online trusted parties. Achieving a unified and efficient design that balances resistance to internal collusion, public verifiability, and dynamic fault tolerance remains a pressing issue for current research. Summary of the Invention

[0007] Therefore, it is necessary to provide a publicly verifiable data security aggregation method, apparatus, and computer device to address the aforementioned technical problems.

[0008] A publicly verifiable method for secure data aggregation, the method comprising: The system obtains the system public parameters, global verification parameters, threshold encryption public key, and secret share allocated to each user issued by the trusted initializer; the system public parameters are used to divide the local collaborative relationships between users and determine the neighboring users of each user. The user's initial signature is forwarded to the corresponding neighboring user. The neighboring user's partial signature is obtained by combining the partial signatures with their secret share. The partial signatures are then merged to obtain the user's intermediate signature. Obtain the final signature generated by the user using their own secret share to complete the intermediate signature, as well as the corresponding encrypted data. Then, merge the received encrypted data and the final signature to obtain the data aggregation result and the aggregated signature. If a user is detected to be offline during the aggregation process, the partial decryption results obtained by each member of the decryption committee from parsing the verification and correction ciphertext are collected. Based on the partial decryption results reaching a preset threshold number, the verification and correction information is obtained. The verification and correction ciphertext is then encrypted using the threshold encryption public key. The data aggregation result, the aggregation signature, the global verification parameters, and the verification correction information are disclosed to support external verifiers in publicly verifying the consistency of the data aggregation result and the aggregation signature.

[0009] A publicly verifiable data security aggregation device, the device comprising: The parameter acquisition module is used to acquire system public parameters, global verification parameters, threshold encryption public keys, and secret shares allocated to each user issued by the trusted initializer; the system public parameters are used to divide the local collaborative relationships between users and determine the neighboring users of each user. The collaborative signature module is used to forward the user's initial signature to the corresponding neighboring user, obtain the partial signature generated by the neighboring user in combination with the secret share they hold, and merge the partial signatures to obtain the user's corresponding intermediate signature. The data aggregation module is used to obtain the final signature generated by the user using their own secret share to complete the intermediate signature and the corresponding encrypted data. The received encrypted data and the final signature are merged to obtain the data aggregation result and the aggregated signature. The verification and correction module is used to collect partial decryption results obtained by each member of the decryption committee from parsing the verification and correction ciphertext if the user is detected to be offline during the aggregation process, and to obtain verification and correction information based on the partial decryption results reaching a preset threshold number; the verification and correction ciphertext is obtained by encrypting it with the threshold encryption public key; The verification output module is used to publicly disclose the data aggregation result, the aggregation signature, the global verification parameters, and the verification correction information to support external verifiers in publicly verifying the consistency of the data aggregation result and the aggregation signature.

[0010] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps: The system obtains the system public parameters, global verification parameters, threshold encryption public key, and secret share allocated to each user issued by the trusted initializer; the system public parameters are used to divide the local collaborative relationships between users and determine the neighboring users of each user. The user's initial signature is forwarded to the corresponding neighboring user. The neighboring user's partial signature is obtained by combining the partial signatures with their secret share. The partial signatures are then merged to obtain the user's intermediate signature. Obtain the final signature generated by the user using their own secret share to complete the intermediate signature, as well as the corresponding encrypted data. Then, merge the received encrypted data and the final signature to obtain the data aggregation result and the aggregated signature. If a user is detected to be offline during the aggregation process, the partial decryption results obtained by each member of the decryption committee from parsing the verification and correction ciphertext are collected. Based on the partial decryption results reaching a preset threshold number, the verification and correction information is obtained. The verification and correction ciphertext is then encrypted using the threshold encryption public key. The data aggregation result, the aggregation signature, the global verification parameters, and the verification correction information are disclosed to support external verifiers in publicly verifying the consistency of the data aggregation result and the aggregation signature.

[0011] The aforementioned publicly verifiable data security aggregation method, apparatus, and computer equipment, by configuring various parameters issued by a trusted initializer and defining local user collaboration relationships, can establish a multi-user collaborative signature constraint mechanism. By forwarding the initial signature, aggregating partial signatures generated by neighboring users based on secret shares, and generating the final signature through secret share completion calculations, it can conceal users' original private input throughout the entire signature interaction and data aggregation process, effectively avoiding the risk of user input privacy leakage in federated learning scenarios. By collecting partial decryption results obtained from the decryption committee's parsing of threshold encryption correction ciphertext, and restoring verification correction information based on threshold conditions, it can adapt to scenarios where users dynamically disconnect during the aggregation process, supplementing the verification support basis missing during disconnection. By integrating global verification parameters and verification correction information to conduct public consistency verification, it can accurately verify the authenticity of the aggregation results and aggregation signatures, and identify tampering behavior by malicious aggregation servers. This invention can protect user input privacy in federated learning while resisting internal collusion attacks between aggregation servers and malicious users, is compatible with dynamic user disconnection scenarios, and ensures the public verifiability of aggregation results. Attached Figure Description

[0012] Figure 1 This is a flowchart illustrating a verifiable data security aggregation method disclosed in one embodiment; Figure 2 This is a schematic diagram illustrating the runtime performance of the protocol proposed in this invention on different entities in one embodiment, wherein, Figure 2 (a) is a schematic diagram of the runtime performance of a single user. Figure 2 (b) is a schematic diagram showing the trend of aggregator runtime as the number of users changes. Figure 2 (c) is a schematic diagram of the verifier's runtime performance; Figure 3 This is a schematic diagram illustrating the experimental communication overhead of the protocol proposed in this invention in one embodiment, wherein, Figure 3 (a) is a schematic diagram showing the change in communication load of a single user with the number of users under different neighbor ratios. Figure 3 (b) is a schematic diagram showing the change of aggregator communication load with the number of users under different neighbor ratios; Figure 4 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0014] To address the issue that existing signature generation mechanisms rely on a fixed set of participants and struggle to support dynamic user disconnections, the generation process of aggregate signatures is redesigned. Specifically, regular graphs are used to establish local collaborative relationships among users, and signature blinding terms are constructed based on pairwise shared secrets, enabling the formation of aggregate signatures to adapt to the actual set of online users. Furthermore, a threshold ElGamal encryption and honest decryption committee set is introduced to assist in completing the auxiliary processing required for signature generation when a user disconnects. Thus, the constructed aggregate signature can support publicly verifiable secure aggregations in dynamic disconnection scenarios without requiring re-initialization.

[0015] The fault-tolerant, verifiable, and secure aggregation protocol proposed in this invention aims to publicly release the first... The method of this invention verifies the aggregation results of private input from online users. The specific process includes four stages: initialization, signing, aggregation, and verification. The system consists of an aggregator, users, verifiers, a trusted initializer, and a decryption committee.

[0016] Aggregator. The aggregator is responsible for collecting the aggregated ciphertext and signature materials submitted by users, calculating the aggregation result and its aggregated signature, and publicly publishing both. This invention models the aggregator as a malicious entity that can arbitrarily deviate from protocol execution and collude with corrupted users to attempt to infer the private input of honest users, tamper with signature materials, or publish incorrect aggregation results.

[0017] Users. Assume the system contains a set of users. In the first In the wheel, the user Holding private input Non-compliant participants can be corrupt at most. One corrupted user can fully collude with the aggregator and execute arbitrary malicious actions. The remaining users honestly follow the protocol, but may be disconnected during the protocol process due to device or network failures.

[0018] Verifier. The verifier is responsible for checking whether the aggregation result published by the aggregator matches the aggregation signature. Any external auditor, user, or system administrator can act as a verifier. This invention assumes that at least one verifier exists in the system.

[0019] Trusted Initiator. The initiator only participates in the setup phase, responsible for generating system public parameters, user-related key materials, and aggregated verification parameters, and securely distributing them to the appropriate entities. After initialization, it exits the protocol and no longer participates in subsequent execution.

[0020] Decryption Committee. To support user account recovery after disconnection, the system introduces a decryption committee to assist in recovering lost data. Committee members collectively hold a threshold share of the decryption private key; any number of members below this threshold cannot independently decrypt or recover the private key. Non-compliant participants may corrupt some committee members, but their number will always remain below the protocol threshold.

[0021] This invention assumes that all non-compliant participants are probabilistic multinomial-time non-compliant participants. The communication channel satisfies confidentiality, authentication, and integrity; messages between users can be forwarded via an aggregator, but their content is not visible to the aggregator. Except for normal disconnections, honest participants will not actively refuse service or intentionally block protocol execution.

[0022] The method of this invention possesses the inadvertent security feature of the aggregator. Even if a malicious aggregator adaptively corrupts some users and the number of decryption committee members below the protocol threshold, it cannot infer the private input of honest users through the view information obtained during the protocol interaction process, nor can it distinguish the protocol execution results corresponding to different input vectors, effectively avoiding the risk of aggregators spying on user privacy. Simultaneously, this invention possesses the unforgeable security feature of the aggregated signature, resisting two typical forgery behaviors. On the one hand, a malicious aggregator cannot independently construct a verifiable aggregated signature without complete signature materials from legitimate users; on the other hand, when the aggregator and malicious users collude internally, even if they possess private information such as secret shares and key shares, they cannot crack the underlying cryptographic assumptions and forge a legitimate aggregated signature, thus fundamentally eliminating the possibility of signature forgery and aggregation result tampering.

[0023] In one embodiment, such as Figure 1 As shown, a publicly verifiable data security aggregation method is provided, including the following steps: Step 102: Obtain the system public parameters, global verification parameters, threshold encryption public key, and secret share allocated to each user issued by the trusted initializer. The system public parameters are used to define the local collaborative relationships between users and determine a user's neighboring users.

[0024] The system's public parameters are generated by the trusted initializer based on preset security parameters. These parameters include fundamental protocol configuration parameters such as bilinear group, hash function, and user scale, and can be used to construct a k-regular undirected graph topology. The global verification parameters are calculated and published by the trusted initializer using the global secret and the user's signature private key. These are the core benchmark parameters for publicly verifying aggregation results. The threshold encryption public key is generated via a distributed key generation protocol and published across the network, used by users to encrypt their verification correction keys. The secret share is an independent key fragment distributed one-to-one to each user after the trusted initializer splits the global secret using the Shamir secret-sharing scheme. Local collaborative relationships are the signature-based interactive collaborative relationships formed by assigning fixed neighbor nodes to each user within the regular undirected graph constructed based on the system's public parameters.

[0025] Step 104: Forward the user's initial signature to the corresponding neighboring user, obtain the partial signature generated by the neighboring user in combination with the secret share they hold, and merge the partial signatures to obtain the user's corresponding intermediate signature.

[0026] The initial signature is the raw signature data generated by the user based on their private input and exclusive signature private key. Neighboring users are nodes identified based on local collaborative relationships, responsible for participating in cross-user signature interaction calculations. A partial signature is sub-signature data generated by neighboring users through cryptographic operations on the received initial signature, incorporating their own share of the secret key. An intermediate signature is transitional signature data obtained by the aggregator collecting all partial signatures corresponding to the same user and merging them.

[0027] It is understandable that this step can complete distributed signature splitting and cross-node interaction based on the preset user local collaboration relationship, integrate the secret share into part of the signature generation process, introduce multi-user collaborative constraint logic, improve the anti-tampering and anti-forgery capabilities of the signature generation process, and help reduce the probability of a single malicious user independently forging a valid signature.

[0028] Step 106: Obtain the final signature generated by the user using their own secret share to complete the intermediate signature and the corresponding encrypted data. Merge the received encrypted data and the final signature to obtain the data aggregation result and the aggregated signature.

[0029] The final signature is a complete and independent signature unit obtained by the user using their own secret share to supplement the intermediate signatures and reconstruct the global secret. Encrypted data is an encrypted vector generated by the user after encoding their private input, which can avoid the plaintext transmission and aggregation of the original private data.

[0030] Understandably, this step can complete the global aggregation processing of multi-user data and signatures while completely hiding the user's original private input plaintext. By using signature completion operations to ensure the integrity of independent signatures and global aggregated signatures, it can effectively protect the privacy of individual user input from being stolen by the aggregation server, while providing complete and compliant aggregation results and aggregated signature basis for subsequent public consistency verification.

[0031] Step 108: If a user is detected to be offline during the aggregation process, collect partial decryption results obtained by each member of the decryption committee from parsing the verification and correction ciphertext. Based on a preset threshold number of partial decryption results, obtain the verification and correction information. The verification and correction ciphertext is then encrypted using a threshold encryption public key.

[0032] The verification and correction ciphertext is generated by encrypting a verification and correction key derived from the user's own signature private key using a threshold encryption public key. It is specifically used for verification and compensation in scenarios where the user experiences dynamic disconnection. The decryption committee is a collaborative group composed of multiple legitimate network nodes, each holding an independent key share derived from the threshold decryption private key. Partial decryption results are partially decrypted data obtained by a single member of the decryption committee decrypting the verification and correction ciphertext individually using their own key share. The preset threshold is a lower limit on the number of valid decryption nodes set according to Shamir's secret sharing rules; only when this number is reached can the encrypted information be fully restored. The verification and correction information is the verification and correction key reconstructed by collecting the preset threshold number of partial decryption results and applying the threshold decryption rules.

[0033] It is understandable that this step can securely recover the verification correction key corresponding to the offline user by relying on the decryption committee and threshold decryption mechanism. The distributed decryption mode avoids the risk of single-node key leakage and can adapt to the actual scenario of users dynamically disconnecting during federated learning aggregation. It can supplement the offline user-specific verification compensation information for subsequent public verification, which is conducive to improving the fault tolerance and dynamic adaptation capability of the entire secure aggregation protocol.

[0034] Step 110: Publicly disclose the data aggregation results, aggregation signature, global verification parameters, and verification correction information to support external verifiers in publicly verifying the consistency of the data aggregation results and aggregation signature.

[0035] Public consistency verification is a standardized process by which external verifiers verify the legality and matching of data aggregation results and aggregation signatures by relying on bilinear pairing operations and combining global verification parameters and verification compensation information.

[0036] Understandably, this step can integrate global verification parameters with the verification and correction information of offline users, adapt to the actual set of online users to complete full-dimensional public verification, and accurately determine the authenticity of the aggregation result and the aggregation signature by means of bilinear pairing operation. It can promptly identify malicious behaviors such as data tampering and signature forgery by the aggregation server, which is conducive to enhancing the overall ability of the protocol to resist collusion attacks between the aggregation server and malicious users.

[0037] The aforementioned publicly verifiable data security aggregation method establishes a multi-user collaborative signature constraint mechanism by configuring various parameters issued by a trusted initializer and defining local user collaboration relationships. It generates the final signature by forwarding the initial signature, aggregating partial signatures generated by neighboring users based on secret shares, and performing secret share completion calculations. This method effectively conceals users' original private input throughout the signature interaction and data aggregation process, mitigating the risk of user input privacy leakage in federated learning scenarios. By collecting partial decryption results obtained from the decryption committee's parsing of threshold encryption correction ciphertexts, and restoring verification correction information based on threshold conditions, it adapts to scenarios where users dynamically disconnect during aggregation, supplementing the missing verification support. Furthermore, by integrating global verification parameters and verification correction information for public consistency verification, it accurately verifies the authenticity of the aggregation results and aggregation signatures, identifying tampering behavior by malicious aggregation servers. This invention, while protecting user input privacy in federated learning, resists internal collusion attacks between aggregation servers and malicious users, is compatible with dynamic user disconnection scenarios, and ensures the publicly verifiable nature of the aggregation results.

[0038] In one embodiment, the method further includes: a trusted initializer generating system public parameters based on pre-set security parameters, splitting the global secret using the Shamir secret sharing scheme to generate secret shares corresponding to each user, generating a threshold encryption public key through a distributed key generation protocol, and calculating and publishing global verification parameters based on the global secret and the user's signature private key.

[0039] In this embodiment, during the setup phase, the Dealer (trusted initiator) first determines the security parameters... λ Selecting and publishing public parameters ,in, It is a large prime number. , and for Cyclic group of order 1. and They are and The random generator. It is a 3-type bilinear pairing operation and satisfies the symmetric external Diffie–Hellman (SXDH) assumption. and These are two distinct and cryptographically secure hash functions. Represents the number of users. This represents the maximum number of malicious users. Secondly, the Dealer randomly selects a secret. ,in, This means selecting uniformly and randomly from the set. For model p Finite fields of integers, using Shamir's secret sharing plan is for each user Generate secret shares Each share corresponds to a coordinate on a two-dimensional plane. Let the x-axis of each share be related to the user ID. Strict correspondence, then (This setting can be achieved by assigning identifiers and shares through the Dealer).

[0040] Each user Generate a private key for signing. , For the first t A subset of users participating in this round of aggregation. To be assigned to users i The signing private key is obtained and sent to the Dealer. Let's assume that the participants in this round of aggregation... Individual users constitute a Regular undirected graph . The user identifiers in the data are arranged in a circle from smallest to largest, and each user node... Choose the one closest to its left. Each node is connected. Assume each user... Selected A set of users It is the set of its corresponding signers.

[0041] For any user , For the entire user group of the system, the system pre-registers long-term public keys for them through public key infrastructure (such as a public key directory). In the In the round aggregation, users Based on this round of neighbor set Read each neighbor from PKI (Public Key Infrastructure). public key and using its own private key Locally compute paired shared secrets Because of the neighbors The same result can be obtained symmetrically, and both parties can obtain a consistent long-term shared secret without performing additional online Diffie-Hellman interactions. Based on this, users... by and round identifier As input to the random function, the round-binding seed is calculated. And further output the mask: ; in, , It is a random number generator. Finally, Dealer calculates and publishes the verification parameters. , It is a system-wide secret.

[0042] Shamir's secret sharing is used to distribute a secret value among multiple participants, ensuring that any number of participants reaching a threshold can recover the secret, while participants below the threshold cannot obtain any valid information about the secret. Let... For a finite field, To share the secret, the participants gather. The reconstruction threshold is The sharer randomly selects a number of times, not exceeding... polynomial ,in , Let be the formal independent variable of the polynomial, and Send to the participants .because , any number not less than Individual shares can be recovered through Lagrange interpolation. And thus obtain the secret .

[0043] In one embodiment, dividing the local collaborative relationships between users and determining the neighboring users of a user includes: constructing a k-regular undirected graph topology based on system common parameters; assigning a preset number of neighboring user nodes to each user based on the regular undirected graph topology, and determining the assigned neighboring user nodes as the user's corresponding neighboring users.

[0044] In one embodiment, merging the received encrypted data and the final signature to obtain a data aggregation result and an aggregated signature includes: performing secure aggregation and summation on the encrypted data reported by all online users to obtain a data aggregation result; and performing algebraic merging operations on the final signatures reported by all online users to obtain an aggregated signature.

[0045] In this implementation, during the signature phase, the user Use an interactive process for its first Private input generation of the wheel Aggregate signatures.

[0046] 1) Calculate the initial signature .user Using its signing private key calculate And send it to the aggregator.

[0047] 2) Calculate partial signature Aggregator forwards user data. initial signature Give it the selected signature set of users ,and , .user After receiving the signature, calculate Partial signature: ; in, The secret share after interpolation weighting. , For system secrets s Assigned to the participants j The secret share, Shamir secretly shares the corresponding Lagrange interpolation coefficients. For round t, user i With neighboring users j The pairwise masks generated between them For users i In the t The wheel's private input, followed by the user Will Send to the aggregator.

[0048] 3) Secret share summation. Once the aggregator receives... A user All parts of the signature ,calculate The aggregator will then Send to user ,in, For users i Selected set of signature-assisted users.

[0049] 4) Calculate the final signature In the previous step, the signature... The index has been added A secret The share, according to The design of Shamir's secret sharing scheme, by adding a secret share, can reconstruct the index. .user Calculate the final signature: ; This signature cannot be verified using the verification key because that key is only applicable to the aggregated signature. This is intentional, as verifying a single user's signature makes it easy for an attacker to learn the user's private input through brute-force attacks. Subsequently, the user... Send message Give to the aggregator, where For users i No. t The ciphertext corresponding to the private input in the round. For users i No. t The final signature of the wheel.

[0050] During the aggregation phase, when the aggregator receives all users ciphertext and final signature The aggregator calculates the aggregate signature: ; Send the aggregate signature to the validator and publish the summation value. Verifiers can verify this through bilinear pairwise computation. The correctness of the equations. Each verifier can check the following equations: ; in, This indicates that the equality check is performed. It is a bilinear pairing mapping. Output the round-related hash map (group elements). , To aggregate the two components of the verification key, For rounds t The corresponding aggregate signature, Given the aggregated sum of all user inputs for this round, if the published result is calculated correctly, then: ; in, For hash output The power group element under the master key s.

[0051] In one embodiment, the steps for each member of the decryption committee to parse the verification and correction ciphertext include: the decryption committee generating a threshold decryption private key through a distributed key generation protocol, splitting the threshold decryption private key into multiple key shares, and distributing them to each member of the decryption committee; when a user is detected to be offline during the aggregation process, the verification and correction ciphertext corresponding to the offline user is forwarded to each member of the decryption committee; each member uses their own key share to partially decrypt the verification and correction ciphertext and generate a partial decryption result.

[0052] In this embodiment, to address the issue of user disconnection, the protocol proposed in this invention introduces a decryption committee. Assuming the input of a user who has lost connection... At the same time, using the correction key This compensates for information lost due to disconnection. The decryption committee's role is to recover the user's pre-encrypted correction key when the user disconnects. This material allows the final verification object to be derived from the original selected set. Adjusted to actual online collection . Representing the The roundup of users who have lost connection.

[0053] Specifically, during the setup phase, the committee Run the DKG protocol to generate a public key for the threshold ElGamal encryption algorithm. Its corresponding private key Not held by any single entity, but rather -Shamir's secret share exists in the form of a shared portion. Among them, Released as a public encryption key to all users; any number less than The committee members were unable to recover. Or complete the decryption.

[0054] In the Before the round of aggregation, users Generate a verification correction key based on your own signature private key. And use threshold ElGamal encryption The user will then Submitted to the aggregator, where, To modify the key The encrypted ciphertext, For threshold ElGamal encryption algorithm. When the user In the When the wheel goes offline, the aggregator will Forwarded to the decryption committee. The committee decrypts based on the private key share. Generate partial decryption results.

[0055] Among them, let For the order of cyclic group Its generator. An ElGamal encryption scheme consists of the following three algorithms: Randomly select private key Generate public key ,in, The public key for ElGamal's encryption is used for the threshold. This is the global private key for the threshold ElGamal.

[0056] : For plaintext Random selection Output ciphertext ,in, The group elements are randomly generated. Represents the assignment definition. The first component of the ciphertext. This is the second component of the ciphertext. For elements of the r-th power group of the public key, : Calculate plaintext .

[0057] If the Diffie-Hellman (DDH) hypothesis is found to be true, then the ElGamal encryption scheme satisfies security under chosen-plaintext attacks.

[0058] In one embodiment, obtaining verification and correction information based on a number of partial decryption results that reach a preset threshold includes: summarizing and merging the collected partial decryption results that reach a preset threshold; performing calculations on the summarized partial decryption results according to a pre-set threshold decryption reconstruction rule to recover the verification and correction information corresponding to the offline user.

[0059] In this embodiment, the aggregator collects no less than After a valid response, the threshold decryption algorithm is invoked to recover the data. ,in, For the threshold ElGamal decryption algorithm, This is a set of indices representing the members of the decryption committee who participated in the decryption process. The decryption threshold is the minimum number of committee members required to recover the plaintext. Subsequently, the aggregator uses the recovered plaintext... Correct the validation criteria.

[0060] In one embodiment, the step of obtaining the verification correction ciphertext includes: the user generating a verification correction key based on their own signature private key; and encrypting the verification correction key using a threshold encryption public key to generate the verification correction ciphertext.

[0061] In one embodiment, the external verifier's public consistency verification of the data aggregation result and the aggregation signature includes: incorporating the verification correction information corresponding to offline users into the verification process to adapt to the verification scope of the actual online user set; combining global verification parameters, data aggregation result, aggregation signature, and verification correction information to construct a consistency verification equation through bilinear pairing operations; determining whether the constructed consistency verification equation is valid, and confirming whether the data aggregation result and the aggregation signature are authentic and legal based on the equation determination result.

[0062] In this embodiment, for the protocol proposed by the present invention, the first The round release value should be The aggregate signature should correspond to this value. This is for verifying the signature. That's correct. The verifier uses the corrected key and checks the consistency check equation: ; in, For the first t Round the set of users who have disconnected. For the first t The final aggregated release value of the round, Let the public key parameter be the one corresponding to user i. If the calculation of the publication result is correct, then: ; Calculating on the left side, we have: ; in, For the first i The first user's j Based on the complete implementation process of the publicly verifiable data security aggregation method, this invention utilizes a regular graph neighbor collaboration mechanism, Shamir secret sharing, threshold ElGamal encryption, and a distributed decryption architecture of the decryption committee to form complete security constraints from multiple dimensions, including privacy protection, anti-forgery, and anti-internal collusion. The security characteristics of the protocol of this invention are analyzed and explained below.

[0063] First, the applicable security model and the capability settings for non-compliant participants are defined.

[0064] Definition 1 (Aggregator inadvertence). Let... As a probabilistic multinomial-time non-compliant participant, it can corrupt the aggregator, a subset of users, and a committee member up to a threshold number, and attempt to infer the private input of the target honest user. If any non-compliant participant... In the following secure games, the winning advantage is a negligible function, and the protocol is said to satisfy the aggregator inadvertence property.

[0065] Setup. The challenger runs the protocol initialization algorithm, generating public parameters, user keys, committee shares, and aggregate verification keys. The challenger then sends the public parameters and aggregate verification keys to non-compliant participants. It also preserves the private status of honest users and members of the honesty committee.

[0066] Corruption. Non-compliant participants can adaptively corrupt the aggregator, some users, and some committee members. For corrupted users, challengers... Returns its private key and internal state; for corrupted committee members, the challenger returns its share and internal state. To corrupt a user group, For the set of honest users. The challenge is to engage the target users. Furthermore, the number of members of the Corruption Committee is below the threshold stipulated in the agreement.

[0067] Challenge. Non-compliant participants choose a challenge round. Target users And give two sets of user input vectors , ,satisfy , , as well as Challengers are randomly selected. ,in, The challenge bits are randomly selected from the challengers and used as input vectors. Execute the agreement, to Return its view in the real protocol, denoted as .

[0068] Speculation. Output from non-compliant participants. in, For non-compliant participants to challenge Bit b The guess result. If If the non-compliant participant wins, then the non-compliant participant's advantage is defined as... , Non-compliant participants In the agreement The safety advantages of the polymerizer under unintentional safety testing. The probability of the corresponding event occurring. (Aggregator Obliviousness) is an indicator of unintentional safety testing by the aggregator. It is indicated for non-compliant participants in polynomial-time events with arbitrary probabilities. All have Then it is called an agreement. Satisfying the unintentionality of the aggregator, among which, This is a negligible function.

[0069] Definition 2 (Unforgeability). If, for any non-compliant participant with bounded probabilistic polynomial time, the probability of successfully forging an aggregate signature under a forgery attack model is negligible, then the signature is considered to satisfy aggregate unforgeability.

[0070] Based on the non-compliant participants and operating environment settings of the above security model, the protocol of this invention has two core security features: the aggregator's unintentionality and the unforgeability of the aggregate signature. The specific security analysis is as follows.

[0071] The method of this invention possesses the characteristic of inadvertent security of the aggregator. Even in scenarios where the aggregator can be maliciously corrupted, and can adaptively corrupt some users and a lower-than-threshold number of decryption committee members, a malicious aggregator cannot infer the private input of honest users through various view information obtained from protocol interactions, nor can it distinguish the protocol execution results corresponding to different user input vectors. This fundamentally eliminates the possibility of aggregators spying on user privacy. The proof process is as follows: Proof: For ease of description, the interfaces through which the protocol of this invention can be accessed by non-compliant participants are as follows.

[0072] : Perform protocol initialization and return public parameters , verification key and the ElGamal public key User-signed private key Secret Shares and ElGamal private key share All of this was kept secret.

[0073] Return to user All private information ,in, For users i Short-term private key, For users i Long-term master private key, For users i Private key fragmentation.

[0074] Return to the decryptor Private key share .

[0075] Given user round and input ,return .

[0076] Given two sets of capacity input vector and , To challenge the rounds, set up Challengers are randomly selected. and based on Perform the challenge round and return the signature view for all participating users. If any user disconnects in this round, also return the corrected ciphertext visible to the aggregator in the actual protocol, the committee's partial decryption result, and the recovered corrected key.

[0077] Record the unintentional game of the real aggregator Constructing hybrid games In the challenge rounds In the process, hidden factors in the initial signatures of all honest users are identified. Replace with a set of random group elements that satisfy the same product constraint. ,Right now ,because It is modeled as a random oracle, and the SXDH (strong external Diffie-Hellman assumption) holds in the underlying bilinear group. The computation of the aforementioned true hidden factor tuples is indistinguishable from that of random tuples under fixed product constraints. Therefore... The following analysis The probability of winning for compliant participants from China and Africa.

[0078] Settings. Invoked by non-compliant participants. get , and .

[0079] Corruption. Invocation by non-compliant participants. and Obtain the internal states of the corrupted user and the corrupted committee members. Due to the challenge conditions, the two sets of inputs are identical for the corrupted user, therefore the corrupted user-related views are distributed the same in both experiments. On the other hand, committee shares below the threshold are insufficient to recover the ElGamal private key, so committee corruption does not provide any additional information about the challenge bit.

[0080] Challenge. Non-compliant participant invocation. Calculate the aggregate signature. In the middle, for any honest user Its initial signature is ,because ,make Then there is .therefore, and They follow a random distribution under the same fixed product constraint, and ,in, For the random group element introduced into the hybrid game, These are the elements of the random group after equivalent transformation. Therefore, the initial signatures of honest users generated by the two sets of challenge inputs have exactly the same joint distribution.

[0081] Partial signature ,in, It is derived solely from the pairwise shared secret and round identifier, and is independent of the input; Also unrelated to the input. The intermediate signature is... The final signature is ,in, The terms are determined by the pairwise mask structure and are independent of the input; input-dependent terms depend only on the sum. Since the two sets of challenge inputs have the same aggregate output, the distribution of the aggregate signatures is also the same.

[0082] Even if the If a user is found to be offline, correct the key. and its ciphertext All depend solely on the round and user key, and are independent of the input value. The plaintext security of the ElGamal threshold ensures that non-compliant participants cannot obtain additional information from the corrected ciphertext; when the same set of disconnections is fixed, the recovered corrected material is also completely consistent in both sets of experiments. Therefore, the dynamic support mechanism does not affect the indistinguishability of the challenge view.

[0083] Speculation. In the middle, non-compliant participants obtain a complete view of the challenges and challenge positions. It is irrelevant, therefore its successful guess is correct. The probability is Then by It can be seen that the advantage of non-compliant participants in real games, based on arbitrary probabilities and polynomial time, is at most a negligible function. Indicates game With calculation Indistinguishable. Therefore, the protocol proposed in this invention satisfies the aggregator inadvertence requirement.

[0084] This invention also possesses the characteristic of unforgeable aggregated signatures, resisting two types of forgery attacks: First, malicious aggregation cannot independently generate a valid aggregated signature without complete signature materials from legitimate users; second, in the face of collusion between the aggregator and malicious users, even if the colluding party holds a portion of the secret share and decryption key share, it cannot break the underlying cryptographic security assumptions, cannot reconstruct the global secret and user signature private key, and cannot forge or tamper with legitimate aggregated signatures and aggregation results. Even if users dynamically disconnect during the aggregation process, the correction key corresponding to the disconnection is only related to the round and user key, and is unrelated to the user's private input. The threshold encryption mechanism can also ensure that the ciphertext will not leak privacy, and the overall protocol can still maintain its original security capabilities under dynamic disconnection conditions. The proof process is as follows: Forgery attacks are generally divided into two types: 1) Type-I forgery. The aggregator generates a valid aggregator signature without receiving any user signatures.

[0085] First, in the protocol proposed in this invention, each round of signatures is bound to a unique hash value. and Under the random oracle model, and It possesses collision resistance and resistance to second preimage attacks, making it difficult for attackers to construct two different inputs that have the same hash value, thereby preventing signatures from being forged or tampered with across rounds.

[0086] Secondly, if the aggregator attempts to independently forge a valid signature, it must possess the user's signing key. Even at most, it can be with Even with collusion among multiple users, signature calculation still requires a secret index. aggregators, at most, only possess... A about The secret share cannot meet the reconstruction conditions, therefore a valid signature cannot be generated.

[0087] 2) Type-II forgery. Aggregators collude with malicious users to forge legitimate aggregate signatures.

[0088] During the operation of the protocol proposed in this invention, the secret information that attackers can utilize includes the secret share held by malicious users. ElGamal key share held by a malicious decryptor and the validator's holding However, under the security assumptions model, malicious users or malicious decryptors cannot reconstruct the secret index. or key Furthermore, through Derivation , or derivation Equivalent to in the group Solving DLP problems or violating the Diffie-Hellman (Co-CDH) assumption in cooperative computing. Both are considered difficult to solve in polynomial time. When a user goes offline, a corrected key is reconstructed. Push down or It is also equivalent to being in a group Solve the DLP problem above.

[0089] The effectiveness of this invention was verified through experiments. The protocol is implemented based on the Charm framework, and the curve selected is the MNT224 curve that satisfies the SXDH assumption, providing 112-bit security strength and supporting type 3 pairing. The size of a medium group element is 56 bytes. and The size of each element is 168 bytes. The element size is 28 bytes. This invention uses the FLBench framework to implement FedAvg-style federated learning, using the MNIST dataset and the LeNet-5 model, with all parameters set to default. No parallel or hardware acceleration methods were used during testing.

[0090] This invention primarily evaluates the computational overhead introduced by cryptographic operations. The experiment assumes that the user has completed local model training and parameter preprocessing during the offline pre-computation phase. The preprocessing time mainly consists of the time for generating masking factors. This time is significantly less than the average time per round of local training (approximately 11.96 seconds).

[0091] Figure 2 The runtime performance of the protocol proposed in this invention is demonstrated on different entities. Figure 2 (a) shows the runtime for a single user, with the majority of the time spent on partial signature generation. This varies depending on the proportion of malicious users. The increase in computational cost per user leads to an increase in computational overhead. Even with 1000 users and It only takes 0.35 seconds for a single user to calculate a signature. Figure 2 (b) describes the trend of aggregator runtime as the number of users changes, which is mainly determined by the number of summation operations of the aggregation signature. Figure 2 (c) This shows that the verifier's runtime remains stable because it only needs to perform three bilinear pairing calculations, and the computational complexity does not change with the number of participants. Furthermore, this invention compares the runtime of mPAVS with the method of this invention for each entity. Here, Exp represents the exponential operation, Mul represents the group multiplication operation, and Pair represents the bilinear mapping. Let... For the number of online users, The number of disconnected users is shown in Table 1. Table 1 shows that the method of this invention supports dynamic disconnection and its runtime is almost comparable to mPAVS. The computational cost of the decryptor is linearly related to the number of disconnected users. In the protocol proposed in this invention, users need to spend more runtime generating the mask factor during initialization, while mPAVS is generated by a trusted third party and updated in each round of aggregation.

[0092] Table 1 Comparison of computational costs for each entity during the online phase

[0093] The communication overhead in the method of this invention mainly comes from the generation of partial signatures. Throughout the entire protocol execution process, all signatures are... The group element in the data is 56 bytes. Figure 3 This is a schematic diagram illustrating the experimental communication overhead of the protocol proposed in this invention. Figure 3 (a) is a schematic diagram showing the change in communication load of a single user with the number of users under different neighbor ratios. Figure 3 (b) A schematic diagram showing the change in aggregator communication load with the number of users under different neighbor ratios, illustrating... Under these conditions, the communication overhead of individual users and the aggregator changes as the number of users increases. At that time, the communication overhead for a single user per round of aggregation is approximately 16.51KB, and the communication overhead for the aggregator per round is approximately 16.13MB.

[0094] When there is When a user goes offline, the decryptor's communication overhead and They show a linear positive correlation. Bytes. Of these, 64 bytes represent the size of a single ElGamal ciphertext. The aggregator's communication overhead is... byte.

[0095] In summary, the protocol proposed in this invention protects user input privacy while ensuring the authenticity and verifiability of aggregation results even in cases of collusion between malicious aggregation servers and malicious users. It also supports protocol execution in scenarios where users dynamically disconnect. Therefore, the protocol further enhances the credibility of privacy-preserving aggregation results, providing effective support for the application of secure aggregation technology in complex and open federated learning environments.

[0096] It should be understood that, although Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated in this invention, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Furthermore, Figure 1At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0097] In one embodiment, a publicly verifiable data security aggregation apparatus is provided, comprising: The parameter acquisition module is used to acquire the system public parameters, global verification parameters, threshold encryption public key, and secret share allocated to each user issued by the trusted initializer; the system public parameters are used to divide the local collaborative relationships between users and determine the neighboring users of each user. The collaborative signature module is used to forward the user's initial signature to the corresponding neighboring user, obtain the partial signature generated by the neighboring user in combination with the secret share they hold, and merge the partial signatures to obtain the user's corresponding intermediate signature. The data aggregation module is used to obtain the final signature generated by the user using their own secret share to complete the intermediate signature and the corresponding encrypted data. The received encrypted data and the final signature are merged to obtain the data aggregation result and the aggregated signature. The verification and correction module is used to collect partial decryption results obtained by each member of the decryption committee from parsing the verification and correction ciphertext if the user is detected to be offline during the aggregation process. Based on the partial decryption results reaching a preset threshold, the verification and correction information is obtained. The verification and correction ciphertext is then encrypted using a threshold encryption public key. The verification output module is used to publicly display the data aggregation results, aggregation signature, global verification parameters, and verification correction information to support external verifiers in publicly verifying the consistency of the data aggregation results and aggregation signature.

[0098] Specific limitations regarding publicly verifiable data security aggregation devices can be found in the limitations of publicly verifiable data security aggregation methods described above, and will not be repeated here. Each module in the aforementioned publicly verifiable data security aggregation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0099] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 4As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a publicly verifiable data security aggregation method. The display screen can be a liquid crystal display (LCD) or an e-ink display. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0100] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0101] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method described above.

[0102] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0103] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A publicly verifiable method for secure data aggregation, characterized in that, The method includes: The system obtains the system public parameters, global verification parameters, threshold encryption public key, and secret share allocated to each user issued by the trusted initializer; the system public parameters are used to divide the local collaborative relationships between users and determine the neighboring users of each user. The user's initial signature is forwarded to the corresponding neighboring user. The neighboring user's partial signature is obtained by combining the partial signatures with their secret share. The partial signatures are then merged to obtain the user's intermediate signature. Obtain the final signature generated by the user using their own secret share to complete the intermediate signature, as well as the corresponding encrypted data. Then, merge the received encrypted data and the final signature to obtain the data aggregation result and the aggregated signature. If a user is detected to be offline during the aggregation process, the partial decryption results obtained by each member of the decryption committee from parsing the verification and correction ciphertext are collected. Based on the partial decryption results reaching a preset threshold number, the verification and correction information is obtained. The verification and correction ciphertext is then encrypted using the threshold encryption public key. The data aggregation result, the aggregation signature, the global verification parameters, and the verification correction information are disclosed to support external verifiers in publicly verifying the consistency of the data aggregation result and the aggregation signature.

2. The method according to claim 1, characterized in that, The method further includes: The trusted initializer generates system public parameters based on pre-set security parameters, splits the global secret using the Shamir secret sharing scheme to generate secret shares for each user, generates threshold encryption public keys through a distributed key generation protocol, and calculates and publishes global verification parameters based on the global secret and the user's signature private key.

3. The method according to claim 1, characterized in that, The process of dividing the local collaborative relationships among users and determining a user's neighboring users includes: Construct a k-regular undirected graph topology based on the system's common parameters; Based on the regular undirected graph topology, a preset number of neighbor user nodes are assigned to each user, and the assigned neighbor user nodes are determined as the user's corresponding neighbor users.

4. The method according to claim 1, characterized in that, The received encrypted data and the final signature are merged separately to obtain the aggregated data result and the aggregated signature, which include: Securely aggregate and sum the encrypted data reported by all online users to obtain the data aggregation result; The final signatures reported by all online users are algebraically merged one by one to obtain the aggregate signature.

5. The method according to claim 1, characterized in that, The steps taken by each member of the decryption committee to analyze, verify, and correct the ciphertext include: The decryption committee generates a threshold decryption private key using a distributed key generation protocol, and then splits the threshold decryption private key into multiple key shares, which are distributed to each member of the decryption committee. When a user is detected to be offline during the aggregation process, the verification and correction ciphertext corresponding to the offline user is forwarded to each member of the decryption committee; Each member uses their own key share to partially decrypt the verification and correction ciphertext, generating a partial decryption result.

6. The method according to claim 1, characterized in that, The verification and correction information obtained by parsing the partial decryption results that reach a preset threshold number includes: The collected partial decryption results that reach a preset threshold number are summarized and merged; The aggregated partial decryption results are processed according to the pre-set threshold decryption and reconstruction rules to recover the verification and correction information corresponding to the offline user.

7. The method according to claim 1, characterized in that, The steps to obtain the verified and corrected ciphertext include: The user generates a verification correction key based on their own signature private key; The verification correction key is encrypted using the threshold encryption public key to generate the verification correction ciphertext.

8. The method according to claim 1, characterized in that, The external verifier performs public consistency verification on the data aggregation result and the aggregation signature, including: Incorporate the verification and correction information corresponding to offline users into the verification process to adapt to the verification scope of the actual online user set; By combining global verification parameters, data aggregation results, aggregation signatures, and verification correction information, a consistency verification equation is constructed through bilinear pairing operations. Determine whether the constructed consistency verification equation is true, and confirm whether the data aggregation result and aggregation signature are genuine and legal based on the equation's determination result.

9. A publicly verifiable data security aggregation device, characterized in that, The device includes: The parameter acquisition module is used to acquire system public parameters, global verification parameters, threshold encryption public keys, and secret shares allocated to each user issued by the trusted initializer; the system public parameters are used to divide the local collaborative relationships between users and determine the neighboring users of each user. The collaborative signature module is used to forward the user's initial signature to the corresponding neighboring user, obtain the partial signature generated by the neighboring user in combination with the secret share they hold, and merge the partial signatures to obtain the user's corresponding intermediate signature. The data aggregation module is used to obtain the final signature generated by the user using their own secret share to complete the intermediate signature and the corresponding encrypted data. The received encrypted data and the final signature are merged to obtain the data aggregation result and the aggregated signature. The verification and correction module is used to collect partial decryption results obtained by each member of the decryption committee from parsing the verification and correction ciphertext if the user is detected to be offline during the aggregation process, and to obtain verification and correction information based on the partial decryption results reaching a preset threshold number; the verification and correction ciphertext is obtained by encrypting it with the threshold encryption public key; The verification output module is used to publicly disclose the data aggregation result, the aggregation signature, the global verification parameters, and the verification correction information to support external verifiers in publicly verifying the consistency of the data aggregation result and the aggregation signature.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

Images