Homomorphic Threshold Cryptosystem for Privacy-Preserving Data Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current privacy preserving data computation techniques are inadequate for aggregating private data from a random selection of client devices in big data analytics applications, as they either require fixed user inputs or compromise user privacy by decrypting individual inputs.
Innovation Solution
A privacy-preserving protocol using a homomorphic threshold cryptosystem, where a server selects a subgroup of client devices, transmits client indices, and receives randomized encrypted data and decryption shares to aggregate and decrypt the data only if the server complies with aggregating data from a sufficiently large group, ensuring user privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the server aggregates private data from client devices, then data analytics efficiency is improved, but user privacy is compromised
Solution Approach 1:
The decryption key is segmented into multiple shares distributed among client devices. The server cannot decrypt aggregated data alone; it requires a threshold number of decryption shares from client devices to reconstruct the key and obtain the decryption result, thus preserving user privacy while enabling efficient data analytics
Solution Approach 2:
Homomorphic encryption serves as an intermediary mechanism that allows the server to perform computations on encrypted data without decrypting it. The server can aggregate encrypted private data from multiple clients and obtain an encrypted result, which is then decrypted by clients using their key shares, eliminating the need for the server to access plaintext data
2Reliability
If the server verifies computations using zero-knowledge proofs, then computation reliability is improved, but communication complexity increases
Solution Approach 1:
Client devices perform preliminary verification by checking whether the server has aggregated data from a sufficient number of clients before decryption. This preliminary check using client indices prevents unnecessary decryption attempts and reduces communication overhead compared to full zero-knowledge proof verification
Solution Approach 2:
The verification mechanism extracts only the essential information needed (client indices and aggregation count) from the complex zero-knowledge proof process. This extracted verification approach maintains computation reliability while significantly reducing communication complexity by removing unnecessary proof elements
3Adaptability or versatility
If the server selects a random subgroup of client devices, then adaptability is improved, but selection reliability decreases
Solution Approach 1:
Client devices provide feedback by verifying the server's selection of client indices and confirming that the aggregated data meets the minimum threshold requirement. This feedback mechanism ensures that random subgroup selection maintains both adaptability and reliability, as clients can reject inadequate aggregations
Solution Approach 2:
The system requires the server to aggregate data from at least a threshold number of clients, which may be more than the minimum needed for basic functionality. This excessive action ensures reliability by providing a buffer against selection failures while maintaining adaptability through flexible threshold configuration
Data Source
AI summary
A method for privacy-preserving computation of aggregated private data of a group of client devices comprises: a server selecting at least t devices; being provided with key information including an encryption key e and a decryption key of a homomorphic threshold cryptosystem; obtaining a random value ri and being provided with the random values of the other devices in the group; the server transmitting client indices identifying selected devices, and signalling a device for aggregate encrypted data of each of the selected devices; the server receiving randomized encrypted data and an associated decryption share from each selected device, the decryption shares being configured such that decryption key d can be reconstructed on the basis of t decryption shares; and, the server aggregating the received randomized encrypted data of the selected devices using the homomorphic properties and using the decryption shares for decrypting the aggregated randomized encrypted data into cleartext.