Secure aggregation with integrity verification
A method for secure aggregation, by a server, of client-provided inputs includes receiving, from each of a plurality of clients, a respective client input, for which a commitment is published. The commitments were computed using randomness and are aggregated by at least two super-clients and a sum of the aggregated commitments is published by each super-client. A sum of the received client inputs is published such that validity of the sum is checkable, by the clients, by comparing the sum of the received client inputs to a verification algorithm result that uses a sum of additive shares computed by the clients using the randomness, and by verifying that the published sum of the aggregated commitments is the same for each super-client. The method can be applied to use cases, for example, in digital medicine using medical data or smartcity applications to support decision-making.
1 . A computer-implemented method for secure aggregation, by a server of a distributed client-server application, of client-provided inputs in a manner allowing for integrity verification, the method comprising:
receiving, from each of a plurality of clients, a respective client input, for which a commitment to the respective client input is published, the commitments having been computed using randomness, and the commitments being aggregated by at least two super-clients and a sum of the aggregated commitments being published by each of the at least two super-clients;
obtaining a sum of the received client inputs; and
publishing the sum of the received client inputs such that validity of the sum of the received client inputs is checkable, by one or more of the clients, by comparing the sum of the received client inputs to a result of a verification algorithm that uses a sum of additive shares that were computed by the clients using the randomness, and by verifying that the published sum of the aggregated commitments is the same for each of the at least two super-clients,
wherein the randomness is different for different clients, and wherein the randomness can only be reconstructed if all of the additive shares for a respective one of the clients are available.
2 . The method of claim 1 , wherein the at least two super-clients, and/or at least two other super-clients, receive and publish different additive shares of a same client along with additional additive shares from other clients such that no super-client obtains all additive shares of a same client, and such that the sum of all additive shares is obtainable by summing the additive shares published by the at least two super-clients and/or the at least two other super-clients.
3 . The method of claim 1 , wherein a number of the super-clients to be used for the secure aggregation is determined from a random beacon, and wherein a number of the additive shares computed per client corresponds to the number of the super-clients such that each of the super-clients receives one additive share per client.
4 . The method of claim 3 , wherein the number of the super-clients to be used for the secure aggregation is determined using a pseudo-random function which takes as input a random seed generated by the random beacon and public keys of the clients.
5 . The method of claim 1 , wherein at least one backup client is selected for each of the at least two super-clients, the backup client in each case having a secret key of a corresponding one of the super-clients.
6 . The method of claim 5 , wherein the server receives the secret key from the corresponding one of the super-clients and sends the secret key to a corresponding one of the backup clients.
7 . The method of claim 5 , wherein a set of backup clients are selected for each of the at least two super-clients, and wherein a secret sharing reconstruction threshold is less than a number of backup clients in the set so as to allow for a dropout of at least one of the at least two super-clients.
8 . The method of claim 1 , wherein the client inputs are blinded using a mask using a key shared with one of the at least two super-clients.
9 . The method of claim 8 , further comprising receiving, from each of the at least two super-clients, a partial blinding that was computed by a respective one of the super-clients by summing the masks received by the respective super-client from different ones of the clients, wherein obtaining the sum of the received client inputs includes aggregating the blinded client inputs and subtracting a sum of the partial blindings.
10 . The method of claim 1 , wherein the commitments are determined using a linearly-homomorphic commitment scheme.
11 . The method of claim 1 , wherein the client inputs are from medical records and/or independent healthcare facilities, and wherein the sum of the received client inputs is used for training a model for medical diagnostics or for monitoring health status of patients.
12 . The method of claim 1 , wherein the client inputs are from sensors of a smartcity application, and wherein the sum of the client inputs are used to determine a condition in the smartcity application.
13 . A computer system for secure aggregation, by a server of a distributed client-server application, of client-provided inputs in a manner allowing for integrity verification, the system comprising one or more hardware processors which, alone or in combination, are configured to provide for execution of the method according to claim 1 .
14 . A tangible, non-transitory computer-readable medium having instructions thereon for secure aggregation, by a server of a distributed client-server application, of client-provided inputs in a manner allowing for integrity verification, the instructions, upon being executed by one or more hardware processors, alone or in combination, providing for execution of the method according to claim 1 .
15 . The method of claim 1 , wherein the commitments have each been computed using a commitment scheme run by a sender that receives as input a message of the sender and a random value chosen by the sender to output the respective commitment, such that validity of the respective commitment is checkable by a verification scheme that takes as input the message, the random value and the respective commitment to verify that the respective commitment was correctly computed using the message and the random value.
16 . The method of claim 1 , wherein a number of the additive shares computed per client corresponds to a number of the super-clients such that each of the super-clients receives one additive share per client.
17 . The method of claim 1 , wherein the commitment is published by providing the commitment to each of the plurality of clients.
18 . A computer-implemented method for secure aggregation, by a server of a distributed client-server application, of client-provided inputs in a manner allowing for integrity verification, the method comprising:
receiving, from each of a plurality of clients, a respective client input, for which a commitment to the respective client input is published, the commitments having been computed using randomness, and the commitments being aggregated by at least two super-clients and a sum of the aggregated commitments being published by each of the at least two super-clients;
obtaining a sum of the received client inputs; and
publishing the sum of the received client inputs such that validity of the sum of the received client inputs is checkable, by one or more of the clients, by comparing the sum of the received client inputs to a result of a verification algorithm that uses a sum of additive shares that were computed by the clients using the randomness, and by verifying that the published sum of the aggregated commitments is the same for each of the at least two super-clients,
wherein a number of the super-clients to be used for the secure aggregation is determined from a random beacon, and wherein a number of the additive shares computed per client corresponds to the number of the super-clients such that each of the super-clients receives one additive share per client.
19 . The method of claim 18 , wherein the number of the super-clients to be used for the secure aggregation is determined using a pseudo-random function which takes as input a random seed generated by the random beacon and public keys of the clients.
20 . A computer-implemented method for secure aggregation, by a server of a distributed client-server application, of client-provided inputs in a manner allowing for integrity verification, the method comprising:
receiving, from each of a plurality of clients, a respective client input, for which a commitment to the respective client input is published, wherein the commitments have been computed using randomness, wherein the commitments are aggregated by at least two super-clients and a sum of the aggregated commitments is published by each of the at least two super-clients, and wherein the client inputs are blinded using a mask using a key shared with one of the at least two super-clients;
receiving, from each of the at least two super-clients, a partial blinding that was computed by a respective one of the super-clients by summing the masks received by the respective super-client from different ones of the clients;
obtaining a sum of the received client inputs including aggregating the blinded client inputs and subtracting a sum of the partial blindings; and
publishing the sum of the received client inputs such that validity of the sum of the received client inputs is checkable, by one or more of the clients, by comparing the sum of the received client inputs to a result of a verification algorithm that uses a sum of additive shares that were computed by the clients using the randomness, and by verifying that the published sum of the aggregated commitments is the same for each of the at least two super-clients.