Private data aggregation with integrity assurance and fault tolerance for mobile crowd-sensing

Abstract

Mobile crowd-sensing can learn the aggregate statistics over personal data to produce useful knowledge about the world. Since personal data may be privacy-sensitive, the aggregator should only gain desired statistics without learning anything about the personal data. To guarantee differential privacy of personal data under an untrusted aggregator, existing approaches encrypt the noisy personal data, and allow the aggregator to get a noisy sum. However, these approaches lack of either efficient support of dynamic joins and leaves, or secure data-integrity verification, or fault tolerance. In this paper, we propose a novel private data aggregation scheme to address these issues for mobile crowd-sensing applications. In our scheme, we first design an efficient group management protocol to deal with the participants’ dynamic joins and leaves. Then we enhance the scheme with data-integrity verification by considering the security vulnerability of limited data range. Moreover, we guarantee fault tolerance by leveraging a future message buffering mechanism, enabling continuously obtaining aggregate results and integrity verifications when failures happen. The analysis indicates that our scheme achieves desired properties, and the performance evaluation demonstrates the scheme’s efficiency in terms of communication and computation overhead.

Appendix

1.1 Theorem 1

Theorem 1

Let $\gamma$ denote the maximum fraction of compromised nodes. Assume any node in a ring can only know the identities of his neighbour nodes. If the number of nodes in a ring ${\mathcal {R}}_i$ satisfies: $|{\mathcal {R}}_{i}| \ge 2\gamma n+1$, then the aggregator cannot completely learn the identities of all the nodes in the ring ${\mathcal {R}}_i$.

Proof

Suppose that all the $\gamma n$ compromised nodes are assigned in the same ring ${\mathcal {R}}_i$. When placing a uncompromised node in the position between two neighbour compromised nodes, it can be placed at most $\gamma n$ uncompromised nodes so that all the compromised nodes can still know the identities of all the other uncompromised nodes in the ring ${\mathcal {R}}_i$. The reason is that the two neighbour compromised nodes of a uncompromised node $U_i$ can confirm $U_i$’s identity and their connectivity through the exchanged parameters $g^{r_i}$. When $\gamma n +1$ or more uncompromised nodes are placed in the ring ${\mathcal {R}}_i$, there exist at least two uncompromised nodes that are neighbours. It is uncertain for the compromised nodes that how many other nodes are between the two uncompromised nodes, so they cannot obtain all the identity information of the nodes in the ring ${\mathcal {R}}_i$.

1.2 Proof of Theorem 2

Proof

Proof of necessity. We use the method of proof by contradiction and take Fig. 6 as an example to illustrate it. Assume that ${\mathcal {R}}_1$ is the subset ${\mathcal {R}}'$ in consideration, i.e., ${\mathcal {R}}'={\mathcal {R}}_1$, ${\mathcal {R}}_a={\mathcal {R}}_1$, and ${\mathcal {R}}_b={\mathcal {R}}_2$. If there does not exist a uncompromised participant U, such that $U \in {\mathcal {R}}_{1}$ and $U \in {\mathcal {R}}_{2}$. According to Eq. (1) and (3), the aggregator is able to obtain the noisy sum of ${\mathcal {R}}_1$. This obviously violates the condition that the aggregator cannot learn the noisy sum of any proper subset ${\mathcal {R}}'$ of the uncompromised participants.

Proof of sufficiency. Let ${\mathcal {R}}'$ denote any proper subset of the uncompromised participants, and the aggregator aims to get the aggregate sum of ${\mathcal {R}}'$. The proof proceeds in three cases.

Case 1: ${\mathcal {R}}'$ is a proper subset of a ring. e.g., ${\mathcal {R}}'=\{U_1\}\subset {\mathcal {R}}_1$ in Fig. 6. Since the aggregator does not know the encryption key of any uncompromised node in ${\mathcal {R}}'$, it cannot obtain the aggregate sum of ${\mathcal {R}}'$.

Case 2: ${\mathcal {R}}'$ is a ring. e.g., ${\mathcal {R}}'={\mathcal {R}}_1=\{U_1,U_2,U_3\}$ in Fig. 6. In this case, due to Constraint 1, $U_2 \in {\mathcal {R}}_1$ and $U_2 \in {\mathcal {R}}_2$, so that $U_2$ uses both the encryption key $\hat{R}_{1,2,t}$ produced in ${\mathcal {R}}_1$ and the encryption key $\hat{R}_{2,2,t}$ produced in ${\mathcal {R}}_2$ to encrypt his sensing data. The aggregator knows that all the encryption keys used in the ring ${\mathcal {R}}_1$ (including $\hat{R}_{1,2,t}$) can cancel out in the aggregate sum. However, the other encryption key $\hat{R}_{2,2,t}$ of $U_2$ cannot cancel out, and the aggregator does not know it. Hence the aggregator cannot obtain the aggregate sum of ${\mathcal {R}}'$.

Case 3: ${\mathcal {R}}'$ is an arbitrary combination of the above two cases. e.g., ${\mathcal {R}}'=\{U_1,U_2,U_3,U_4\}$ in Fig. 6. The proof of this case can be based on the above two cases. $\square$