Cryptonite: A Framework for Flexible Time-Series Secure Aggregation with Non-interactive Fault Recovery

Abstract In many real-world applications, an untrusted aggregator (server) is required to collect privacy-sensitive data from the users (clients) to compute aggregate statistics on that data periodically. In Private Stream Aggregation (PSA), multiple data producers encrypt their data for a central party, which can then retrieve only the aggregate sum of the encrypted values, without access to any individual values. PSA enables untrusted aggregators to execute aggregation operations over privacy-critical data from multiple data sources. Traditionally, existing PSA schemes require the aggregator to interact with a trusted third party to achieve fault tolerance. However, this kind of interactive recovery poses many security and practical vulnerabilities to achieve fault tolerance in real-world applications. This paper introduces a new formal PSA framework that ensures rigorous privacy guarantees for individual user inputs and achieves fault tolerance with non-interactive recovery . Existing definitions for fault tolerance do not account for the impact of faults on security and cannot defend against residual function attacks. We define a new level of security for a non-interactive fault tolerance model with malicious adversaries that guarantees defense for such attacks during fault recovery. We present the first PSA protocol that provably achieves this new level of security. Our techniques are versatile and can be used to enhance any existing PSA scheme to safely recover from faults in a non-interactive manner. We employ our proposed framework and use trusted hardware, cryptographic hashing, and p-ary trees to develop a protocol that achieves significant improvements in scalability and communication efficiency. Our proposed protocol is about 3 $$\times$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mo>×</mml:mo> </mml:math> faster than existing PSA protocols for cases when faults do not occur. During cases when faults occur, our protocol provides faster execution by about 1–2 orders of magnitude compared to existing works.