[Paper Review] An Accountable Anonymous Data Aggregation Scheme for Internet of Things

Longfei Wu, Xiaojiang Du+3 more|arXiv (Cornell University)|Mar 21, 2018

Internet Traffic Analysis and Secure E-voting21 references3 citations

TL;DR

This paper proposes a novel, efficient, and accountable anonymous data aggregation scheme for the Internet of Things (IoT) that enables secure data collection across multiple untrusted IoT companies. By leveraging semi-trusted provider servers and a one-time peer-shuffle mechanism for index messages, the scheme preserves data anonymity while ensuring accountability against active and passive attacks, outperforming Dissent in execution time and communication overhead—especially with larger user groups and multiple providers.

ABSTRACT

The Internet of Things (IoT) has become increasingly popular in people's daily lives. The pervasive IoT devices are encouraged to share data with each other in order to better serve the users. However, users are reluctant to share sensitive data due to privacy concerns. In this paper, we study the anonymous data aggregation for the IoT system, in which the IoT company servers, though not fully trustworthy, are used to assist the aggregation. We propose an efficient and accountable aggregation scheme that can preserve the data anonymity. We analyze the communication and computation overheads of the proposed scheme, and evaluate the total execution time and the per-user communication overhead with extensive simulations. The results show that our scheme is more efficient than the previous peer-shuffle protocol, especially for data aggregation from multiple providers.

Motivation & Objective

• To address the challenge of anonymous data aggregation across multiple untrusted IoT companies in a server-users-servers architecture.
• To ensure data privacy by preventing any single IoT server from linking data to its true originator, even if compromised.
• To provide accountability against both passive collusion and active attacks, including 12 novel attack vectors specific to the multi-provider model.
• To reduce communication and computation overheads compared to existing protocols like Dissent, especially in large-scale, multi-provider settings.
• To eliminate reliance on trusted third parties by using semi-trusted provider servers that do not leak their own data.

Proposed method

• The scheme uses a two-phase protocol: first, users encrypt their data using RSA with padding, then apply a one-time peer-shuffle over index messages to break linkability.
• Each provider server performs serial encryption and decryption on index messages only once, minimizing repeated computation across multiple providers.
• The protocol relies on public-key cryptography and digital signatures to ensure authenticity and detect tampering.
• A novel index-based message routing mechanism ensures that only the collector can reconstruct the final aggregated result, while preserving originator anonymity.
• The system resists 12 active attacks and two passive collusion attacks by enforcing strict message integrity checks and using verifiable encryption.
• The design avoids the need for pairwise secrets or frequent key updates, reducing setup overhead compared to DC-nets.

Experimental results

Research questions

• RQ1 How can data anonymity be preserved when aggregating data from multiple untrusted IoT companies in a server-users-servers architecture?
• RQ2 What are the key attack vectors specific to multi-provider data aggregation in IoT systems, and how can they be mitigated?
• RQ3 Can an anonymous aggregation scheme be both efficient and accountable without relying on trusted third parties?
• RQ4 How does the performance of the proposed scheme compare to existing protocols like Dissent in terms of execution time and communication overhead?
• RQ5 What is the impact of increasing user group size, data size, and number of providers on the scheme’s efficiency?

Key findings

• The proposed scheme significantly reduces total execution time and per-user communication overhead compared to Dissent, especially as user group size increases.
• For large user groups (e.g., 100+ users), the scheme’s efficiency advantage grows due to optimized serial encryption/decryption handling.
• With multiple providers, the scheme’s performance remains stable, while Dissent’s execution time and communication overhead increase substantially.
• The scheme supports efficient aggregation from multiple providers by performing the computationally heavy peer-shuffle only once per index message, not per provider.
• In simulations, the scheme outperforms Dissent in both computation and communication, even when accounting for Java’s slower execution compared to the original implementation.
• The protocol effectively resists 12 active attacks and two passive collusion attacks, ensuring both anonymity and accountability in adversarial settings.