[Paper Review] Scalable and Secure Aggregation in Distributed Networks

Sébastien Gambs, Rachid Guerraoui+3 more|arXiv (Cornell University)|Jul 27, 2011

Cryptography and Data Security26 references3 citations

TL;DR

This paper presents a scalable and secure distributed protocol for computing aggregation functions with a communication complexity of $O(n\log^3 n)$, achieving near-optimal performance. It uses a clustered overlay structure to enable efficient, privacy-preserving computation tolerant to up to $(\frac{1}{2}-\epsilon)n$ malicious nodes, ensuring exact output with high probability.

ABSTRACT

We consider the problem of computing an aggregation function in a \emph{secure} and \emph{scalable} way. Whereas previous distributed solutions with similar security guarantees have a communication cost of $O(n^3)$, we present a distributed protocol that requires only a communication complexity of $O(n\log^3 n)$, which we prove is near-optimal. Our protocol ensures perfect security against a computationally-bounded adversary, tolerates $(1/2-ε)n$ malicious nodes for any constant $1/2 > ε> 0$ (not depending on $n$), and outputs the exact value of the aggregated function with high probability.

Motivation & Objective

• Address the scalability and security challenges in distributed aggregation functions across large-scale networks.
• Overcome the high communication cost of prior secure multiparty computation protocols, which scale as $O(n^3)$.
• Enable exact aggregation output with high probability despite up to $(\frac{1}{2}-\epsilon)n$ malicious nodes.
• Ensure strong privacy guarantees for individual inputs while maintaining low communication and computational overhead.
• Design a protocol that is both communication-efficient and resilient to adversarial behavior in dynamic, decentralized environments.

Proposed method

• Construct a distributed overlay using a modified version of the protocol from [AS09], forming clusters of size $O(\log n)$ with a majority of honest nodes.
• Leverage the cluster structure to perform secure multiparty computation at the cluster level, reducing global communication costs.
• Apply threshold cryptosystems (e.g., threshold Paillier) within each cluster to securely compute local aggregations.
• Use message authentication and secret sharing techniques to ensure correctness and prevent tampering by malicious nodes.
• Design a protocol that ensures the final output is the exact value of the aggregation function with high probability, even under adversarial control.
• Implement and evaluate the protocol on the Emulab testbed, comparing it to a non-layout-based secure aggregation protocol.

Experimental results

Research questions

• RQ1 Can a secure and scalable aggregation protocol be designed with communication complexity closer to the theoretical lower bound of $\Omega(n\log n)$?
• RQ2 Is it possible to tolerate up to $\frac{1}{2}-\epsilon$ fraction of malicious nodes while maintaining exact output with high probability?
• RQ3 Can a distributed protocol achieve both privacy and correctness with significantly reduced communication cost compared to existing $O(n^3)$ solutions?
• RQ4 How does organizing nodes into clusters improve the efficiency of secure aggregation in large-scale networks?
• RQ5 What is the practical performance trade-off between layout-based and non-layout-based secure aggregation protocols in real-world deployments?

Key findings

• The proposed protocol achieves a global communication complexity of $O(n\log^3 n)$, which is within a $\log^2 n$ factor of the theoretical lower bound of $\Omega(n\log n)$.
• The protocol tolerates up to $(\frac{1}{2}-\epsilon)n$ malicious nodes for any constant $\epsilon > 0$, independent of $n$, and ensures exact output with high probability.
• In experimental evaluation, the protocol scaled efficiently: with 200 nodes, the non-layout-based protocol required ~30 GB of communication, while the proposed protocol used only ~20 MB per node.
• Execution time for the proposed protocol remained within minutes even at 800 nodes, while the non-layout-based protocol took tens of hours.
• The most computationally expensive step—vote decryption—was significantly reduced in cost by delegating it to small clusters, demonstrating the efficiency of the cluster-based design.
• The protocol’s communication cost per node grows negligibly with network size, while the non-layout-based protocol’s cost per node reached 600 MB in a 400-node network.