[Paper Review] STAR: Secret Sharing for Private Threshold Aggregation Reporting

Alex Davidson, Peter J. Snyder+4 more|arXiv (Cornell University)|Sep 21, 2021

Privacy-Preserving Technologies in Data4 citations

TL;DR

STAR is a practical, efficient threshold aggregation system that enables cryptographically enforced 𝜅-anonymity for client-side telemetry data using secret sharing and oblivious pseudorandom functions (OPRFs). It achieves 1773× faster performance, 62.4× less communication, and 24× lower cost than prior systems, while supporting arbitrary data types and minimal trust assumptions.

ABSTRACT

Threshold aggregation reporting systems promise a practical, privacy-preserving solution for developers to learn how their applications are used "\emph{in-the-wild}". Unfortunately, proposed systems to date prove impractical for wide scale adoption, suffering from a combination of requiring: \emph{i)} prohibitive trust assumptions; \emph{ii)} high computation costs; or \emph{iii)} massive user bases. As a result, adoption of truly-private approaches has been limited to only a small number of enormous (and enormously costly) projects. In this work, we improve the state of private data collection by proposing $\mathsf{STAR}$, a highly efficient, easily deployable system for providing cryptographically-enforced $κ$-anonymity protections on user data collection. The $\mathsf{STAR}$ protocol is easy to implement and cheap to run, all while providing privacy properties similar to, or exceeding the current state-of-the-art. Measurements of our open-source implementation of $\mathsf{STAR}$ find that it is $1773 imes$ quicker, requires $62.4 imes$ less communication, and is $24 imes$ cheaper to run than the existing state-of-the-art.

Motivation & Objective

• To address the impracticality of existing threshold aggregation systems due to high trust, computation, or communication costs.
• To enable widespread adoption of private telemetry by developers with minimal trust and implementation complexity.
• To provide strong privacy guarantees (equivalent to 𝜅-anonymity) without requiring large user bases or noise injection.
• To support arbitrary data types in threshold-protected aggregation, extending beyond numeric-only systems.
• To design a system that is efficient, auditable, and deployable using well-established cryptography.

Proposed method

• Clients generate a ciphertext by encrypting their measurement and auxiliary data using a key derived from their input and randomness from a dedicated OPRF-based randomness server.
• The client sends the ciphertext, a 𝜅-out-of-N secret share of the randomness, and a deterministic tag identifying the measurement.
• The aggregation server collects messages with the same tag and reconstructs the encryption key only when at least 𝜅 clients have contributed.
• The OPRF server ensures privacy by returning pseudorandom function outputs without learning client inputs, even if malicious.
• STAR supports a lightweight variant, STARLite, that derives randomness solely from the measurement if its entropy is sufficient.
• The protocol ensures perfect correctness and concrete security, avoiding noise-induced errors common in randomized response approaches.

Experimental results

Research questions

• RQ1 Can threshold aggregation be made practical for real-world deployment by reducing computational, communication, and trust overheads?
• RQ2 How can strong privacy guarantees (like 𝜅-anonymity) be achieved without relying on large user bases or noise injection?
• RQ3 Can secret sharing be adapted to support arbitrary data types and non-interactive, distributed client coordination in a threshold aggregation setting?
• RQ4 Is it possible to achieve high performance and low cost while maintaining strong cryptographic security and minimal trust assumptions?
• RQ5 How can OPRF-based randomness generation be leveraged to enable efficient, private, and scalable aggregation?

Key findings

• STAR is 1773× faster than the prior state-of-the-art in threshold aggregation performance.
• STAR reduces communication overhead by 62.4× compared to existing systems.
• STAR reduces operational cost by 24×, making it viable for small to medium-scale applications.
• The system supports arbitrary data types, unlike prior systems limited to numeric inputs.
• STARLite enables deployment without a separate randomness server when input entropy is sufficient, reducing infrastructure complexity.
• The protocol provides perfect correctness and concrete security, avoiding the error and leakage issues of randomized response-based approaches.