Source-linked AI summary
Secure and Privacy-Preserving Consensus
Minghao Ruan, Huan Gao, Yongqiang Wang
TL;DR
Conventional consensus can disclose private node states, motivating a decentralized solution that protects information without an aggregator or third party. The paper embeds homomorphic encryption in pairwise interaction dynamics, providing deterministic consensus, passive-attack resilience, and extensions to other consensus tasks. The approach is experimentally and numerically demonstrated, with per-iteration computation scaling with the number of neighbors and key length.
Problem
Conventional consensus exchanges explicit states, threatening privacy and exposing plaintext messages, while decentralized cryptographic protection without an aggregator is difficult because of key management.
Method
The paper combines additive homomorphic cryptography with pairwise consensus dynamics to encrypt states and support confidential decentralized interactions.
Results
The protocol guarantees deterministic convergence to the average subject to quantization error, protects against external eavesdroppers, and extends to weighted average and maximum/minimum consensus.
Takeaways & Limitations
Privacy and security are integrated into decentralized consensus while remaining manageable for resource-constrained microcontrollers and applicable to dynamic coupling topologies.
Abstract
from arXiv · showhide
Consensus is fundamental for distributed systems since it underpins key functionalities of such systems ranging from distributed information fusion, decision-making, to decentralized control. In order to reach an agreement, existing consensus algorithms require each agent to exchange explicit state information with its neighbors. This leads to the disclosure of private state information, which is undesirable in cases where privacy is of concern. In this paper, we propose a novel approach that enables secure and privacy-preserving average consensus in a decentralized architecture in the absence of an aggregator or third-party. By leveraging partial homomorphic cryptography to embed secrecy in pairwise interaction dynamics, our approach can guarantee consensus to the exact value in a deterministic manner without disclosing a node's state to its neighbors. In addition to enabling resilience to passive attackers aiming to steal state information, the approach also allows easy incorporation of defending mechanisms against active attackers which try to alter the content of exchanged messages. Furthermore, in contrast to existing noise-injection based privacy-preserving mechanisms which have to reconfigure the entire network when the topology or number of nodes varies, our approach is applicable to dynamic environments with time-varying coupling topologies. This secure and privacy-preservation approach is also applicable to weighted average consensus as well as maximum/minimum consensus under a new update rule. The approach is light-weight in computation and communication. Implementation details and numerical examples are provided to demonstrate the capability of our approach.
I. INTRODUCTION
Consensus supports distributed computing applications, but conventional protocols expose exchanged state values and leave decentralized privacy and security unresolved. The paper develops a cryptography-based approach for confidential consensus in undirected, connected networks, including time-varying weights and multiple consensus variants.
- Consensus underpins distributed information fusion, decision-making, decentralized control, and applications spanning control, signal processing, robotics, and optimization.
- Explicit state exchange can disclose participants’ private information and expose plaintext messages to attackers.Examples include personal opinions in social consensus and generation information in power systems.
- Existing noise-based approaches trade privacy against exact accuracy, while decentralized cryptographic consensus faces key-management difficulty without an aggregator or third party.
- The proposed approach uses homomorphic cryptography to protect states in undirected networks, requiring each protected node to have at least one legitimate neighbor.A legitimate neighbor follows the protocol faithfully without attempting to infer other nodes’ states.
- The framework targets time-varying weighted networks and extends beyond average consensus to weighted average and maximum/minimum consensus.The network model assumes an undirected, connected graph, while the paper states that discussions apply to time-varying weights.
- Paillier encryption uses public-key encryption, decryption with a private key, and additive homomorphism to compute sums from ciphertexts.Randomized encryption also provides resistance to dictionary attacks, while plaintext scaling supports representation of real-valued states.
III. CONFIDENTIAL INTERACTION PROTOCOL
The protocol combines encryption with randomized, node-specific coupling weights to compute state differences privately in a fully decentralized network. It preserves symmetric weights for average consensus, supports time-varying interactions, and has per-iteration computation proportional to neighborhood size.
- Protocol design: The protocol encrypts states and embeds randomness in the coupling dynamics instead of adding covering noise, enabling deterministic convergence to the average subject to quantization error.It is designed for completely decentralized operation without a third party.
- Protocol design: Each interaction constructs symmetric weights as aij = ai_jaj_i, with each factor randomly generated and known only to its originating node.Symmetry is required for average consensus, while independent node-specific factors prevent interacting nodes from inferring one another’s states.
- Interaction procedure: In a pairwise exchange, one node sends an encrypted negative state and public key; the neighbor computes a weighted difference in ciphertext and returns it for decryption.The receiving node multiplies the decrypted result by its own random factor, and the reverse exchange produces the other node’s weighted difference.
- Convergence conditions: Random factors vary by iteration, and the protocol’s admissible range must satisfy 0 < a < ā < 1/(εΔ) to guarantee average-consensus convergence.After the initial iteration, factors are selected from a finite admissible range; the results also hold for time-varying weights.
- Decentralized output: Every node can calculate the average value in a completely decentralized manner, unlike approaches that withhold the final consensus value from individual nodes.The protocol can therefore support applications requiring the precise consensus value for cooperative control or information fusion.
- Complexity: The total computation overhead per iteration is O(|N_i|l), depending on a node’s neighbor count and public-key bit length rather than network size.A Raspberry Pi implementation is cited as an experimental test of manageability on resource-constrained real-time control systems.
IV. THEORETICAL ANALYSIS OF CONVERGENCE
The confidential interaction protocol preserves average consensus while supporting time-varying coupling weights and provides a geometric convergence-rate guarantee. The rate depends on the admissible weight range through η, creating a trade-off between randomization range and convergence speed.
- Connected networks achieve average consensus under the confidential interaction protocol, including switching interaction graphs enabled by time-varying weighted matrices.
- The bound means a positive constant C exists such that ||x[k] − α1|| ≤ Cγ^k, and smaller γ indicates faster convergence.
- The convergence rate is at least γ = (1 − ηN−1)^(1/(N−1)), with η = min{1−ε∆¯a^2, εa^2} and 0 < γ < 1.
- Initial weights affect the absolute convergence time through C but do not affect the exponential convergence rate γ.
- Increasing η accelerates convergence but reduces the admissible range [a, ¯a], producing a trade-off when intermediate states must remain private.
V. ANALYSIS OF PRIVACY AND SECURITY
The paper distinguishes privacy from security: privacy concerns preventing honest-but-curious adversaries from learning network states, whereas security concerns exchanged-information integrity and alteration.
- Privacy is associated with unobservability and semantic security against honest-but-curious adversaries, while security addresses threats that alter exchanged information.
A. Privacy Guarantees
The privacy analysis defines protection as preventing an honest-but-curious adversary from estimating an initial state with any accuracy. Protection holds when the target node has another legitimate neighbor, but fails in a single-neighbor collusion configuration.
- Paillier’s semantic security prevents the recipient of the first transmission E(−x_i) from seeing x_i.
- Privacy means an honest-but-curious adversary cannot estimate a node’s initial value with any accuracy, not merely fail to determine it uniquely.
- An adversary receiving Alice’s messages cannot learn her initial state when Alice also connects to a legitimate neighbor Bob.
- The proof uses indistinguishable accessible information: alternative initial values can produce the same information available to Eve while preserving the consensus value.
- Encrypting only the initial iteration is sufficient when only initial states require protection, reducing encryption to a one-time computational cost.
- The guarantee extends to multiple colluding honest-but-curious nodes when Alice has at least one legitimate neighbor, and to noncolluding curious neighbors.
- Privacy can remain enabled when Eve interacts with all of Alice’s neighbors, unlike the cited existing approaches.
- If Alice connects to the rest of the network only through a colluding honest-but-curious node or group, Eve can asymptotically infer Alice’s initial state.
B. Security Solution
Because additive homomorphism allows an attacker to modify encrypted messages, the paper adds digital signatures and hash verification to detect tampering and prevent forged identities.
- Additive homomorphism lets an active attacker inject noise into an encrypted message, potentially causing convergence to a wrong value or preventing convergence.
- The defense attaches a digital signature and hash to each encrypted message so the recipient can verify communication integrity.
- Signature verification detects message modification and prevents an attacker from forging Alice’s identity with a passing signature.
VI. EXTENSIONS TO OTHER CONSENSUS
The confidential interaction protocol extends privacy preservation beyond average consensus to weighted average, maximum, and minimum consensus.
- The same confidential interaction protocol is applied to weighted average, maximum, and minimum consensus problems.
A. Weighted Average Consensus
The paper extends confidential consensus to weighted average and maximum consensus using modified update rules and random coupling weights. Under connectedness and bounded-weight conditions, the states converge to the corresponding target value.
- A. Weighted Average Consensus: Weighted average consensus converges to a weighted sum of the initial states using positive node weights.
- A. Weighted Average Consensus: Average consensus is a special case of weighted average consensus when all node weights are equal.
- A. Weighted Average Consensus: For a connected network, the confidential protocol achieves weighted average consensus when random coupling weights satisfy the stated admissible-range condition.
- B. Maximum Consensus: The maximum-consensus update replaces summation with a max operator and includes each node itself so the operator output remains non-negative.
- B. Maximum Consensus: For a connected network with random coupling weights in [a, ¯a] and 0 < a < ¯a < 1, the update rule achieves maximum consensus.
- B. Maximum Consensus: Each node’s state is non-decreasing, while the maximum state remains invariant over time under the proposed maximum-consensus update.
- B. Maximum Consensus: The Lyapunov function decreases until all nodes reach maximum consensus, establishing convergence of the proposed update.
C. Minimum Consensus
The paper adapts the confidential interaction protocol to minimum consensus through a new update rule. Under connectedness and bounded random coupling weights, all states converge to the minimum initial value.
- C. Minimum Consensus: Minimum consensus seeks convergence of every state to the minimum initial state value.
- C. Minimum Consensus: The paper proposes a new minimum-consensus update rule based on the same idea used for maximum consensus.
- C. Minimum Consensus: For a connected network with coupling weights in [a, ¯a] and 0 < a < ¯a < 1, the update rule achieves minimum consensus.
VII. IMPLEMENTATION DETAILS
Implementation converts real-valued states to encryptable fixed-length integers and back, while simulations and hardware experiments evaluate convergence, privacy, and computational overhead. The reported examples reach average, weighted-average, and maximum consensus, with encrypted differences remaining random to an unintended observer.
- Implementation requirements: Implementation must address coupling-weight constraints and additional technical issues in the confidential interaction protocol.
- Numerical representation: Real-valued states are mapped to unsigned integers for encryption and reconstructed using an inverse casting function.
- Numerical representation: Quantization error is bounded and can be made arbitrarily small by choosing a sufficiently large Q.
- Experimental evaluation: The evaluation combines numerical simulations with hardware experiments on a resource-constrained Raspberry-Pi micro-controller network.
- Numerical results: The average-consensus simulation uses a four-node undirected ring with initial states {1, 2, 4, 8}, yielding average 3.75.
- Numerical results: After convergence, encrypted weighted differences still appear random to an unintended observer.
- Numerical results: The weighted-average simulation converges to 4.9, while the maximum-consensus simulation reaches the exact maximum in about 7 steps.
- Computational cost: One encrypted state exchange takes about 7 ms on a desktop computer without hardware-specific optimization.
B. Comparison with Existing Results
The comparisons show that correlated-noise protocols can expose initial states to an eavesdropper, whereas encrypted message exchange prevents wiretapping from providing such an advantage.
- The differential-privacy approach injects uncorrelated Laplace noise into exchanged states, trading computational accuracy against privacy.
- The simulations use the topology and weight matrix from [12] with five initial node states set to {1, 2, 3, 4, 5}.
- 1) Comparison with the approach in [12]:: The correlated-noise approach in [12] allows an observer with message and topology access to recover node 1’s true initial state as consensus is reached.
- Our encrypted protocol prevents Eve from gaining an advantage by wiretapping communication.
- The approach in similarly converges to node 1’s true initial state under the same observer design, despite using a different noise sequence.
2) Comparison with the approach in [13]:
The comparison with and related protocols emphasizes that encrypted message exchange avoids eavesdropping-based state recovery without sacrificing consensus accuracy. Hardware experiments further demonstrate convergence on a six-node Raspberry Pi network, while encryption introduces measurable computational overhead.
- 2) Comparison with the approach in [13]:: An external eavesdropper gains no information from the proposed protocol because transmitted messages are encrypted inherently.
- Differential privacy links consensus accuracy and initial-state estimation accuracy, so larger noise can impair the final consensus value.
- The proposed encrypted message-exchange mechanism does not affect the final consensus accuracy, avoiding the accuracy–privacy trade-off.
- Six Raspberry Pi boards experimentally reached the average consensus value 580.67 from initial states 777, 168, 788, 242, 610, and 899 in about 13 steps.
- The approach is naturally extendable to time-varying networks, unlike the cited noise-injection approaches that assume time-invariant parameters.
- Encryption adds computational overhead of 7 ms in numerical simulations and 7.8 ms in hardware experiments compared with unencrypted alternatives.