Source-linked AI summary
CRSF: Collusion-Resilient Privacy-Preserving Sensor Fusion with Byzantine-Robust Participation
Chao Yin, Haihong Tian, Zheng Yang, Haibin Zhang, Fabio Massacci, Chenglu Jin
TL;DR
Existing garbled-circuit sensor-fusion protocols do not protect against sensor-server collusion or Byzantine manipulation of participation. CRSF adds PBFT-based submission agreement and threshold-protected, status-dependent label release, proving privacy, correctness with explicit abort, and liveness while incurring moderate online overhead.
Problem
Garbled-circuit sensor-fusion protocols remain vulnerable to sensor-server collusion and Byzantine servers manipulating participation, threatening honest-sensor privacy and fusion correctness.
Method
CRSF combines PBFT-based agreement on sensor submissions with status-dependent label release and threshold protection of circuit-input labels.
Results
CRSF provides privacy, correctness with explicit abort, and liveness, while retaining predictable scaling with moderate additional online overhead.
Takeaways & Limitations
CRSF achieves stronger resilience to sensor-server collusion and Byzantine participation manipulation within the sensor-server-client architecture at a practical online-performance cost.
Takeaways & Limitations
The guarantees rely on the stated adversarial, setup, cryptographic, and fault-threshold assumptions.
Abstract
from arXiv · showhide
Privacy-preserving sensor fusion enables an untrusted server to compute an aggregate result over distributed sensor measurements without learning either individual inputs or the final output. Recent garbled-circuit-based protocols provide an efficient realization of this functionality in a sensor--server--client architecture, but remain vulnerable to sensor--server collusion and Byzantine manipulation of sensor participation. These weaknesses can compromise honest-sensor privacy, incorrectly exclude honest sensors, and corrupt the computed fusion result, thereby undermining the security guarantees expected from the protocol. We present CRSF, a collusion-resilient sensor-fusion protocol that addresses these weaknesses while providing privacy, correctness with explicit abort, and liveness. CRSF introduces a Practical Byzantine Fault Tolerance (PBFT)-based agreement phase for sensor submissions and uses server-specific, status-dependent label release with threshold protection of circuit-input labels. This design prevents any Byzantine server from unilaterally manipulating sensor participation and prevents any admissible sensor-server coalition from obtaining enough secret material to compromise honest-sensor privacy. We implement CRSF and compare its online execution time with the most relevant state-of-the-art baseline. Our Google Cloud evaluation measures the total computation and communication cost of the online protocol under fault-free and representative faulty executions. Across a range of fault-tolerant fusion circuits and up to 261 sensors, CRSF demonstrates a highly practical trade-off between robust security and protocol performance.
1 Introduction
CRSF strengthens privacy-preserving sensor fusion against sensor-server collusion and Byzantine participation manipulation while retaining the sensor-server-client workflow and practical online performance.
- Motivation: Sensor fusion combines distributed measurements to produce a more accurate, robust, and actionable view while keeping readings private from the server and client.The architecture also requires resilience to corrupted sensors and reliable output delivery under intended availability assumptions.
- Prior work: PG jointly provides input privacy, Byzantine fault tolerance, and guaranteed output delivery, making it a key baseline for three-role sensor fusion.PG is a garbled-circuit-based protocol designed to tolerate malicious sensor behavior and pollution attacks under its original threat model.
- Limitations: PG does not protect against colluding corrupted sensors and a Byzantine server that combine protocol views.This stronger adversarial model motivates revisiting privacy-preserving sensor fusion while preserving the baseline’s core properties.
- Limitations: PG’s single-server participation decision can exclude honest sensors while retaining malicious ones, violating the fault-threshold premise of the fusion algorithm.Collusion can also expose complementary circuit-input labels, compromising honest-sensor privacy and fusion-result integrity.
- CRSF: CRSF adds Byzantine-robust agreement on sensor submissions and threshold protection of circuit-input labels to the garbled-circuit workflow.The protocol uses agreement before status-dependent label release and threshold protection before fusion evaluation.
- Results: CRSF provides privacy, correctness with explicit abort, and liveness, while measured total phase time remains around one second at the largest tested instances.The implementation evaluates online performance under fault-free and representative faulty executions on Google Cloud.
2 System and Threat Model
The system uses independent sensors, four servers, and a client that receives only the decoded fusion output, under a model allowing multiple corrupted sensors and one Byzantine server.
- System model: The architecture contains a client, n independent sensors, and four servers computing a fusion function over private measurements.Sensors encode measurements locally; servers process encoded inputs and outputs without learning plaintext measurements or the plaintext result.
- System model: Only the client communicates with the servers and can decode the final output.The client does not receive sensor measurements in the clear.
- Threat model: The adversary may corrupt multiple sensors and at most one server, with corrupted sensors allowed to submit malformed labels and collude with that server.The corrupted server may send inconsistent messages, while the client follows the protocol honestly.
- Threat model: The number of malicious sensors must remain below the fault threshold of the underlying Marzullo-style fusion algorithm.The stated examples are fewer than 1/3 or 1/2 of the relevant population, depending on the algorithm.
- Security goals: The intended guarantees are privacy for honest measurements, correctness or explicit abort, and liveness for an honest client.The client learns only the protocol output and protocol-visible status information needed for output delivery.
3 Preliminaries
The preliminaries establish garbled-circuit computation, Shamir sharing, PBFT, and PG’s workflow before identifying collusion and participation weaknesses that motivate CRSF.
- Garbled circuits: A garbling scheme generates a garbled circuit, encoding information, and decoding information, then evaluates encoded inputs into labels that decode to the circuit output.For input vector x, evaluation produces garbled output labels and decoding recovers C(x) except with negligible probability.
- Garbled circuits: Garbled-circuit security is characterized through privacy, obliviousness, and authenticity, with public leakage represented by Φ(C).The supplied preliminaries define obliviousness via simulation from public leakage and authenticity via negligible probability of producing an invalid accepted output.
- Secret sharing: Shamir secret sharing reconstructs a secret from any t shares while fewer than t shares are statistically independent of that secret.The scheme uses a degree-(t−1) polynomial over a finite field with distinct nonzero evaluation points.
- PBFT: PBFT tolerates up to f Byzantine replicas when n ≥ 3f + 1 and forms Byzantine quorums through pre-prepare, prepare, and commit phases.Its safety and liveness rely on standard assumptions including partial synchrony, authenticated communication, and at most f Byzantine replicas.
- PG baseline: PG separates client circuit preparation from sensor-side input garbling and uses checking and filter gates before fusion-circuit evaluation.Checking gates detect malformed submissions, while filter gates derive circuit-input labels from sensor-side and client-side labels.
- PG limitations: PG’s fixed FreeXOR offset lets colluding sensors and a Byzantine server obtain complementary labels, while unilateral admission decisions can violate the fault threshold.These weaknesses motivate extending the PG workflow against sensor-server collusion and Byzantine participation manipulation.
4 The CRSF Protocol
CRSF strengthens garbled-circuit sensor fusion against sensor-server collusion and Byzantine participation manipulation through PBFT-based agreement and threshold-protected, status-dependent label release. Its online protocol first agrees on sensor submissions, then validates statuses and reconstructs circuit-input labels from server-specific shares.
- Design rationale: CRSF avoids OT-based label selection because OT would increase online work for sensors and the client while leaving Byzantine participation manipulation unresolved.The client would need per-sensor label-transfer interactions, and OT addresses label exposure but not admission control.
- Agreement on sensor submissions: PBFT-based agreement establishes a common outcome for each sensor before label validation and fusion evaluation.With four servers and f = 1, each quorum has size 2f + 1 = 3.
- Agreement on sensor submissions: The evidence rule preserves a delivered honest submission: at most one Byzantine server still leaves two matching honest reports in every three-report evidence set.Thus, an honest participating sensor receives outcome (Hon, r_i), rather than Mal.
- Status-dependent label release: The checking layer derives a status vector that determines whether each sensor receives the Hon or Mal branch of client-side filter-gate labels.The client accepts only a 3-of-4 majority status vector and releases one branch, never both, to each server.
- Label reconstruction: Servers reconstruct candidate circuit-input labels from triples of server-specific shares, with each complete label protected by byte-wise (3, 4) Shamir sharing.A reconstructed candidate is accepted only after an additional checking layer validates it.
5 Security Analysis
CRSF’s security analysis models coalition views and leakage, then establishes privacy, correctness with explicit abort, and liveness under stated adversarial and cryptographic assumptions.
- Privacy: Under the stated assumptions, the privacy theorem covers one corrupted server and corrupted sensors within the underlying fusion algorithm’s fault threshold.The analysis assumes honest setup, correctly distributed verification keys, collision-resistant hashing, secure signatures and PRGs, secure garbling, and private, correct Shamir sharing.
- Privacy: The corrupted coalition learns neither honest sensors’ measurements nor the plaintext fusion output beyond coalition leakage Lcoal.The coalition view includes corrupted inputs and randomness, submitted labels, server transcripts, visible garbled artifacts, gate outputs, reconstruction shares, and reconstructed circuit-input labels.
- Privacy: The privacy proof simulates honest-sensor labels and protocol artifacts while replacing complementary coalition-visible shares with independently generated uniform field-element strings.Indistinguishability relies on Shamir privacy, PRG security, garbled-circuit obliviousness, signature unforgeability, collision resistance, and garbled-gate authenticity.
- Correctness with Explicit Abort: PBFT safety and deterministic evidence rules force continuing honest servers to use the same outcome and status vectors, while three-server majority release fixes the accepted vector.With at most one Byzantine server, a Byzantine server cannot create a different majority, and garbled-circuit authenticity prevents acceptance of an invalid output-label vector except with negligible probability.
- Liveness: Under PBFT liveness conditions, the honest client eventually outputs either a decoded fusion result or ⊥.Agreement instances decide an evidence-supported outcome unless an explicit abort occurs; after agreement, the remaining protocol phases are finite computations and message exchanges.
6 Evaluation
CRSF was implemented and evaluated on Google Cloud across five Marzullo-style fault-tolerant fusion circuits, scaling to 261 sensors. Compared with PG, it adds agreement and reconstruction overhead while retaining predictable scaling and robustness under a representative faulty execution.
- The evaluation measures online authenticated submissions, PBFT agreement, label reconstruction, and garbled-circuit evaluation on Google Cloud.Experiments use four CRSF server nodes and one client-side node, while PG uses one server and one client-side VM.
- Across all five fusion circuits, PG remains faster because CRSF adds inter-server PBFT agreement and threshold share reconstruction.
- For a fixed four-server deployment, CRSF runtime grows approximately linearly with sensor count, indicating predictable scaling.
- The evaluated faulty execution can run faster than the corresponding fault-free execution because omitted submissions and a non-responsive backup reduce processing and signature verification.The faulty setting uses the maximum tolerated sensor faults and one non-responsive server, with quorum 2f+1 = 3.
- In the largest tested instances, PBFT agreement communicates about 8.9–9.7 MB and takes below 0.51 seconds, while reconstruction communicates about 1.2–1.5 MB and takes below 0.14 seconds in fault-free cases.
7 Related Work
Prior work has examined collusion resistance across several sensing and aggregation settings, including privacy-preserving aggregation schemes for people-centric urban sensing.
- Prior work studies collusion resistance in several sensing and aggregation settings.
- PriSense uses data slicing and mixing for privacy-preserving aggregation in people-centric urban sensing.
8 Conclusion
CRSF combines PBFT-based submission agreement, status-dependent label release, and threshold sharing to strengthen privacy-preserving sensor fusion. The implementation shows predictable scaling with moderate online overhead while providing the stated security properties.
- CRSF is a collusion-resilient privacy-preserving sensor-fusion protocol for the sensor–server–client architecture.
- It combines PBFT-based submission agreement with status-dependent label release and byte-wise (3, 4) Shamir sharing of circuit-input labels.
- These mechanisms prevent unilateral Byzantine-server control of participation and complementary-label reconstruction by an admissible sensor–server coalition.
- The paper proves privacy, correctness with explicit abort, and liveness under its stated assumptions.
- Implementation and Google Cloud evaluation show predictable scaling across evaluated fault-tolerant fusion circuits with moderate online overhead.
A.1 Proof of Theorem 1
The proof constructs a simulator and establishes indistinguishability through hybrids that replace coalition-visible shares and honest-side interfaces while preserving protocol behavior. It also handles aborts by exposing only the transcript prefix visible before the abort.
- The proof constructs a simulator and proves indistinguishability through two hybrids.
- The simulator generates consistent submissions, PBFT transcripts, status messages, label-release transcripts, and checking behavior from simulated outcomes.
- The simulator preserves the prescribed output type and reconstructs simulated fusion labels exactly.
- When an abort is specified, the simulator outputs only the visible transcript prefix up to the abort point.
- Hybrids: In H1, below-threshold shares of complementary circuit-input labels are replaced by uniformly random byte-wise shares using Shamir privacy.
- Hybrids: In H2, the final garbled-circuit evaluator view is replaced using garbling-scheme obliviousness, while surrounding transcripts are regenerated coherently.
B Detailed Analysis of the Limitations of PG
Under the stronger threat model, PG has two limitations: sensor-server collusion can break input privacy and correctness, while a Byzantine server can manipulate sensor participation.
- PG is secure only under its original threat model, which excludes server-sensor collusion and assumes prescribed participation.
- A colluding Byzantine server and corrupted sensor can obtain complementary circuit-input labels, recover the FreeXOR offset ∆, and compromise honest-sensor privacy.Knowing ∆ also allows complementary labels to be derived on fusion-circuit wires.
- Recovering ∆ additionally lets a malicious server flip the semantic meaning of fusion-circuit outputs, violating correctness.
- A Byzantine server can exclude honest sensors while retaining corrupted ones, changing the effective participating set and potentially violating the fusion algorithm’s fault-threshold premise.
- In the illustrative AND-gate circuit, labels from one colluding sensor reveal another sensor’s label semantics and enable the final output to be flipped.