The Capacity Region of Information Theoretic Secure Aggregation with Uncoded Groupwise Keys

We consider the ({\mathsf K},{\mathsf U}, {\mathsf S})=(5,2,3) information theoretic secure aggregation problem with uncoded groupwise keys. Note that in this example, for the ease of illustration, we assume that the field size {\mathsf q} is a large enough prime; it will be proved later that our proposed scheme works for arbitrary field size.

By the converse bound derived in Section ?, we have {\mathsf R}_1\geq \frac{\binom{{\mathsf K}-1}{{\mathsf S}-1}}{\binom{{\mathsf K}-1}{{\mathsf S}-1}-\binom{{\mathsf K}-1-{\mathsf U}}{{\mathsf S}-1}} = \frac{6}{5} and {\mathsf R}_2\geq \frac{1}{{\mathsf U}}=\frac{1}{2}. Inspired by the converse bound, we divide each input vector W_i where i\in [{\mathsf K}] into \binom{{\mathsf K}-1}{{\mathsf S}-1}-\binom{{\mathsf K}-1-{\mathsf U}}{{\mathsf S}-1}=5 non-overlapping and equal-length pieces, W_{i}=\{W_{i,1},\ldots,W_{i,5}\}. For each set {\mathcal V}\in \binom{[{\mathsf K}]}{{\mathsf S}}, we generate a key Z_{{\mathcal V}} containing \frac{{\mathsf S}{\mathsf L}}{\binom{{\mathsf K}-1}{{\mathsf S}-1}-\binom{{\mathsf K}-1-{\mathsf U}}{{\mathsf S}-1}}=\frac{3{\mathsf L}}{5} symbols uniformly i.i.d. over \mathbb{F}_{{\mathsf q}}; let Z_{{\mathcal V}} be shared by the users in {\mathcal V}. In addition, we further divide each key Z_{{\mathcal V}} into {\mathsf S}=3 sub-keys, Z_{{\mathcal V}}=\{Z_{{\mathcal V},k}:k\in {\mathcal V}\}, where each sub-key Z_{{\mathcal V},k} has \frac{{\mathsf L}}{5} symbols.

From the converse bound we see that in the first round each user k\in [5] should send more than {\mathsf L} symbols,

while input vector W_k contains {\mathsf L} symbols. Thus, unlike the secure aggregation scheme in [groupwisekey2022wan] which has {\mathsf R}_1=1, in the first round besides the encrypted input vector, we also need to transmit some coded messages composed of keys, to cope with the fact that some keys cannot be transmitted in the second round due to user dropouts. For each key {\mathcal Z}_{{\mathcal V}}, we select a 6-length vector {\mathbf a}_{{\mathcal V}}=[a_{{\mathcal V},1},\ldots,a_{{\mathcal V},6}]^{\text{\rm T}} which will serve as the coefficient vector of its sub-keys during the first round. The selection of these coefficient vectors to guarantee the encodability, decodability and security, is the most important step in the proposed secure aggregation scheme. We denote the sets {\mathcal V}\in \binom{[{\mathsf K}]}{{\mathsf S}} where k \in {\mathcal V} by {\mathcal S}_{k,1},\ldots,{\mathcal S}_{k,\binom{{\mathsf K}-1}{{\mathsf S}-1}}; denote the sets in \binom{[{\mathsf K}]\setminus\{k\}}{{\mathsf S}} by \overline{{\mathcal S}}_{k,1},\ldots,\overline{{\mathcal S}}_{k,\binom{{\mathsf K}-1}{{\mathsf S}}}. For the security and encodability, it will be explained later that the selection has the following two properties respectively:

In order to guarantee (?) and (?), we select the coefficient vectors by the following two steps:

• We first select each vector {\mathbf a}_{{\mathcal V}} for each {\mathcal V} \in \binom{[{\mathsf K}]}{{\mathsf S}} where 1\in {\mathcal V}. More precisely, we choose each element in {\mathbf a}_{{\mathcal V}} uniformly i.i.d. over \mathbb{F}_{{\mathsf q}}. In this example, we let

  \begin{aligned} & {\mathbf a}_{\{1,2,3\}}=[0, 1, 0, 0, 1, 1]^{\text{\rm T}}, \ {\mathbf a}_{\{1,2,4\}}=[1, 0, 1, 1, 1, 1]^{\text{\rm T}},\ {\mathbf a}_{\{1,2,5\}}=[0, 0, 0, 1, 0, 1]^{\text{\rm T}},\\ & {\mathbf a}_{\{1,3,4\}}=[0, 1, 1, 1, 0, 1]^{\text{\rm T}},\ {\mathbf a}_{\{1,3,5\}}=[1, 1, 0, 1, 0, 1]^{\text{\rm T}},\ {\mathbf a}_{\{1,4,5\}}=[1, 0, 0, 0, 0, 1]^{\text{\rm T}}. \end{aligned}

• Then we fix each of the remaining vectors by a linear combination of the selected vectors in the first step. More precisely, to fix {\mathbf a}_{\{2,3,4\}}, we let {\mathbf a}_{\{2,3,4\}} be a linear combination of {\mathbf a}_{\{1,3,4\}}, {\mathbf a}_{\{1,2,4\}}, and {\mathbf a}_{\{1,2,3\}}, where the coefficients are either +1 or -1 and alternated,

  \begin{aligned} {\mathbf a}_{\{2,3,4\}}= {\mathbf a}_{\{1,3,4\}}- {\mathbf a}_{\{1,2,4\}} +{\mathbf a}_{\{1,2,3\}}. \end{aligned}

  Similarly, for each {\mathcal V} \in \binom{[2:{\mathsf K}]}{{\mathsf S}}, we let {\mathbf a}_{{\mathcal V}} be the following linear combination of {\mathbf a}_{{\mathcal V}\setminus\{k\} \cup \{1\}} where k\in {\mathcal V}, (recall that {\mathcal V}(i) represents the i^{\text{th}} smallest element in {\mathcal V})

  \begin{aligned} {\mathbf a}_{{\mathcal V}}= \sum_{i\in [3]} (-1)^{i-1} {\mathbf a}_{{\mathcal V}\setminus \{{\mathcal V}(i)\} \cup \{1\}}. \end{aligned}

The detailed section on the coefficient vectors is given in Table ?. It can be checked that this selection has the two properties in (?) and (?). The first property could be directly checked. For the second property, we have

thus the rank of [{\mathbf a}_{\{2,3,4\}},{\mathbf a}_{\{2,3,5\}},{\mathbf a}_{\{2,4,5\}},{\mathbf a}_{\{3,4,5\}}] is equal to the rank of [{\mathbf a}_{\{2,3,4\}},{\mathbf a}_{\{2,3,5\}},{\mathbf a}_{\{2,4,5\}}] which is equal to 3. In addition, since

thus the rank of [{\mathbf a}_{\{1,3,4\}},{\mathbf a}_{\{1,3,5\}},{\mathbf a}_{\{1,4,5\}},{\mathbf a}_{\{3,4,5\}}] is equal to the rank of [{\mathbf a}_{\{1,3,4\}},{\mathbf a}_{\{1,3,5\}},{\mathbf a}_{\{1,4,5\}}] which is equal to 3. Similarly, we can also check that the rank of [{\mathbf a}_{\{1,2,4\}},{\mathbf a}_{\{1,2,5\}},{\mathbf a}_{\{1,4,5\}},{\mathbf a}_{\{2,4,5\}}] is equal to the rank of [{\mathbf a}_{\{1,2,4\}},{\mathbf a}_{\{1,2,5\}},{\mathbf a}_{\{1,4,5\}}] which is equal to 3; the rank of [{\mathbf a}_{\{1,2,3\}},{\mathbf a}_{\{1,2,5\}},{\mathbf a}_{\{1,3,5\}},{\mathbf a}_{\{2,3,5\}}] is equal to the rank of [{\mathbf a}_{\{1,2,3\}},{\mathbf a}_{\{1,2,5\}},{\mathbf a}_{\{1,3,5\}}] which is equal to 3; the rank of [{\mathbf a}_{\{1,2,3\}},{\mathbf a}_{\{1,2,4\}},{\mathbf a}_{\{1,3,4\}},{\mathbf a}_{\{2,3,4\}}] is equal to the rank of [{\mathbf a}_{\{1,2,3\}},{\mathbf a}_{\{1,2,4\}},{\mathbf a}_{\{1,3,4\}}] which is equal to 3. Thus the property is satisfied. We will show later that this selection guarantees the encodability, decodability and security.

After the selection of the above coefficient vectors, the transmission in the first round by each user k\in [{\mathsf K}] can be divided into two parts (as explained before):

• The first part contains \binom{{\mathsf K}-1}{{\mathsf S}-1}-\binom{{\mathsf K}-1-{\mathsf U}}{{\mathsf S}-1}=5 linear combinations of pieces and sub-keys, where each linear combination contains {\mathsf L}/5 symbols. For each j\in [5], let user k transmit

  \begin{aligned} X_{k,j} = W_{k,j}+ \sum_{{\mathcal V}\in \binom{[5]}{3}: k\in {\mathcal V}} a_{{\mathcal V},j} Z_{{\mathcal V},k}. \end{aligned}

• The second part contains \binom{{\mathsf K}-1-{\mathsf U}}{{\mathsf S}-1}=1 linear combination of sub-keys with {\mathsf L}/5 symbols; let user k transmit

  \begin{aligned} X_{k,6}=\sum_{{\mathcal V}\in \binom{[5]}{3}: k\in {\mathcal V}} a_{{\mathcal V},6} Z_{{\mathcal V},k}. \end{aligned}

Hence, user k transmits X_k=(X_{k,1},\ldots, X_{k,6}), totally 6{\mathsf L}/5 symbols in the first round. Since the selection of the coefficient vectors has the property in (?), the rank of the sub-keys in X_k is equal to the dimension of X_k and thus from X_k the server cannot get any information about W_k (see [groupwisekey2022wan, Appendix C] for the formal proof).

Now we consider the case {\mathcal U}_1=[5], i.e., no user drops in the first round. From the first round, the server can recover

for each j\in [5], and recover

Hence, the server should further recover the second term on the RHS of (?), \sum_{{\mathcal V}\in \binom{[5]}{3}} a_{{\mathcal V},j} Z_{{\mathcal V}}^{[5]} for j\in [5], in the second round.

In the second round, to achieve {\mathsf R}_2=1/2, we divide each Z_{{\mathcal V}}^{[5]} where {\mathcal V} \in \binom{[5]}{3} into 2 non-overlapping and equal-length coded keys, Z_{{\mathcal V}}^{[5]}=\left\{ Z_{{\mathcal V},1}^{[5]} , Z_{{\mathcal V},2}^{[5]} \right\}, where each coded key contains \frac{{\mathsf L}}{10} symbols. Hence, we can write the recovery task of the second round in the matrix form

where (recall that {\bf 0}_{m \times n} represents the zero matrix with dimension m\times n)

Note that F_6=\sum_{{\mathcal V}\in \binom{[5]}{3}} a_{{\mathcal V},6} Z_{{\mathcal V},1}^{[5]} and F_{12}=\sum_{{\mathcal V}\in \binom{[5]}{3}} a_{{\mathcal V},6} Z_{{\mathcal V},2}^{[5]} have been already recovered by the server from the first round.

We focus on each user k\in [5], who should transmit \binom{{\mathsf K}-1}{{\mathsf S}-1}-\binom{{\mathsf K}-1-{\mathsf U}}{{\mathsf S}-1}= 5 linear combinations of F_1,\ldots,F_{12} in the second round; in the matrix form these 5 linear combinations are

where {\bf S}_k is a matrix with dimension 5\times 12. Note that for the encodability, user k can only compute the coded keys Z_{{\mathcal V},j}^{[5]} where k\in {\mathcal V}; thus in the transmitted linear combinations the coefficients of the coded keys which user k cannot compute should be equal to 0.

For user 1, the columns of {\bf S}_1 {\bf F} with indices in [7:10] \cup [17:20] should be {\bf 0}_{5 \times 1}, since these columns correspond to

which cannot be computed by user 1. Assume that the column-wise sub-matrix of {\bf F} including the columns with indices in [7:10] \cup [17:20] is {\bf F}_1 with dimension 12 \times 8, where

We need to find 5 linearly independent left null vectors of {\bf F}_1, and let {\bf S}_1 be the matrix of these 5 vectors. Note that if {\bf F}_1 is full rank, the left null space of {\bf F}_1 only contains 12-8=4 linearly independent vectors. However, by our construction, it has been shown in (?) that {\mathbf a}_{\{3,4,5\}}= {\mathbf a}_{\{2,4,5\}}-{\mathbf a}_{\{2,3,5\}} +{\mathbf a}_{\{2,3,4\}}; in other words, the coefficient vectors corresponding to the unknown coded keys of user 1 are aligned. Thus by this interference alignment-like construction leading to (?), the rank of {\bf F}_1 is 6, and thus the left null space of {\bf F}_1 contains 12-6=6 linearly independent vectors. More precisely, the left null space of [ {\mathbf a}_{\{2,3,4\}}, {\mathbf a}_{\{2,3,5\}},{\mathbf a}_{\{2,4,5\}}] is the linear space spanned by

Hence, the left null space of {\bf F}_1 is the linear space spanned by

We let each row of {\bf S}_1 be one random linear combination of the vectors in (?); in this example, we let

For user 2, the columns of {\bf S}_2 {\bf F} with indices in \{4,5,6,10,14,15,16,20\} should be {\bf 0}_{5 \times 1}, since these columns correspond to

which cannot be computed by user 2. Assume that the column-wise sub-matrix of {\bf F} including the columns with indices in \{4,5,6,10,14,15,16,20\} is {\bf F}_2 with dimension 12 \times 8, where

By construction we have {\mathbf a}_{\{3,4,5\}}= {\mathbf a}_{\{1,4,5\}}-{\mathbf a}_{\{1,3,5\}} +{\mathbf a}_{\{1,3,4\}} as shown in (?). The left null space of [ {\mathbf a}_{\{2,3,4\}}, {\mathbf a}_{\{2,3,5\}},{\mathbf a}_{\{2,4,5\}}] is the linear space spanned by

Hence, the left null space of {\bf F}_2 is the linear space spanned by

We let each row of {\bf S}_2 be one random linear combination of the vectors in (?); in this example, we let

Similarly, we let

As a summary, the constraint (?) is satisfied by the interference alignment-like construction, while satisfying this constraint leads to the successful encoding of each user.

Then we check the decodability. Note that F_6 and F_{12} have been recovered by the server from the first round. Recall that {\mathbf e}_{n,i} represents the vertical n-dimensional standard unit vector whose i^{\text{th}} element is 1. For any set of two users {\mathcal U}_2=\{u_1,u_2\} \subseteq [{\mathsf K}] where |{\mathcal U}_2|=2, one can check that from (?)-(?) that the matrix

whose dimension is 12\times 12, is full rank; thus the server can recover F_1,\ldots,F_{12} and then recover W_1+\cdots+W_{5}.

For the security, from the first round the server cannot obtain any information about W_1,\ldots, W_{5}. In the second round, all the transmissions by all users are linear combinations of F_1,\ldots, F_{12}, where F_6 and F_{12} can be recovered from the first round. Since each F_i, where i\in [12]\setminus \{6,12\} contains {\mathsf L}/10 symbols, by [shannonsecurity] the server can only obtain additional 10 {\mathsf L}/10 ={\mathsf L} symbols about W_1,\ldots, W_{5} from the second round, which are exactly the symbols in W_1+\cdots+W_{5}. Hence, the proposed secure aggregation scheme is secure.

The above scheme could be directly extended to other {\mathcal U}_1 \subseteq [5] where {\mathcal U}_1 \geq 2. For example, consider {\mathcal U}_1=[4]. After the first round, the server can recover

for each j\in [5], and recover

Hence, the server should further recover in the second round

where {\bf F} is given in (?), and F_6 , F_{12} have been recovered from the first round. By choosing {\bf S}_1, {\bf S}_2, {\bf S}_3, {\bf S}_4 as in (?)-(?), we let each user k\in [4] transmit {\bf S}_{k} {\bf F} in the second round. For any set of two users {\mathcal U}_2=\{u_1,u_2\} \subseteq [4] where |{\mathcal U}_2|=2, the matrix in (?) is full rank; thus the decodability was proved. By the same reason as the case {\mathcal U}_1=[5], we can also prove that the proposed scheme is secure for the case {\mathcal U}_1=[4].

As a result, the proposed secure aggregation scheme achieves {\mathsf R}_1=6/5 and {\mathsf R}_2=1/2, coinciding with the converse bound in Section ?. \square