Privacy-Preserving Average Consensus via State Decomposition
Privacy-Preserving Average Consensus via State Decomposition
复制标题
DOI：
10.1109/tac.2019.2902731
复制
发表时间：
2019-02
影响因子：
6.8
通讯作者：
Yongqiang Wang
中科院分区：
文献类型：
--
作者：
Yongqiang Wang
平均共识支撑了分布式系统的关键功能，从分布式信息融合、决策、分布式优化到负载平衡和分散控制。现有的分布式平均共识算法需要每个节点交换状态信息并向其邻居公开，这在状态是私有的或包含敏感信息的情况下是不可取的。在本文中，我们提出了一种新的方法，该方法通过让每个节点将其状态分解为两个子状态来避免在平均共识中泄露个体状态信息。对于每个节点，两个子状态中的一个参与计算和节点间交互，就好像它是原始状态一样，而另一个子状态仅与同一节点的第一个子状态交互，对其他节点完全不可见。两个子状态的初始值是随机选择的，但它们的平均值固定为原始状态的初始值，这是确保收敛到期望的共识值的关键。与基于差异隐私的隐私保护平均共识方法直接相反，该方法通过牺牲一致性值的准确性来实现隐私保护，所提出的方法可以保证收敛到精确的期望值而不会有任何误差。提出的方法不仅能够防止向诚实但好奇的邻居泄露节点的初始状态，还可以提供保护，防止能够窃听通信链路的外部窃听者的干扰。数值仿真结果表明了该方法的有效性及其相对于现有同类方法的优势。
Average consensus underpins key functionalities of distributed systems ranging from distributed information fusion, decision-making, distributed optimization, to load balancing and decentralized control. Existing distributed average consensus algorithms require each node to exchange and disclose state information to its neighbors, which is undesirable in cases where the state is private or contains sensitive information. In this paper, we propose a novel approach that avoids disclosing individual state information in average consensus by letting each node decompose its state into 2 substates. For each node, one of the two substates involves in computation and internode interactions as if it were the original state, while the other substate interacts only with the first substate of the same node, being completely invisible to other nodes. The initial values of the two substates are chosen randomly but with their mean fixed to the initial value of the original state, which is key to guarantee convergence to the desired consensus value. In direct contrast to differential-privacy based privacy-preserving average-consensus approaches, which enable privacy by compromising accuracy in the consensus value, the proposed approach can guarantee convergence to the exact desired value without any error. Not only is the proposed approach able to prevent the disclosure of a node's initial state to honest-but-curious neighbors, it can also provide protection against inference by external eavesdroppers able to wiretap communication links. Numerical simulations demonstrate the effectiveness of the approach and its advantages over state-of-the-art counterparts.