Anti-poisoning attack federated learning method based on lightweight homomorphic encryption

Abstract

The invention discloses an anti-poisoning attack federated learning method based on lightweight homomorphic encryption. The method comprises an initialization stage, a gradient encryption and signature generation stage, an aggregation weight verification and calculation stage, a gradient aggregation stage and a gradient correctness verification stage. According to the method, a unique mask is generated at each client, the encrypted local gradient is blinded, the opponent can obtain the plaintext message only by knowing the mask of each client, and the attack of selecting the plaintext is effectively resisted. According to the method, information is sent among the communication entities through an integrity verification algorithm based on an elliptic curve, so that the integrity of the transmitted information is ensured, an enemy is prevented from tampering with the information, and man-in-the-middle attack is effectively resisted; in the whole training process, through the homomorphic encryption algorithm, data calculation and processing in the ciphertext state are achieved, it is guaranteed that data privacy is not leaked, meanwhile, symmetric homomorphic encryption is adopted, the calculation overhead of a server is reduced, and performance is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security communication technology, and in particular to a federated learning method based on lightweight homomorphic encryption that is resistant to poisoning attacks. Background Art

[0002] Nowadays, traditional security protection measures are unable to cope with emerging network attacks. Therefore, it is proposed to establish an intelligent threat intelligence platform to deal with complex network attacks. In the platform, multiple threat intelligence data are needed to jointly train a model, and each participant with threat intelligence data is only allowed to keep the data in their own hands. In response to this situation, the federated learning framework came into being.

[0003] Federated learning ensures that multiple participants can jointly train the same model without leaking local original data. Each participant uploads local gradients instead of sharing original data to achieve the effect of protecting privacy. However, the uploaded local gradients may contain some sensitive information, which attackers can use to reconstruct the original data. At the same time, some attackers can tamper with the uploaded local gradients or mix malicious data into the local data set, making the model training results contrary to the expected results, inducing the model to produce wrong results for specific data, and the trained model cannot achieve the characteristics of accuracy and effectiveness.

[0004] Based on this, in order to achieve privacy protection of threat intelligence data and detection of poisoned data, while reducing the overhead of the training process, a lightweight homomorphic encryption anti-poisoning attack federated learning method is designed. By using lightweight homomorphic encryption, data can remain encrypted during transmission and processing, which not only protects the privacy of users, but also effectively prevents data tampering and malicious attacks. In addition, the protection mechanism against poisoning attacks can identify and resist malicious data from untrusted nodes, ensuring the security and integrity of data during federated learning. This invention method has very important application prospects in the model training of intelligent threat intelligence platforms. Summary of the invention

[0005] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a federated learning method based on lightweight homomorphic encryption that is resistant to poisoning attacks.

[0006] The objective of the present invention is achieved through the following technical solutions: The present invention discloses a federated learning method for resisting poisoning attacks based on lightweight homomorphic encryption, comprising the following steps: S1. System initialization: The trusted center sets the system public parameters, including the setting of the additive cyclic group based on the elliptic curve and its generator, the collision-resistant hash function, the system master public key and the key of the symmetric encryption algorithm. The trusted center also sets the system master private key and keeps it secretly, and registers various communication entities in the system. The trusted center generates its own signature private key for each communication entity and sends it to each communication entity through a secure channel; S2, Gradient encryption and signature generation: Each client first trains the model locally to obtain the local gradient, symmetrically encrypts the data of each dimension of the local gradient, adds a mask for blinding, and signs the encrypted gradient and mask. Finally, the ciphertext and digital signature are sent to the aggregation server. S3. Verification and calculation of aggregation weight: After the aggregation server receives the information sent by all clients, it first uses the digital signature verification algorithm based on elliptic curves to batch verify all signatures; if the verification is successful, the message sent is accepted and has not been tampered with, otherwise it is rejected; the aggregation server calculates the gradient mean in the ciphertext state, and generates a random number to blind the mean and the encrypted local gradient. The result generates a digital signature and sends the blinded ciphertext and signature to the central server. After receiving the signature, the central server first verifies it. After the verification is successful, it executes the anomaly detection algorithm, calculates the aggregation weight of each local gradient, and sends it to the aggregation server for aggregation processing; S4, Gradient aggregation: After receiving the aggregation weight, the aggregation server calculates the aggregation result and the verification value of each client in the encrypted state, and sends it to the central server for decryption. The central server decrypts the received result and sends it to each client; S5. Gradient correctness verification: After receiving the message, the client performs integrity verification. If all pass, it indicates that the aggregation result has not been tampered with. The client receives the aggregation result and iterates to continue the next round of training.

[0007] Furthermore, the step S1 specifically includes the following steps: S11. The trusted center TA generates initialization model parameters And the learning rate ; Based on finite fields Choose a non-singular elliptic curve as , where the coefficient ,satisfy , the trusted center selects Step addition loop , choose the generator as , in a finite field Pick the first non-zero random number As the decryption private key of the elliptic curve, calculate the corresponding public key ; S12. The trusted center selects two secure prime numbers within a preset range. , and satisfies ; From a finite field Pick the second non-zero random number from , and choose a small integer , obtain the key of the symmetric homomorphic encryption algorithm ; S13. The trusted center sets 5 collision-resistant hash functions: ; Set up a hash function ,in yes Factorial cyclic groups; S14: The trusted center generates the identity of the first client , the identity of the aggregation server , the identity of the central server ; S15. Trusted Center in Limited Domain The first client Pick the third non-zero random number , the aggregation server Pick the fourth non-zero random number , the central server Pick the fifth non-zero random number ; and perform doubling operation on the third non-zero random number to obtain the first group element ; Perform doubling operation on the fourth non-zero random number to obtain the second group element ; Perform doubling operation on the fifth non-zero random number to obtain the third group element ; Finally, the first client Generate the first signature private key ; for the aggregation server Generate the second signature private key ; for the central server Generate the third signature private key ; S16. Trusted Center Public Parameters and sends the first client Send the first parameter set , to the aggregation server Send the second parameter set ; To the central server Send the third parameter set .

[0008] Preferably, in step S2, each client encrypts the gradient, generates a mask to blind it, and generates a digital signature corresponding to the gradient; wherein the first client Execution includes the following steps: S21: The first client Use Global model of the wheel Train on the local dataset and obtain Dimensional Local Gradient Model ; The first client Select two random numbers respectively. As the elliptic curve encryption parameters, as the symmetric homomorphic encryption parameter, and As a random mask; using the key of the symmetric homomorphic encryption algorithm Encrypted Gradient and use Perform blinding and calculate the encrypted blinded local gradient ;use Mask Encryption, double point calculation blind mask first component , and the second component of the blinding mask ; Blind mask second component Hash and XOR the result with the mask value to calculate the blinded encrypted value , get the encrypted data set ; S22: The first client In finite fields Pick the sixth non-zero random number , calculate the fourth group element ,in is the first component of the fourth group element, is the second component of the fourth group element; the first client Get the first timestamp ,calculate , calculated from this Digital signature ,in ; S23: The first client Send the message Send to aggregation server , proceed to the next step.

[0009] Preferably, The first client The index of each valid client in is recorded in the collection Get the second client , and there are ; Among them, the aggregation server Execution includes the following steps: S31, according to the first timestamp of the received message , determine whether ,in is the delay allowed by the system, is the current timestamp; if it does not meet the requirements, the integrity authentication fails; otherwise, the aggregation server Randomly select a set of coefficients , where each coefficient exist Randomly selected from is an integer within a preset range; for the second client ,calculate , and according to the fourth group element Calculate the corresponding intermediate parameters ; The integrity of the information is verified by the following equation: ; S32, using the decryption private key based on the elliptic curve encryption algorithm sent by the trusted center TA ,calculate , and Hash the result With blinded encrypted value Perform XOR to restore the mask value ; Calculate the unblinded encrypted gradient ; S33, to ensure that private data is not leaked, the aggregation server Calculate the gradient mean in the encrypted state ; S34, also to protect data privacy, aggregation server For the second client Generate random numbers , the unblinded encrypted gradient And the mean gradient The corresponding random number Multiply them together to get the blinded encrypted gradient and the mean gradient ; S35, Aggregation Server In finite fields Pick the seventh non-zero random number , calculate the fifth group element ,in is the first component of the fifth group element, is the second component of the fifth group element; and obtains the second timestamp , calculated from this ; and calculate its digital signature ; S36, Aggregation Server Information Send to central server .

[0010] Preferably, in step S3; the central server The implementation specifically includes the following steps: S3a, as the central server Received from Aggregation Server Information sent , according to the second timestamp received , determine whether If the requirements are not met, the integrity authentication is deemed to have failed; otherwise, the central server calculate , and then according to the received ,calculate ; Through the equation To verify the integrity of the information; S3b, Central Server Using symmetric keys For the second client of and Decrypt and obtain the blinded local model gradient and the mean gradient ; S3c, Central Server To perform anomaly detection, we first compute the local model gradient for each blind With the mean gradient of Norm distance ;calculate With the mean gradient The ratio between Represents the degree of deviation between the gradient uploaded by each client and the mean; defines a benchmark The corresponding second client The aggregation weight of is not affected; on the contrary, if , it indicates that the corresponding second client There is a possibility of data poisoning, and the aggregation weight needs to be reduced; thus, the calculation is obtained for each second client The aggregation weight is ; S3d, Central Server In finite fields Pick the eighth non-zero random number , calculate the sixth group element ,in is the first component of the sixth group element, Is the second component of the sixth group element; get the third timestamp , calculated from this ; and calculate its corresponding digital signature ,in ; S3e, Central Server Broadcast information .

[0011] Preferably, the aggregation server in step S4 Calculate the first aggregation result in the encrypted state And the first verification value after encryption of each client , and sent to the central server ; Central Server Decrypt it and send it to each client, aggregation server The implementation specifically includes the following steps: S41, when the aggregation server Received from central server Information sent , according to the third timestamp received , determine whether If it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, the calculation , and then according to ,calculate ; Through the equation To verify the integrity of the information; S42: Perform gradient aggregation in an encrypted state to protect privacy, and obtain an encrypted first aggregation result. , and the second client The first verification value in ; S43, Aggregation Server Randomly pick the ninth non-zero random number , calculate the seventh group element ,in The first component of the seventh group element, The second component of the seventh group element; get the fourth timestamp , calculated from this ; and calculate its digital signature ,in ; S44, Aggregation Server Information Send to central server .

[0012] Preferably, in step S4, the central server The implementation specifically includes the following steps: S4a, when the central server Received from Aggregation Server Information sent , according to the fourth timestamp received , determine the fifth timestamp , whether it satisfies If it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, the calculation , and then according to ,calculate ; Through the equation To verify the integrity of the information; S4b, decrypting the first aggregation result And the first verification value , the second aggregation result obtained after decryption is The second verification value obtained after decryption is ; S4c, Central Server Broadcast the second aggregation result And the second verification value .

[0013] Preferably, the step S5 specifically includes the following steps: S51, second client After receiving all the verification information, three verifications are performed to determine the integrity of the aggregation results; First, verify the aggregation weight The correctness of the second client Received from central server Information sent , according to the third timestamp received , determine whether If it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, the calculation , and then according to ,calculate ; Through the equation To verify the integrity of the information; Secondly, determine the second verification value The correctness of the second client According to its local gradient With the generated mask value calculate and verify the received second value with Compare and accept if they are equal, otherwise consider the received second verification value It was forged, ending this round of training; Finally, verify the correctness of the aggregation results; the second client calculate Is it equal to the second aggregation result? , if they are not equal, the result is considered to be falsified and the current round of training ends; S52, second client Calculate the global model parameters for round t+1 Perform update iterations and conduct the next round of training based on the updated model parameters until the model converges.

[0014] The beneficial effects of the present invention are: 1) Each client generates a unique mask and blinds the encrypted local gradient. The adversary can only obtain the plaintext message by knowing the mask of each client, which effectively resists the chosen plaintext attack.

[0015] 2) All information sent between communication entities must go through an integrity verification algorithm based on elliptic curves to ensure the integrity of the transmitted information, prevent the adversary from tampering with the information, and effectively resist man-in-the-middle attacks.

[0016] 3) After the client sends the encrypted local gradient to the server, the aggregation server and the central server execute the anomaly detection algorithm to detect abnormal data and reduce its aggregation weight, effectively resisting data poisoning attacks.

[0017] 4) During the entire training process, the homomorphic encryption algorithm is used to realize data calculation and processing in the ciphertext state, ensuring that data privacy is not leaked. At the same time, symmetric homomorphic encryption is used to reduce the computing overhead of the server and improve performance.

[0018] 5) On the basis of ensuring data confidentiality, integrity and non-repudiation, through this method, the server can receive multiple ciphertexts from different clients, and can achieve decryption through batch verification, further improving the performance of communication between entities. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 The present invention is a flowchart of the steps of a federated learning method for resisting poisoning attacks based on lightweight homomorphic encryption according to an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0021] The present invention discloses a federated learning method for resisting poisoning attacks based on lightweight homomorphic encryption, in order to achieve privacy protection of threat intelligence data and detection of poisoning data, while reducing the cost of the training process. The schematic diagram of the steps is as follows: Figure 1 As shown, the specific steps include: S1. System initialization: The trusted center sets the system public parameters, including the setting of the additive cyclic group based on the elliptic curve and its generator, the collision-resistant hash function, the system master public key and the key of the symmetric encryption algorithm. The trusted center also sets the system master private key and keeps it secretly, and registers various communication entities in the system. The trusted center generates its own signature private key for each communication entity and sends it to each communication entity through a secure channel; S2, Gradient encryption and signature generation: Each client first trains the model locally to obtain the local gradient, symmetrically encrypts the data of each dimension of the local gradient, adds a mask for blinding, and signs the encrypted gradient and mask. Finally, the ciphertext and digital signature are sent to the aggregation server. S3. Verification and calculation of aggregation weight: After the aggregation server receives the information sent by all clients, it first uses the digital signature verification algorithm based on elliptic curves to batch verify all signatures; if the verification is successful, the message sent is accepted and has not been tampered with, otherwise it is rejected; the aggregation server calculates the gradient mean in the ciphertext state, and generates a random number to blind the mean and the encrypted local gradient. The result generates a digital signature and sends the blinded ciphertext and signature to the central server. After receiving the signature, the central server first verifies it. After the verification is successful, it executes the anomaly detection algorithm, calculates the aggregation weight of each local gradient, and sends it to the aggregation server for aggregation processing; S4, Gradient aggregation: After receiving the aggregation weight, the aggregation server calculates the aggregation result and the verification value of each client in the encrypted state, and sends it to the central server for decryption. The central server decrypts the received result and sends it to each client; S5. Gradient correctness verification: After receiving the message, the client performs integrity verification. If all pass, it indicates that the aggregation result has not been tampered with. The client receives the aggregation result and iterates to continue the next round of training.

[0022] Specifically, the step S1 comprises the following steps: S11. The trusted center TA generates initialization model parameters And the learning rate ; Based on finite fields Choose a non-singular elliptic curve as , where the coefficient ,satisfy , the trusted center selects Step addition loop , choose the generator as , in a finite field Pick the first non-zero random number As the decryption private key of the elliptic curve, calculate the corresponding public key ; S12. The trusted center selects two secure prime numbers within a preset range. The preset range is a range pre-set according to the working environment, is not limited to a specific range, and satisfies ; From a finite field Pick the second non-zero random number from , and choose a small integer , obtain the key of the symmetric homomorphic encryption algorithm ; S13. The trusted center sets 5 collision-resistant hash functions: ; Set up a hash function ,in yes Factorial cyclic groups; S14: The trusted center generates the identity of the first client , the identity of the aggregation server , the identity of the central server ; S15. Trusted Center in Limited Domain The first client Pick the third non-zero random number , the aggregation server Pick the fourth non-zero random number , the central server Pick the fifth non-zero random number ; and perform doubling operation on the third non-zero random number to obtain the first group element ; Perform doubling operation on the fourth non-zero random number to obtain the second group element ; Perform doubling operation on the fifth non-zero random number to obtain the third group element ; Finally, the first client Generate the first signature private key ; for the aggregation server Generate the second signature private key ; for the central server Generate the third signature private key ; S16. Trusted Center Public Parameters and sends the first client Send the first parameter set , to the aggregation server Send the second parameter set ; To the central server Send the third parameter set .

[0023] Specifically, in step S2, each client encrypts the gradient, generates a mask to blind it, and generates a digital signature of the corresponding gradient; wherein the first client Execution includes the following steps: S21: The first client Use Global model of the wheel Train on the local dataset and obtain Dimensional Local Gradient Model ; The first client Select two random numbers respectively. As the elliptic curve encryption parameters, as the symmetric homomorphic encryption parameter, and As a random mask; using the key of the symmetric homomorphic encryption algorithm Encrypted Gradient and use Perform blinding and calculate the encrypted blinded local gradient ;use Mask Encryption, double point calculation blind mask first component , and the second component of the blinding mask ; Blind mask second component Hash and XOR the result with the mask value to calculate the blinded encrypted value , get the encrypted data set ; S22: The first client In finite fields Pick the sixth non-zero random number , calculate the fourth group element ,in is the first component of the fourth group element, is the second component of the fourth group element; the first client Get the first timestamp ,calculate , calculated from this Digital signature ,in ; S23: The first client Send the message Send to aggregation server , proceed to the next step.

[0024] Specifically, The first client The index of each valid client in is recorded in the collection Get the second client , and there are ; Among them, the aggregation server Execution includes the following steps: S31, according to the first timestamp of the received message , determine whether ,in is the delay allowed by the system, is the current timestamp; if it does not meet the requirements, the integrity authentication fails; otherwise, the aggregation server Randomly select a set of coefficients , where each coefficient exist Randomly selected from is an integer within a preset range. The preset range is a range preset according to the working environment and is not limited to a specific range. For the second client ,calculate , and according to the fourth group element Calculate the corresponding intermediate parameters ; The integrity of the information is verified by the following equation: ; S32, using the decryption private key based on the elliptic curve encryption algorithm sent by the trusted center TA ,calculate , and Hash the result With blinded encrypted value Perform XOR to restore the mask value ; Calculate the unblinded encrypted gradient ; S33, to ensure that private data is not leaked, the aggregation server Calculate the gradient mean in the encrypted state ; S34, also to protect data privacy, aggregation server For the second client Generate random numbers , the unblinded encrypted gradient And the mean gradient The corresponding random number Multiply them together to get the blinded encrypted gradient and the mean gradient ; S35, Aggregation Server In finite fields Pick the seventh non-zero random number , calculate the fifth group element ,in is the first component of the fifth group element, is the second component of the fifth group element; and obtains the second timestamp , calculated from this ; and calculate its digital signature ; S36, Aggregation Server Information Send to central server .

[0025] Specifically, in step S3, the central server The implementation specifically includes the following steps: S3a, as the central server Received from Aggregation Server Information sent , according to the second timestamp received , determine whether If the requirements are not met, the integrity authentication is deemed to have failed; otherwise, the central server calculate , and then according to the received ,calculate ; Through the equation To verify the integrity of the information; S3b, Central Server Using symmetric keys For the second client of and Decrypt and obtain the blinded local model gradient and the mean gradient ; S3c, Central Server To perform anomaly detection, we first compute the local model gradient for each blind With the mean gradient of Norm distance ;calculate With the mean gradient The ratio between Represents the degree of deviation between the gradient uploaded by each client and the mean; defines a benchmark The corresponding second client The aggregation weight of is not affected; on the contrary, if , it indicates that the corresponding second client There is a possibility of data poisoning, and the aggregation weight needs to be reduced; thus, the calculation is obtained for each second client The aggregation weight is ; S3d, Central Server In finite fields Pick the eighth non-zero random number , calculate the sixth group element ,in is the first component of the sixth group element, Is the second component of the sixth group element; get the third timestamp , calculated from this ; and calculate its corresponding digital signature ,in ; S3e, Central Server Broadcast information .

[0026] Specifically, in step S4, the aggregation server Calculate the first aggregation result in the encrypted state And the first verification value after encryption of each client , and sent to the central server ; Central Server Decrypt it and send it to each client, aggregation server The implementation specifically includes the following steps: S41, when the aggregation server Received from central server Information sent , according to the third timestamp received , determine whether If it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, the calculation , and then according to ,calculate ; Through the equation To verify the integrity of the information; S42: Perform gradient aggregation in an encrypted state to protect privacy, and obtain an encrypted first aggregation result. , and the second client The first verification value in ; S43, Aggregation Server Randomly pick the ninth non-zero random number , calculate the seventh group element ,in The first component of the seventh group element, The second component of the seventh group element; get the fourth timestamp , calculated from this ; and calculate its digital signature ,in ; S44, Aggregation Server Information Send to central server .

[0027] Specifically, in step S4, the central server The implementation specifically includes the following steps: S4a, when the central server Received from Aggregation Server Information sent , according to the fourth timestamp received , determine the fifth timestamp , whether it satisfies If it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, the calculation , and then according to ,calculate ; Through the equation To verify the integrity of the information; S4b, decrypting the first aggregation result And the first verification value , the second aggregation result obtained after decryption is The second verification value obtained after decryption is ; S4c, Central Server Broadcast the second aggregation result And the second verification value .

[0028] Preferably, the step S5 specifically includes the following steps: S51, second client After receiving all the verification information, three verifications are performed to determine the integrity of the aggregation results; First, verify the aggregation weight The correctness of the second client Received from central server Information sent , according to the third timestamp received , determine whether If it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, the calculation , and then according to ,calculate ; Through the equation To verify the integrity of the information; Secondly, determine the second verification value The correctness of the second client According to its local gradient With the generated mask value calculate and verify the received second value with Compare and accept if they are equal, otherwise consider the received second verification value It was forged, ending this round of training; Finally, verify the correctness of the aggregation results; the second client calculate Is it equal to the second aggregation result? , if they are not equal, the result is considered to be falsified and the current round of training ends; S52, second client Calculate the global model parameters for round t+1 Perform update iterations and conduct the next round of training based on the updated model parameters until the model converges.

[0029] Exemplarily, the correctness analysis of the anti-poisoning attack federated learning method based on lightweight homomorphic encryption includes: Correctness of batch signature verification: During the verification of malicious intent and calculation of aggregation weights, the aggregation server Will receive messages and signatures from clients. Assuming that a message is received from a client, each first client The valid client subscripts in the collection are recorded Get the second client Before the server processes the data, it must first verify the integrity of the data. In order to efficiently verify the integrity of all confidential data, the aggregation server A batch verification signature algorithm based on elliptic curve can be used. Assume that each second client The message sent is , calculated as well as , randomly selected , the specific process is as follows: ; Correctness of the anomaly detection algorithm: In the tth round of training, the central server receive After the message is received, integrity verification is performed. If it passes, the terminal server uses the symmetric key Decrypt the ciphertext and get and In the anomaly detection process, the deviation between the local gradient of each client and the standard value can still be obtained by using the masked parameters for calculation. , assuming that the local gradient is a dimensional vector, then: .

[0030] The above is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not deviate from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. A federated learning method based on lightweight homomorphic encryption to resist poisoning attacks, characterized in that: The following steps are involved: S1. System initialization: The trusted center sets the system public parameters, including the setting of the additive cyclic group based on the elliptic curve and its generator, the collision-resistant hash function, the system master public key and the key of the symmetric encryption algorithm. The trusted center also sets the system master private key and keeps it secretly, and registers various communication entities in the system. The trusted center generates its own signature private key for each communication entity and sends it to each communication entity through a secure channel; S2, Gradient encryption and signature generation: Each client first trains the model locally to obtain the local gradient, symmetrically encrypts the data of each dimension of the local gradient, adds a mask for blinding, and signs the encrypted gradient and mask. Finally, the ciphertext and digital signature are sent to the aggregation server. S3. Verification and calculation of aggregation weight: After the aggregation server receives the information sent by all clients, it first uses the digital signature verification algorithm based on elliptic curves to batch verify all signatures; If the verification is successful, the message is accepted and has not been tampered with. Otherwise, it is rejected. In the ciphertext state, the aggregation server calculates the gradient mean and generates a random number to blind the mean and encrypted local gradient. The result generates a digital signature and sends the blinded ciphertext and signature to the central server. After receiving the signature, the central server first verifies it. After the verification is successful, the anomaly detection algorithm is executed to calculate the aggregation weight of each local gradient and send it to the aggregation server for aggregation processing. S4, Gradient aggregation: After receiving the aggregation weight, the aggregation server calculates the aggregation result and the verification value of each client in the encrypted state, and sends it to the central server for decryption. The central server decrypts the received result and sends it to each client; S5. Gradient correctness verification: After receiving the message, the client performs integrity verification. If all pass, it indicates that the aggregation result has not been tampered with. The client receives the aggregation result and iterates to continue the next round of training.

2. According to claim 1, the anti-poisoning attack federated learning method based on lightweight homomorphic encryption is characterized in that: The step S1 specifically includes the following steps: S11. The trusted center TA generates initialization model parameters And the learning rate ; Based on finite fields Choose a non-singular elliptic curve as , where the coefficient ,satisfy , the trusted center selects Step addition loop , choose the generator as , in a finite field Pick the first non-zero random number As the decryption private key of the elliptic curve, calculate the corresponding public key ; S12. The trusted center selects two secure prime numbers within a preset range. , and satisfies ; From a finite field Pick the second non-zero random number from , and choose a small integer , obtain the key of the symmetric homomorphic encryption algorithm ; S13. The trusted center sets 5 collision-resistant hash functions: ; Set up a hash function ,in yes Factorial cyclic groups; S14: The trusted center generates the identity of the first client , the identity of the aggregation server , the identity of the central server ; S15. Trusted Center in Limited Domain The first client Pick the third non-zero random number , the aggregation server Pick the fourth non-zero random number , the central server Pick the fifth non-zero random number ; and perform doubling operation on the third non-zero random number to obtain the first group element ; Perform doubling operation on the fourth non-zero random number to obtain the second group element ; Perform doubling operation on the fifth non-zero random number to obtain the third group element ; Finally, the first client Generate the first signature private key ; for the aggregation server Generate the second signature private key ; for the central server Generate the third signature private key ; S16. Trusted Center Public Parameters and sends the first client Send the first parameter set , to the aggregation server Send the second parameter set ; To the central server Send the third parameter set .

3. The anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to claim 2 is characterized in that: In step S2, each client encrypts the gradient, generates a mask to blind it, and generates a digital signature corresponding to the gradient; wherein the first client Execution includes the following steps: S21: The first client Use Global model of the wheel Train on the local dataset and obtain Dimensional Local Gradient Model ; The first client Select two random numbers respectively. As the elliptic curve encryption parameters, as the symmetric homomorphic encryption parameter, and As a random mask; using the key of the symmetric homomorphic encryption algorithm Encrypted Gradient and use Perform blinding and calculate the encrypted blinded local gradient ;use Mask Encryption, double point calculation blind mask first component , and the second component of the blinding mask ; Blind mask second component Hash and XOR the result with the mask value to calculate the blinded encrypted value , get the encrypted data set ; S22: The first client In finite fields Pick the sixth non-zero random number , calculate the fourth group element ,in is the first component of the fourth group element, is the second component of the fourth group element; the first client Get the first timestamp ,calculate , calculated from this Digital signature ,in ; S23: The first client Send the message Send to aggregation server , proceed to the next step.

4. The anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to claim 3 is characterized in that: The first client The index of each valid client in is recorded in the collection Get the second client , and there are ; Among them, the aggregation server Execution includes the following steps: S31, according to the first timestamp of the received message , determine whether ,in is the delay allowed by the system, is the current timestamp; if it does not meet the requirements, the integrity authentication fails; otherwise, the aggregation server Randomly select a set of coefficients , where each coefficient exist Randomly selected from is an integer within a preset range; for the second client ,calculate , and according to the fourth group element Calculate the corresponding intermediate parameters ; The integrity of the information is verified by the following equation: ; S32, using the decryption private key based on the elliptic curve encryption algorithm sent by the trusted center TA ,calculate , and Hash the result With blinded encrypted value Perform XOR to restore the mask value ; Calculate the unblinded encrypted gradient ; S33, to ensure that private data is not leaked, the aggregation server Calculate the gradient mean in the encrypted state ; S34, also to protect data privacy, aggregation server For the second client Generate random numbers , the unblinded encrypted gradient And the mean gradient The corresponding random number Multiply them together to get the blinded encrypted gradient and the mean gradient ; S35, Aggregation Server In finite fields Pick the seventh non-zero random number , calculate the fifth group element ,in is the first component of the fifth group element, is the second component of the fifth group element; and obtains the second timestamp , calculated from this ; and calculate its digital signature ; S36, Aggregation Server Information Send to central server .

5. The anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to claim 4 is characterized in that: In step S3, the central server The execution specifically includes the following steps: S3a, as the central server Received from Aggregation Server Information sent , according to the second timestamp received , determine whether If the requirements are not met, the integrity authentication is deemed to have failed; otherwise, the central server calculate , and then according to the received ,calculate ; Through the equation To verify the integrity of the information; S3b, Central Server Using symmetric keys For the second client of and Decrypt and obtain the blinded local model gradient and the mean gradient ; S3c, Central Server To perform anomaly detection, we first compute the local model gradient for each blind With the mean gradient of Norm distance ;calculate With the mean gradient The ratio between Represents the degree of deviation between the gradient uploaded by each client and the mean; defines a benchmark The corresponding second client The aggregation weight of is not affected; on the contrary, if , it indicates that the corresponding second client There is a possibility of data poisoning, and the aggregation weight needs to be reduced; thus, the calculation is obtained for each second client The aggregation weight is ; S3d, Central Server In finite fields Pick the eighth non-zero random number , calculate the sixth group element ,in is the first component of the sixth group element, Is the second component of the sixth group element; get the third timestamp , calculated from this ; and calculate its corresponding digital signature ,in ; S3e, Central Server Broadcast information .

6. The anti-poisoning attack federated learning method based on lightweight homomorphic encryption according to claim 5 is characterized in that: In step S4, the aggregation server Calculate the first aggregation result in the encrypted state And the first verification value encrypted by each client , and sent to the central server ; Central Server Decrypt it and send it to each client, aggregation server The execution specifically includes the following steps: S41, when the aggregation server Received from central server Information sent , according to the third timestamp received , determine whether If it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, the calculation , and then according to ,calculate ; Through the equation To verify the integrity of the information; S42: Perform gradient aggregation in an encrypted state to protect privacy, and obtain an encrypted first aggregation result. , and the second client The first verification value in ; S43, Aggregation Server Randomly pick the ninth non-zero random number , calculate the seventh group element ,in The first component of the seventh group element, The second component of the seventh group element; get the fourth timestamp , calculated from this ; and calculate its digital signature ,in ; S44, Aggregation Server Information Send to central server .

7. The method for resisting poisoning attacks based on lightweight homomorphic encryption according to claim 6 is characterized in that: In step S4, the central server The execution specifically includes the following steps: S4a, when the central server Received from Aggregation Server Information sent , according to the fourth timestamp received , determine the fifth timestamp , whether it satisfies If it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, the calculation , and then according to ,calculate ; Through the equation To verify the integrity of the information; S4b, decrypting the first aggregation result And the first verification value , the second aggregation result obtained after decryption is The second verification value obtained after decryption is ; S4c, Central Server Broadcast the second aggregation result And the second verification value .

8. The method for resisting poisoning attacks based on lightweight homomorphic encryption according to claim 7 is characterized in that: The step S5 specifically comprises the following steps: S51, second client After receiving all the verification information, three verifications are performed to determine the integrity of the aggregation results; First, verify the aggregation weight The correctness of the second client Received from central server Information sent , according to the third timestamp received , determine whether If it does not meet the requirements, the integrity authentication is judged to be unsuccessful; otherwise, the calculation , and then according to ,calculate ; Through the equation To verify the integrity of the information; Secondly, determine the second verification value The correctness of the second client According to its local gradient With the generated mask value calculate and verify the received second value with Compare and accept if they are equal, otherwise consider the received second verification value It was forged, ending this round of training; Finally, verify the correctness of the aggregation results; the second client calculate Is it equal to the second aggregation result? , if they are not equal, the result is considered to be falsified and the current round of training ends; S52, second client Calculate the global model parameters for round t+1 Perform update iterations and conduct the next round of training based on the updated model parameters until the model converges.

Images