User privacy protection method based on privacy enhancement federated learning

Abstract

The invention belongs to the technical field of privacy protection, and relates to a user privacy protection method based on privacy enhanced federated learning, which comprises the following steps that: a secret key distribution center generates a public key and a private key and respectively distributes the public key and the private key to participants and a central server; the central server initializes model parameters and transmits the model parameters to all participants, each participant trains a model on a local data set and encrypts the local gradient after calculating a loss function and the local gradient, the central server receives the encryption gradients of all participants, and the encryption gradients are aggregated and decrypted to obtain a global gradient; the participants receive the global gradient and update the local model parameters, and each participant can flexibly select and adjust the implementation mode of each module according to the own data characteristics and business requirements to adapt to different data types and sources, so that the problem of insufficient flexibility in the traditional method is solved.

Description

Technical Field

[0001] This invention belongs to the field of privacy protection technology and relates to a user privacy protection method based on privacy-enhancing federated learning. Background Technology

[0002] In today's big data era, collaboration among enterprises has become a trend. By sharing and integrating data from multiple parties, businesses can gain a more comprehensive understanding of user behavior, thereby achieving various business goals such as precision marketing, personalized recommendations, and improved user satisfaction. However, with the increase in data volume and the diversification of data types, data privacy and security issues are becoming increasingly prominent. If data privacy issues are not effectively addressed, they will not only hinder data sharing and utilization but may also trigger a crisis of trust among users, ultimately affecting a company's reputation and market performance.

[0003] Existing privacy protection methods are mainly divided into two categories: centralized training and distributed training. Centralized training involves all parties concentrating their respective datasets on a central server for unified processing and model training. This method may lead to serious privacy and security issues, especially when the data contains sensitive information (such as vehicle information and user purchasing behavior), significantly increasing the risk of data leakage. For example, malicious attackers can obtain sensitive information by eavesdropping on data uploaded to cloud service providers. Moreover, centralized data processing leads to high costs for data transmission and storage, especially for large-scale datasets. Distributed training involves each participant processing data and training the model locally, then sending the trained model parameters to a central server for aggregation. Although distributed training, such as federated learning, reduces the privacy risks associated with centralized data storage by sharing only local model parameters rather than the data itself, the shared model parameters may still leak sensitive information from the participants. For example, malicious attackers can use the shared parameters for reverse engineering to infer private information from the training data. Existing federated learning methods often lack suitable encryption and privacy protection measures, failing to effectively protect data privacy during data sharing and processing. They incur significant communication overhead during data transmission and computation, and when dealing with heterogeneous data and complex models, they often struggle to guarantee the training effectiveness and accuracy of the model. Furthermore, some existing privacy protection methods (such as those based on secure multi-party computation and homomorphic encryption) require multiple rounds of communication, resulting in high communication overhead, slow training processes, and limited practical application. Therefore, a new user privacy protection method is urgently needed. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of existing technologies and to design a user privacy protection method based on privacy-enhanced federated learning. This method achieves both privacy protection and efficient federated learning through non-interactive secure aggregation and multi-layered encryption mechanisms.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: A user privacy protection method based on privacy-enhanced federated learning includes the following steps: S1. The key distribution center generates a public key and a private key. The public key is used to encrypt the gradient, and the private key is used to decrypt the gradient. The generated public key and private key are distributed to the participants and the central server, respectively. S2. The central server initializes the model parameters and transmits the parameter information to all participants. Each participant trains the model on its local dataset and calculates the loss function and local gradient. S3. The participants encrypt the local gradient by first using the RBGV encryption scheme to generate the internal ciphertext, and then using the A-LWE encryption scheme to generate the external ciphertext. S4. The central server receives the encryption gradients from all participants, aggregates and decrypts the encryption gradients to obtain the global gradient. S5. Participants receive the global gradient and update their local model parameters.

[0006] As a further technical solution of the present invention, step S1, when the key distribution center generates the public key and the private key, includes two processes: internal encryption and external encryption. The specific process of internal encryption is as follows: random vector Indicates a uniform distribution The sampled vector has a size of Modulus is , represented as: Private key From Gaussian distribution The sampled vector has a size of The standard deviation is , represented as: ;noise With private key The generation formula is the same, and the calculation is the same. : ,in, Through random vectors Private key and noise The calculated public key components, It is the modulus, from which the public key is obtained. and private key : , ; The specific process of external encryption is as follows: random vector Indicates a uniform distribution The sampled vector has a size of Modulus is , represented as: private key From Gaussian distribution The sampled vector has a size of The standard deviation is , represented as: The generating matrix is : ,in, It is a unit vector, thus yielding the public key. and private key , , and These represent the private key of each participant and the private key of the central server, respectively.

[0007] As a further technical solution of the present invention, the model parameters in step S2 include the learning rate. Initial global parameters and loss function Each participant calculates the loss function through forward propagation. And calculate the gradient through backpropagation. Specifically, the loss function is applied to each data sample. Predicted value Compared with actual value Losses between Summing and averaging the results, we can express the following as: ,in, Indicates the participating parties In the Local dataset in round training, This indicates the number of data samples. The features and labels of the data are represented; the local gradient calculation formula is: in, Indicates the participating parties In the The gradient vector calculated during each round of training. Represents the loss function For model parameters The gradient.

[0008] As a further technical solution of the present invention, the specific process of generating internal ciphertext using the RBGV encryption scheme in step S3 is as follows: first, through a mapping function... Map the gradient to Then through Gaussian distribution The sampled noise vector is obtained Its size is The standard deviation is , is represented as: Then, from the small vector distribution... Medium-sampled random vector Its size is Finally, calculate the ciphertext. and Obtain the internal ciphertext ,in , .

[0009] As a further technical solution of the present invention, the specific process of generating external ciphertext using the A-LWE encryption scheme in step S3 is as follows: through Map the internal ciphertext to a vector space Then from the distribution Mid-sampling error item Then calculate the external ciphertext. : .

[0010] As a further technical solution of the present invention, the specific process of step S4 is as follows: The aggregated ciphertext is obtained from the outer ciphertext using the following formula: Then calculate the error items: ; During internal decryption, the internal ciphertext is recovered first: , will get Divided into two parts and Then through the mapping function get and Then, the ciphertext is modulated, switching from modulus to digital. arrive get and By eliminating the private key item Obtain the decrypted global gradient : .

[0011] As a further technical solution of the present invention, the process of updating the local model parameters in step S5 is as follows: ,in, Indicates the first Model parameters after training round The learning rate, used to control the step size for updating model parameters, Indicates the first The global gradient calculated during each training round. Indicates the number of participants.

[0012] Compared with the prior art, the present invention has the following beneficial effects: (1) Non-interactive secure aggregation is adopted, which does not require multiple communication rounds in each aggregation process, reduces the overhead of multiple rounds of communication, improves the communication efficiency of the system, and effectively solves the problem of high communication overhead in distributed methods.

[0013] (2) Multiple encryption protection is implemented. The local gradient is encrypted internally using the BGV homomorphic encryption scheme, and the A-LWE encryption scheme is used externally for secure aggregation. This ensures the security of data during transmission and aggregation. Even if multiple entities collude, the private data of the participants cannot be leaked, thus solving the problem of insufficient privacy protection in centralized and distributed methods.

[0014] (3) By performing differential privacy processing on the gradient after each round of local model training, the privacy of shared parameters is further prevented from being leaked, ensuring that data privacy is not leaked and that even if the data is intercepted, it is difficult to recover the original data.

[0015] (4) Each participant can flexibly choose and adjust the implementation method of each module according to its own data characteristics and business needs, adapt to different data types and sources, and solve the problem of insufficient flexibility in traditional methods. Attached Figure Description

[0016] Figure 1 The flowchart of the user privacy protection method based on privacy-enhanced federated learning provided by this invention is shown. Detailed Implementation

[0017] The present invention will be further described below with reference to the embodiments and accompanying drawings.

[0018] Example: like Figure 1 As shown, this embodiment provides a user privacy protection method based on privacy-enhanced federated learning, which includes the following steps: S1. The key distribution center generates a public key and a private key. The public key is used to encrypt the gradient, and the private key is used to decrypt the gradient. The generated public key and private key are distributed to the participants and the central server, respectively. The generation of the public key and private key by the key distribution center includes two processes: internal encryption and external encryption. The specific process of internal encryption is as follows: random vector Indicates a uniform distribution The sampled vector has a size of Modulus is , represented as: Private key From Gaussian distribution The sampled vector has a size of The standard deviation is , represented as: ;noise With private key The generation formula is the same, and the calculation is the same. : ,in, Through random vectors Private key and noise The calculated public key components, It is the modulus, from which the public key is obtained. and private key : , ; The specific process of external encryption is as follows: random vector Indicates a uniform distribution The sampled vector has a size of Modulus is , represented as: private key From Gaussian distribution The sampled vector has a size of The standard deviation is , represented as: The generating matrix is : ,in, It is a unit vector, thus yielding the public key. and private key , , and These represent the private key of each participant and the private key of the central server, respectively; key generation and distribution are achieved through step S1 to ensure the security of encryption and decryption operations in subsequent steps.

[0019] S2. The central server initializes the model parameters and transmits the model parameter information to all participants. The model parameters include the learning rate. Initial global parameters and loss function Each participant trains its model on its local dataset and computes the loss function and local gradient. Specifically, each participant computes the loss function through forward propagation. And calculate the gradient through backpropagation. The loss function is applied to each data sample. Predicted value Compared with actual value Losses between Summing and averaging the results, we can express the following as: ,in, Indicates the participating parties In the Local dataset in round training, This indicates the number of data samples. The features and labels of the data are represented; the local gradient calculation formula is: in, Indicates the participating parties In the The gradient vector calculated during each round of training. Represents the loss function For model parameters The gradient, or gradient vector, is used to update the model parameters in order to minimize the loss function.

[0020] S3. The participants encrypt the local gradient, first using the RBGV encryption scheme to generate the internal ciphertext, and then using the A-LWE encryption scheme to generate the external ciphertext; the specific process of using the RBGV encryption scheme to generate the internal ciphertext is as follows: first, through the mapping function... Map the gradient to Then through Gaussian distribution The sampled noise vector is obtained Its size is The standard deviation is , represented as: Then, from the small vector distribution... Medium-sampled random vector Its size is Finally, calculate the ciphertext. and Obtain the internal ciphertext ,in , ; The specific process of generating external ciphertext using the A-LWE encryption scheme is as follows: Through... Map the internal ciphertext to a vector space Then from the distribution Mid-sampling error item Then calculate the external ciphertext. : .

[0021] In this embodiment, the error item is calculated. The following algorithm is used: .

[0022] S4. The central server receives the encryption gradients from all participants, aggregates and decrypts them to obtain the global gradient; in the external ciphertext, the aggregated ciphertext is obtained using the following formula: Then calculate the error items: During internal decryption, first recover the internal ciphertext: , will get Divided into two parts and Then through the mapping function get and Then, the ciphertext is modulated, switching from modulus to digital. arrive get and By eliminating the private key item Obtain the decrypted global gradient : .

[0023] S5. Participants receive the global gradient and update their local model parameters, as shown below: ,in, Indicates the first Model parameters after training round The learning rate, used to control the step size for updating model parameters, Indicates the first The global gradient calculated during each training round. Indicates the number of participants.

[0024] In this implementation, the key generation center is a trusted entity responsible for initializing the entire system, generating public parameters, and distributing private keys to each participant and the central server to ensure the security of data encryption and decryption. The central server is responsible for securely aggregating encrypted local gradients from multiple participants and broadcasting the updated global model parameters to each participant. Each participant has its own private dataset, trains its model locally, calculates its local gradient, encrypts its local gradient using its public key, uploads the encrypted gradient to the central server, and simultaneously receives the global model parameters broadcast by the central server to update its local model. On the participant side, each participant first perturbs its local gradient vector using a distributed Gaussian mechanism to achieve differential privacy, then encrypts the perturbed gradient vector into BGV ciphertext (called the internal ciphertext), and finally embeds the BGV ciphertext into A-LWE ciphertext (called the external ciphertext) to achieve a secure aggregation protocol. On the central server side, the server can only correctly decrypt the external ciphertext after aggregating the ciphertexts of all participants. Simultaneously, the internal ciphertexts are automatically summed, allowing the central server to easily decrypt the aggregated value without leaking the privacy of any individual participant.

[0025] Structures and algorithms not described in detail in this article are general techniques in this field.

[0026] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0027] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A user privacy protection method based on privacy-enhanced federated learning, characterized in that, Specifically, the following steps are included: S1. The key distribution center generates a public key and a private key. The public key is used to encrypt the gradient, and the private key is used to decrypt the gradient. The generated public key and private key are distributed to the participants and the central server, respectively. S2. The central server initializes the model parameters and transmits the parameter information to all participants. Each participant trains the model on its local dataset and calculates the loss function and local gradient. S3. The participants encrypt the local gradient by first using the RBGV encryption scheme to generate the internal ciphertext, and then using the A-LWE encryption scheme to generate the external ciphertext. S4. The central server receives the encryption gradients from all participants, aggregates and decrypts the encryption gradients to obtain the global gradient. S5. The participants receive the global gradient and update the local model parameters of the participants.

2. The user privacy protection method based on privacy-enhanced federated learning according to claim 1, characterized in that, Step S1, when the key distribution center generates the public and private keys, includes two processes: internal encryption and external encryption. The specific process of internal encryption is as follows: random vector Indicates a uniform distribution The sampled vector has a size of Modulus is , represented as: Private key From Gaussian distribution The sampled vector has a size of The standard deviation is , represented as: ;noise With private key The generation formula is the same, and the calculation is the same. : ,in, Through random vectors Private key and noise The calculated public key components, It is the modulus, from which the public key is obtained. and private key : , ; The specific process of external encryption is as follows: random vector Indicates a uniform distribution The sampled vector has a size of Modulus is , represented as: private key From Gaussian distribution The sampled vector has a size of The standard deviation is , represented as: The generating matrix is : ,in, It is a unit vector, thus yielding the public key. and private key , , and These represent the private key of each participant and the private key of the central server, respectively.

3. The user privacy protection method based on privacy-enhanced federated learning according to claim 2, characterized in that, The model parameters mentioned in step S2 include the learning rate. Initial global parameters and loss function Each participant calculates the loss function through forward propagation. And calculate the gradient through backpropagation. Specifically, the loss function is applied to each data sample. Predicted value Compared with actual value Losses between Summing and averaging the results, we can express the following as: ,in, Indicates the participating parties In the Local dataset in round training, This indicates the number of data samples. The features and labels of the data are represented; the local gradient calculation formula is: in, Indicates the participating parties In the The gradient vector calculated during each round of training. Represents the loss function For model parameters The gradient.

4. The user privacy protection method based on privacy-enhanced federated learning according to claim 3, characterized in that, Step S3, which uses the RBGV encryption scheme to generate the internal ciphertext, involves first using a mapping function. Map the gradient to Then through Gaussian distribution The sampled noise vector is obtained Its size is The standard deviation is , represented as: Then, from the small vector distribution... Medium-sampled random vector Its size is Finally, calculate the ciphertext. and Obtain the internal ciphertext ,in , .

5. The user privacy protection method based on privacy-enhanced federated learning according to claim 4, characterized in that, Step S3, generating external ciphertext using the A-LWE encryption scheme, involves the following steps: Map the internal ciphertext to a vector space Then from the distribution Mid-sampling error item Then calculate the external ciphertext. : .

6. The user privacy protection method based on privacy-enhanced federated learning according to claim 5, characterized in that, The specific process of step S4 is as follows: The aggregated ciphertext is obtained from the outer ciphertext using the following formula: Then calculate the error items: ; During internal decryption, the internal ciphertext is recovered first: , will get Divided into two parts and Then through the mapping function get and Then, the ciphertext is modulated, switching from modulus to digital. arrive get and By eliminating the private key item Obtain the decrypted global gradient : .

7. The user privacy protection method based on privacy-enhanced federated learning according to claim 6, characterized in that, Step S5 involves updating the local model parameters as follows: ,in, Indicates the first Model parameters after training round The learning rate controls the step size for updating model parameters. Indicates the first The global gradient calculated during each training round. Indicates the number of participants.

Images