Dynamic search hybrid encryption and contribution value-aware federated learning privacy protection method

Abstract

The application relates to the technical field of federated learning and privacy protection, and discloses a dynamic search hybrid encryption and contribution value perception federated learning privacy protection method, which mainly comprises the following steps: constructing a privacy protection scheme combining a contribution degree perception local evaluation and a hybrid encryption mechanism, realizing differentiated privacy protection of client privacy data, effectively reducing the calculation time cost and communication cost based on a single homomorphic encryption privacy mechanism; constructing a security token driven center storage server access control and dynamic key rotation mechanism, and combining a searchable relevance trapdoor index of ciphertext storage, realizing key non-replayability and historical data non-revealability; and the method is based on a contribution perception security aggregation algorithm, a joint secret computation protocol is used to evaluate contribution values of each local model in a ciphertext state, contribution value plaintext is not revealed, aggregation screening of a global model is ensured, power dispersion of a center storage server is completed, and the overall efficiency and privacy of the system are significantly improved.

Description

Technical Field

[0001] This invention relates to the fields of federated learning and privacy protection technology, specifically a privacy protection method for federated learning that combines dynamic search with hybrid encryption and contribution value awareness. Technical Background

[0002] As artificial intelligence increasingly relies on large-scale, multi-source, heterogeneous data, traditional centralized data processing models have led to serious privacy leaks, data misuse, and security risks during model training and inference. This is particularly evident in fields like healthcare and finance, where data silos are strictly regulated. This phenomenon not only hinders the possibility of mitigating individual identification risks through data sharing but also exacerbates the risk of single-point leaks, severely restricting the applicability of centralized machine learning. To address this challenge, federated learning, as an emerging distributed machine learning paradigm, is characterized by edge nodes collaboratively training models while keeping data locally and only uploading parameters or gradients to a central server for aggregation. This achieves a privacy protection mechanism where "the model moves even when the data doesn't move," maintaining model performance while ensuring compliance.

[0003] However, while federated learning architecture emphasizes data localization at the system design level to avoid the risk of raw data leakage, it still faces multiple privacy leakage threats in actual deployment and research. First, there are privacy and integrity threats: gradient inversion, membership inference, and model reverse engineering attacks can leak sensitive information through shared parameters, while poisoning and backdoor attacks can pollute the global model. Second, existing protection technologies have defects: noise in differential privacy can accumulate and reduce model performance; homomorphic encryption (HE) has extremely high computational overhead; and secure multi-party computation (MPC) is complex, making it difficult to adapt to real-world scenarios. Finally, the core bottleneck has not been overcome: existing solutions either have an imbalance between encryption efficiency and scenario requirements, or rely on a central server to store ciphertext, which poses a risk of leakage due to collusion or intrusion, and lack a power check mechanism, failing to mitigate the vulnerability of centralized storage from an architectural perspective. Summary of the Invention

[0004] The purpose of this invention is to provide a dynamically searchable, hybrid encryption technology-based federated learning privacy protection method to address the issues mentioned in the background, such as the imbalance between encryption overhead and efficiency, and the prominent risks of centralized secure storage of ciphertext. This invention aims to explore how to maximize model performance while protecting client privacy and reduce the impact of encryption technology on the overall system efficiency.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a privacy-preserving method for dynamically searching hybrid encryption and contribution-value-aware federated learning, comprising the following steps:

[0006] S1: Federated learning initialization. The client initializes the local model parameters based on the local dataset it holds. The model mainly consists of a convolutional neural network with multiple linear layers and convolutional layers connected. The client initializes the model based on this and then trains the local model.

[0007] S2: The key generation center allocates a master key group. The key generation center allocates an encrypted master key group to each client. The encrypted master key group contains an independent and unique security token initial value for each client, as well as the same asymmetric encryption public key and symmetric encryption key.

[0008] The client's security access token is dynamically updated locally according to the chain update rules during subsequent global training, without the need for the key generation center to redistribute it.

[0009] The asymmetric encryption private key is kept only by the key generation center, and the client selects different encryption schemes based on the differences in local privacy data;

[0010] S3: Server access registration. The client sends a registration request to the server using independent and unique registration information, which mainly includes the corresponding security access token and hash identification code.

[0011] The client-side hash identifier is hash-bound to the local model parameters and dynamically updated locally in the form of a hash tree;

[0012] The server receives the registration information of the corresponding client, generates the corresponding security password based on the security access token, and stores the client registration information and security password in different data tables. The two tables are linked through the client security access token field.

[0013] Based on each client's registration information, the server calculates an irreversible secure association index key using a trapdoor function. This key is an independent identifier field for storing the client's private data.

[0014] S4: Local model training and encryption on the client side. The client trains the local model using a local private dataset and calculates the contribution value of the local model based on data features in a random test dataset to evaluate the generalization ability of the local model.

[0015] To address the data discrepancies between local model parameters and contribution values, the client employs different encryption schemes to encrypt them, resulting in ciphertext privacy data. This ciphertext privacy data includes ciphertext of local model parameters and ciphertext of local model contribution values.

[0016] The client uploads local private data to the server based on a secure access token for secure indexing and storage;

[0017] S5: Contribution value-aware secure aggregation. The server performs global representativeness screening on the ciphertext of each client model contribution value stored. Based on the joint confidentiality computation protocol with the key center, the ciphertext is subjected to a decisionable mask using the homomorphic scalar multiplication property of Paillier encryption. The most globally representative model parameters are obtained based on the final determined contribution value ciphertext.

[0018] S6: Global model broadcasting and local update. The server sends the global model parameters and their corresponding stored hash identification codes to each client. The client decrypts the data and verifies the model's validity.

[0019] If the global model verification performance is lower than the local model performance, the client will treat it as a malicious model, calculate a new hash identification code based on the global model and return it to the server. The server will mark the hash identification code and prohibit clients with the hash identification code from accessing and storing data in the next round of global training.

[0020] If the global model validation performance is better than the local model, the client will update the local model accordingly.

[0021] S7: Repeat S2 to S6 until the global training iterations are completed.

[0022] Preferably, the specific steps of step S2, which involves allocating the master key group and updating the security access token locally in a chain, are as follows:

[0023] S2.1 Key Generation: The key generation center generates the master key required for the hybrid encryption mechanism for each client in the system. Its mathematical expression is:

[0024] ;

[0025] In the master key group middle, This represents the initial value of the access server security token, which is issued only by the key generation center in the first round of global training. In subsequent global training, the client updates the token locally based on the initial value. This represents the symmetric key for the Fernet encryption algorithm; This represents the public key for the Paillier encryption algorithm, and the Paillier private key in this scheme. Independently held by the key generation center;

[0026] S2.2, Local chained update of security access token: The client updates the security access token based on its initial value. To generate more secure and complex security tokens, a local chain-based update is performed. The key derivation function (KDF) used in the update computation employs the verifiable secure key derivation algorithm PBKDF-HMAC, whose mathematical expression is as follows:

[0027] ;

[0028] in, Indicates the global number The original password for the wheel, Indicates the global number The input salt value for the round, this expression is the global first... In the round against the first Wheel security token Chained update rules, The mathematical formula can be expressed as:

[0029] ;

[0030] in, Token pending update Timestamps in milliseconds;

[0031] If the current time The following satisfies , If the maximum security time interval is specified, then the security token is indicated. Expiration is used to prevent the replay of historical tokens;

[0032] The mathematical calculation expression is: The status word Record the number of security token updates, random number Generated by a pseudo-random function generator (PRNG), which is dual-bound to a security token, enhancing... Its non-replayability and non-forgeability.

[0033] Preferably, the specific steps of step S3, server access registration method and security association index trapdoor function, are as follows:

[0034] S3.1 Client Registration Information Initialization: The client uses an independent and unique security access token and hash identification code. Send a registration request to the server. Hash binding is performed with local model parameters to achieve hash identification codes. Uniqueness and collision resistance are determined by the different initial local model parameters for each client. The hash calculation yields the following mathematical formula: ;

[0035] Subsequent The update rule can be formally expressed as follows, and its mathematical calculation expression is: ,in , This represents the local model parameters trained by the client in the l-th global round. This update rule can be viewed as a hash tree of depth L, where L is the total number of global training rounds, and each right leaf node is the hash value of the local model parameters in the current global round.

[0036] S3.2 Server Access Registration: Each client sends its current local registration information to the server. Dynamic access registration is performed. The server initializes the internal database structure and establishes a client information database (CDDB) and a client ciphertext database (CCDB). The CDDB contains a client information table (CIT) and a password matching table (PMT), while the CCDB contains only a client ciphertext table (CCT).

[0037] Server storage client and This is added to the corresponding field of the CIT table in the CDDB database, and based on each client's... Value calculation security password: The server stores the corresponding The original password PW is entered into the table PMT in the CDDB database via a field. By associating the CIT table with the PMT table, we can achieve isolated storage of access data and internal data.

[0038] S3.3, Secure Association Index Trapdoor Function Calculation: To achieve secure storage of ciphertext in the CCT table of the CCDB database, a trapdoor function is used. Generate a secure index key, the original password PW, and combine it with client registration information to construct a related trapdoor index;

[0039] The calculation process is as follows: Let It is a prime number. cyclic group For its generator, randomly select As a trapdoor information Modulus The integer ring, for the input message and random numbers The mathematical expression for the trapdoor function is: ,in Output calculated value ;

[0040] The server uses the client's original password PW as... , As a random number for the trapdoor Using trapdoor functions Generate CCT security keywords table This security trapdoor function constructs a ciphertext storage keyword index, preventing the leakage of client-related registration information and unknown trapdoor information. Under this premise, the original password PW of the keyword can be made unforgeable and uniquely matched, ensuring the high-security storage of encrypted private data.

[0041] Preferably, the specific steps of step S4, client-side local model training and encryption, are as follows:

[0042] S4.1 Local Model Training: All clients execute local model parameters. Training, based on the local training dataset Calculate the Local Stochastic Gradient Descent (SGD) algorithm: ;

[0043] in These are the parameters of the i-th client during the t-th round of local training. It is its local parameter loss function, The learning rate;

[0044] S4.2 Model Contribution Calculation: The model parameters are trained locally on the i-th client. Calculate its contribution value V;

[0045] The calculation principle is as follows: for the test dataset The j-th data sample , For sample data, For sample labels, sample labels It has K categories; each sample data Contains multiple features Therefore Set to include different Let M be a set, and let the m-th characteristic element in M ​​be represented as The set length |M| is the total number of sample features;

[0046] The local model is a mapping function: The output is a K-dimensional probability vector. Indicates parameters The model F is used for the sample The probability of predicting the label as k;

[0047] The objective of calculating the contribution value is to satisfy the following formula:

[0048] ;

[0049] in This represents reference sample data for correctly predicting label categories. Representation of features The marginal contribution increment to the predicted value, then The calculation formula is:

[0050] ;

[0051] Where M represents the total set of features of a sample data, and Q represents the set M excluding the feature elements. A subset formed by the outer elements, satisfying The mathematical formula for Pr(Q) can be expressed as:

[0052] ;

[0053] Pr(Q) represents removing element Q. The probability of combinations of other elements in set M forming subset Q. The mathematical formula can be expressed as:

[0054] ;

[0055] in, Representing characteristic elements The marginal contribution of model F to the predicted probability of the label of the k-th class sample before and after adding set M is considered. Therefore, the above formula can be regarded as calculating the probability of the predicted probability of the k-th class sample over all possible subsets Q. The weighted average of the marginal contributions before and after adding M;

[0056] S4.3, Client-side privacy data encryption: After the client completes local model training, it uses... The parsed key For local model parameters Encryption is performed to obtain ciphertext parameters. The encryption expression is: ;

[0057] Use key Encrypt the contribution value V to obtain the ciphertext contribution value V. enc The encryption expression is: , With V enc Composition of client privacy data tuples ;

[0058] At this point, the client uses the current... and Send a data storage request to the server, and the server will... Recalculate the original password PW and perform a trapdoor function. The server generates a security keyword and a raw password (PW) for matching. If the match is successful, the server returns a response to the client, and the client can then send the privacy data tuple (CP) to the server for storage. Otherwise, the server refuses to receive it.

[0059] Based on the successful client trapdoor function calculation result, the server searches for the corresponding keyword original password PW in the CCT table and stores the CP privacy data in the keyword original password PW field.

[0060] Preferably, the specific steps of step S5, contribution value perception security aggregation, are as follows:

[0061] S5.1 Collaborative Confidential Computation: For each client's privacy data that has been securely stored in table CCT, the server extracts the encrypted model contribution value of each client according to the storage order. This forms a ciphertext list I, whose exemplary expression is: ;

[0062] To achieve the selection of the optimal contribution value in the encrypted state, this collaborative confidentiality calculation mechanism based on the server and the key generation center performs the following operations:

[0063] Step 1: The server needs to calculate and generate a random number R as a mask for each element in I. The mathematical principle for calculating the random number R can be described as follows: Let N be a large prime number that satisfies... , It is also a large prime number. Is the order as The modular multiplicative subgroup of N exists with a unique Cyclic subgroups , for The generator is a random number. , For model Integer ring, and based on subgroups The discrete logarithm problem (DLP) on the right side of the spectrum suffers from the hard assumption that the elements of the subgroup are used as random numbers R, i.e. ;

[0064] The second step involves the server performing a scalar multiplication homomorphic computation on each Paillier encrypted element in the ciphertext list I based on a random number R. That is, for any element in I... ,right The mathematical principle formula for scalar multiplication homomorphic computation can be expressed as: ;

[0065] in This represents the Paillier ciphertext scalar multiplication homomorphic computation. It is the Paillier decryption function. It is an encryption function, where n is the Paillier encryption public parameter, and V is... The corresponding contribution value in plaintext;

[0066] The ciphertext list after calculating the mask of each element in I is: ;

[0067] Third step, the server will send the mask list I mask Send it to a trusted key generation center, which uses a private key that has not been publicly disclosed. Decryption I plain That is, I mask In plaintext, the key generation center cannot know any true contribution value V without disclosing the random number R; it can only judge its magnitude. Therefore, the key generation center selects I... plain The maximum element value is denoted as V max To make the greatest contribution to the plain text;

[0068] Fourth step, the key generation center will In mask list I mask Corresponding element Send to the server;

[0069] S5.2, Global Model Aggregation: Server-side Recalculate scalar homomorphic multiplication The optimal contribution value of the demasked ciphertext is obtained. And through the inverse operation of the trapdoor function. Restore the corresponding client token to verify the model's existence; its mathematical expression is:

[0070] ;

[0071] After the global model existence verification passes, according to Match the corresponding optimal global optimal model parameter ciphertext in the CCT table, denoted as .

[0072] S5.2 Global Model Aggregation: Server-side Recalculate scalar homomorphic multiplication The optimal contribution value of the demasked ciphertext is obtained. And calculate the inverse operation of the trapdoor function. Restore the corresponding client token to verify the model's existence; its mathematical expression is: ;

[0073] After the global model existence verification passes, according to Match the corresponding optimal global optimal model parameter ciphertext in the CCT table, denoted as .

[0074] Preferably, the specific steps of step S6, global model broadcasting and local update, are as follows:

[0075] The server will Its corresponding hash identification code HRC global Broadcast to each client, which uses a symmetric key. right Decrypt to obtain plaintext global model parameters ;

[0076] Client based on To validate the effectiveness of the model;

[0077] If the global model validation performance is lower than the local model validation accuracy by more than a preset threshold, the client will consider it a malicious model and calculate a new hash identifier HRC based on this. * Its mathematical expression is: The server will mark this hash identifier HRC. * In the next round of global training, clients possessing this hash identifier will be prohibited from accessing and storing data.

[0078] If the global model validation performance is better than the local model, the client updates the local model accordingly, while the server clears the CCT table, retaining only the current one. correspond By indexing the original password PW, the first round of global training for this scheme is now complete. Attached Figure Description

[0079] Figure 1 This is a flowchart illustrating the learning method of the present invention;

[0080] Figure 2 This is a performance comparison chart of the method of this invention and five safe federated learning schemes on the MNIST dataset;

[0081] Figure 3 This is a performance comparison chart of the method of this invention and five traditional federated learning methods on the Fashion-MNIST dataset. Detailed Implementation

[0082] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0083] Please see Figures 1-3This invention provides a technical solution: a privacy-preserving method for dynamically searching hybrid encryption and contribution-aware federated learning, aiming to improve the performance of the global model, such as... Figure 1 As shown, the method flow is as follows:

[0084] S1. Federated Learning Initialization: The client initializes the local model parameters based on the local dataset it holds. The model mainly consists of a convolutional neural network with multiple linear and convolutional layers connected together. The client initializes the model based on this and then trains the local model.

[0085] S2. Key Generation Center Distributes Master Key Sets: The key generation center generates the master key required for the hybrid encryption mechanism for each client in the system. Its mathematical expression is:

[0086] ;

[0087] In the master key group middle, This represents the initial value of the access server security token, which is issued only by the key generation center in the first round of global training. In subsequent global training, the client updates the token locally based on the initial value. This represents the symmetric key for the Fernet encryption algorithm; This represents the public key for the Paillier encryption algorithm, and the Paillier private key in this scheme. Independently held by the key generation center;

[0088] S2.2, Local chained update of security access token: The client updates the security access token based on its initial value. To generate more secure and complex security tokens, a local chain-based update is performed. The key derivation function (KDF) used in the update computation employs the verifiable secure key derivation algorithm PBKDF-HMAC, whose mathematical expression is as follows:

[0089] ;

[0090] in, Indicates the global number The original password for the wheel, Indicates the global number The input salt value for the round, this expression is the global first... In the round against the first Wheel security token The chained update rules. The mathematical formula can be expressed as:

[0091] ;

[0092] in, Token pending update The timestamp is in milliseconds; if the current time... The following satisfies , If the maximum security time interval is specified, then the security token is indicated. Expiration is used to prevent the replay of historical tokens; The mathematical calculation expression is The status word Record the number of security token updates, random number Generated by a pseudo-random function generator (PRNG), which is dual-bound to a security token for enhanced security. Its non-replayability and non-forgeability;

[0093] S3. Server Access Registration: The client uses a unique and secure access token and hash identifier. The client sends a registration request to the server. Hash binding is performed with local model parameters to achieve hash identification codes. Uniqueness and collision resistance are determined by the different initial local model parameters for each client. The hash calculation yields the following mathematical formula: The following The update rule can be formally expressed as follows, and its mathematical calculation expression is:

[0094] ;

[0095] in , This represents the local model parameters trained by the client in the global l-th round, i.e., the parameters trained by each client in the global (l+1)-th round in the l-th round. The update calculation, for The update rule can be viewed as a hash tree of depth L, where L is the total number of global training rounds, and each right leaf node is the hash value of the local model parameters under the current global round.

[0096] Each client sends its current local registration information to the server. Dynamic access registration is performed. The server initializes its internal database structure, establishing a Client Information Database (CDDB) and a Client Ciphertext Database (CCDB). The CDDB contains a Client Information Table (CIT) and a Password Matching Table (PMT), while the CCDB contains only the Client Ciphertext Table (CCT). The server stores client information. and This is added to the corresponding field of the CIT table in the CDDB database, and based on each client's... Value calculation security password The server stores the corresponding The original password PW is entered into the table PMT in the database CDDB, using the field... By associating the CIT table with the PMT table, the goal of isolating access data from internal data storage is achieved.

[0097] To securely store ciphertext in the CCT table of the CCDB database, a trapdoor function is used. The original password PW, a secure index key, is generated and combined with client registration information to construct a related trapdoor index. The calculation process is as follows: Let... It is a prime number. cyclic group For its generator, randomly select As a trapdoor information Modulus The integer ring, for the input message and random numbers The mathematical expression for the trapdoor function is:

[0098] ;

[0099] in Output calculated value The server will use the client's original password PW as... , As a random number for the trapdoor Using trapdoor functions Generate CCT security keywords table This security trapdoor function constructs a ciphertext storage keyword index, enabling the leakage of client-related registration information and the inclusion of unknown trapdoor information. Under the premise that the keyword original password PW is unforgeable and uniquely matched, the high-security storage of encrypted privacy data is ensured.

[0100] S4. Client-side local model training and encryption: All clients execute local model parameters. Training, based on the local training dataset Calculate the Local Stochastic Gradient Descent (SGD) algorithm:

[0101] ;

[0102] in These are the parameters of the i-th client during the t-th round of local training. It is its local parameter loss function, The learning rate;

[0103] The model parameters are trained locally on the i-th client. The contribution value V is calculated, and the calculation principle can be described as follows: For the test dataset The j-th data sample , For sample data, For sample labels, sample labels It has K categories;

[0104] Each sample data Contains multiple features Therefore Set to include different Let M be a set, and let the m-th characteristic element in M ​​be represented as Let the set length |M| be the total number of sample features, and let the local model be a mapping function. The output is a K-dimensional probability vector. Indicates parameters The model F is used for the sample The probability of predicting label k is used; therefore, the objective of calculating this contribution value is to satisfy the following formula:

[0105] ;

[0106] in This represents reference sample data for correctly predicting label categories. Representation of features The marginal contribution increment to the predicted value, then The calculation formula is:

[0107] ;

[0108] Where M represents the total set of features of a sample data, and Q represents the set M excluding the feature elements. A subset formed by the outer elements, satisfying The mathematical formula for Pr(Q) can be expressed as:

[0109] ;

[0110] Pr(Q) represents removing element Q. The probability of combinations of other elements in set M forming subset Q. The mathematical formula can be expressed as:

[0111] ;

[0112] Representing characteristic elements The marginal contribution of model F to the predicted probability of the label of the k-th class sample before and after adding set M is considered. Therefore, the above formula can be regarded as calculating the probability of the predicted probability of the k-th class sample label over all possible subsets Q. The weighted average of the marginal contributions before and after adding M;

[0113] After the client completes local model training, use The parsed key For local model parameters Encrypt: Obtain the ciphertext parameters Using a key Encrypt the contribution value V: The ciphertext contribution value V is obtained. enc The two constitute the client-side privacy data tuple. At this point, the client uses the current and Send a data storage request to the server, and the server will... Recalculate the original password PW and perform a trapdoor function. The server generates a security keyword original password (PW) for matching. If a match is found, the server returns a response to the client, allowing the client to send the privacy data tuple (CP) to the server for storage. Otherwise, the server refuses to receive the data. Based on the successful client trapdoor function calculation, the server searches for the corresponding keyword original password (PW) in the table CCT and stores the CP privacy data in the field of the keyword original password (PW).

[0114] S5. Contribution Value-Aware Secure Aggregation: For each client's privacy data that has been securely stored in table CCT, the server extracts the encrypted model contribution value of each client according to the storage order. The ciphertext list I is composed of the following: .

[0115] To achieve the selection of the optimal contribution value in the encrypted state, a collaborative confidentiality calculation mechanism between the server and the key generation center will be used. First, the server needs to calculate and generate a random number R as a mask for each element in I. The mathematical principle for calculating the random number R in this invention can be described as follows: Let N be a large prime number that satisfies... , It is also a large prime number. Is the order as The modular multiplicative subgroup of N exists with a unique Cyclic subgroups , for The generator is a random number. , For model Integer ring, and based on subgroups The discrete logarithm problem (DLP) on the right side of the spectrum suffers from the hard assumption that the elements of the subgroup are used as random numbers R, i.e. ;

[0116] The server performs a scalar multiplication homomorphic computation on each Paillier encrypted element in the ciphertext list I based on a random number R. That is, for any element of I... ,right The mathematical principle formula for scalar multiplication homomorphic computation can be expressed as: ;

[0117] in This represents the Paillier ciphertext scalar multiplication homomorphic computation. It is the Paillier decryption function. This is the encryption function, where n is the Paillier encryption public parameter, and V is the plaintext contribution value. The ciphertext list after masking each element in I is: ;

[0118] Then, the server will send the mask list I mask Send it to a trusted key generation center, which uses a private key that has not been publicly disclosed. Decryption I plain That is, I mask In plaintext, the key generation center cannot know any true contribution value V without disclosing the random number R; it can only judge its magnitude. Therefore, the key generation center selects I... plain The maximum element value is denoted as V max To maximize the contribution to plaintext, the key generation center will finally... In mask list I mask Corresponding element Send to the server;

[0119] server Recalculate scalar homomorphic multiplication The optimal contribution value of the demasked ciphertext is obtained. And calculate the inverse operation of the trapdoor function. Restore the corresponding client token to verify the model's existence; its mathematical expression is:

[0120] ;

[0121] After the global model existence verification passes, according to Match the corresponding optimal global optimal model parameter ciphertext in the CCT table, denoted as ;

[0122] S6, Global Model Broadcast and Local Update: The server will... Its corresponding hash identification code HRC global Broadcast to each client, which uses a symmetric key. right Decrypt to obtain plaintext global model parameters The client is based on The model validity is verified. If the global model verification performance is lower than the local model performance, the client considers it a malicious model and calculates a new hash identifier HRC based on this. * Its mathematical expression is:

[0123] ;

[0124] The server will mark this hash identifier HRC. * In the next round of global training, clients possessing this hash identifier will be prohibited from accessing and storing data.

[0125] If the global model validation performance is better than the local model, the client will update the local model accordingly.

[0126] Finally, the server clears the CCT table, retaining only the current table. correspond By indexing the original password PW, one round of global training for this invention is now complete.

[0127] Example:

[0128] This experiment was conducted on the Ubuntu 22.04 operating system, using an AMD PYC955464-core, 128-thread 3.75GHz CPU, 503GB RAM, and an NVIDIA GeForce RTX 4090 24GB GPU. The code was written in Python 3.10.16, and deep learning training was performed using the PyTorch 2.1.2 framework. The proposed DSHE-TFL method was implemented in this experimental environment, and its global performance was compared with the following five federated learning methods: FedAvg (the classic federated learning model parameter averaging algorithm), PPVFL (an optimization scheme using the Chinese Remainder Theorem in federated learning to use Paillier encryption), LWEFL (the first scheme to use Paillier homomorphic encryption to protect interactive content in federated learning), PPFLHE (an optimization scheme for encryption mechanisms in medical scenarios), and BCHEFL (an optimization scheme using batch encryption).

[0129] In addition, a statistical comparison was made with the practical overhead of five encryption schemes: Paillier-1 is the ordinary Paillier encryption scheme, Paillier-2 is the batch encryption approach of the BCHEFL scheme, CKKS and BFV fully homomorphic encryption schemes, and the domestic commercial cryptography SM4.

[0130] Two sets of image classification experiments demonstrated the superior global performance of the DSHE-TFL proposed in this invention.

[0131] In this embodiment, the experimental datasets are the classic MNIST handwritten digit dataset and the Fashion-MNIST clothing image dataset. Both the MNIST and Fashion-MNIST datasets contain 70,000 handwritten digit image samples, divided into a 60,000 training dataset and a 10,000 test dataset. Each image is... A grayscale image of pixels, containing 10 categories of image labels;

[0132] In this experiment, convolutional neural networks (CNNs) were used for image classification on both the MNIST and Fashion-MNIST datasets. The MNIST model consists of two convolutional-pooling modules and two fully connected layers, and finally outputs the classification probability through Softmax.

[0133] The Fashion-MNIST model structure is similar, except that BatchNorm is introduced after each convolutional layer to improve training stability. The proposed scheme and the above five federated learning schemes were trained on CNN models on the MNIST dataset and the Fashion-MNIST dataset respectively, and the global model performance was compared. The main training parameters are: 20 clients, 10 local training rounds, 50 global training rounds, batch size of training data of 128, stochastic gradient descent algorithm as the training model optimizer, learning rate of 0.01, and cross-entropy function as the loss function.

[0134] like Figure 2 and Figure 3 The results show the trends of global model accuracy of each scheme on the MNIST and Fashion-MNIST (FMNIST) datasets as a function of the number of global iterations. On MNIST, all schemes initially had low accuracy, which gradually improved with iterations. The scheme of this invention showed a significant advantage from the 5th round onwards, eventually stabilizing at close to 100%. In contrast, FedAvg (plaintext interaction) converged to approximately 97.2%.

[0135] PPVFL and LWEFL suffer from parameter precision loss due to homomorphic encryption, resulting in slightly lower initial accuracy, which eventually stabilizes at around 96%. PPFLHE and BCHEFL reach approximately 99% and 98% respectively. On the FM-NIST dataset with higher sample complexity, all schemes exhibit training fluctuations. The scheme of this invention steadily improves after the 10th round, eventually stabilizing at 94% accuracy. FedAvg fluctuates drastically, with an accuracy of only about 89%. Although LWEFL has a similar accuracy of about 90%, its fluctuations are reduced, attributed to the suppression of feature responses by the ciphertext parameters. The average accuracy of PPVFL, PPFLHE, and BCHEFL ranges from 92% to 93%, as shown in Table 1.

[0136] Table 1. Performance comparison of the method of this invention and five federated learning schemes on different datasets.

[0137]

[0138] In the comparative experiments on the MNIST and FMNIST datasets, this invention, by introducing appropriate security computation mechanisms, ensures the security of the federated learning system while maintaining a high global model accuracy, demonstrating that this invention has high stability under multivariate privacy computation constraints.

[0139] This embodiment compares the encryption time overhead of the hybrid encryption mechanism in the proposed DSHE-TFL scheme with the encryption schemes in the above four papers and the domestic asymmetric encryption scheme SM4. Encryption time is monitored under different parameter models. The experimental models include five different parameter models: MNIST-CNN, FMNIST-CNN, ResNet18, MobileNet-V3 and Densenet121.

[0140] Table 2. Comparison of time overhead of the method of the present invention and five federated learning encryption schemes under different models.

[0141]

[0142] As shown in Table 2, in the MNIST-CNN and FMNIST-CNN models, the encryption time of the traditional Paillier scheme (Paillier-1 and Paillier-2) is as high as 28.82s and 160.21s, respectively. Although the batch processing optimization proposed by Paillier-2 significantly reduces the encryption time to 5.72s and 114.21s, it is still far higher than the actual acceptable range.

[0143] In comparison, the CKKS and BFV fully homomorphic encryption schemes achieve millisecond-level overhead (<1s) in both types of C-NN models, and the domestic SM4 encryption scheme also improves upon Paillier-type schemes by nearly 98%.

[0144] This invention employs a hybrid encryption mechanism that exhibits optimal performance across all models: it takes only 0.015s and 0.234s on MNIST-CNN and FMNIST-CNN, respectively, which is 99.95% and 99.74% faster than Paillier-1, and 92.31% and 77.67% faster than SM4, with an overall efficiency improvement of over 95.50%. For large-scale models such as ResNet18, MobileNet-V3, and DenseNet121, the hybrid encryption mechanism in this paper still maintains extremely low overhead (<11.3s), while Paillier-like schemes are not included in the statistics due to their excessively high computational complexity. In this embodiment, the hybrid encryption mechanism of this invention achieves a high degree of compatibility between encryption efficiency and federated learning communication latency while ensuring privacy and security.

[0145] The above specific embodiments further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above are merely specific embodiments of the present invention and do not limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the protection scope of the present invention.

Claims

1. A privacy-preserving method for dynamically searching hybrid encryption and contribution-aware federated learning, characterized in that, Includes the following steps: S1: Federated learning initialization. The client initializes the local model parameters based on the local dataset it holds. The model mainly consists of a convolutional neural network with multiple linear layers and convolutional layers connected. The client initializes the model based on this and then trains the local model. S2: The key generation center allocates a master key group. The key generation center allocates an encrypted master key group to each client. The encrypted master key group contains an independent and unique security token initial value for each client, as well as the same asymmetric encryption public key and symmetric encryption key. The client's security access token is dynamically updated locally according to the chain update rules during subsequent global training, without the need for the key generation center to redistribute it. The asymmetric encryption private key is kept only by the key generation center, and the client selects different encryption schemes based on the differences in local privacy data; S3: Server access registration. The client sends a registration request to the server using independent and unique registration information, which mainly includes the corresponding security access token and hash identification code. The client-side hash identifier is hash-bound to the local model parameters and dynamically updated locally in the form of a hash tree; The server receives the registration information of the corresponding client, generates the corresponding security password based on the security access token, and stores the client registration information and security password in different data tables. The two tables are linked through the client security access token field. Based on each client's registration information, the server calculates an irreversible secure association index key using a trapdoor function. This key is an independent identifier field for storing the client's private data. S4: Local model training and encryption on the client side. The client trains the local model using a local private dataset and calculates the contribution value of the local model based on data features in a random test dataset to evaluate the generalization ability of the local model. To address the data discrepancies between local model parameters and contribution values, the client employs different encryption schemes to encrypt them, resulting in ciphertext privacy data. This ciphertext privacy data includes ciphertext of local model parameters and ciphertext of local model contribution values. The client uploads local private data to the server based on a secure access token for secure indexing and storage; S5: Contribution value-aware secure aggregation. The server performs global representativeness screening on the ciphertext of each client model contribution value stored. Based on the joint confidentiality computation protocol with the key center, the ciphertext is subjected to a decisionable mask using the homomorphic scalar multiplication property of Paillier encryption. The most globally representative model parameters are obtained based on the final determined contribution value ciphertext. S6: Global model broadcasting and local update. The server sends the global model parameters and their corresponding stored hash identification codes to each client. The client decrypts the data and verifies the model's validity. If the global model verification performance is lower than the local model performance, the client will treat it as a malicious model, calculate a new hash identification code based on the global model and return it to the server. The server will mark the hash identification code and prohibit clients with the hash identification code from accessing and storing data in the next round of global training. If the global model validation performance is better than the local model, the client will update the local model accordingly. S7: Repeat S2 to S6 until the global training iterations are completed.

2. The privacy protection method for dynamic search hybrid encryption and contribution value awareness federated learning according to claim 1, characterized in that, The specific steps of step S2, which involves allocating the master key group and updating the local chained rules for the security access token, are as follows: S2.1 Key Generation: The key generation center generates the master key set required for the hybrid encryption mechanism for each client in the system. Its mathematical expression is: ； In the master key group middle, This represents the initial value of the access server security token, which is issued only by the key generation center in the first round of global training. In subsequent global training, the client updates the token locally based on the initial value. This represents the symmetric key for the Fernet encryption algorithm; This represents the public key for the Paillier encryption algorithm, and the Paillier private key in this scheme. Independently held by the key generation center; S2.2, Local chained update of security access token: The client updates the security access token based on its initial value. To generate more secure and complex security tokens, a local chain-based update is performed. The key derivation function (KDF) used in the update computation employs the verifiable secure key derivation algorithm PBKDF-HMAC, whose mathematical expression is as follows: ； in, Indicates the global number The original password for the wheel, Indicates the global number The input salt value for the round, this expression is the global first... In the round against the first Wheel security token Chained update rules, The mathematical formula can be expressed as: ； in, Token pending update Timestamps in milliseconds; If the current time The following satisfies , If the maximum security time interval is specified, then the security token is indicated. Expiration is used to prevent the replay of historical tokens; The mathematical calculation expression is: The status word Record the number of security token updates, random number Generated by a pseudo-random function generator (PRNG), which is dual-bound to a security token, enhancing... Its non-replayability and non-forgeability.

3. The privacy protection method for dynamic search hybrid encryption and contribution value awareness federated learning according to claim 1, characterized in that, The specific steps of the S3 server access registration method and the security association index trapdoor function are as follows: S3.1 Client Registration Information Initialization: The client uses an independent and unique security access token and hash identification code. Send a registration request to the server. Hash binding is performed with local model parameters to achieve hash identification codes. Uniqueness and collision resistance are determined by the different initial local model parameters for each client. The hash calculation yields the following mathematical formula: ; Follow-up The update rule can be formally expressed as follows, and its mathematical calculation expression is: ,in , This represents the local model parameters trained by the client in the l-th global round. This update rule can be viewed as a hash tree of depth L, where L is the total number of global training rounds, and each right leaf node is the hash value of the local model parameters in the current global round. S3.2 Server Access Registration: Each client sends its current local registration information to the server. Dynamic access registration is performed. The server initializes the internal database structure and establishes a client information database (CDDB) and a client ciphertext database (CCDB). The CDDB contains a client information table (CIT) and a password matching table (PMT), while the CCDB contains only a client ciphertext table (CCT). Server storage client and This is added to the corresponding field of the CIT table in the CDDB database, and based on each client's... Value calculation security password: The server stores the corresponding The original password PW is entered into the table PMT in the CDDB database via a field. By associating the CIT table with the PMT table, we can achieve isolated storage of access data and internal data. S3.3, Secure Association Index Trapdoor Function Calculation: To achieve secure storage of ciphertext in the CCT table of the CCDB database, a trapdoor function is used. Generate a secure index key, the original password PW, and combine it with client registration information to construct a related trapdoor index; The calculation process is as follows: Let It is a prime number. cyclic group For its generator, randomly select As a trapdoor information Modulus The integer ring, for the input message and random numbers The mathematical expression for the trapdoor function is: ,in Output calculated value ; The server uses the client's original password PW as... , As a random number for the trapdoor Using trapdoor functions Generate CCT security keywords table This security trapdoor function constructs a ciphertext storage keyword index, preventing the leakage of client-related registration information and unknown trapdoor information. Under this premise, the original password PW of the keyword can be made unforgeable and uniquely matched, ensuring the high-security storage of encrypted private data.

4. The privacy protection method for dynamic search hybrid encryption and contribution value awareness federated learning according to claim 1, characterized in that, The specific steps for client-side local model training and encryption in step S4 are as follows: S4.1 Local Model Training: All clients execute local model parameters. Training, based on the local training dataset Calculate the Local Stochastic Gradient Descent (SGD) algorithm: ; in These are the parameters of the i-th client during the t-th round of local training. It is its local parameter loss function, The learning rate; S4.2 Model Contribution Calculation: The model parameters are trained locally on the i-th client. Calculate its contribution value V; The calculation principle is as follows: for the test dataset The j-th data sample , For sample data, For sample labels, sample labels It has K categories; each sample data Contains multiple features Therefore Set to include different Let M be a set, and let the m-th characteristic element in M ​​be denoted as The set length |M| is the total number of sample features; Let the local model be a mapping function. The output is a K-dimensional probability vector. Indicates parameters The model F is used for the sample The probability of predicting the label as k; The objective of calculating the contribution value is to satisfy the following formula: ； in This represents the reference sample data for correctly predicting the label category. Representation of features The marginal contribution increment to the predicted value, then The calculation formula is: ； Where Q represents set M excluding the characteristic element A subset formed by the outer elements, satisfying The mathematical formula for Pr(Q) can be expressed as: ； Pr(Q) represents removing element Q. The probability of combinations of other elements in set M forming subset Q. The mathematical formula can be expressed as: ； Representing characteristic elements The marginal contribution of model F to the predicted probability of the label of the k-th class sample before and after adding set M is considered. Therefore, the above formula can be regarded as calculating the probability of the predicted probability of the k-th class sample over all possible subsets Q. The weighted average of the marginal contributions before and after adding M; S4.3, Client-side privacy data encryption: After the client completes local model training, it uses... The parsed key For local model parameters Encryption is performed to obtain ciphertext parameters. The encryption expression is: ; Use key Encrypt the contribution value V to obtain the ciphertext contribution value V. enc The encryption expression is: , With V enc Composition of client privacy data tuples ; At this point, the client uses the current... and Send a data storage request to the server, and the server will... Recalculate the original password PW and perform a trapdoor function. The server generates a security keyword and a raw password (PW) for matching. If the match is successful, the server returns a response to the client, and the client can then send the privacy data tuple (CP) to the server for storage. Otherwise, the server refuses to receive it. Based on the successful client trapdoor function calculation result, the server searches for the corresponding keyword original password PW in the CCT table and stores the CP privacy data in the keyword original password PW field.

5. The privacy protection method for dynamic search hybrid encryption and contribution value awareness federated learning according to claim 1, characterized in that, The specific steps of step S5, contribution value-aware security aggregation, are as follows: S5.1 Collaborative Confidential Computation: For each client's privacy data that has been securely stored in table CCT, the server extracts the encrypted model contribution value of each client according to the storage order. This forms a ciphertext list I, whose exemplary expression is: ; To achieve the selection of the optimal contribution value in the encrypted state, this collaborative confidentiality calculation mechanism based on the server and the key generation center performs the following operations: Step 1: The server needs to calculate and generate a random number R as a mask for each element in I. The mathematical principle for calculating the random number R can be described as follows: Let N be a large prime number that satisfies... , It is also a large prime number. Is the order as The modular multiplicative subgroup of N exists with a unique Cyclic subgroups , for The generator is a random number. , For model Integer ring, and based on subgroups The discrete logarithm problem (DLP) on the right side of the spectrum suffers from the hard assumption that the elements of the subgroup are used as random numbers R, i.e. ; The second step involves the server performing a scalar multiplication homomorphic computation on each Paillier encrypted element in the ciphertext list I based on a random number R. That is, for any element in I... ,right The mathematical principle formula for scalar multiplication homomorphic computation can be expressed as: ; in This represents the Paillier ciphertext scalar multiplication homomorphic computation. It is the Paillier decryption function. It is an encryption function, where n is the Paillier encryption public parameter, and V is... The corresponding contribution value in plaintext; The ciphertext list after calculating the mask of each element in I is: ; Third step, the server will send the mask list I mask Send it to a trusted key generation center, which uses a private key that has not been publicly disclosed. Decryption I plain That is, I mask In plaintext, the key generation center cannot know any true contribution value V without disclosing the random number R; it can only judge its magnitude. Therefore, the key generation center selects I... plain The maximum element value is denoted as V max To make the greatest contribution to the plain text; Fourth step, the key generation center will In mask list I mask Corresponding element Send to the server; S5.2, Global Model Aggregation: Server-side Recalculate scalar homomorphic multiplication The optimal contribution value of the demasked ciphertext is obtained. And through the inverse operation of the trapdoor function. Restore the corresponding client token to verify the model's existence; its mathematical expression is: ； After the global model existence verification passes, according to Match the corresponding optimal global optimal model parameter ciphertext in the CCT table, denoted as .

6. The privacy protection method for dynamic search hybrid encryption and contribution-aware federated learning according to claim 1, characterized in that, The specific steps of step S6, global model broadcasting and local update, are as follows: The server will Its corresponding hash identification code HRC global Broadcast to each client, which uses a symmetric key. right Decrypt to obtain plaintext global model parameters ; Client based on To validate the effectiveness of the model; If the global model validation performance is lower than the local model validation accuracy by more than a preset threshold, the client will consider it a malicious model and calculate a new hash identifier HRC based on this. * Its mathematical expression is: The server will mark this hash identifier HRC. * In the next round of global training, clients possessing this hash identifier will be prohibited from accessing and storing data. If the global model validation performance is better than the local model, the client updates the local model accordingly, while the server clears the CCT table, retaining only the current one. correspond By indexing the original password PW, the first round of global training for this scheme is now complete.

Images