Client apparatus, server apparatus, parameter concealing system, parameter concealing method, and parameter concealing program

Abstract

To prevent a global model from being disclosed to an integration server in combination learning using multi-key homomorphic encryption.SOLUTION: A client apparatus 200 included in a parameter concealing system 90 that executes combination learning using multi-key homomorphic encryption includes an information processing unit 210. The information processing unit 210 generates parameter ciphertexts from parameters of a local model, generates partial decrypted texts from an integrated parameter ciphertext generated by integrating the parameter ciphertexts by homomorphic operations, and generates encrypted partial decrypted texts from the partial decrypted texts. Further, the information processing unit 210 generates an aggregated partial decrypted text from an encrypted aggregated partial decrypted text generated by integrating the encrypted partial decrypted texts by homomorphic operations, and decrypts parameters of a global model on the basis of the aggregated partial decrypted text and the integrated parameter ciphertext.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a client device, a server device, a parameter concealment system, a parameter concealment method, and a parameter concealment program. [Background technology]

[0002] Homomorphic encryption is an encryption method that allows operations such as addition and multiplication to be performed on encrypted data without decryption. Here, a method that generates a separate key for each client is called multi-key homomorphic encryption.

[0003] Federated learning is a method for training machine learning models. In federated learning, multiple clients each train a machine learning model using their own training data to generate a local model. An integrated server then integrates the local models sent from each client to generate a global model. Federated learning makes it possible to train a model without directly sharing the data used for training from each client. However, federated learning presents a challenge in that the local models, which are the intellectual property of each client, are disclosed to the integrated server. Another challenge is the risk of leakage due to eavesdropping when the local models are transmitted.

[0004] Non-Patent Document 1 proposes a method called xMK-CKKS as a federated learning method, which encrypts each client's local model using multi-key homomorphic encryption to prevent the local model from leaking to the integrated server, other clients, etc. The following describes the processing of xMK-CKKS. First, each client generates a public key and a private key for multi-key homomorphic encryption. Then, an aggregate public key is generated by adding together the public keys of each client. Each client then trains a local model using the training data in its local environment. Each client then encrypts its local model using the aggregate public key and sends the encrypted local model to the integration server. The integration server then performs a model integration process, where the integration server uses homomorphic operations to sum up the encrypted local models of each client to generate an encrypted global model. The integration server then sends the encrypted global model to each client. Next, each client generates a partial decryption using the encrypted global model sent from the integrated server and the private key of each client, and sends the generated partial decryption to the integrated server. The integration server then decodes the global model by adding together the partial decodes sent by each client. The integration server then sends the global model to each client. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Ma, Jing, et al., “PRIVACY-PRESERVING FEDERATED LEARNING BASED ON MULTI-KEY HOMOMORPHIC ENCRYPTION”, April 2021 Summary of the Invention [Problem to be solved by the invention]

[0006] According to the technology disclosed in Non-Patent Document 1, the use of multi-key homomorphic encryption has succeeded in preventing the local model from being leaked to the integrated server and other clients. However, in this technique, the integration server holds the partial decryption necessary for decrypting the global model, and therefore, this technique has a problem in that the global model is disclosed to the integration server.

[0007] The present disclosure aims to prevent the global model from being disclosed to an integrated server in federated learning using multi-key homomorphic encryption. [Means for solving the problem]

[0008] The client device according to the present disclosure comprises: A client device included in a parameter concealment system that performs federated learning using multi-key homomorphic encryption, generating a parameter ciphertext by encrypting parameters of the local model using homomorphic encryption; generating a partially decrypted text by partially decrypting at least a part of an integrated parameter ciphertext generated by integrating the parameter ciphertexts generated by each client device included in the parameter concealment system using a homomorphic operation, and encrypting the partially decrypted text by using the homomorphic encryption, generating an encrypted partially decrypted text; an information processing unit that generates an aggregated partial decrypted text by decrypting, using homomorphic encryption, an encrypted aggregated partial decrypted text that has been generated by integrating, by homomorphic operation, the encrypted partial decrypted texts generated by each client device included in the parameter concealment system, and decrypts parameters of a global model based on the aggregated partial decrypted text and the integrated parameter ciphertext; Equipped with. [Effects of the Invention]

[0009] According to the present disclosure, a client device included in a parameter concealment system that performs federated learning using multi-key homomorphic encryption partially decrypts at least a portion of an integrated parameter ciphertext using homomorphic encryption to generate a partial decrypted text, encrypts the partial decrypted text using homomorphic encryption to generate an encrypted partial decrypted text, and discloses the encrypted partial decrypted text to an integrated server. Therefore, according to the present disclosure, the global model is not disclosed to the integrated server. Therefore, according to the present disclosure, in federated learning using multi-key homomorphic encryption, it is possible to prevent the global model from being disclosed to the integrated server. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of a parameter concealment system 90 according to the first embodiment. [Figure 2] FIG. 2 is a diagram for explaining an outline of processing by the parameter concealment system 90 according to the first embodiment. [Figure 3] FIG. 2 is a diagram for explaining an outline of processing by the parameter concealment system 90 according to the first embodiment. [Figure 4] FIG. 2 is a diagram showing an example of the hardware configuration of a server device 100 according to the first embodiment. [Figure 5] 4 is a flowchart showing the operation of the parameter concealment system 90 according to the first embodiment. [Figure 6] FIG. 3 is a diagram for explaining the operation of the parameter concealment system 90 according to the first embodiment. [Figure 7] FIG. 3 is a diagram for explaining the operation of the parameter concealment system 90 according to the first embodiment. [Figure 8] FIG. 3 is a diagram for explaining the operation of the parameter concealment system 90 according to the first embodiment. [Figure 9] FIG. 3 is a diagram for explaining the operation of the parameter concealment system 90 according to the first embodiment. [Figure 10] FIG. 3 is a diagram for explaining the operation of the parameter concealment system 90 according to the first embodiment. [Figure 11] FIG. 3 is a diagram for explaining the operation of the parameter concealment system 90 according to the first embodiment. [Figure 12] FIG. 3 is a diagram for explaining the operation of the parameter concealment system 90 according to the first embodiment. [Figure 13] FIG. 3 is a diagram for explaining the operation of the parameter concealment system 90 according to the first embodiment. [Figure 14] FIG. 3 is a diagram for explaining the operation of the parameter concealment system 90 according to the first embodiment. [Figure 15]FIG. 10 is a diagram showing an example of a hardware configuration of a server device 100 according to a modification of the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] In the description of the embodiments and the drawings, the same elements and corresponding elements are given the same reference numerals. The description of elements given the same reference numerals will be omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, "unit" may be read as "circuit," "step," "procedure," "process," or "circuitry" as appropriate.

[0012] Embodiment 1 Hereinafter, this embodiment will be described in detail with reference to the drawings.

[0013] ***Configuration Description*** 1 shows an example of the configuration of a parameter concealment system 90 according to this embodiment. The parameter concealment system 90 performs federated learning using multi-key homomorphic encryption. The federated learning may be xMK-CKKS as described in Non-Patent Document 1. The parameter concealment system 90 includes a server device 100 and a plurality of client devices 200. The server device 100 and each client device 200 are communicatively connected. Note that the numbers assigned to each client device in the drawings are identifiers for each client device. N is an integer of 2 or greater.

[0014] The server device 100 is also called an integrated server, and includes an information processing unit 110 . The information processing unit 110 generates an integrated parameter ciphertext by integrating, using homomorphic operations, the parameter ciphertexts generated by each client device 200 included in the parameter concealment system 90. The information processing unit 110 also generates an encrypted aggregate partial decrypted text by integrating, using homomorphic operations, the encrypted partial decrypted texts generated by each client device 200. The parameter ciphertext is obtained by encrypting parameters of a local model using homomorphic encryption. The encrypted partial decrypted text is obtained by encrypting the partial decrypted text using homomorphic encryption. The partial decrypted text is obtained by partially decrypting at least a part of the integrated parameter ciphertext using homomorphic encryption.

[0015] The following describes the processing of the information processing unit 110 when the parameter concealment system 90 executes xMK-CKKS as federated learning. In this case, the parameter ciphertext consists of a first component and a second component. The first component is a component based on the aggregate public key, local model parameters, and random numbers. The second component is a component based on public parameters and random numbers. The aggregate public key is an aggregate of the public keys of the multi-key homomorphic encryption in each client device 200. The information processing unit 110 generates a first integrated component by integrating, through a homomorphic operation, the first components generated by each client device 200. The information processing unit 110 also generates a second integrated component by integrating, through a homomorphic operation, the second components generated by each client device 200. Here, the integrated parameter ciphertext consists of the first integrated component and the second integrated component.

[0016] The client device 200 is also simply called a client, and includes an information processing unit 210 . The information processing unit 210 generates a parameter ciphertext by encrypting parameters of the local model using homomorphic encryption. The information processing unit 210 then generates a partial decrypted text by partially decrypting at least a portion of the integrated parameter ciphertext using homomorphic encryption, and generates an encrypted partial decrypted text by encrypting the partial decrypted text using homomorphic encryption. The information processing unit 210 then generates an aggregated partial decrypted text by decrypting the encrypted aggregated partial decrypted text using homomorphic encryption, and decrypts parameters of the global model based on the aggregated partial decrypted text and the integrated parameter ciphertext. The integrated parameter ciphertext is generated by integrating, in the server device 100, the parameter ciphertexts generated by each client device 200 included in the parameter concealment system 90 using homomorphic operations. The encrypted aggregated partial decrypted text is generated by integrating, in the server device 100, the encrypted partial decrypted texts generated by each client device 200 using homomorphic operations.

[0017] The following describes the processing of the information processing unit 210 when the parameter concealment system 90 executes xMK-CKKS as federated learning. First, the information processing unit 210 shares a public key and a private key of the single-key homomorphic encryption with each client device 200. Then, the information processing unit 210 generates a parameter ciphertext by encrypting parameters of the local model using the aggregate public key. Then, the information processing unit 210 generates a partial decrypted text by partially decrypting a part of the integrated parameter ciphertext using the private key of the multi-key homomorphic encryption. Then, the information processing unit 210 generates an encrypted partial decrypted text by encrypting the partial decrypted text using the public key of the single-key homomorphic encryption. Then, the information processing unit 210 generates an aggregate partial decrypted text by decrypting the encrypted aggregate partial decrypted text using the private key of the single-key homomorphic encryption. The parameter ciphertext may be composed of a first component based on the aggregate public key, local model parameters, and random numbers, and a second component based on public parameters and random numbers. Furthermore, the integrated parameter ciphertext may be composed of a first integrated component and a second integrated component. The first integrated component is generated by integrating the first components generated by each client device 200 through a homomorphic operation. The second integrated component is generated by integrating the second components generated by each client device 200 through a homomorphic operation. At this time, the information processing unit 210 generates a partially decrypted text by partially decrypting the second integrated component using a private key for multi-key homomorphic encryption. Furthermore, the information processing unit 210 decrypts the global model parameters using the aggregate partially decrypted text and the first integrated component.

[0018] FIG. 2 is a diagram for explaining an outline of the processing of the parameter concealment system 90 in comparison with the prior art. In the prior art, an integrated server executes the partial decoding process and the model decoding process. On the other hand, in the parameter concealment system 90, the processing performed by the integrated server in the conventional technology is divided into processing performed by the server device 100 and processing performed by the client device 200. Specifically, in the parameter concealment system 90, the global model is not disclosed to the server device 100 by performing partial decryption using homomorphic operations. Furthermore, in the parameter concealment system 90, in order to reduce the number of times homomorphic operations are performed, the decryption process is divided into a process on the server device 100 side and a process on the client device 200 side by appropriately decomposing the mathematical formula for the decryption process according to the conventional technology. Here, the entire process is divided into two stages: an aggregation process of partial decryption in the server device 100 (a process performed by homomorphic operations) and a decryption process in the client device 200 (a process performed using plaintext). In other words, the entire process is not performed by homomorphic operations.

[0019] FIG. 3 is a diagram illustrating an outline of the processing of the parameter concealment system 90. As shown in FIG. In the parameter concealment system 90, the partial decryption is encrypted by homomorphic encryption, so that the data for decrypting the global model is not disclosed to the server device 100. Here, the aggregation of the partial decryption is performed by homomorphic operations. Furthermore, while the decryption process is executed on the integrated server in the conventional technology, the parameter concealment system 90 performs the decryption process on the client device 200, thereby reducing the number of homomorphic operations on the server device 100.

[0020] 4 shows an example of the hardware configuration of the server device 100 according to this embodiment. The server device 100 is made up of a computer. The server device 100 may be made up of multiple computers.

[0021] As shown in the figure, the server device 100 is a computer that includes hardware such as a processor 11, a memory 12, an auxiliary storage device 13, an input / output IF (Interface) 14, and a communication device 15. These pieces of hardware are appropriately connected via signal lines 19.

[0022] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of the computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). The server device 100 may include a plurality of processors that take the place of the processor 11. The plurality of processors share the role of the processor 11.

[0023] The memory 12 is typically a volatile storage device, specifically a random access memory (RAM). The memory 12 is also called a primary storage device or a main memory. Data stored in the memory 12 is saved in the secondary storage device 13 as needed.

[0024] The auxiliary storage device 13 is typically a non-volatile storage device, and specific examples thereof include a ROM (Read Only Memory), an HDD (Hard Disk Drive), or a flash memory. Data stored in the auxiliary storage device 13 is loaded into the memory 12 as needed. The memory 12 and the auxiliary storage device 13 may be integrated into one unit.

[0025] The input / output IF 14 is a port to which an input device and an output device are connected. A specific example of the input / output IF 14 is a USB (Universal Serial Bus) terminal. Specific examples of the input device are a keyboard and a mouse. A specific example of the output device is a display.

[0026] The communication device 15 is a receiver and a transmitter, and is specifically a communication chip or a network interface card (NIC).

[0027] Each unit of the server device 100 may use the input / output IF 14 and the communication device 15 as appropriate when communicating with other devices.

[0028] The auxiliary storage device 13 stores a parameter concealment program. The parameter concealment program is a program that causes a computer to realize the functions of each unit included in the server device 100. The parameter concealment program is loaded into the memory 12 and executed by the processor 11. The functions of each unit included in the server device 100 are realized by software.

[0029] Data used when executing the parameter concealment program and data obtained by executing the parameter concealment program are stored in a storage device as appropriate. Each unit of the server device 100 uses a storage device as appropriate. Specific examples of the storage device include at least one of the memory 12, the auxiliary storage device 13, a register in the processor 11, and a cache memory in the processor 11. Note that the terms "data" and "information" may have the same meaning. The storage device may be independent of the computer. The functions of the memory 12 and the auxiliary storage device 13 may be realized by other storage devices.

[0030] The parameter concealment program may be recorded on a computer-readable nonvolatile recording medium. Specific examples of the nonvolatile recording medium include an optical disk and a flash memory. The parameter concealment program may be provided as a program product. The hardware configuration of the client device 200 is the same as the hardware configuration of the server device 100 .

[0031] ***Explanation of Operation*** The operation procedure of each device included in the parameter concealment system 90 corresponds to a parameter concealment method, and the program that realizes the operation of each device included in the parameter concealment system 90 corresponds to a parameter concealment program.

[0032] 5 is a flowchart showing an example of the operation of the parameter concealment system 90. The operation will be described with reference to FIG.

[0033] (Step S1: Multi-key homomorphic encryption key generation process) 6 is a diagram for explaining the processing of this step. The processing of this step corresponds to part of (0) in FIG. The information processing unit 210 of each client device 200 generates a public key bi and a private key si for multi-key homomorphic encryption based on the public parameter a. A specific example of the multi-key homomorphic encryption is MK-CKKS. The information processing unit 210 of each client device 200 generates an aggregate public key b* by adding together the public keys b i generated by all the other client devices 200. Here, b* represents the aggregate public key. Note that b*=b 1 +...+b N. N represents the total number of client devices 200 included in the parameter concealment system 90.

[0034] (Step S2: Single-key homomorphic encryption key sharing process) 7 is a diagram for explaining the processing of this step. The processing of this step corresponds to part of (0) in FIG. The information processing unit 210 of each client device 200 shares a public key and a private key of the single-key homomorphic encryption (CKKS), that is, a single-key public key p and a single-key private key q.

[0035] (Step S3: Local model learning process) 8 is a diagram for explaining the processing of this step. The processing of this step corresponds to (1) in FIG. The information processing unit 210 of each client device 200 generates model parameters wi (i∈{1, ..., N}) by learning a local model, where wi is a weight parameter of the local model in each client device 200. Note that when the local model is a neural network or the like, wi represents a set of multiple parameters.

[0036] (Step S4: Local model encryption and transmission process) 9 is a diagram for explaining the processing of this step, which corresponds to (2) in FIG. The information processing unit 210 of each client device 200 generates ciphertext ci by encrypting the model parameters using the aggregate public key b*, and transmits the generated ciphertext ci to the server device 100. Because the model parameters are encrypted with the aggregate public key b* by the processing of this step, the parameters of the local model will not be leaked between the client devices 200. The ciphertext ci is obtained by encrypting the weight parameters of the local model in each client device 200 using the aggregate public key b*. The ciphertext ci corresponds to a parameter ciphertext. Here, the ciphertext ci is a vector consisting of two components, such as ci = (ci_0, ci_1). Each of ci_0 and ci_1 is as shown in [Equation 1]. Here, mi is a message (model parameter). Each of vi, ei_0, and ei_1 is a random number. a is a public parameter. Note that in this specification, the equations disclosed in Non-Patent Document 1 have been appropriately simplified. ci_0 corresponds to the first component. ci_1 corresponds to the second component.

[0037] [Formula 1] ci_0=vi·b*+mi+ei_0 ci_1=vi·a+ei_1

[0038] (Step S5: Model integration processing) 10 is a diagram for explaining the processing of this step, which corresponds to (3) in FIG. The information processing unit 110 of the server device 100 integrates the model parameters transmitted from each client device 200. Note that the local model of each client device 200 is encrypted with the public key b*. Therefore, the server device 100 generates Csum by integrating the model parameters, i.e., calculating the sum of the model parameters, using a homomorphic operation. Here, Csum is the encrypted global model parameter w, i.e., the encrypted global parameter. w and Csum are each as shown in [Equation 2]. Csum corresponds to the integrated parameter ciphertext. Csum_0 corresponds to the first integrated component. Csum_1 corresponds to the second integrated component.

[0039] [Formula 2] w=w1+…+wN Csum=(Csum_0,Csum_1)=(Σci_0,Σci_1)

[0040] (Step S6: Partial Decryption Calculation Processing) 11 is a diagram for explaining the processing of this step, which corresponds to (4) and (5) in FIG. The information processing unit 110 of the server device 100 transmits Csum to each client device 200. The information processing unit 210 of the client device 200i calculates partial decryption Di based on Csum_1, generates E(Di) by encrypting Di using the single-key public key p, and transmits E(Di) to the server device 100. Here, Di is as shown in [Equation 3]. ei* is a random number. E(Di) is the partial decryption Di encrypted using the single-key public key p. The partial decryption Di corresponds to the partially decrypted text. E(Di) corresponds to the encrypted partially decrypted text.

[0041] [Formula 3] Di=si·Csum_1+ei*

[0042] (Step S7: Partial Decoding Aggregation Processing) 12 is a diagram for explaining the processing of this step, which corresponds to (6) and (7) in FIG. As shown in [Formula 4], the information processing unit 110 of the server device 100 calculates E(D) by adding up E(D1), ..., E(DN) transmitted from each client device 200 using homomorphic operations. The information processing unit 110 of the server device 100 transmits E(D) to each client device 200. Here, the process shown in [Formula 4] corresponds to the process of aggregating partial decryptions. E(D) corresponds to the encrypted aggregated partially decrypted text. D corresponds to the aggregated partially decrypted text.

[0043] [Formula 4] E(D1)+…+E(DN)=E(D1+…+DN)=E(D)

[0044] (Step S8: E(D) Decryption Process) 13 is a diagram for explaining the processing of this step, which corresponds to (8) in FIG. The information processing unit 210 of each client device 200 generates D by decrypting E(D) transmitted from the server device 100 using the single-key private key q.

[0045] (Step S9: Global model decoding process) 14 is a diagram for explaining the processing of this step, which corresponds to (9) in FIG. The information processing unit 210 of each client device 200 decodes the global parameter w by adding the decoded D and Csum_0 as shown in [Formula 5]. The processing in this step corresponds to the processing of decoding the global model using aggregated partial decoding.

[0046] [Formula 5] w=w1+…+wN=D1+…+DN+Csum_0=D+Csum_0

[0047] ***Explanation of the effect of the first embodiment*** As described above, in this embodiment, client device 200 encrypts partial decryption. Furthermore, server device 100 performs aggregation of multi-key homomorphic encryption using homomorphic operations. Therefore, according to this embodiment, federated learning can be performed without disclosing the global model to server device 100. Furthermore, in this embodiment, unlike the conventional technology in which all data to be decrypted is encrypted using homomorphic encryption, only the portion containing the private key information of the client device 200 is encrypted using homomorphic encryption. Therefore, according to this embodiment, the number of operations using homomorphic encryption is reduced compared to the conventional technology. Here, operations using homomorphic encryption are slower than operations using plaintext. Therefore, according to this embodiment, federated learning using multi-key homomorphic encryption can be performed faster than the conventional technology.

[0048] ***Other Configurations*** <Variation 1> FIG. 15 shows an example of the hardware configuration of the server device 100 according to this modification. The server device 100 includes a processing circuit 18 in place of the processor 11, the processor 11 and memory 12, the processor 11 and auxiliary storage device 13, or the processor 11, memory 12, and auxiliary storage device 13. The processing circuitry 18 is hardware that realizes at least some of the components of the server device 100. The processing circuitry 18 may be dedicated hardware or may be a processor that executes a program stored in the memory 12 .

[0049] When processing circuitry 18 is dedicated hardware, processing circuitry 18 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The server device 100 may include a plurality of processing circuits that replace the processing circuit 18. The plurality of processing circuits share the role of the processing circuit 18.

[0050] In the server device 100, some of the functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0051] Processing circuitry 18 is illustratively implemented in hardware, software, firmware, or a combination thereof. The processor 11, memory 12, auxiliary storage device 13, and processing circuit 18 are collectively referred to as "processing circuitry." In other words, the functions of the functional components of the server device 100 are realized by the processing circuitry. The hardware configuration example of the client device 200 may be the same as that of this modified example.

[0052] ***Other embodiments*** Although the first embodiment has been described, it is also possible to combine multiple parts of this embodiment. Alternatively, it is also possible to implement this embodiment in part. In addition, this embodiment may be modified in various ways as needed, and may be implemented in any combination, either as a whole or in part. The above-described embodiments are essentially preferred examples and are not intended to limit the scope of the present disclosure, its applications, and uses. The procedures described using flowcharts and the like may be modified as appropriate.

[0053] Various aspects of the present disclosure are summarized below as appendices.

[0054] (Appendix 1) A client device included in a parameter concealment system that performs federated learning using multi-key homomorphic encryption, generating a parameter ciphertext by encrypting parameters of the local model using homomorphic encryption; generating a partially decrypted text by partially decrypting at least a part of an integrated parameter ciphertext generated by integrating the parameter ciphertexts generated by each client device included in the parameter concealment system using a homomorphic operation, and encrypting the partially decrypted text by using the homomorphic encryption, generating an encrypted partially decrypted text; an information processing unit that generates an aggregated partial decrypted text by decrypting, using homomorphic encryption, an encrypted aggregated partial decrypted text that has been generated by integrating, by homomorphic operation, the encrypted partial decrypted texts generated by each client device included in the parameter concealment system, and decrypts parameters of a global model based on the aggregated partial decrypted text and the integrated parameter ciphertext; A client device comprising:

[0055] (Appendix 2) the parameter concealment system executes xMK-CKKS as the federated learning, The information processing unit a public key and a private key of a single-key homomorphic encryption system are shared between the parameter concealment system and each of the client devices; generating the parameter ciphertext by encrypting the parameters of the local model using an aggregate public key obtained by aggregating public keys of the multi-key homomorphic encryption in each client device included in the parameter concealment system; generating the partially decrypted text by partially decrypting a portion of the integrated parameter ciphertext using a private key of the multi-key homomorphic encryption; generating the encrypted partial decrypted text by encrypting the partial decrypted text using a public key of the single-key homomorphic encryption; 2. The client device of claim 1, wherein the client device generates the aggregated partial decrypted text by decrypting the encrypted aggregated partial decrypted text using a private key of the single-key homomorphic encryption.

[0056] (Appendix 3) the parameter ciphertext comprises a first component based on the aggregate public key, a parameter of the local model, and a random number, and a second component based on a public parameter and a random number; the integrated parameter ciphertext comprises a first integrated component generated by integrating, through a homomorphic operation, the first components generated by each of the client devices included in the parameter concealment system, and a second integrated component generated by integrating, through a homomorphic operation, the second components generated by each of the client devices included in the parameter concealment system, The information processing unit generating the partially decrypted text by partially decrypting the second integrated component using a private key of the multi-key homomorphic encryption; 3. The client device of claim 2, wherein the client device decodes parameters of the global model using the aggregated partially decrypted text and the first integrated component.

[0057] (Appendix 4) A server device included in a parameter concealment system that performs federated learning using multi-key homomorphic encryption, generating an integrated parameter ciphertext by integrating, by a homomorphic operation, parameter ciphertexts generated by encrypting parameters of a local model using homomorphic encryption, by each client device included in the parameter concealment system; an information processing unit that generates an encrypted aggregate partial decrypted text by integrating, by homomorphic operation, a partial decrypted text generated by partially decrypting at least a part of the integrated parameter ciphertext using homomorphic encryption and an encrypted partial decrypted text generated by encrypting using homomorphic encryption, by each client device included in the parameter concealment system; A server device comprising:

[0058] (Appendix 5) the parameter concealment system executes xMK-CKKS as the federated learning, the parameter ciphertext comprises an aggregate public key obtained by aggregating public keys of the multi-key homomorphic encryption in each client device included in the parameter concealment system, a first component based on parameters of the local model and a random number, and a second component based on public parameters and a random number; the information processing unit generates a first integrated component by integrating, through a homomorphic operation, the first components generated by each of the client devices included in the parameter concealment system, and generates a second integrated component by integrating, through a homomorphic operation, the second components generated by each of the client devices included in the parameter concealment system, 5. The server device according to claim 4, wherein the integrated parameter ciphertext is composed of the first integrated component and the second integrated component.

[0059] (Appendix 6) A parameter concealment system comprising a plurality of client devices according to any one of Supplementary Notes 1 to 3, and a server device according to Supplementary Note 4 or 5. [Explanation of symbols]

[0060] 11 processor, 12 memory, 13 auxiliary storage device, 14 input / output IF, 15 communication device, 18 processing circuit, 19 signal line, 90 parameter concealment system, 100 server device, 110 information processing unit, 200 client device, 210 information processing unit.

Claims

1. A client device included in a parameter concealment system that performs federated learning using multi-key homomorphic encryption, generating a parameter ciphertext by encrypting parameters of the local model using homomorphic encryption; generating a partially decrypted text by partially decrypting at least a part of an integrated parameter ciphertext generated by integrating the parameter ciphertexts generated by each client device included in the parameter concealment system using a homomorphic operation, and encrypting the partially decrypted text by using the homomorphic encryption, generating an encrypted partially decrypted text; an information processing unit that generates an aggregated partial decrypted text by decrypting, using homomorphic encryption, an encrypted aggregated partial decrypted text that has been generated by integrating, by homomorphic operation, the encrypted partial decrypted texts generated by each client device included in the parameter concealment system, and decrypts parameters of a global model based on the aggregated partial decrypted text and the integrated parameter ciphertext; A client device comprising:

2. the parameter concealment system executes xMK-CKKS as the federated learning, The information processing unit a public key and a private key of a single-key homomorphic encryption system are shared between the parameter concealment system and each of the client devices; generating the parameter ciphertext by encrypting the parameters of the local model using an aggregate public key obtained by aggregating public keys of the multi-key homomorphic encryption in each client device included in the parameter concealment system; generating the partially decrypted text by partially decrypting a portion of the integrated parameter ciphertext using a private key of the multi-key homomorphic encryption; generating the encrypted partial decrypted text by encrypting the partial decrypted text using a public key of the single-key homomorphic encryption; The client device of claim 1 , wherein the aggregate partial decrypted text is generated by decrypting the encrypted aggregate partial decrypted text using a private key of the single-key homomorphic encryption.

3. the parameter ciphertext comprises a first component based on the aggregate public key, parameters of the local model, and a random number, and a second component based on public parameters and a random number; the integrated parameter ciphertext comprises a first integrated component generated by integrating, through a homomorphic operation, the first components generated by each of the client devices included in the parameter concealment system, and a second integrated component generated by integrating, through a homomorphic operation, the second components generated by each of the client devices included in the parameter concealment system, The information processing unit generating the partially decrypted text by partially decrypting the second integrated component using a private key of the multi-key homomorphic encryption; The client device of claim 2 , wherein the aggregated partial decrypted sentence and the first integrated component are used to decode parameters of the global model.

4. A server device included in a parameter concealment system that performs federated learning using multi-key homomorphic encryption, generating an integrated parameter ciphertext by integrating, by a homomorphic operation, parameter ciphertexts generated by encrypting parameters of a local model using homomorphic encryption, by each client device included in the parameter concealment system; an information processing unit that generates an encrypted aggregate partial decrypted text by integrating, by homomorphic operation, a partial decrypted text generated by partially decrypting at least a part of the integrated parameter ciphertext using homomorphic encryption and an encrypted partial decrypted text generated by encrypting using homomorphic encryption, by each client device included in the parameter concealment system; A server device comprising:

5. the parameter concealment system executes xMK-CKKS as the federated learning, the parameter ciphertext comprises an aggregate public key obtained by aggregating public keys of the multi-key homomorphic encryption in each client device included in the parameter concealment system, a first component based on parameters of the local model and a random number, and a second component based on public parameters and a random number; the information processing unit generates a first integrated component by integrating, through a homomorphic operation, the first components generated by each of the client devices included in the parameter concealment system, and generates a second integrated component by integrating, through a homomorphic operation, the second components generated by each of the client devices included in the parameter concealment system, The server device according to claim 4 , wherein the integrated parameter ciphertext is made up of the first integrated component and the second integrated component.

6. A parameter concealment system comprising a plurality of client devices according to claim 1 and a server device according to claim 4.

7. A client device is a computer included in a parameter concealment system that performs federated learning using multi-key homomorphic encryption, generating a parameter ciphertext by encrypting parameters of the local model using homomorphic encryption; generating a partially decrypted text by partially decrypting at least a part of an integrated parameter ciphertext generated by integrating the parameter ciphertexts generated by each client device included in the parameter concealment system using a homomorphic operation, and encrypting the partially decrypted text by using the homomorphic encryption, generating an encrypted partially decrypted text; a parameter concealment method that generates an aggregated partial decrypted text by decrypting, using homomorphic encryption, an encrypted aggregated partial decrypted text that is generated by integrating the encrypted partial decrypted texts generated by each client device provided in the parameter concealment system using a homomorphic operation, and decrypts parameters of a global model based on the aggregated partial decrypted text and the integrated parameter ciphertext.

8. A server device, which is a computer included in a parameter concealment system that performs federated learning using multi-key homomorphic encryption, generating an integrated parameter ciphertext by integrating, by a homomorphic operation, parameter ciphertexts generated by encrypting parameters of a local model using homomorphic encryption, by each client device included in the parameter concealment system; A parameter concealment method in which each client device included in the parameter concealment system generates an encrypted aggregate partial decrypted text by integrating, using homomorphic operations, a partial decrypted text generated by partially decrypting at least a portion of the integrated parameter ciphertext using homomorphic encryption, and then encrypting the partial decrypted text using homomorphic encryption.

9. A parameter concealment program executed by a client device, which is a computer included in a parameter concealment system that performs federated learning using multi-key homomorphic encryption, comprising: generating a parameter ciphertext by encrypting parameters of the local model using homomorphic encryption; generating a partially decrypted text by partially decrypting at least a part of an integrated parameter ciphertext generated by integrating the parameter ciphertexts generated by each client device included in the parameter concealment system using a homomorphic operation, and encrypting the partially decrypted text by using the homomorphic encryption, generating an encrypted partially decrypted text; an information process for generating an aggregated partial decrypted text by decrypting, using homomorphic encryption, an encrypted aggregated partial decrypted text generated by integrating the encrypted partial decrypted texts generated by each client device included in the parameter concealment system using a homomorphic operation, and decrypting parameters of a global model based on the aggregated partial decrypted text and the integrated parameter ciphertext. a parameter concealment program that causes the client device to execute the above;

10. A parameter concealment program executed by a server device, which is a computer included in a parameter concealment system that performs federated learning using multi-key homomorphic encryption, comprising: generating an integrated parameter ciphertext by integrating, by a homomorphic operation, parameter ciphertexts generated by encrypting parameters of a local model using homomorphic encryption, by each client device included in the parameter concealment system; an information processing in which each client device included in the parameter concealment system generates an encrypted aggregate partial decrypted text by integrating, by homomorphic operation, a partial decrypted text generated by partially decrypting at least a part of the integrated parameter ciphertext using homomorphic encryption, and an encrypted partial decrypted text generated by encrypting using homomorphic encryption. a parameter concealment program that causes the server device to execute the above;

Images