A fast Paillier encryption method in federated learning system

Abstract

The invention discloses a fast Paillier encryption method in a federated learning system, comprising: step 1, offline obtaining a secret state zero set by modular exponentiation operation: in the offline stage of the training protocol, each participant of the federated learning system determines the total number of its own encryption tasks according to its corresponding training tasks, and each participant locally uses a public key to generate a number of secret state zeros corresponding to the total number of its own encryption tasks by modular exponentiation operation to form a secret state zero set; step 2, using the secret state zero set obtained offline to encrypt online by modular multiplication operation: in the online stage of the training protocol, each time each participant performs Paillier encryption on plaintext, a secret state zero is randomly selected from the secret state zero set generated by the participant to perform this Paillier encryption operation by modular multiplication operation, and the selected secret state zero is removed from the secret state zero set. The method can reduce the time overhead of encryption operation in the online stage, and effectively improve the operation efficiency of the online stage of the federated learning training protocol.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a fast Paillier encryption method in a federated learning system. Background Art

[0002] In recent years, with the increasingly stringent supervision of personal data privacy, the importance of protecting personal data privacy has been emphasized, and the extensive circulation and sharing of private data has been restricted. Therefore, many traditional applications based on collecting a large amount of user data in cloud computing centers to centrally train machine learning models will be greatly restricted. The data held by various enterprises and institutions will be transformed into data islands, which cannot be circulated between each other, resulting in the inability of big data to fully exert its effectiveness and value. In this context, federated learning technology was born. Federated learning is a new paradigm of distributed machine learning, which trains global machine learning models by exchanging model parameters, gradients or other intermediate calculation values, thereby avoiding direct exchange of private training data between participants. This can not only effectively expand the number of samples and feature dimensions of each participant, improve the performance of each participant's local model, but also protect the data privacy of each participant, truly achieving data availability but not visibility. Furthermore, in order to protect the privacy of intermediate information transmitted during the federated learning training process, such as in horizontal federated learning, model parameters or gradients are transmitted between participants and the central server, and in vertical federated learning, residuals, gradients, Hessian matrices and other information are transmitted between participants, the Paillier homomorphic encryption algorithm is widely used.

[0003] The Paillier encryption algorithm (probabilistic public key encryption algorithm) is an asymmetric encryption algorithm that satisfies the additive homomorphic property. Compared with the traditional public key encryption algorithm, it supports arithmetic operations on the ciphertext domain and ensures that the operation results on the ciphertext domain are the same as the calculation results on the plaintext domain after decryption. Based on this additive homomorphic property, the Paillier encryption algorithm is widely used in many actual federated learning systems to encrypt the intermediate information transmitted in federated learning to prevent the information receiver from inferring private information, further improving the security of the federated learning system and protecting the privacy of training data.

[0004] In the existing benchmark Paillier encryption algorithm, a random number needs to be generated and a modular exponentiation operation needs to be performed for each encryption task. When the number of encryption tasks is small, the encryption time overhead is still acceptable, but for iterative machine learning systems such as federated learning, the number of encryption tasks will continue to increase with the increase in iteration rounds, causing the time overhead of the Paillier encryption algorithm to become a bottleneck for the operating efficiency of the entire federated learning system.

[0005] In view of this, the present invention is proposed. Summary of the invention

[0006] The purpose of the present invention is to provide a fast Paillier encryption method in a federated learning system, which can reduce the encryption operation overhead of the online stage of the training protocol while ensuring the same security as the benchmark Paillier encryption algorithm, improve the operating efficiency of the entire federated learning system, and thus solve the above-mentioned technical problems existing in the prior art.

[0007] The objective of the present invention is achieved through the following technical solutions:

[0008] An embodiment of the present invention provides a fast Paillier encryption method in a federated learning system, comprising:

[0009] Step 1: Obtain a secret state zero set by modular exponentiation offline: In the offline phase of the training protocol before the federated learning system starts model training, each participant of the federated learning system determines the total number of its own encryption tasks according to its own corresponding training tasks. Each participant uses the public key locally to generate a number of secret state zeros corresponding to the total number of its own encryption tasks by modular exponentiation to form a secret state zero set;

[0010] Step 2, use the secret state zero set obtained offline to perform online encryption by modular multiplication operation: each participant starts the online phase of the federated learning training protocol and enters the online phase of the training protocol to perform federated learning training. Each time each participant needs to perform a Paillier encryption operation on the plaintext, it randomly selects a secret state zero from the secret state zero set generated by the participant in step 1 to perform the Paillier encryption operation by modular multiplication, and removes the selected secret state zero from the secret state zero set.

[0011] Compared with the prior art, the fast Paillier encryption method in the federated learning system provided by the present invention has the following beneficial effects:

[0012] Each participant in the federated learning system generates a set of secret zeros corresponding to the total number of encryption tasks by modular exponentiation in the offline phase. When plaintext needs to be encrypted in the online phase, each participant can perform modular multiplication on the ciphertext domain using the secret zeros generated in the offline phase to achieve encryption. Since modular multiplication has a smaller time overhead than large integer modular exponentiation, it avoids the large integer modular exponentiation that is time-consuming in the benchmark Paillier encryption algorithm used by each participant in the online phase, and can reduce the time overhead of encryption operations in the online phase. This method greatly improves the operating efficiency of the online phase of the federated learning training protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0014] Figure 1 A schematic diagram of a flow chart of a fast Paillier encryption method in a federated learning system provided in an embodiment of the present invention.

[0015] Figure 2 A flowchart of offline obtaining a secret state zero set of the fast Paillier encryption method provided in an embodiment of the present invention.

[0016] Figure 3 A schematic diagram showing a comparison of the running time of the same benchmark Paillier encryption algorithm in the online phase of the training protocol in the fast Paillier encryption method provided in an embodiment of the present invention.

[0017] Figure 4 A schematic diagram showing a comparison of the running time of the same benchmark Paillier encryption algorithm in the offline phase of the training protocol in the fast Paillier encryption method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in combination with the specific content of the present invention; it is obvious that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, which does not constitute a limitation of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of the present invention.

[0019] First, the terms that may be used in this article are explained as follows:

[0020] The term “and / or” means that either or both of them can be realized at the same time. For example, X and / or Y means both “X” or “Y” and “X and Y”.

[0021] The terms "include", "comprises", "contains", "has" or other descriptions with similar semantics should be interpreted as non-exclusive inclusion. For example, including certain technical feature elements (such as raw materials, components, ingredients, carriers, dosage forms, materials, dimensions, parts, components, mechanisms, devices, steps, procedures, methods, reaction conditions, processing conditions, parameters, algorithms, signals, data, products or products, etc.) should be interpreted as including not only certain technical feature elements explicitly listed, but also other technical feature elements known in the art that are not explicitly listed.

[0022] The term "consisting of..." means excluding any technical feature elements not explicitly listed. If this term is used in a claim, it will make the claim closed, so that it does not contain technical feature elements other than the technical feature elements explicitly listed, except for the conventional impurities related to them. If this term only appears in a clause of a claim, it only limits the elements explicitly listed in the clause, and the elements recorded in other clauses are not excluded from the overall claim.

[0023] Unless otherwise specified or limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in this article can be understood according to specific circumstances.

[0024] When concentration, temperature, pressure, size or other parameters are expressed in the form of a numerical range, the numerical range should be understood to specifically disclose all ranges formed by the pairing of any upper limit, lower limit, and preferred value in the numerical range, regardless of whether the range is explicitly stated; for example, if a numerical range of "2 to 8" is stated, the numerical range should be interpreted as including ranges such as "2 to 7", "2 to 6", "5 to 7", "3 to 4 and 6 to 7", "3 to 5 and 7", "2 and 5 to 7", etc. Unless otherwise specified, the numerical ranges stated herein include both their end values ​​and all integers and fractions within the numerical range.

[0025] The orientation or position relationship indicated by terms such as "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", etc. are based on the orientation or position relationship shown in the drawings and are only for the convenience and simplification of description, and do not explicitly or implicitly indicate that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation of this document.

[0026] The fast Paillier encryption method in the federated learning system provided by the present invention is described in detail below. The contents not described in detail in the embodiments of the present invention belong to the prior art known to professional and technical personnel in the field. If the specific conditions are not specified in the embodiments of the present invention, they are carried out according to the conventional conditions in the field or the conditions recommended by the manufacturer. The reagents or instruments used in the embodiments of the present invention that do not indicate the manufacturer are all conventional products that can be purchased commercially.

[0027] like Figure 1 As shown, an embodiment of the present invention provides a fast Paillier encryption method in a federated learning system, including:

[0028] Step 1: Obtain a secret state zero set by modular exponentiation offline: In the offline phase of the training protocol before the federated learning system starts model training, each participant of the federated learning system determines the total number of its own encryption tasks according to its own corresponding training tasks. Each participant uses the public key locally to generate a number of secret state zeros corresponding to the total number of its own encryption tasks by modular exponentiation to form a secret state zero set;

[0029] Step 2, use the secret state zero set obtained offline to perform online encryption by modular multiplication operation: each participant starts the online phase of the federated learning training protocol and enters the online phase of the training protocol to perform federated learning training. Each time each participant needs to perform a Paillier encryption operation on the plaintext, it randomly selects a secret state zero from the secret state zero set generated by the participant in step 1 to perform the Paillier encryption operation by modular multiplication, and removes the selected secret state zero from the secret state zero set.

[0030] like Figure 2 As shown, in the above step 1, each participant of the federated learning system determines the total number of its own encryption tasks according to its own corresponding training tasks in the following manner, and each participant locally uses the public key to generate a number of secret zeros corresponding to the total number of its own encryption tasks to form a secret zero set, including:

[0031] Step 11, determine the total number of encryption tasks for the training protocol: each participant in the federated learning system determines the total number of encryption tasks that it needs to perform during the entire training protocol operation according to the selected machine learning model;

[0032] Step 12, generate and obtain the public key: the party with the private key first randomly selects two prime numbers p and q of the same length and no less than 512 bits, and calculates n = pq. Then let g = n + 1, Then the public key generated by the participant with the private key is (n,g), and the private key is (λ,μ); other participants in the federated learning system request the public key of the participant with the private key;

[0033] Step 13, generate secret zeros: After each participant in the federated learning system obtains the public key, it generates a corresponding number of secret zeros by encrypting the obtained public key according to the total number of encryption tasks determined by each participant, and combines all the generated secret zeros into a secret zero set.

[0034] In step 11 above, if the two parties are participating in the longitudinal logistic regression model, the party with the public key follows the formula The total number of encryption tasks of the party with the public key is calculated, where m is the feature dimension of the party with the public key; b is the size of the small batch data set; E is the number of iterations; and D is the total number of training set samples. The party with the private key calculates the total number of encryption tasks of the party with the private key according to formula 4ED, where E is the number of iterations; and D is the total number of training set samples.

[0035] If two parties participate in the longitudinal neural network model, the party with the public key follows the formula Calculate the total number of encryption tasks for the party with the public key. In the formula, z is the model output dimension of the party with the public key; E is the number of iterations; D is the total number of training set samples; b is the size of the small batch data set; then the party with the private key uses the formula Calculate the total number of encryption tasks. In the formula, is the number of model parameters; E is the number of iterations; D is the total number of training set samples; b is the size of the small batch data set.

[0036] In the above step 13, a corresponding number of secret zeros are generated by encrypting the obtained public key in the following manner, and all the generated secret zeros are combined into a secret zero set, including:

[0037] Method 1: Use the base Paillier encryption algorithm to generate a secret zero for each encryption task using the obtained public key, and combine all the generated secret zeros into a secret zero set;

[0038] Method 2: Determine the predetermined number of encryption tasks according to the total number of encryption tasks, use the benchmark Paillier encryption algorithm to generate a secret zero for each encryption task of the predetermined number of encryption tasks by encrypting the obtained public key, use the generated secret zeros to randomly combine to obtain all the required secret zeros, and combine all the generated secret zeros into a secret zero set. By generating a small batch of secret zeros in the offline stage and then randomly combining them, the running time of the offline stage can be further shortened.

[0039] In the first method of step 13, a secret zero is generated for each encryption task by encrypting the obtained public key using the base Paillier encryption algorithm in the following manner, and all the generated secret zeros are combined into a secret zero set, including:

[0040] Randomly select N random integers r1, r2, ..., r according to the total number of encryption tasks N And ensure 0 <r i <n,i=1,2,…,N;

[0041] The party with the private key uses each random integer r i Use the base Paillier encryption algorithm to encrypt the integer 0 with the obtained public key, that is, Generate dense zero;

[0042] The party with the private key will form all the generated secret zeros into a secret zero set S = { <0> 1, <0> 2,…, <0> N}.

[0043] In the second method of the above step 13, the predetermined number of encryption tasks is determined according to the total number of encryption tasks in the following manner, a base Paillier encryption algorithm is used to generate a secret state zero for each encryption task of the predetermined number of encryption tasks by encrypting the obtained public key, the generated secret state zeros are randomly combined to obtain all the required secret state zeros, and all the generated secret state zeros are combined into a secret state zero set, including:

[0044] If the total number of encryption tasks is N, the formula Calculate the predetermined number of encryption tasks m;

[0045] According to the predetermined number of encryption tasks m, m random integers r1, r2, ..., r are randomly selected. m And also ensure 0 <r i <n,i=1,2,…,m,r i is an integer;

[0046] The party with the private key uses m random integers to generate a corresponding number of secret zeros, and the generated secret zeros are combined into a secret zero subset T = { <0> 1, <0> 2,…, <0> m},in

[0047] The party with the private key calculates all 2 |T| -1 non-empty subset, denoted as For every non-empty subset The party with the private key multiplies all the elements in the non-empty subset and obtains from According to the total number of encryption tasks, N values ​​are randomly selected to form a secret state zero set S = {, 0>1,, 0>2,…, <0> N}.

[0048] In summary, the fast Paillier encryption method for the federated learning system of the embodiment of the present invention generates secret zeros in the offline stage. When the plaintext needs to be encrypted in the online stage, the secret zeros generated in the offline stage are used to perform addition operations on the ciphertext domain, thereby avoiding the secret zeros required for encryption in the previous online stage being obtained by the large integer modular exponentiation operation that is time-consuming in the online stage execution of the benchmark Paillier encryption algorithm, and can reduce the time overhead of encryption operations in the online stage. This method greatly improves the operating efficiency of the online stage of the federated learning training protocol.

[0049] In order to more clearly demonstrate the technical solution and technical effects provided by the present invention, the fast Paillier encryption method for a federated learning system provided by an embodiment of the present invention is described in detail below with reference to a specific embodiment.

[0050] Example 1

[0051] like Figure 1 As shown, an embodiment of the present invention provides a fast Paillier encryption method in a federated learning system, which can be divided into two steps: an offline training protocol phase and an online training protocol phase. Without loss of generality, it is assumed that the private key owner (i.e., the participant who owns the private key) in the federated learning system is called Bob, and the public key owner (i.e., the participant who owns the public key) is called Alice.

[0052] Step 1, training protocol offline phase: Before the federated learning system starts model training, that is, in the training protocol offline phase, each participant determines the total number of encryption tasks based on the specific training task, and uses the public key to complete the generation of the corresponding number of encrypted zeros locally. More specifically, this phase can be divided into the following three sub-steps (see Figure 2 ):

[0053] Step 11, determine the total number of encryption tasks for the training protocol: Each participant in the federated learning system determines the total number of encryption tasks that it needs to perform during the entire training protocol according to the selected machine learning model; let the total number of training set samples be D, the number of iterations be E, and the size of the small batch data set be b; then in the longitudinal logistic regression model involving two participants, let the feature dimension of the public key party be m, then the total number of encryption tasks of the public key party is The total number of encryption tasks of the private key party is 4ED; for example, in the longitudinal neural network model involving two participants, let the model output dimension of the public key party be z and the model parameter be Then the total number of encryption tasks of the public key party is The total number of encryption tasks of the private key party is

[0054] Step 12, generate and obtain the public key: As in the traditional Paillier encryption system, Bob first randomly selects two prime numbers p and q of the same length and no less than 512 bits, and calculates n = pq. Then let g = n + 1, Then the public key generated by Bob is (n,g) and the private key is (λ,μ). Other participants in the federated learning system, such as Alice, request Bob's public key.

[0055] Step 13, generate secret zeros: After each participant in the federated learning system obtains the public key (i.e., the Paillier public key), it generates a corresponding number of secret zeros according to the total number of encryption tasks of the training protocol determined by it. Without loss of generality, assume that the total number of encryption tasks that Bob needs to perform during the entire training protocol is N, and he can use the following two methods to generate N secret zeros:

[0056] Method 1: For each encryption task, a secret zero is generated using the base Paillier encryption algorithm.

[0057] Specifically: Bob randomly selects N random integers r1, r2, ..., r N And ensure 0 <r i <n,i=1,2,…,N,r i is an integer. Then for every random integer r i , Bob encrypts the integer 0 using the base Paillier encryption algorithm, i.e.

[0058] Bob groups all the secret zeros into a set S = { <0> 1, <0> 2,…, <0> N}, used by the online phase of the training protocol.

[0059] Method 2: First use the baseline Paillier encryption algorithm to generate a small batch of secret zeros and then randomly combine them.

[0060] In this second method, Bob does not use the base Paillier encryption algorithm to generate a secret state zero for each encryption task, but first calculates as the predetermined quantity that needs to be generated;

[0061] Then randomly select m random integers r1, r2, ..., r m And also ensure 0 <r i <n,i=1,2,…,m;

[0062] Then Bob uses m random integers to generate a small batch of dense zero sets T = { <0> 1, <0> 2,…, <0> m},in Then Bob calculates all 2 |T| -1 non-empty subset, denoted by For every non-empty subset Bob multiplies all the elements in the subset together and gets Finally, Bob N values ​​are randomly selected from the dense zero set S, which is used in the online phase of the training protocol.

[0063] Step 2, online phase of training protocol: After each participant in the federated learning system generates the required number of secret zeros in the offline phase, each participant starts the online phase of the federated learning training protocol; without loss of generality, assuming that participant Bob needs to perform an encryption operation on the plaintext x in the online phase of the training protocol, he randomly selects an element s from the secret zero set S calculated in the offline phase j , calculate Enc(x)=s j g x modn 2 =s j (nx+1)modn 2 , then update the set S = S-{s j In this way, the computationally time-consuming large integer modular exponentiation operation in the original baseline Paillier encryption algorithm is replaced by a computationally efficient modular multiplication operation, thereby reducing the computational time overhead of the encryption task during the online training phase.

[0064] The above method can be verified to be consistent with the existing Paillier encryption method in the following way. According to the decryption formula in the traditional Paillier encryption system Where c represents the ciphertext, function Then for plaintext x:

[0065] (a) Randomly select an element from the dense zero set S generated by method 1, denoted as but Substituting into the decryption formula, we get

[0066] in It is based on Carmichael's theorem. The decryption result proves the correctness of the Paillier encryption of the secret state zero of the secret state zero set generated by method 1 in step 13.

[0067] (b) Randomly select an element from the dense zero set S generated by method 2, without loss of generality, denoted as but Similarly, substituting the ciphertext c into the decryption formula yields Using Carmichael's theorem, we can get The decryption result also proves the correctness of the Paillier encryption of the secret state zero of the secret state zero set generated by method 2 in step 13.

[0068] The fast Paillier encryption method in the federated learning system proposed in this invention is compared with the computational time overhead of the existing benchmark Paillier encryption algorithm in the online phase of the training protocol. Figure 3 The test environment is macOS Monterey 12.2.1 operating system, 1.4GHz quad-core Intel Core i5 CPU, and 8G memory. Figure 3 The horizontal axis in the middle is the total number of encryption tasks that need to be performed in the online phase of the federated learning training protocol, which is divided into four groups, namely (4K, 8K, 16K, 32K); the vertical axis is the running time of the two encryption algorithms, which is obtained by taking the average of three running times. It can be seen that the fast Paillier encryption algorithm is significantly faster than the baseline Paillier encryption algorithm in encryption tasks of four different scales, with running times increased by 49.2 times, 46.6 times, 51.3 times and 46.9 times respectively, which fully verifies its effectiveness. At the same time, Figure 4 The comparison of the running time of two schemes for generating secret zero states adopted by the fast Paillier encryption algorithm in the offline phase of the training protocol is also shown. The horizontal axis also represents the total number of encryption tasks required to be performed by the federated learning training protocol, which is also divided into four groups, namely (4K, 8K, 16K, 32K). The vertical axis represents the time consumed by the two schemes for generating secret zero states, which is obtained by taking the average of three times. It can be seen that in the four groups of encryption tasks of different sizes, the running time of method 2 is increased by 38.8 times, 51.1 times, 61.5 times and 67.7 times compared with method 1. At the same time, it can be found that as the scale of encryption tasks continues to increase, the computational efficiency of method 2 will be further expanded, thereby further reducing the running time of the fast Paillier encryption algorithm in the offline phase of the training protocol.

[0069] Example 2

[0070] See also Figure 1 , 2 , taking the two-party vertical federated learning system as an example, assuming that the participant Bob in the system has a private key and a public key, and the participant Alice only has a public key, then the specific implementation of the fast Paillier encryption algorithm is as follows:

[0071] Step 1, offline phase of training protocol:

[0072] Step 11, determine the total number of encryption tasks for the training protocol: Bob considers the selected machine learning model, the number of samples and feature dimensions of the local dataset, the number of iterations, and the size of the small batch dataset, and finally determines the total number of encryption tasks N=7 that he needs to perform during the entire training protocol.

[0073] Step 12, generate the public key: Bob randomly selects prime numbers p=13 and q=17, and calculates n=13×17=221. μ=192 -1 mod221=160, and set g=221+1=222 and λ=192. Then the public key obtained by Bob is (221, 222) and the private key is (192, 160).

[0074] Step 13, generate secret zero: After determining that there are 7 encryption tasks in total, Bob can generate 7 secret zeros in the following two ways:

[0075] (a) For each encryption task, a secret state zero is generated using the base Paillier encryption algorithm. Bob randomly selects seven random integers, r1 = 156, r2 = 127, r3 = 102, r4 = 50, r5 = 178, r6 = 121, and r7 = 182. Then Bob calculates <0> 1=222 0 ×156 221 mod221 2 =23829, similarly, we can calculate <0> 2=3358, <0> 3=36992, <0> 4=17050, <0> 5=23299, <0> 6=15740, <0> 7=26364, and finally we can get the offline stage dense state zero set S={23829,3358,36992,17050,23299,15740,26364} for use in the online stage.

[0076] (b) Generate a small batch of dense states and then combine them randomly. Bob first calculates Then, three random integers are randomly selected, namely r1=139, r2=160, and r3=164. Then, Bob calculates the small batch secret state zero set T={222 0 ×139 221 mod221 2 , 222 0 ×160 221 mod221 2 , 222 0 ×164 221 mod221 2}={42903,45991,9901}. Then Bob calculates all 2 3 -1 = 7 non-empty subsets, namely T1 = {42903}, T2 = {45991}, T3 = {9901}, T4 = {42903, 45991}, T5 = {42903, 9901}, T6 = {45991, 9901}, T7 = {42903, 45991, 9901}. Taking subset T7 as an example, calculate s7 = 42903 × 45991 × 9901 mod 221 2 =44466. Similarly, we can get s1=42903, s2=45991, s3=9901, s4=24314, s5=12426, s6=12248 respectively. Finally, Bob can get the offline stage dense state zero set S={42903, 45991, 9901, 24314, 12426, 12248, 44466} for use in the online stage.

[0077] Step 2, online training protocol phase: The plaintext set that Bob needs to encrypt in the entire federated learning training protocol is X = {11, 12, 13, 14, 15, 16, 17}. Taking encryption X3 = 13 as an example, Bob randomly selects s2 = 3358 from the secret state zero set generated by Scheme 1 and calculates Enc(13) = 3358 × (1 + 13 × 221) mod 221 2 =29215; Similarly, Bob can also choose to randomly select s6=12248 from the dense zero set generated by Scheme 2 and calculate Enc(13)=12248×(1+13×221)mod221 2 =35232.

[0078] The correctness of the above embodiment is verified by the following method: For the ciphertext Enc(13)=29215 obtained by randomly selecting s2=3358 from method 1, the traditional Paillier decryption formula can be used to calculate Similarly, for the ciphertext Enc(13)=35232 obtained by randomly selecting s6=12248 from method 2, the traditional Paillier decryption formula can also be used to calculate This shows that the fast Paillier encryption algorithm is correct.

[0079] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed in the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims. The information disclosed in the background technology section of this article is only intended to deepen the understanding of the overall background technology of the present invention, and should not be regarded as an admission or in any form that the information constitutes prior art known to those skilled in the art.

Claims

1. A fast Paillier encryption method in a federated learning system, characterized in that: include: Step 1: Obtain a secret state zero set by modular exponentiation offline: In the offline phase of the training protocol before the federated learning system starts model training, each participant of the federated learning system determines the total number of its own encryption tasks according to its own corresponding training tasks. Each participant uses the public key locally to generate a number of secret state zeros corresponding to the total number of its own encryption tasks by modular exponentiation to form a secret state zero set; Step 2, use the secret state zero set obtained offline to perform online encryption by modular multiplication operation: each participant starts the online phase of the federated learning training protocol and enters the online phase of the training protocol to perform federated learning training. Each time each participant needs to perform a Paillier encryption operation on the plaintext, it randomly selects a secret state zero from the secret state zero set generated by the participant in step 1 to perform the Paillier encryption operation by modular multiplication, and removes the selected secret state zero from the secret state zero set.

2. The fast Paillier encryption method in the federated learning system according to claim 1, characterized in that: In step 1, each participant of the federated learning system determines the total number of its own encryption tasks according to its own corresponding training tasks in the following manner, and each participant locally uses the public key to generate a number of secret zeros corresponding to the total number of its own encryption tasks to form a secret zero set, including: Step 11, determine the total number of encryption tasks for the training protocol: each participant in the federated learning system determines the total number of encryption tasks that it needs to perform during the entire training protocol operation according to the selected machine learning model; Step 12, generate and obtain the public key: the party with the private key first randomly selects two prime numbers p and q of the same length and no less than 512 bits, and calculates n = pq. Then let g = n + 1, Then the public key generated by the participant with the private key is (n,g), and the private key is (λ,μ); other participants in the federated learning system request the public key of the participant with the private key; Step 13, generate secret zeros: After each participant in the federated learning system obtains the public key, it generates a corresponding number of secret zeros by encrypting the obtained public key according to the total number of encryption tasks determined by each participant, and combines all the generated secret zeros into a secret zero set.

3. The fast Paillier encryption method in the federated learning system according to claim 2, characterized in that: In step 11, if the two participants are participating in the longitudinal logistic regression model, the participant with the public key follows the formula The total number of encryption tasks of the party with the public key is calculated, where m is the feature dimension of the party with the public key; b is the size of the small batch data set; E is the number of iterations; and D is the total number of training set samples. The party with the private key calculates the total number of encryption tasks of the party with the private key according to formula 4ED, where E is the number of iterations; and D is the total number of training set samples. If two parties participate in the longitudinal neural network model, the party with the public key follows the formula Calculate the total number of encryption tasks for the party with the public key. In the formula, z is the model output dimension of the party with the public key; E is the number of iterations; D is the total number of training set samples; b is the size of the small batch data set; then the party with the private key uses the formula Calculate the total number of encryption tasks. In the formula, is the number of model parameters; E is the number of iterations; D is the total number of training set samples; b is the size of the small batch data set.

4. The fast Paillier encryption method in the federated learning system according to claim 2 or 3, characterized in that: In step 13, a corresponding number of secret zeros are generated by encrypting the acquired public key in the following manner, and all the generated secret zeros are combined into a secret zero set, including: Method 1: Use the base Paillier encryption algorithm to generate a secret zero for each encryption task using the obtained public key, and combine all the generated secret zeros into a secret zero set; Method 2: Determine a predetermined number of encryption tasks based on the total number of encryption tasks, use the benchmark Paillier encryption algorithm to generate a secret zero for each encryption task of the predetermined number of encryption tasks by encrypting the obtained public key, use the generated secret zeros to randomly combine the required all secret zeros, and combine all the generated secret zeros into a secret zero set.

5. The fast Paillier encryption method in the federated learning system according to claim 4, characterized in that: In the first mode of step 13, a secret zero is generated for each encryption task by encrypting it with the obtained public key using the base Paillier encryption algorithm in the following manner, and all the generated secret zeros are combined into a secret zero set, including: Randomly select N random integers r1, r2, ..., r according to the total number of encryption tasks N And ensure 0 <r i <n,i=1,2,…,N,r i is an integer; The party with the private key uses each random integer r i Use the base Paillier encryption algorithm to encrypt the integer 0 with the obtained public key to generate a secret zero; The party with the private key will form all the generated secret zeros into a secret zero set S = { <0> 1, <0> 2,…, <0> N }.

6. The fast Paillier encryption method in the federated learning system according to claim 4, characterized in that: In the second mode of step 13, the predetermined number of encryption tasks is determined according to the total number of encryption tasks in the following manner, a base Paillier encryption algorithm is used to generate a secret state zero for each encryption task of the predetermined number of encryption tasks by encrypting the obtained public key, the generated secret state zeros are randomly combined to obtain all the required secret state zeros, and all the generated secret state zeros are combined into a secret state zero set, including: If the total number of encryption tasks is N, the formula Calculate the predetermined number of encryption tasks m; According to the predetermined number of encryption tasks m, m random integers r1, r2, ..., r are randomly selected. m And also ensure 0 <r i <n,i=1,2,…,m; The party with the private key uses m random integers to generate a corresponding number of secret zeros, and the generated secret zeros are combined into a secret zero subset T = { <0> 1, <0> 2,…, <0> m },in The party with the private key calculates all 2 |T| -1 non-empty subset, denoted as For every non-empty subset The party with the private key multiplies all the elements in the non-empty subset and obtains from According to the total number of encryption tasks N, N values ​​are randomly selected to form a secret state zero set S = { <0> 1, <0> 2,…, <0> N }.

Images