A federated learning user identity continuous authentication method based on model matching

Abstract

The present application relates to the field of identity authentication of federated learning, and provides a user identity continuous authentication scheme based on model matching. In the traditional federated learning architecture, the identity verification of each edge user by the central server depends on the network security transmission protocol and system access identity authentication, which lacks effective defense means when facing attacks on the client and transmission process. The present scheme measures the matching degree between the edge models uploaded by the edge users in the continuous two training of federated learning to continuously authenticate the user identity, and is divided into three parts: edge user-central server model parameter interaction, edge model feature extraction and user identity authentication. The central server uses the characteristic that the decision boundary of the model trained with the same data set has high dependence, collects the model feature reflecting the private data set by collecting the gradient of the decision boundary of the edge model, and then inputs the encoder based on contrast learning to calculate the matching degree between the models and exclude the identity abnormal users. The present scheme is widely applicable to various federated learning systems based on neural networks, and has high accuracy, practicability and compatibility.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of security authentication of federated learning, and in particular to a user identity continuous authentication method based on the matching degree between edge models before and after each round of iteration in federated learning training of edge users. BACKGROUND

[0002] With the development and application of machine learning technology, neural networks, as the most advanced branch of machine learning, have been commercialized by Internet companies and applied to all aspects of people's life. The complexity of learning tasks faced by neural networks has led Internet companies to face the dilemma of insufficient data and poor data quality when training models. This has led us to urgently need a machine learning mechanism that supports multi-party collaborative training, which not only solves the problem of data acquisition and circulation but also protects the privacy rights of data owners, i.e. federated learning.

[0003] In federated learning, multiple edge users (mobile device owners or organizations and enterprises) train edge models on their own edge devices based on the data they have. The central server collects edge models and coordinates to integrate a central model trained by multiple parties. Compared with traditional neural network training frameworks, federated learning does not involve data flow, only model parameter transmission, effectively reducing data privacy leakage.

[0004] However, this distributed machine learning framework of federated learning faces many security threats, the most important of which is the identity authentication of edge users participating in the calculation. The current common federated learning architecture mainly relies on the system identity access mechanism of the client and the network security transmission protocol of the transmission end for the identity authentication of edge users, i.e. edge users need to provide identity information and password to enter the federated learning system, and then complete the public and private key docking through HTTPS, FTP, SSH, etc. Transmission protocol for model parameter transmission. This setting transfers all security obligations to edge users participating in federated learning. Once the account password, key, session key of the edge user is cracked, the attacker can easily replace the original edge user. Attackers who join federated learning can obtain benefits and hinder the training process of federated learning through the three most common attack means of model parameter stealing, model pollution, and backdoor implantation. Therefore, in order to ensure the security of the federated learning architecture, it should have the ability of continuous user identity authentication based on user behavior.

[0005] In recent years, some studies on the influence of training data on the change of model parameters in the centralized training process of neural networks show that the hidden implicit features in the model parameters can reflect the information of the data set. Since the data is not circulated in the federated learning scenario, it is feasible to authenticate the user identity by matching the features of the uploaded model of each edge user. However, how to extract implicit features from the uploaded model parameters and how to analyze the implicit features to obtain the matching degree are still unclear. There is no similar patent to the invention at home and abroad. SUMMARY

[0006] The present application provides a user identity continuous authentication method based on the model matching degree of edge users before and after each iteration in federated learning training, aiming at the deficiency of the user identity authentication mechanism in the existing framework of federated learning. In view of the defect that the user identity authentication in the traditional federated learning framework relies too much on the external architecture such as system identity access mechanism and network security transmission protocol, the federated learning central server can continuously authenticate the user identity in each training through the behavior of edge users, i.e. the data uploaded by edge users.

[0007] The present application is realized by the following technical solutions:

[0008] A federated learning user identity continuous authentication method based on model matching, characterized by comprising:

[0009] Central server-edge user model parameter upload and delivery stage: edge user uploads edge model and central server delivers central model;

[0010] Edge model feature extraction stage: feature extraction is performed on each round of edge model collected by extraction algorithm;

[0011] User identity authentication stage: the matching degree of the edge model in the current round and the edge model in the previous round is the index for identity authentication of the edge user.

[0012] Further, the central server-edge user model parameter upload and delivery stage: in the initial round t0, the central server should deliver the randomly initialized central model parameters G 0 to each edge user {u1, u2, …, u N}. In the subsequent training rounds t i , each edge user u j should upload the entire parameters of the edge model The central server aggregates all edge models to obtain the central model G i of the current training round t i and then delivers the model parameter update to each edge user.

[0013] Further, the edge model feature extraction module extracts features from each edge model uploaded by each edge user in each training round of federated learning. For each edge model, first, the decision boundary points are generated by screening a uniformly dispersed data subset from the central server test set, and then the gradient of the edge model at each decision boundary point is calculated and singular value dimensionality reduction is performed.

[0014] Further, the method for screening a uniformly dispersed data subset is as follows: if a uniformly dispersed data subset of size N is to be divided from the central server test data set, first, the output vector of the test data set in the edge model is extracted, and the K-means clustering algorithm is used on the output vector until n classes are divided, and a data point is randomly sampled from each class to form a data subset of size N.

[0015] The output vector of the data set in the edge model refers to the combination of the vector of each data point in the data set at the output layer of the edge model.

[0016] Further, the method for generating decision boundary points selects two data points (X i i and X i j) belonging to different classes from the uniformly dispersed data subset, and uses the bisection method to find a real number λ in the interval [0, 1] that satisfies λ * x j i + (1 - λ) * x -6 is a data point with a distance from the model decision boundary less than 1e

[0017] The distance of the decision boundary point from the decision boundary should be less than 1e -6 , i.e., the decision boundary point should satisfy where is the edge model of edge user j in round i, represents the predicted label of the model on the data point, and argmax1(·) refers to the maximum value in each dimension of the input vector, and argmax2(·) refers to the second largest value in each dimension.

[0018] Further, the gradient of the edge model at the decision boundary point is calculated on the generated decision boundary point, and the gradient vector is

[0019]

[0020] where is the edge model uploaded by edge user j in training round i, is the preliminary feature of the model, is the decision boundary point of the model.

[0021] ​​Further, the gradient vector is singular value reduced. First, singular value decomposition is performed to obtain singular values, left singular vectors and right singular vectors. The head singular values accounting for 95% of the total sum are arranged in descending order of singular values, and the left singular vectors corresponding to the head singular values are retained as the singular value reduced result.

[0022] Further, the feature vectors of the edge models in each round are input into the user identity authentication module to complete identity authentication determination. The module uses the feature vectors of the edge models in the previous training round and the positive counterpart feature vectors obtained by multi-view enhancement as the training set, trains a model feature encoder for each edge user using contrastive learning, and submits the model feature encoder to the user identity discriminator to determine the identity according to the matching degree of the edge model in the current round and the edge model in the previous round.

[0023] wherein the multi-view feature vector enhancement refers to inputting the feature vector Z of the central server test data set on the edge model, and for each data point x in the test set, finding the k nearest data points to x in Z in Euclidean distance to form a candidate point set and using the non-replacement grabbing method to split the candidate point set into k uniformly distributed data subsets of size N and repeat the decision boundary point generation algorithm to calculate the new edge model gradient and perform singular value reduction.

[0024] Further, the model feature encoder is trained using contrastive learning. The features of the edge model L j and the positive counterpart generated based on the features are projected onto the same face of the low-dimensional hypersphere; the features of the remaining edge models and the positive counterparts generated based on the features are collectively referred to as the negative counterpart features of the edge model L j , and are projected onto the opposite face of the hypersphere. The parameter update of the edge model in the federated learning training round is:

[0025]

[0026] wherein, is the matching degree of the edge model in the current round and the edge model in the previous round.

[0027] Further, the matching degree output by the encoder corresponding to the edge user is input into the user identity discriminator to output a determination result. If the matching degree is greater than a threshold t, it is determined that the user identity is normal; if the matching degree is less than the threshold t, it is determined that the user identity is abnormal, and the central model update parameters are stopped from being issued to the user in this round and the edge model parameters uploaded by the user are stopped from being received in future rounds.

[0028] Wherein, the threshold value t should be, the matching degree from the same user in the previous round is simulated as mu1, the matching degree from different users is simulated as mu2, and the intersection value t of the two Gaussian distributions is used as the discrimination threshold value of whether to pass the identity authentication.

[0029] Compared with the prior art, the present application has the following advantages:

[0030] The present application effectively prevents an attacker from impersonating an edge user to join federated learning in any iteration (i.e., except the first time) after the training begins. When performing user identity authentication, the case where an edge user in the initial round of federated learning is impersonated by an attacker is not considered. On the one hand, in the entire information interaction process of federated learning between edge users and the server, the attacker maintains a consistent identity throughout the training process, and from the perspective of the server, it does not belong to the impersonated attacker. On the other hand, the possibility of user impersonation in the initial round of federated learning is relatively small, and the initial round is relatively close in time to the system access identity confirmation and the establishment of the encrypted communication channel, and potential attackers often lack the ability to hinder normal communication within a short period of time. Further, the present solution can resist the free-rider attack, model pollution attack, and backdoor injection attack implemented by the attacker after joining the federated learning, which are the most common attack methods in the three federated learning frameworks. Among them, the free-rider attack refers to an attacker who obtains the central model issued by the central server without paying any training cost; the model pollution attack refers to an attacker who invades the training process and uploads specific update parameters to the central server to hinder the convergence of the federated learning model or reduce the model accuracy; and the backdoor injection attack refers to an attacker who invades the training process and uploads model update parameters with a backdoor vulnerability to the central server, so that the aggregated central model hides a vulnerability known only to the attacker. BRIEF DESCRIPTION OF DRAWINGS

[0031] Other features, objects, and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments, read in conjunction with the accompanying drawings:

[0032] Figure 1 Flowchart of the federated learning user identity continuous authentication method embodiment based on model matching of the present application.

[0033] Figure 2 Schematic diagram of the edge model feature screening stage in the federated learning user identity continuous authentication method based on model matching of the present application.

[0034] Figure 3 Block schematic diagram of the user identity authentication stage in the federated learning user identity continuous authentication method based on model matching of the present application. DETAILED DESCRIPTION

[0035] The specific embodiments of the present application are described in detail below with reference to the accompanying drawings and preferred embodiments.

[0036] A user identity continuous authentication method based on model matching degree of edge users before and after each iteration in federated learning training.

[0037] The user identity continuous authentication method in this scheme is based on model matching. Due to the characteristic that the data of each edge user is not circulated in federated learning, the edge model is iteratively trained on the fixed private data set of the edge user. Therefore, there is a high matching degree between the edge models uploaded by the edge user in different training rounds of federated learning. On the contrary, if the edge user is impersonated by an attacker in a certain federated learning training round, the attacker can only migrate the existing model parameters to another data set collected by it and iteratively train and transmit to the central server at the beginning of the next round of model upload, because the attacker cannot obtain the private data set of the edge user. At this time, the matching degree between the edge model uploaded by the attacker and the edge model uploaded by the edge user in the previous round and retained in the central server is reduced, so that the central server determines that the user identity authentication fails, and refuses the suspicious edge user to join the training in the next training round.

[0038] Figure 1 The flowchart of the federated learning user identity continuous authentication method based on model matching of the present application.

[0039] As Figure 1 shown, the user identity continuous authentication method provided by this embodiment can be divided into three parts: S1, central server-edge user model parameter upload and distribution stage, which refers to the mode of edge user uploading edge model and central server distributing central model; S2, edge model feature extraction stage, which refers to the central server extracting features of the edge model after collecting each round of edge model and archiving; S3, user identity authentication stage, which refers to the central server performing user identity authentication according to the retained edge model in each round.

[0040] In S1 of this embodiment, at the initial round t0 when federated learning starts, the central server randomly initializes the parameters G0 of the central model 0 and distributes the model parameters G0 to each edge user {u1, u2, …, uN}. 0 In the subsequent training rounds, the model upload and distribution between the central server and the edge users should be carried out in the following manner: in the t-th training round, each edge user u N updates the model parameters based on the central model Gt-1 obtained in the previous training round t i , and obtains a new edge model Gt using its private training set Dt as training data. j i+1 i-1 j ​​​​ After that, edge user u j Uploads the edge model To the central server, in particular, edge user u j Uploads should be all parameters of the edge model Instead of parameter updates of the edge model Further, the central server collects all edge models N From all edge users {u1, u2, …, u After that, it aggregates them to obtain the central model G i Of the current training round t i ; Finally, the central server updates the model parameters And sends them to each edge user, in particular, the central server should send parameter updates of each edge model instead of the actual parameters of the central model. The model parameter upload and download module of the present scheme effectively prevents potential attackers from obtaining central model parameters without training costs after intervening in federated learning in the t i th round. In detail, under the present framework, the attacker needs to complete at least one upload-download cycle to obtain the central model, but the user identity identification module in the present framework judges the attacker as a suspicious user after completing the model upload, and cannot obtain the downloaded model parameter updates. i j

[0041] In S2 of the embodiment, the edge model feature extraction module extracts the decision boundary gradient features of each edge model and retains them after collecting the edge models in each training round. As shown in Figure 2 , the edge model feature extraction can be divided into three steps of S201, selecting feature generation data; S202, calculating the decision boundary gradient; and S203, extracting the main direction of the decision boundary.

[0042] Among them, S201 refers to the central server selecting a data subset with uniform dispersion from its test data set, using the bisection method to generate decision boundary data points as feature generation data. The selection of data points in the test data set should ensure uniform dispersion as much as possible, that is, the data points should be as evenly distributed as possible after being projected by the output layer of the edge model, and should be mutually exclusive, so as to maximize the collection of gradients of each part of the decision boundary of the edge model to ensure the integrity and accuracy of the features. Specifically, when selecting data points, the data points should be as evenly distributed as possible in the output space of the edge model ​​The eigenvector on the top refers to the vector composed of the values of each neuron in the output layer of the model when the data points are input. Initially, the K-means clustering algorithm randomly selects N data points in the dataset as the initial centers of N classes. Then, iteratively, the data points closest to the center in Euclidean distance are pulled into the class in each round, and the center point of all data points in the class is counted as the new class center. Therefore, the N-class centers obtained by the K-means clustering algorithm meet the characteristics of uniform distribution and mutual exclusion. In the selection of N, too large N will lead to too large calculation amount in generating features; too small N will lead to too few decision boundary gradients in feature extraction. The present application suggests that N is greater than 20 and less than c*c, where c represents the number of classification categories of the original model. Further, the data points (X i ,X j ) classified by the edge model into different categories among the obtained data points are paired. The convexity of the model output space is utilized, that is, there must be a real number λ between 0 and 1 that satisfies λ*x i +(1-λ)*x j is a data point X that is less than 1e -6 from the decision boundary of the model (that is, X satisfies where is the edge model of the edge user j in the round i, represents the predicted label of the model on the data point, and argmax1(·) refers to the maximum value in each dimension of the input vector, and argmax2(·) refers to the second largest value in each dimension). The bisection method is used to find the corresponding λ, and the generated data point X is added to the feature generation point.

[0043] Further, in S202, the decision boundary gradient of each edge model on the data point set generated in S201 is extracted. Wherein the decision boundary gradient of the jth edge model on the mth data point in the feature generation point of the edge model is that is, the gradient of the loss function used in the model training when the data point is equal to and the edge model parameter is equal to . The gradients of the edge model on the k feature generation data points are combined to become the preliminary features of the model , that is,

[0044]

[0045] Further, in S203, the preliminary features of the edge model obtained in the previous step are input to perform singular value decomposition to obtain singular values, left singular vectors and right singular vectors, wherein each vector in the left singular vector represents the main direction of the extension of the edge model decision boundary gradient, and the corresponding singular value represents the weight of the main direction in the decision boundary gradient distribution. The present scheme is to prevent the edge model features from being too redundant to affect the robustness of the subsequent model matching degree module, and only the main vectors with high weights in the preliminary features are retained as the final feature vectors of the edge model. Specifically, the singular values corresponding to each main direction are arranged in descending order and summed, and the head left singular vectors with a weight sum of 95% of the total singular values are retained as the edge model feature vectors. Due to the redundancy of the neural network model decision boundary, the decision boundary has a high degree of dependence on the geometric distribution, i.e., there is a low-dimensional subspace in the model decision space that covers most of the decision boundary gradients. Therefore, the singular values tend to drop sharply, and the number of singular vectors with a weight sum of 95% of the total singular values is much smaller than the total number of singular vectors. Therefore, the final feature vectors of the edge model have the characteristics of low dimension and high information density compared with the preliminary feature vectors.

[0046] In S3 of this embodiment, the user identity authentication module inputs the feature vectors of each edge model in each round of federated learning training, compares them with the edge model feature vectors uploaded by the edge user in the previous round, and authenticates the identity of the user. As shown in Figure 3 , the module can be divided into S301, multi-view model feature enhancement; S302, model feature encoder training based on contrastive learning; and S303, user identity authentication discrimination.

[0047] S301, multi-view model feature enhancement, refers to enhancing the model features corresponding to each edge model in a multi-view manner to generate a plurality of positive samples similar to but not identical to the model features. Specifically, data enhancement is performed by data sampling, and the central server collects k substitute subsets with the same distribution as the data subset described in S201 from its test data set, and generates decision boundary data points as model feature generation points based on this using bisection method, to generate k model features with high similarity for each edge model. When collecting the substitute subsets with the same distribution, assume that the feature vector of a data point in the test data set of the central server in any edge model is Z, for each data point x in the generated sub-data set, find the w data points in Z that are most adjacent to it in Euclidean distance to form a candidate point set Each data point and its w neighboring data points are treated as balls in a box. Data points are grabbed from each box without replacement. Data points grabbed in the same batch are combined into a new uniformly distributed subset of size N. Therefore, we obtain a total of w uniformly distributed subsets of size N and generate w feature pairs for each model.

[0048] Furthermore, in S302, using the features of the edge models and the multi-view augmented pairs of those features as training data, contrastive learning is used to train a feature encoder for each edge model. Each feature encoder is responsible for encoding a specific feature of an edge model. For example, it might be responsible for encoding the features of edge user u. j Uploaded edge model L j Feature encoder E j It should be possible to project the high-dimensional features of this edge model onto a low-dimensional hypersphere (20 dimensions in this embodiment). In this hypersphere, the edge model L... j The features and the pairs generated by these features are projected onto the same surface of the hypersphere. The features of the remaining edge models and the pairs generated by these features are collectively referred to as L. j The negative pair features of the model are projected onto the opposite face of the hypersphere. Therefore, in training epoch i of federated learning, if we want to determine the marginal user u... j Uploaded edge model and The degree of matching can and The feature vector is input into the feature encoder E j And calculate the cosine similarity of its output, i.e., the matching degree. Due to the contrastive learning characteristics of the encoder's hyperspherical mapping, the learning is not performed via the original edge user u. j The model trained on the private training set (i.e., the model uploaded by the attacker) and the previous round of edge user u j The matching degree of the uploaded edge model will be significantly lower than that of the edge user u. j The model is uploaded normally. During the federated learning training rounds, as the number of models uploaded by each edge user gradually increases, the feature encoder E corresponding to that edge user... j Iterative training should also be performed. Specifically, in training epoch i of federated learning, the feature encoder of that epoch... The parameters are updated as follows:

[0049]

[0050] Further, in S303, the matching degree of each edge model collected in the latest training round i of federated learning and the edge model uploaded by the user in the last round is taken as input, and the user identity authentication discriminator is used to determine whether each edge user passes the identity authentication. Specifically, if the edge model does not match the edge model uploaded by the user in the last round, i.e., the matching degree is less than the threshold t, it is determined that the user's identity is suspicious, and the user is refused to continue participating in federated learning. The central server will not consider the model parameters uploaded by the user when integrating the central model and stop downloading model update parameters to the user. On the contrary, if the matching degree is higher than the threshold t, it is determined that the user passes the user identity authentication and continues to participate in federated learning. The discrimination threshold t is obtained by using a bimodal Gaussian model in the present application. Specifically, the matching degrees between the model features that are positive and negative pairs in the previous rounds are taken as observation values to predict a reasonable threshold. It is assumed that the matching degrees between the features that are positive and negative pairs comply with Gaussian distributions G(m1, σ1), G(m2, σ2) with different means and variances. m1 and m2 are obtained by calculating the mean of the matching degrees of such models, and σ1 and σ2 are obtained by calculating the variance of all the model features relative to the estimated mean. The threshold t is the separation value that maximizes the classification accuracy, and it is theoretically proven that in the bimodal Gaussian model, this value is equal to the intersection value of the probability density functions of the two Gaussian distributions. Using the present application can effectively exclude any impostor edge user attacker from the federated learning framework in one model distribution-uploading round. The impersonation scenarios include but are not limited to: the attacker is another edge user in the federated learning framework, the attacker is a person outside the framework who has been listening to the upload and download data since the beginning of federated learning, the attacker is a person who knows the central model parameters, the attacker is a model pollution attacker who has intervened in the federated learning framework from a certain round, and the attacker is a backdoor attacker who has intervened in the federated learning framework from a certain round. At the same time, the security module for continuous user identity authentication in federated learning provided by the present application is compatible with the remaining security modules and training modules of the federated learning framework, and can be integrated with any horizontal federated learning framework based on deep neural networks.

[0051] Those skilled in the art will understand that these are only illustrative, and various changes or modifications can be made to these embodiments without departing from the principles and essence of the present application, therefore, the protection scope of the present application is defined by the appended claims.

Claims

1. A method for continuously authenticating the identity of a federated learning user based on model matching, characterized in that, Comprise: The central server-edge user model parameter upload and issue stage: the edge user uploads the edge model and the central server issues the central model; The edge model feature extraction stage: the collected edge model of each round is extracted by the extraction algorithm; The user identity authentication stage: the matching degree of the edge model in the current round and the edge model in the previous round is taken as an index to authenticate the identity of the edge user; The edge model feature extraction stage, in each training round of federated learning, the edge model uploaded by each edge user in the round is extracted, and the feature extraction includes S201, selecting feature generation data; S202, calculating the decision boundary gradient; S203, extracting the decision boundary direction; S201, selecting feature generation data: selecting a uniformly dispersed data subset with a size of N from the central server test data set, and using bisection method to generate decision boundary data points as the feature generation data point set S202, calculating the decision boundary gradient of the edge model: extracting the decision boundary gradient of each edge model the data point set generated in S201 at the decision boundary gradient, where the jth edge model corresponds to the mth data point The corresponding decision boundary gradient of the jth edge model on the mth data point is The gradient of the edge model on the k features of the data point is combined into the preliminary features of the edge model ; S203, extracting the decision boundary direction: singular value dimension reduction is performed on the preliminary features of the edge model, and the gradient of the edge model on each decision boundary point is calculated; The user identity authentication stage: the feature vectors of the edge models in the previous training rounds and the positive feature vectors obtained by multi-view enhancement are used as a training set, a model feature encoder is trained for each edge user using contrast learning, and the user identity discriminator determines the identity of the edge user according to the matching degree of the edge model in the current round and the edge model in the previous round.

2. The model matching based federated learning user identity persistent authentication method according to claim 1, characterized in that, The central server-edge user model parameter upload and issue stage, specifically includes: At initial round t0, the central server initializes the central model parameters G randomly 0 and sends them to each edge user {u1, u2, …, u N} In each training round t i Each edge user u j Uploads all parameters of the edge model After collecting all edge models, the central server aggregates them to obtain the training round t. i Central model G i The updated model parameters should be issued subsequently. To each peripheral user.

3. The model matching based federated learning user identity persistent authentication method of claim 1, wherein, The selected uniform dispersed data subset with a size of N specifically includes: First, the output vector of the test data set in the edge model is extracted, and the K-means clustering algorithm is used on the output vector until n classes are divided, then a data point is randomly sampled in each class to form a data subset with a size of N.

4. The model matching based federated learning user identity persistent authentication method according to claim 3, characterized in that, The output vector refers to the combination of the vector of each data point in the data set in the output layer of the edge model.

5. The model matching based federated learning user identity persistent authentication method according to claim 1, characterized in that, Select two data points (X i ,X j ) from the uniformly dispersed data subset belonging to different categories, find a real number λ in the interval [0,1] by using dichotomy, so that λ*x i +(1-λ)*x j is a data point with a distance less than 1e -6 from the decision boundary of the distance model, and add it to the decision boundary point data set.

6. The model matching based federated learning user identity persistent authentication method according to claim 1, characterized in that, The distance of the decision boundary point from the decision boundary should be less than 1e -6 The decision boundary point should satisfy wherein is the margin model of the marginal user j in round i, represents the predicted label of the model on the data point, and argmax1(·) refers to the maximum value among the values of each dimension in the input vector, and argmax2(·) refers to the second largest value among the values of each dimension.

7. The gradient of the computed margin model on a decision boundary point according to claim 1, wherein: The gradient vector of the edge model on all decision boundary points is wherein denotes the edge model of the edge user j at training round i, denotes the preliminary features of the model, denotes the decision boundary point of the model.

8. The model matching based federated learning user identity persistent authentication method of claim 1, wherein, The singular value dimension reduction is performed on the gradient vector, specifically: singular value decomposition is performed on the gradient vector of the edge model to obtain singular values, left singular vectors and right singular vectors, and the singular values are arranged in descending order to calculate the minimum head singular value sequence that accounts for more than 95% of the total, and the left singular vector corresponding to the minimum head singular value sequence is reserved as the result of singular value dimension reduction. 9.The model matching based federated learning user identity persistent authentication method according to claim 1, characterized in that, Multi-view feature vector enhancement, taking the feature vector Z of the central server test dataset on the edge model as input, for each data point x in the test set, find the k nearest neighbors of x in Z under the Euclidean distance, form a candidate point set And use the non-replacement sampling method to split the candidate point set into k uniform dispersion data subsets of size N and repeat the decision boundary point generation algorithm, calculate the new edge model gradient and perform singular value dimensionality reduction.

10. The model matching based federated learning user identity persistent authentication method of claim 7, wherein, contrastive learning training model feature encoders: project features of edge model L j and positive counterparts generated based on the features to the same face of a low-dimensional hypersphere; features of the remaining edge models and positive counterparts generated based on the features are collectively referred to as negative counterpart features of L j model, which are projected to the opposite face of the hypersphere; their parameter updates in a federated learning training round are: wherein is the match degree of the current round edge model and the previous round edge model.

11. The model matching based federated learning user identity persistent authentication method according to claim 1, characterized in that, The user identity authentication discriminator: the matching degree output by the encoder corresponding to the edge user of the edge model in the current round and the edge model in the previous round is taken as input, if the matching degree is greater than a threshold t, it is determined that the user identity is normal; If the matching degree is less than the threshold t, it is determined that the user identity is abnormal, and the central model update parameters are stopped from being issued to the user in this round and the edge model parameters uploaded by the user are stopped from being received in future rounds.

12. The model matching based federated learning user identity persistent authentication method according to claim 1, characterized in that, The matching degree determination threshold t is that the matching degrees from the same user in the previous round are simulated as μ1 and the matching degrees from different users are simulated as μ2 using bimodal mixed Gaussian simulation, and the intersection value t of the two Gaussian distributions is taken as the discrimination threshold of whether to pass the identity authentication.

Images