Verifiable federated learning device and method for secure data aggregation in industrial control network

Abstract

The application discloses a kind of verifiable federated learning device and method of secure data aggregation in industrial control network, the method is based on the verifiable federated learning device of secure data aggregation in industrial control network, including obtaining initialized public parameter;Determine the participant and the center server public-private key part key pair;Determine the participant and the center server session key;Determine three-party negotiation key;Obtain encrypted local gradient;Obtain auxiliary verification label and signature;Obtain proof information, aggregation result and proof;Obtain verification result.This method adopts double concealment technology and data encryption technology, can ensure the confidentiality and integrity of data, generates the negotiation key between server and participant using lightweight three-party key negotiation mode, can better realize lightweight secure data aggregation process.

Description

TECHNICAL FIELD

[0001] The present application relates to information security cryptography, and in particular to a device and method for verifiable federated learning of secure data aggregation in an industrial control network. BACKGROUND

[0002] With the rapid development of industrial control networks, a large number of heterogeneous terminal products can access the network. These terminal products can generate more accurate local models by federated learning with third-party servers, and monitor, collect and aggregate various data obtained from local sensors in real time. Although federated learning can update parameter data without collecting raw data from participants, existing results show that shared gradients still retain sensitive information from the training set. At the same time, a malicious third-party aggregation server may return fake aggregated gradients, and it is necessary to ensure lightweight execution of the entire solution during the aggregation process. Currently, some machine learning and federated learning solutions in related scenarios mainly include:

[0003] To reduce the verification cost of the participant side, Hahn et al. [C. Hahn, H. Kim, M. Kim, and J. Hur, “Versa: Verifiable secure aggregation for cross-device federated learning,” IEEE Transactions on Dependable and Secure Computing, 2021.] proposed a verifiable secure aggregation method for cross-device federated learning, which achieved privacy protection of participant private gradients and verification of model aggregation through key expansion of pseudo-random generator (PRG); Shen et al. [W. Shen, J. Qin, J. Yu, R. Hao, and J. Hu, “Enabling identity-based integrity auditing and data sharing with sensitive information hiding for secure cloud storage,” IEEE Transactions on Information Forensics and Security, vol. 14, no. 2, pp. 331–346, 2018.] proposed a scheme that can protect sensitive information and publish other information, allowing data sharing while protecting sensitive information and supporting remote data integrity auditing; Zhao et al. [J. Zhao, H. Zhu, F. Wang, R. Lu, H. Li, J. Tu, and J. Shen, “Cork: A privacy-preserving and lossless federated learning scheme for deep neural network,” Information Sciences, vol. 603, pp. 190–209, 2022.]A privacy-protected and lossless federated learning scheme is proposed, which supports fault-tolerant secure aggregation of all participants and protects sensitive gradient data in global model gradient parameters using a lossless model perturbation mechanism, so that gradient data cannot be derived through attribute inference attacks; Chinese patent CN115168902A discloses a group-verified chain privacy-protected federated learning method, which uses a group chain learning mechanism to ensure user privacy during the training phase, and proposes a verifiable secure aggregation method to ensure the verifiability of the global model; Chinese patent CN116049897A discloses a verifiable privacy-protected federated learning method based on linear homomorphic hash and sign encryption, which can implement federated learning method under double servers, provide parameter confidentiality, aggregation result verifiability and identity authentication service; Chinese patent CN114785510A discloses a verifiable lightweight privacy-protected federated learning method, which applies Paillier homomorphic encryption system and distributed selective stochastic gradient descent method to local training, and uses a signature method with edge computing framework to realize lightweight local gradient verification of data integrity. These papers and patent technology solutions show the application of federated learning in data aggregation, and provide some new ideas and methods for realizing more secure and privacy-protected federated learning.

[0004] Although there is an aggregation operation on the gradient in the traditional federated learning method, it is not enough to complete the function and security requirements in the actual scene for the following reasons: the first reason is that the existing method generally uses a trusted third-party entity to complete the key generation between entities, which is an unrealistic requirement for system deployment in the actual scene; the second reason is that most of the existing methods need to implement a key agreement scheme between entities, which causes the computational complexity to reach O(n 2 ) complexity, which is unacceptable in terms of time overhead in the actual scene; the third is that the existing method generally uses high-complexity bilinear technology in the construction method, which can be avoided, so the aggregation task they implement is not practical. SUMMARY

[0005] The purpose of the present application is to overcome the shortcomings of the prior art and provide a verifiable federated learning method and device for secure data aggregation in an industrial control network. This method uses double concealment technology and data encryption technology to ensure data confidentiality and integrity, and uses a lightweight three-party key agreement method to generate negotiation keys between servers and participants, which can better implement a lightweight secure data aggregation process.

[0006] The technical solution to achieve the purpose of the present application is:

[0007] A verifiable federated learning device for secure data aggregation in an industrial control network, based on an edge industrial control node, comprising:

[0008] A local gradient calculation unit for calculating private gradients of local data;

[0009] A local gradient upload unit for determining an upload method based on the private gradients;

[0010] A local data encryption unit for determining an encrypted gradient result based on the upload method;

[0011] A local data signcryption unit for determining a signcrypted gradient result based on the encrypted gradient result;

[0012] A central server verification unit for determining a signcryption correctness result based on the signcrypted gradient result;

[0013] A central server aggregation unit for determining a gradient aggregation result based on the encrypted gradient result;

[0014] A central server signcryption unit for determining a signcrypted aggregated gradient result based on the gradient aggregation result;

[0015] A local data verification unit for determining an aggregated gradient confirmation result based on the signcrypted aggregated gradient result.

[0016] A verifiable federated learning method for secure data aggregation in an industrial control network, comprising the above-mentioned verifiable federated learning device for secure data aggregation in an industrial control network, wherein the participants and the aggregation server interact with each other, and the method comprises the following steps:

[0017] 1) Obtain the public parameters initialized by the device: the device initialization process is performed by the central server, and for the security parameter 1 λ , the central server generates a multiplicative cyclic group of prime order p Let g be a generator of , the central server selects a hash function a secure homomorphic hash function and a pseudo-random generator Finally, the central server publishes the public parameters

[0018] 2) Determine the participant public-private key part key pair based on the public parameters: the participant u i generates a public-private key pair for the multiple key encapsulation mechanism as shown in formula (1):

[0019]

[0020] wherein the participant u i randomly selects and calculate Thus, the participant u i The public key and the private key of the participant u i are pk i =(y i , X i ) and sk i =(a i , x i ) respectively, then the participant u i sends (u i , X i ) to the center server, after receiving the message (u i , X i ) from all participants in the user group U, the center server sorts {u i ∈ U} and broadcasts the sorted to all participants u v ∈ U;

[0021] 3) Determine the center server public-private key part key based on the public parameter: the center server generates a public-private key pair for the multi-key encapsulation mechanism as shown in formula (2):

[0022]

[0023] Wherein, the center server randomly selects and calculates μ=g i Then the center server publishes the public key pk=(pk, μ) and keeps the private key sk=(sk, v) secret;

[0024] 4) Determine the participant session key based on the public-private key part key: after the local data encryption unit receives the sorted public key of all participants and the public key of the center server, the participant u i，j calculates n-1 encapsulation / decryption keys as shown in formula (3):

[0025]

[0026] Wherein, Ω j ={X i，j , pk}, KU i is the session key from participant u j to participant u i，j , CU i，j is the encapsulation of the key KU i，j encapsulated in Q i , the participant u i，j publishes {(CU i , u j , u i )|u j , ue U, i≠j} ;

[0027] 5) Determining the center server session key based on the public-private key pair partial key: the center server generates a key for each pair of users (i, j) according to the following formula as shown in formula (4):

[0028]

[0029] wherein K i，j is the session key, C i，j is an encapsulation of K i，j using the public-private key pair, and then the center server publishes the message {(C i，j , u i , u j )|u i , u j e U, i≠j} ;

[0030] 6) Determining the participant-initiated three-party negotiation key based on the session key: in the case that the participating user u j broadcasts X j and the center server broadcasts pk, the user u i calculates the key group KU j，i and K i，j , and calculates the three-party agreement key as shown in formula (5):

[0031]

[0032] wherein sid = CU j，i || CU i，j || C i，j ;

[0033] 7) Determining the center server-initiated three-party negotiation key based on the session key: in the case that the participating users u i and u j broadcast X i and X j , the center server calculates the key group KU i，j and KU j，i and calculates the three-party agreement key as shown in formula (6):

[0034]

[0035] wherein sid = CU j，i || CU i，j || C i，j ;

[0036] 8) Obtaining the encrypted local gradient based on the three-party negotiation key: in the case that the user u i ​and every user u except u i j i，j i≠j i i

[0037]

[0038] Here j runs through every value not equal to i;

[0039] 9) Obtain the auxiliary verification tag and signature based on the encrypted local gradient and the user private key: In order to achieve correctness verification on the result returned by the collaborator ui, the collaborator u i calculates the local gradient auxiliary verification tag as shown in formula (8):

[0040] and

[0041] The collaborator u i randomly selects and calculates formula (9), formula (10) and formula (11):

[0042]

[0043]

[0044] s i = k i -a i e i mod p (11),

[0045] where t i is a time stamp, finally, the collaborator u i sends the tuple signature τ i = (r i , s i ) and the time stamp t i to the center server;

[0046] 10) Obtain the proof information, aggregation result and proof based on the auxiliary verification tag and signature: the center server verifies as shown in formula (12):

[0047]

[0048] where for each 1≤i≤n, If it is true, all the local gradient tuples of the participants are considered to be valid, then the center server calculates formula (13):​​​​​​

[0049]

[0050] and for each u i ∈U, the central server calculation formula (14):

[0051]

[0052] The central server continues calculations. in It is all u i ∈U The sum of the values ​​is randomly selected by the central server. And calculate formulas (15), (16), and (17):

[0053] δ=g z (15),

[0054]

[0055] l=z-νηmod p (17),

[0056] in, It's a timestamp, and finally, a tuple. Broadcast to all collaborators;

[0057] 11) Obtain the verification results: for each collaborator u i calculate And verify formula (18):

[0058]

[0059] If true, then collaborator u i Verification formula (19):

[0060]

[0061] If formula (19) does not hold, then participant u i Broadcast the message to other participants to stop authentication. If all participants verify that formula (19) is true, then each participant continues to verify formula (20):

[0062]

[0063] If formula (20) is satisfied, then participant u i We assume that m equals the expected true gradient aggregation value and accept the global parameter m.

[0064] A computer device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the verifiable federated learning method for secure data aggregation in the industrial control network when executing the computer program.

[0065] A non-transitory computer readable storage medium stores a computer program, and the computer program implements the verifiable federated learning method for secure data aggregation in the industrial control network when executed by a processor.

[0066] A computer program product comprises a computer program, and the computer program implements the verifiable federated learning method for secure data aggregation in the industrial control network when executed by a processor.

[0067] The technical solution solves the problems of integrity and security, ensures that the participating center nodes can safely collect client data, aggregate data, and return the aggregation results to each participant; since the private gradient data of the participants may be affected by common attacks such as eavesdropping and tampering during the process of sharing data on the public network, the technical solution adopts double-blinding technology and data encryption technology to ensure the confidentiality and integrity of the data.

[0068] To support the verifiability of aggregated data, the technical solution uses homomorphic hash technology to process the gradient, and the hash values before and after aggregation can be used to verify the final result; to reduce the high computational complexity of the traditional scheme and solve the problem that the private key of the sub-node in the traditional verifiable scheme will be exposed, the technical solution uses a lightweight three-party key agreement method to generate a negotiated key between the server and the participants, which can better implement a lightweight secure data aggregation algorithm.

[0069] This method adopts double-blinding technology and data encryption technology to ensure the confidentiality and integrity of the data, and uses a lightweight three-party key agreement method to generate a negotiated key between the server and the participants, which can better implement a lightweight secure data aggregation process. BRIEF DESCRIPTION OF DRAWINGS

[0070] Figure 1 A schematic diagram of the federated learning method model in the embodiment;

[0071] Figure 2 A schematic diagram of the verifiable gradient aggregation method model in the embodiment;

[0072] Figure 3 A schematic diagram of the method flow in the embodiment;

[0073] Figure 4 A schematic diagram of the structure of the verifiable gradient aggregation device in the embodiment;

[0074] Figure 5 This is a schematic diagram of the electronic device in the embodiment. Detailed Implementation

[0075] The present invention will be further described below with reference to the accompanying drawings and embodiments, but this is not intended to limit the scope of the invention.

[0076] Example:

[0077] like Figure 4 As shown, a verifiable federated learning device for secure data aggregation in an industrial control network, implemented based on edge industrial control nodes, includes:

[0078] The local gradient calculation unit is used to calculate the private gradient of local data;

[0079] A local gradient upload unit is used to determine the upload method based on the private gradient;

[0080] A local data encryption unit is used to determine the encryption gradient result based on the upload method;

[0081] A local data signature unit is used to determine a signature gradient result based on the encryption gradient result;

[0082] The central server verification unit is used to determine the correctness of the signature based on the signature gradient result;

[0083] The central server aggregation unit is used to determine the gradient aggregation result based on the encrypted gradient result;

[0084] The central server signature unit is used to determine the signature aggregation gradient result based on the gradient aggregation result.

[0085] The local data verification unit is used to determine the aggregation gradient confirmation result based on the signature aggregation gradient result.

[0086] like Figure 3 As shown, a verifiable federated learning method for secure data aggregation in an industrial control network includes the aforementioned verifiable federated learning device for secure data aggregation in an industrial control network, wherein participants and an aggregation server interact with each other on data, and the method includes the following steps;

[0087] 1) Obtain common parameters for device initialization: The device initialization process is executed by the central server. For security parameter 1... λ The central server generates a multiplicative cyclic group of prime order p. Let g be For a generator, the central server selects a hash function. A secure homomorphic hash function and a pseudo-random generator Finally, the center server publishes the public parameter

[0088] 2) Determine the participant public-private key pair based on the public parameter: participant u i Generate a public-private key pair for the multi-key encapsulation mechanism as shown in equation (1):

[0089]

[0090] Where participant u i Randomly select And calculate Therefore, the public key and private key of participant u i are pk i =(y i , X i ) and sk i =(a i , x i ), respectively. Then, participant u i sends (u i , X i ) to the center server. After receiving messages (u i , X i ) from all participants in the user group U, the center server sorts {u i ∈ U} and broadcasts the sorted to all participants u i ∈ U;

[0091] 3) Determine the center server public-private key pair based on the public parameter: the center server generates a public-private key pair for the multi-key encapsulation mechanism as shown in equation (2):

[0092]

[0093] Where the center server randomly selects And calculates μ=g v Then, the center server publishes the public key pk=(pk, μ) and keeps the private key sk=(sk, v) secret;

[0094] 4) Determine the participant session key based on the public-private key pair: after the local data encryption unit receives all participant sorted public keys and the center server public key, participant u i Calculates n-1 pairs of encapsulation / decryption keys as shown in equation (3):

[0095]

[0096] Where Q i，j ={X j,pk},KU i，j From the participant u i To the participant u j Session key, CU i，j It is encapsulated in Q i，j Key KU i，j Encapsulation, participant u i Announcement {(CU i，j u i u j )|u i u j ∈i≠j};

[0097] 5) Determine the central server session key based on the public and private key pairs: The central server generates a key for each pair of users (i, j) according to the following formula as shown in formula (4):

[0098]

[0099] in K i，j For the session key, C i，j Is using Key pair K i，j An encapsulation, then the central server publishes the message {(C i，j u i u j )|u i u j ∈u,i≠j};

[0100] 6) Determine the tripartite negotiation key initiated by the participant based on the session key: (This is repeated in the original text, likely due to an error in the original.) j Broadcast X j In the event that the central server broadcasts a PK (player versus player) message, user u i Calculate the key group KU j，i and K i，j The tripartite agreement key is calculated as shown in formula (5):

[0101]

[0102] Where sid = CU j，i ||CU i，j ||C i，j ;

[0103] 7) Determine the tripartite negotiation key initiated by the central server based on the session key: (This is repeated in the original text, likely due to an error in the original.) i and u j Broadcast X i and X j In this case, the central server calculates the key group KU j，i and KUj，i and the three-party agreement key is calculated as shown in equation (6):

[0104]

[0105] where sid=CU j，i ||CU i，j ||C i，j ;

[0106] 8) Obtain the encrypted local gradient based on the three-party negotiation key: in user u i and each user u i except u j , the shared key {k i，j} i≠j generated between u i encrypts its local gradient m i as shown in equation (7):

[0107]

[0108] Here j traverses each value not equal to i;

[0109] 9) Obtain the auxiliary verification tag and signature based on the encrypted local gradient and the user private key: in order to achieve correctness verification on the returned result of the collaborator u i , the collaborator u i calculates the local gradient auxiliary verification tag as shown in equation (8):

[0110] and

[0111] The collaborator u i randomly selects and calculates equation (9), equation (10) and equation (11):

[0112]

[0113]

[0114] s i =k i -a i e i mod p (11),

[0115] where t i is the time stamp, finally, the collaborator u i signs the tuple τ i =(r i , s i ) and the time stamp ti sent to the center server;

[0116] 10) Obtain proof information, aggregation result and proof based on auxiliary verification label and signature: the center server verifies as shown in formula (12):

[0117]

[0118] where, for each 1≤i≤n, If it is true, the local gradient tuple of all participants is considered to be valid, then the center server calculates formula (13):

[0119]

[0120] and for each u i ∈U, the center server calculates formula (14):

[0121]

[0122] The center server continues to calculate where is the sum of all u i ∈U , the center server randomly selects and calculates formula (15), formula (16) and formula (17):

[0123] δ=g z (15),

[0124]

[0125] l=z-vηmod p (17),

[0126] where, is a timestamp, finally, the tuple is broadcast to all collaborators;

[0127] 11) Obtain verification result: each collaborator u i calculates and verifies formula (18):

[0128]

[0129] If it is true, the collaborator u i verifies formula (19):

[0130]

[0131] If formula (19) is not true, the participant u ibroadcast a message to other participants to abort the identity authentication, if all participants verify that formula (19) is true, each participant continues to verify formula (20):

[0132]

[0133] If formula (20) is satisfied, the participant u i Believe that m is equal to the expected real gradient aggregation value and accept the global parameter m.

[0134] As Figure 5 shown, a computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above-mentioned verifiable federated learning method for secure data aggregation in an industrial control network when executing the computer program.

[0135] A non-transitory computer readable storage medium stores a computer program, wherein the computer program is executed by a processor to implement the above-mentioned verifiable federated learning method for secure data aggregation in an industrial control network.

[0136] A computer program product includes a computer program, wherein the computer program is executed by a processor to implement the above-mentioned verifiable federated learning method for secure data aggregation in an industrial control network.

[0137] Specifically, in this example:

[0138] (1) The parameters or gradients uploaded by the participants can expose their related information, and the server can infer the original training data of the participants from them, and the privacy is threatened, therefore, guaranteeing the confidentiality of the parameters is a security requirement of federated learning;

[0139] (2) A malicious server may tamper with the aggregation result and return incorrect aggregation results to the participants, thereby manipulating the global model, therefore, being able to verify the correctness of the model aggregation is another security requirement of federated learning;

[0140] (3) The user identity in the federated learning framework is complex, and there may be malicious parties impersonating legitimate users to upload toxic local model information, thereby reducing the usability of the global model, therefore, federated learning needs to identify the identity of the user to ensure the authenticity of the identity of each participant, which is also a security requirement;

[0141] The above security requirements do not achieve ideal effects in the related art, and there are the following problems in methods and technologies:

[0142] The first problem is that existing methods generally use a trusted third-party entity to handle key generation between entities, which is impractical for real-world system deployment. The second problem is that most existing methods require implementing a key negotiation scheme between entities, resulting in a computational complexity of O(n log n). 2 The complexity of the methods is too high, which is unacceptable in terms of time consumption in real-world scenarios; thirdly, existing methods generally use the high-complexity bilinear technique when constructing the method, which can be avoided; therefore, the aggregation tasks they implement are impractical and not suitable for federated learning data aggregation methods in real-world environments.

[0143] like Figure 1 As shown, Figure 1 The diagram illustrates the distribution of entities and data flows in a federated learning environment. Participants and the server collaboratively train a unified neural network model. To accelerate model convergence, participants upload their gradients to an aggregation server, which aggregates all gradients and returns the results. Assume there are n participants u i Where i = 1, 2, ..., n, they negotiated a model architecture, and each round of federated learning can be described as follows:

[0144] A neural network model can be represented as a function f(x, M), where x is the input and M are the model parameters. The model parameters M include all biases and connections between all neurons. Assume the participant u... i Holding training set Where x j It is the input, y j It is x j The label, T represents D i Size, loss function L f (D i M) can be defined as follows:

[0145]

[0146] The goal of training a neural network model is to find the gradient, update M accordingly, and thus minimize the loss function L. f (D i The value of M is calculated for the participant u using stochastic gradient descent within the framework. i gradient m i :

[0147]

[0148] Where ΔL f The loss function L f The derivative of It is Di a random subset, then all participants upload their gradients to the aggregation server for aggregation, Finally, the aggregation server sends the aggregation result to each participant so that the participant updates the model parameter M←M-η·m / n after receiving m, where η is the learning rate, if the termination condition is not reached, the system enters the next round of federated learning;

[0149] Participants are implemented by a group of industrial control terminal devices, each terminal device holds a small amount of data or keeps the feature of low data diversity, each participant has a unique legal identity in the system, denoted by u i or u j The goal of the participant is to collaboratively train a high-quality neural network model through federated learning, in each round of federated learning, each participant trains the model locally, encrypts its own gradient, and uploads it to the aggregation server, in addition, they receive the aggregation ciphertext from the aggregation server, verify its correctness, and update the model, in this method, participants are assumed to be honest and curious, which means they will upload correct gradient values, however, some participants may collude with the central aggregation server to obtain the gradients of other participants;

[0150] The central server generates keys and parameters in the initialization and distributes them to participants, in each round of federated learning, the central server aggregates the uploaded ciphertexts, and then distributes the results to each participant, in this method, the aggregation server is assumed to be malicious, it may try to steal the privacy information of participants through the received gradients, or even forge the aggregation ciphertext to affect the model update;

[0151] As shown in Figure 2 , the data is trained by the participants through the local gradient calculation unit to the model, the parameters in the model are uploaded to the central server by the participants using the local gradient upload unit, the participants encrypt the private local gradient before uploading through the local data encryption unit, and the participants sign and encrypt the encrypted private local gradient through the local data signing unit, the central server receives the private local gradient of the n participants, and then uses the central server verification unit to test the correctness of the private local gradient, after the test is passed, the central server uses the central server aggregation unit to aggregate the encrypted gradient result, then the central server uses the central server signing unit to sign the aggregation result, finally the central server sends the aggregated result to the participants, the participants verify the aggregation result, and give the final decision of whether to receive or not;

[0152] As shown in Figure 5As shown, the electronic device can include a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other through the communications bus 540. The processor 510 can invoke the logic instructions in the memory 530 to execute the verifiable federated learning method for secure data aggregation in an industrial control network. In addition, the logic instructions in the memory 530 can be implemented in the form of a software functional unit and sold or used as an independent product. When stored in a computer-readable storage medium, the logic instructions can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present example or the part that essentially contributes to the prior art or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device) to execute all or part of the steps of the method. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various storage medium that can store program codes.

[0153] In another aspect, the present example also provides a computer program product including a computer program that can be stored on a non-transitory computer-readable storage medium. When executed by a processor, the computer program enables a computer to execute the verifiable federated learning method for secure data aggregation in an industrial control network based on an edge industrial control node implementation, including: obtaining system initialization public parameters; determining participant and center server public and private key partial key pairs based on the public parameters; determining participant and center server session keys based on the public and private key partial key pairs; determining a three-party negotiation key based on the session key; obtaining an encrypted local gradient based on the three-party negotiation key; obtaining an auxiliary verification tag and a signature based on the encrypted local gradient and the user private key; obtaining proof information, aggregation results, and proofs based on the auxiliary verification tag and the signature; and obtaining a verification result based on the proof information, the auxiliary tag, and the proof.

[0154] In yet another aspect, the example also provides a non-transitory computer readable storage medium having stored thereon a computer program, which, when executed by a processor, implements a verifiable federated learning method for secure data aggregation in an industrial control network based on an edge industrial control node, comprising: obtaining a public parameter of system initialization; determining a participant and a center server public-private key partial key pair based on the public parameter; determining a participant and a center server session key based on the public-private key partial key pair; determining a three-party negotiation key based on the session key; obtaining an encrypted local gradient based on the three-party negotiation key; obtaining an auxiliary verification tag and a signature based on the encrypted local gradient and a user private key; obtaining proof information, aggregation results and proof based on the auxiliary verification tag and the signature; obtaining a verification result based on the proof information, the auxiliary tag and the proof;

[0155] The device is merely illustrative, and the units as described in the device can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed to multiple network units, and part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment.

Claims

1. A verifiable federated learning method for secure data aggregation in industrial control networks, using a verifiable federated learning device for secure data aggregation in industrial control networks, the verifiable federated learning device for secure data aggregation in industrial control networks is implemented based on an edge industrial control node, comprising: a local gradient calculation unit for calculating private gradients of local data; a local gradient upload unit for determining an upload method based on the private gradients; a local data encryption unit for determining an encrypted gradient result based on the upload method; a local data signcryption unit for determining a signcrypted gradient result based on the encrypted gradient result; a center server verification unit for determining a signcryption correctness result based on the signcrypted gradient result; a center server aggregation unit for determining a gradient aggregation result based on the encrypted gradient result; a center server signcryption unit for determining a signcrypted aggregated gradient result based on the gradient aggregation result; a local data verification unit for determining an aggregated gradient confirmation result based on the signcrypted aggregated gradient result, wherein the participants and the aggregation server interact with each other, and the method comprises the following steps: 1) Acquisition device initialization public parameters: the device initialization process is performed by the central server, for security parameter 1 λ , the central server generates a multiplicative cyclic group of prime order p Let g be a generator of , the central server selects a hash function a secure homomorphic hash function and a pseudo-random generator Finally, the central server publishes public parameters 2) Determine participant public-private key pair based on public parameter: participant u i Generate public-private key pair for multiple key encapsulation mechanism as shown in equation (1): wherein the participant u i is randomly selected and calculated the public key and the private key of the participant u i are pk i =(y i , X i ) and sk i =(a i , x i ) respectively, then the participant u i sends (u i , X i ) to the center server, after receiving the messages (u i , X i ) from all participants in the user group U, the center server sorts {u i ∈ U} and broadcasts the sorted to all participants u i ∈ U; 3) determining the center server public-private key partial key pair based on the public parameter: the center server generates a public-private key pair for the multi-key encapsulation mechanism as shown in formula (2): where the center server randomly selects and computes μ = g v Then, the center server publishes the public key pk = (pk, μ) and keeps the private key sk = (sk, v) secret; 4) Determine participant session key based on partial key pair of public and private key: After receiving all participant ordered public key and the public key of the center server, participant u i Compute n-1 pairs of encapsulation / decapsulation keys as shown in equation (3): wherein KU i，j is a session key from participant u i to participant u j , CU i，j is an encapsulation of the key KU encapsulated in i，j , participant u i publishes {(CU i，j , u i , u j ) | u i , u j ∈ U, i≠j}; 5) determining the center server session key based on the public-private key partial key pair: the center server generates a key for each pair of users (i, j) according to the following formula as shown in formula (4): wherein K i，j is a session key, C i，j is used K i，j to encrypt a message, then the center server publishes the message {(C i，j , u i , u j )|u i , u j ∈ U, i≠j}; 6) Participant initiated three-party negotiation key based on session key: At participating user u j Broadcast out X j and the center server broadcasts out pk, user u i Compute key set KU j，i and K i，j Compute three-party agreement key as shown in formula (5): where sid = CU j，i ||CU i，j ||C i，j ; 7) Session key based three-party negotiation key initiated by the center server: In the case of participating users u i and u j broadcasting out X i and X j , the center server calculates the key group KU i，j and KU j，i and calculates the three-party agreement key as shown in equation (6): where sid = CU j，i || CU i，j || C i，j ; 8) Obtain encrypted local gradient based on three-party negotiated key: In user u i and each user u i except u j generate a shared key {k i,j} i≠j , the user u i encrypts his own local gradient m i as shown in formula (7): Here j traverses each value not equal to i; 9) Obtain the auxiliary verification tag and signature based on the encrypted local gradient and the user's private key: collaborator u i Compute the local gradient auxiliary verification tag as shown in equation (8): and Collaborator u i Randomly selecting And calculate formula (9), formula (10) and formula (11): s i = k i -a i e i mod p (11), where t i is a timestamp, finally, the collaborator u i sends the tuple to the central server with signature τ i = (r i , s i ) and timestamp t i ; 10) obtaining proof information, aggregation result and proof based on auxiliary verification label and signature: the center server verifies as shown in formula (12): where, for each 1≤i≤n, If it is true, then the local gradient tuples of all participants are considered to be valid, and then the center server calculates formula (13): and for each u i ∈ U, the center server computes formula (14): The central server continues to calculate where is the sum of all u i ∈ U The central server randomly selects and calculates equation (15), equation (16), and equation (17): δ = g z (15), wherein, is a timestamp, lastly, the tuple is broadcast to all collaborators; 11) Obtain the verification result: each collaborator u i Compute and verify equation (18): If true, then collaborator u i Verify equation (19): If formula (19) is not true, then the participant u i If formula (19) is not true, then the participant u broadcasts a message to the other participants to abort the authentication, and if all participants verify that formula (19) is true, then each participant proceeds to verify formula (20): If formula (20) is satisfied, the participant u i Believe m is equal to the expected real gradient aggregation value and accept the global parameter m.

2. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the verifiable federated learning method for secure data aggregation in industrial control networks as claimed in claim 1.

3. A non-transitory computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 2. The computer program is executed by the processor to realize the verifiable federated learning method for secure data aggregation in industrial control networks as claimed in claim 1.

4. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to realize the verifiable federated learning method for secure data aggregation in industrial control networks as claimed in claim 1.

Images