Trustzone-based federated learning method

Abstract

The application discloses a kind of TrustZone-based federated learning methods, comprising: using TrustZone on client local training, using TrustZone on server to carry out safe aggregation, so that the model parameter or gradient update of enemy hand is hidden, face the challenge of current TrustZone limited memory size, federated learning system trains each model layer in the trusted area using hierarchical training until it converges;Respond to secure data transmission, select symmetric encryption method to encrypt the data output by the client, and transmit the encrypted training data in TrustZone to the server, decrypt in TrustZone before aggregation on the server, encrypt in TrustZone after aggregation and transmit to the client, and then update the model after decryption in TrustZone on the client;Using differential privacy method, set privacy parameter to data, add noise to data in a privacy protection manner, while still allowing accurate analysis to be performed.The application effectively improves the security of the TrustZone-based federated learning system.

Description

Technical Field

[0001] This invention belongs to the field of data security, specifically relating to a federated learning method based on TrustZone. Background Technology

[0002] Federated learning is an evolving field, attracting increasing attention for its use in training machine learning models while protecting the privacy and security of decentralized data. Researchers are exploring various techniques to improve the efficiency and scalability of federated learning and developing new methods for integrating it with other machine learning techniques. Furthermore, new applications of federated learning are being developed, such as federated recommender systems, federated speech recognition, and federated computer vision.

[0003] Trusted Execution Environments (TEEs) are also a rapidly developing field, with researchers working to improve their performance and security to enable wider adoption in various applications, including federated learning. Furthermore, efforts are underway to develop TEEs capable of running on a wider range of devices and platforms, and to integrate them more seamlessly into existing software systems. TEEs are widely used across various domains to provide a secure execution environment for sensitive tasks and protect sensitive data. In the context of federated learning, TEEs are used to protect data and model parameters during training. Researchers are exploring various approaches to implementing federated learning TEEs, including hardware-based TEEs, software-based TEEs, and hybrid TEEs combining hardware and software security. Additionally, work is being conducted to improve the performance and scalability of federated learning TEEs.

[0004] Research on TEEs and federated learning is active and ongoing. TEEs are increasingly being applied across various fields, including security, cryptography, and cloud computing, providing secure execution environments for sensitive tasks and protecting sensitive data. The use of TEEs in federated learning as a way to protect the privacy and security of decentralized data and models during training is also gaining popularity. Researchers are exploring various methods for implementing federated learning TEEs, including hardware-based TEEs, software-based TEEs, and hybrid TEEs combining hardware and software security. Furthermore, efforts are underway to improve the performance and scalability of federated learning TEEs, as well as to develop new technologies for integrating TEEs with federated learning systems.

[0005] To date, federated learning and TEEs are active research and development areas in machine learning and computer security. In recent years, the use of federated learning has grown rapidly due to the increasing demand for privacy-preserving machine learning models and the growth of distributed data sources. Current work aims to improve the efficiency and scalability of federated learning and develop new technologies for training models on distributed and heterogeneous data. However, TrustZone-based solutions suffer from limitations such as limited runtime space, limited modifiability, and low general applicability. How to further improve the security of TrustZone-based federated learning systems is a problem that needs to be addressed. Summary of the Invention

[0006] To address the problems existing in current technologies, the primary objective of this invention is to improve data privacy and security in federated learning. This invention presents a secure federated learning system that uses TrustZone to defend against information leaks in cloud servers and member inference attacks on cloud servers and edge clients. It is a hardware-secure end-to-end federated learning framework that protects the aggregator and edge clients in a real-world environment. It employs AES symmetric encryption to encrypt data output from both the client and server, and uses differential privacy methods to set privacy parameters for the data, thereby achieving both training integrity and user privacy protection.

[0007] The objective of this invention is achieved through the following technical solution:

[0008] A TrustZone-based federated learning method includes the following steps:

[0009] S1. Generate a safe zone and a real zone based on a trusted execution environment, set an initial value for a maximum number of iterations, and select a training model and dataset;

[0010] S2. The client sends a request to the server to download the initial model parameters. The server responds to the request by sending the initial model parameters into a secure area and encrypting them using symmetric encryption. Then, it sends the encrypted model parameters to the client.

[0011] S3. Using the client-side algorithm, the client verifies with the federated learning server, then sends the encrypted model parameters to the local secure area for decryption. After that, the decrypted model is trained in layers, and the generated model parameters are encrypted using the differential privacy method in the secure area and then sent to the server.

[0012] S4. Using a server-side algorithm, the server receives model parameters from each client, decrypts them in a secure area, and runs a federated averaging function in the server's TEE to aggregate all trained model parameters from each client, resulting in a globally trained model. The server uses data forgetting to hide the actual memory reference sequence.

[0013] S5. The server calculates the loss function on the global model. If the loss function satisfies the error constraint, the server sends the encrypted global model to each client. Otherwise, another round of steps S3 to S5 will be performed. A client can exit at any time during the training process, but can only rejoin after one round of training. The process stops when the maximum number of iterations is reached.

[0014] The server-side algorithm is adapted to TrustZone.

[0015] The client algorithm described is a client algorithm adapted for TrustZone.

[0016] The symmetric encryption described in step S2 uses the AES symmetric encryption method adapted to TrustZone.

[0017] The differential privacy method described in step S3 involves adding DP noise to the model parameters.

[0018] The TrustZone mentioned in step S1 uses trusted technology to generate a secure zone and a real zone on the operating system. Without the user's permission, data interaction between the secure zone and the real zone cannot be realized.

[0019] The security zone mentioned in step S1 is a security zone memory allocated by the operating system to store security zone data.

[0020] The layered training described in step S3 allows for the selection of layers to be trained in a safe zone, while the remaining layers are trained in the real environment.

[0021] This invention, based on the TrustZone federated learning method, provides a platform for isolated execution and secure data processing in federated learning. Furthermore, it upgrades the system's security using AES symmetric encryption and differential privacy methods to prevent attackers from intercepting and obtaining data. Compared with existing technologies, this invention has the following advantages and beneficial effects:

[0022] 1. This invention uses TrustZone for local layered training on the client side and TrustZone for secure aggregation on the server side, thereby hiding model parameters or gradient updates from adversaries. In the face of the challenge of the limited memory size of TrustZone, the system utilizes layered training to train each model layer in a trusted region until it converges.

[0023] 2. To address the issue of secure data transmission, this invention employs a symmetric encryption method to encrypt the data output by the client. The training data is encrypted in TrustZone before being transmitted to the server. Before aggregation on the server, the data is decrypted in TrustZone. After aggregation, the data is encrypted in TrustZone and transmitted to the client. The client then decrypts the data in TrustZone and updates the model.

[0024] 3. This invention uses a differential privacy method to set privacy parameters on the data, adding noise to the data in a way that protects privacy while still allowing accurate analysis to be performed. Attached Figure Description

[0025] Figure 1 This is a flowchart of the federated learning method based on TrustZone in this invention;

[0026] Figure 2 This is an overall architectural diagram of the present invention;

[0027] Figure 3 This is a comparison chart of the accuracy of the embodiments of the present invention compared to traditional federated learning;

[0028] Figure 4 This is a comparison chart of the accuracy before and after differential privacy in an embodiment of the present invention. Detailed Implementation

[0029] To make the objectives and technical solutions of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and embodiments, but the implementation of this invention is not limited thereto.

[0030] This invention emphasizes the high security of federated learning and aims to design a method suitable for combining federated learning with TrustZone. This invention needs to solve two key problems. Firstly, one challenge lies in improving the security of the federated learning system to protect the privacy of various data on the client side. Secondly, while ensuring TrustZone configuration, another challenge is how to enhance the privacy of data transmission between the client and server. Some basic concepts related to this invention are:

[0031] (1) Federated Learning: Federated learning is a machine learning method that allows multiple devices or parties to train models on their local data while keeping their data private on the devices. It enables the training of deep learning models on decentralized data without compromising privacy or security. In particular, the learning task is solved by a large number of participating clients. To protect user privacy, clients are often assigned local data and trained on it.

[0032] (2) TrustZone: TrustZone is a secure zone on a computer or mobile device designed to protect sensitive data and code from tampering and unauthorized access. TEE provides an isolated environment for running code and storing data, making them ideal for storing and processing sensitive information such as encryption keys, payment information, and personal data.

[0033] (3) AES Symmetric Encryption: Symmetric encryption is an encryption method that uses the same symmetric key to encrypt and decrypt plaintext. A symmetric encryption scheme is defined as a tuple (including key generation, encryption process, and decryption process). Compared with public key encryption, symmetric encryption has a faster encryption speed and higher efficiency.

[0034] (4) Differential Privacy: Differential privacy is a cryptographic algorithm technique for analyzing and designing privacy-preserving algorithms that allow individuals to share their data while protecting their sensitive information. The main idea behind differential privacy is to add noise to query results or datasets to prevent third parties from being unable to accurately determine whether certain specific data exists in the dataset after theft. Formally, a mechanism is called differential privacy if its output does not indicate the presence or absence of any personal data, unless such information can be inferred from the data without the mechanism. In other words, the output of the mechanism should be nearly identical regardless of whether the input contains data from a specific individual.

[0035] Example

[0036] This embodiment implements a federated learning method to improve the protection of privacy and the integrity of training systems, thereby ensuring the integrity of the deep learning process; such as Figure 1 As shown, this embodiment includes the following steps:

[0037] S1. Generate a safe zone and a real zone based on a trusted execution environment, set an initial value for a maximum number of iterations, and select a training model and dataset;

[0038] S2. The client sends a request to the server to download the initial model parameters. The server responds to the request by sending the initial model parameters into a secure area and encrypting them using symmetric encryption. Then, it sends the encrypted model parameters to the client.

[0039] S3. Using the client-side algorithm, the client verifies with the federated learning server, then sends the encrypted model parameters to the local secure area for decryption. After that, the decrypted model is trained in layers, and the generated model parameters are encrypted using the differential privacy method in the secure area and then sent to the server.

[0040] S4. Using a server-side algorithm, the server receives model parameters from each client, decrypts them in a secure area, and runs a federated averaging function in the server's TEE to aggregate all trained model parameters from each client, resulting in a globally trained model. The server uses data forgetting to hide the actual memory reference sequence.

[0041] S5. The server calculates the loss function on the global model. If the loss function satisfies the error constraint, the server sends the encrypted global model to each client. Otherwise, another round of steps S3 to S5 will be performed. A client can exit at any time during the training process, but can only rejoin after one round of training. The process stops when the maximum number of iterations is reached.

[0042] In other words, both the server and each client have machines that support TrustZone and are allowed to train a model parameter set. Each client inspects the model, decrypts it in a secure zone, trains it locally on private data, adds noise, and then sends the model parameter set to the server. The server uses its TrustZone module to verify the model parameter set, decrypts it in a secure zone, comprehensively evaluates the noise, and aggregates the models trained by each client using a federated averaging function (such as a weighted average, geometric median, etc.) to generate a globally trained model.

[0043] like Figure 2 As shown, before the training process begins, each client receives model parameters and verifies them with the federated learning server. Assuming a legitimate federated learning server exists, it will function correctly with the protocol but may attempt to gather information from the trained model. An outside colluding participant might inspect messages exchanged between the federated learning server or the final model to collect private data from other participants. Both the server and clients possess machines with TrustZone support, allowing the training of a model parameter. Each client inspects the model, decrypts it in a secure zone, trains it locally on private data, adds noise, and then sends the model parameters to the server. The server verifies the clients using its TrustZone module, decrypts the model in a secure zone, comprehensively evaluates the noise, and aggregates the trained models using a federated averaging function (e.g., weighted average, geometric median, etc.) to generate a globally trained model.

[0044] In this embodiment, the specific process of the federated learning server method is as follows:

[0045] (1) Select clients with sufficient TEE memory and initialize the list of participating clients;

[0046] (2) Initialize parameters in the TEE, including performing local updates on the client and decrypting the server before aggregation;

[0047] (3) Use an upgrade algorithm to achieve secure aggregation and encrypt parameters on the server;

[0048] (4) Backup the encrypted parameters in the TEE and store them in the REE.

[0049] In this embodiment, the specific process of the federated learning client method is as follows:

[0050] (1) Upon receiving global model parameters, select to send them to TEE;

[0051] (2) Conduct forward propagation training and backward propagation training in TEE;

[0052] (3) Update the parameters of the current layer and perform local parameter trimming;

[0053] (4) Add noise and encrypt the parameters before uploading.

[0054] The experimental results of this embodiment on the LeNet accuracy on the MNIST dataset, compared to traditional federated learning, are as follows: Figure 3 As shown in the figure, the experimental results comparing the accuracy before and after differential privacy are as follows: Figure 4 As shown.

[0055] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A TrustZone-based federated learning method, characterized in that, The method comprises the following specific steps: S1, generating a secure area and a real area based on a trusted execution environment, setting an initial value of a maximum iteration number, selecting a training model and a data set; S2, the client requests the server to download the initial model parameters, the server responds to the request, sends the initial model parameters into the secure area and uses symmetric encryption, and then sends the encrypted model parameters to the client; S3, using the client algorithm, the client verifies the federated learning server, then sends the encrypted model parameters into the local secure area for decryption, then trains the decrypted model in layers, uses differential privacy method for the generated model parameters, then encrypts in the secure area, and sends the encrypted model parameters to the server; S4, using the server algorithm, the server receives the model parameters sent by each client, sends them into the secure area for decryption, and runs the federated average function in the TEE of the server to aggregate all the trained model parameters of each client, to obtain a globally trained model; the server uses data oblivion to hide the actual memory reference sequence; S5, the server calculates the loss function on the global model; if the loss function meets the error constraint, the server sends the encrypted global model to each client, otherwise another round of steps S3 to S5 will be performed; one party can quit at any time during the training process, but can only join after a round of training, and stop when the maximum iteration number is reached.

2. The TrustZone-based federated learning method of claim 1, wherein, The server algorithm is a server algorithm adapted to TrustZone.

3. The TrustZone-based federated learning method of claim 1, wherein, The client algorithm is a client algorithm adapted to TrustZone.

4. The TrustZone-based federated learning method of claim 1, wherein, The symmetric encryption in step S2 uses an AES symmetric encryption method adapted to TrustZone.

5. The TrustZone-based federated learning method according to claim 1, characterized in that, The differential privacy method in step S3 adds DP noise to the model parameters.

6. The TrustZone-based federated learning method according to claim 1, characterized in that, The TrustZone in step S1 is to generate a secure area and a real area on the operating system using trusted technology, and the data interaction between the secure area and the real area cannot be realized without user permission.

7. The TrustZone-based federated learning method according to claim 1, characterized in that, The secure area in step S1 is to generate a secure area by allocating secure area memory to the operating system, which is used to store secure area data.

8. The TrustZone-based federated learning method according to claim 1, characterized in that, The layered training in step S3 is to select the layers to be sent into the secure area for training, and the remaining layers are trained in the real area.

Images