Data security aggregation method and system based on multi-homomorphic property

Abstract

This invention relates to a data security aggregation method and system based on multiple homomorphic attributes. Users generate a random mask using a seed as a privacy parameter. This random mask masks each user's private input. A temporary key and a global public key are used to encrypt the privacy parameter, and the ciphertext and the masked private input are sent to an aggregation server. The aggregation server aggregates the received ciphertext from each user and returns the aggregation result to the user. Users then use a temporary key, their own client private key, and the server's public key to perform a transformation calculation on the aggregation result and send the transformation calculation result back to the aggregation server. The aggregation server decrypts the transformation result using its private key, obtains the seed sum, uses the seed sum to obtain the random mask sum, aggregates the masked private input to obtain the privacy input sum, and subtracts the random mask sum from the privacy input sum to obtain the global parameters in federated learning. This invention improves aggregation efficiency and is suitable for federated learning on large-scale mobile terminals and IoT devices.

Description

Technical Field

[0001] This invention relates to the field of federated learning technology, and in particular to a data security aggregation method and system based on multiple homomorphic attributes. Background Technology

[0002] Federated learning allows multiple distributed devices to train local models using their local data, and then a central server aggregates these local models to generate a global model by exchanging them. Since the data doesn't leave the local device, users don't face the risk of privacy data leakage compared to traditional centralized data training. Federated learning has the advantage of using rich data from different sources to train high-quality models. With the development of mobile IoT, the number of devices connected to the network is increasing, such as mobile terminals and IoT devices. This massive scale contains a large amount of valuable data, and it has become a reality for enterprises to use this data for federated learning to train high-quality models, providing users with a better experience and enhancing industry competitiveness. Compared to traditional centralized data training, federated learning significantly reduces the risk of privacy leakage by sharing models. However, as research has deepened, studies have shown that privacy attacks can still steal user privacy data through model updates, such as member inference attacks and attribute inference attacks. Therefore, protecting local models in federated learning is necessary. To this end, existing research has proposed privacy protection mechanisms based on secure multi-party computation, homomorphic encryption, and differential privacy to protect local models in federated learning.

[0003] Differential privacy involves users adding carefully crafted noise to their model parameters before uploading their local model to the aggregation server. This protects the local model while the server aggregates the perturbed model to obtain an approximate result based on the differential privacy property. However, this method requires a trade-off between privacy protection and model utility; more noise provides better model protection but results in lower model quality. Homomorphic encryption-based aggregation schemes involve users encrypting their local model using a homomorphic encryption algorithm and sending the ciphertext to the server. The server aggregates the ciphertext and returns the result to the participants for decryption before starting a new round of training. For schemes using full homomorphic encryption, users train directly on the ciphertext. Homomorphic encryption protects the model from leakage without affecting its quality. However, the computational and communication overhead of homomorphically encrypting high-dimensional model parameters is expensive. In cross-device federated learning, participants are typically numerous mobile terminals and IoT devices with limited computing and communication resources, whose performance may not meet training requirements. Homomorphic encryption may require additional security assumptions, such as the need for all participants to share a key and the intolerance of collusion between the server and users. For example, the practical secure aggregation scheme SecAgg achieves privacy-preserving model aggregation through lightweight one-time key encryption. Users u and v share a seed s_(u, v), and then use a pairwise masking mechanism to protect the model. After aggregation, the masks cancel each other out to obtain the global model. However, to generate the pairwise masks, SecAgg requires users to perform a large number of key negotiations and secret sharing, making the computational overhead of secure aggregation quadratic in terms of the number of users. Furthermore, due to the use of pairwise masks, the aggregation time increases significantly with the number of offline users to eliminate the impact of offline users. When there are d offline users, the server needs to perform (nd)d key recovery operations to ensure correct aggregation, which may not be suitable for federated learning scenarios with large-scale user participation. Summary of the Invention

[0004] To address these issues, this invention provides a data security aggregation method and system based on multiple homomorphic attributes, which solves the problems of privacy leakage, resource constraints, and frequent user logouts that exist in federated learning on existing large-scale mobile terminals and IoT devices.

[0005] According to the design scheme provided by this invention, a data security aggregation method based on multiple homomorphic attributes is provided for privacy protection in federated learning, comprising:

[0006] Each user generates a client public-private key pair locally, the aggregation server generates a server public-private key pair, and each client sends its own client public key to the aggregation server. The aggregation server generates a global public key by merging the client public keys, and sends the global public key and the server public key to each user.

[0007] Each user uses a seed as a privacy parameter, generates a random mask using a pseudo-random number from the seed, masks the privacy input using the random mask, encrypts the privacy parameter using a locally generated temporary key and a global public key, and sends the encrypted ciphertext and the masked privacy input to the aggregation server; the aggregation server aggregates the received ciphertexts from each user according to the additive homomorphism of the encryption algorithm, and returns the aggregated ciphertext to the user.

[0008] Users use a temporary key, their own client private key, and the server public key to perform transformation calculations on the aggregated ciphertext, and send the transformation calculation results to the aggregation server. The aggregation server uses the server private key to decrypt the transformation results to obtain the user's seed sum, uses the seed sum to generate a random mask sum, and the aggregation server obtains the privacy input sum by aggregating the masked privacy input. The global parameters of federated learning are obtained by subtracting the random mask sum from the privacy input sum.

[0009] As a data security aggregation method based on multiple homomorphic attributes in this invention, before each user encrypts their own private input using a locally randomly generated temporary key and a global public key, the method further includes: generating a random mask using a seed pseudo-random number generator, and encrypting the private input using the random mask, wherein the seed pseudo-random number generator uses a pseudo-random number function with homomorphic attributes.

[0010] As a data security aggregation method based on multiple homomorphic attributes in this invention, a random mask is further generated using a seed pseudo-random number generator, comprising:

[0011] First, a shared input sequence is constructed by concatenating the training round number and the model parameter index;

[0012] Then, based on the shared input sequence, a random mask is generated using a seed pseudo-random number generator.

[0013] As a data security aggregation method based on multiple homomorphic attributes in this invention, a random mask is further generated using a seed pseudo-random number generator, the generation process of which is expressed as: r i =SHPRG(s i ), where SHPRG(s i )=[F(s i [b||τ)], 0<b<L, where b is the index of each model parameter and L is the index of the user's local model m. iThe length of τ is the current training round number, s i For user u i A seed randomly selected locally, F(s) i b||τ)=s i H(b||τ), where H() is the hash function.

[0014] As a data security aggregation method based on multiple homomorphic attributes in this invention, a random mask is generated using a seed pseudo-random number generator. The generation process further includes: representing the seed randomly selected by the user locally using several of its congruent numbers; generating a random mask based on the seed pseudo-random number generator; and then performing CRT encoding on the seed to transform random mask aggregation into seed aggregation in data aggregation.

[0015] As a data security aggregation method based on multiple homomorphic attributes in this invention, it further includes: before federated learning training, each user divides its client private key into t shares with a preset threshold t, and secretly shares each share with other users, so as to tolerate user withdrawal during data security aggregation.

[0016] As a data security aggregation method based on multiple homomorphic attributes in this invention, the data security aggregation tolerates user exit from training, which includes: if a user exits training in federated learning training, other users send their received shares to the server. After receiving more than t shares, the server reconstructs and recovers the client private key of the user who exited training, so that the server can obtain global parameters by aggregating and decrypting the received second ciphertext.

[0017] Furthermore, the present invention also provides a data security aggregation system based on multiple homomorphic attributes for privacy protection in federated learning, comprising: local users consisting of several clients and an aggregation server connected to each local user, wherein each user generates a client public-private key pair locally, the aggregation server generates a server public-private key pair, and each client sends its own client public key to the aggregation server, the aggregation server generates a global public key by merging the client public keys, and sends the global public key and the server public key to each user;

[0018] Furthermore, in the data security aggregation process, firstly, each user uses a seed as a privacy parameter, generates a random mask using a pseudo-random number from the seed, and masks the privacy input using the random mask. The privacy parameter is then encrypted using a locally generated temporary key and a global public key, and the encrypted ciphertext and the masked privacy input are sent to the aggregation server. The aggregation server aggregates the received ciphertexts from each user based on the additive homomorphism of the encryption algorithm and returns the aggregated ciphertext to the user. Next, the user uses a temporary key, their own client private key, and the server public key to perform a transformation calculation on the aggregated ciphertext and sends the transformation result to the aggregation server. The aggregation server decrypts the transformation result using its private key to obtain the user's seed sum, generates a random mask sum using the seed sum, and obtains the privacy input sum by aggregating the masked privacy input. Finally, the global parameters for federated learning are obtained by subtracting the random mask sum from the privacy input sum.

[0019] The beneficial effects of this invention are:

[0020] This invention uses a public key to encrypt the seed's private input, ensuring that the server can decrypt the sum of the private inputs using its private key without knowing the individual private inputs. It tolerates worst-case user collusion, i.e., the existence of n-2 colluding users. Furthermore, it combines homomorphic pseudo-random number technology to transform random vector aggregation into seed aggregation, avoiding the computational overhead of high-dimensional vector encryption and the communication overhead of ciphertext transmission. It further introduces a secret sharing mechanism to tolerate users withdrawing from training at any time during aggregation, with minimal increase in client computation time. Experimental data analyzes the correctness, security, and efficiency of the scheme. Experimental results show that the aggregation time of the proposed scheme increases linearly with the number of users and decreases as the number of disconnected users increases. Compared to state-of-the-art privacy-preserving aggregation schemes, this scheme significantly improves aggregation efficiency without compromising privacy guarantees and user withdrawal tolerance. With 500 users and a 30% disconnection rate, it reduces aggregation time by approximately 24 times, showing promising application prospects in federated learning for large-scale mobile terminals and IoT devices. Attached image description:

[0021] Figure 1 This is a schematic diagram of federated learning aggregation in the embodiment;

[0022] Figure 2 This is a schematic diagram of the secure aggregation interaction process in the embodiment. Detailed implementation method:

[0023] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0024] To address the privacy leaks, resource constraints, and frequent user logouts associated with federated learning on large-scale mobile terminals and IoT devices as described in the background art, this invention provides a data security aggregation method based on multiple homomorphic attributes for privacy protection in federated learning. The method includes: First, each user generates a client public-private key pair locally, the aggregation server generates a server public-private key pair, and each client sends its own client public key to the aggregation server. The aggregation server generates a global public key by fusing the client public keys and sends the global public key and the server public key to each user. Next, each user uses a seed as a privacy parameter, generates a random mask using a pseudo-random number generated from the seed, and masks the privacy input using the random mask. A randomly generated temporary key and a global public key are used to encrypt the privacy parameters. The encrypted ciphertext and the masked privacy input are then sent to the aggregation server. The aggregation server aggregates the received ciphertexts from each user based on the additive homomorphism of the encryption algorithm and returns the aggregated ciphertext to the user. The user then uses the temporary key, their own client private key, and the server public key to perform a transformation calculation on the aggregated ciphertext and sends the transformation result to the aggregation server. The aggregation server uses its private key to decrypt the transformation result to obtain the user's seed sum. It uses the seed sum to generate a random mask sum. The aggregation server obtains the privacy input sum by aggregating the masked privacy input. Finally, it subtracts the random mask sum from the privacy input sum to obtain the global parameters for federated learning.

[0025] Similar to the SecAgg scheme, this embodiment divides participants into two categories: users and aggregation servers. The basic structure and aggregation process are as follows: Figure 1 As shown, the aggregation server S acts as the central hub responsible for aggregating data from the user set. Input from n users.

[0026] Table 1. Description of symbols in the text

[0027]

[0028] user Holding a local private dataset, representing a client, and obtaining a local model m by training on the local dataset. i Other symbols are described in Table 1. The goal of this solution is to enable the server to obtain information about a single user u when it is unable to do so. i Model m i Aggregate global model in the case At the same time, it is also necessary to ensure robustness to user logout at any time to meet the needs of cross-device federated learning applications.

[0029] Users encrypt the seed, which is used as a privacy parameter, using a public key. This ensures that the server can decrypt the seed using its private key without knowing the individual seed. Without considering the possibility of users leaving the server, the worst-case scenario of user collusion can be tolerated, i.e., there are n-2 users colluding.

[0030] The threat model considers a semi-honest federated learning environment, where the aggregation server and users may be semi-honest, following rules during training but curious about the local models of honest users, intending to infer customers' local private data by observing these local models. The proposed solution aims to maintain the confidentiality of individual model updates for each user, with all participants only allowed to learn the sum of all user private inputs.

[0031] In addition to the semi-honest setting, the scenario of collusion between the aggregation server and users needs to be considered. That is, the server may collude with some users, sharing internal state and all received / sent messages with other colluding users, intending to increase the success rate of stealing the privacy data of other honest users. For the collusion scenario, the proposed solution aims to guarantee the confidentiality of the honest client model; that is, if fewer than T users collude with the server, they will not learn any local model information of the honest users. (This is not considered in the context of the previous sentence.) This is because, in this scenario, colluding users and servers can calculate the model information of honest users from the aggregation results by subtracting. Furthermore, regarding the setting of the T value, in a cross-host federated learning environment, without considering user disconnection issues, the maximum number of colluders that this solution can tolerate is [value missing]. In a cross-device federated learning environment, considering the possibility of users leaving training at any time, the maximum number of colluding users that this solution can tolerate depends on the threshold of secret sharing, with a maximum of [missing value]. Lowering tolerance is reasonable in a cross-device federated learning environment because the large number of users, geographically dispersed, greatly reduces the likelihood of large-scale user collusion.

[0032] To protect the security of users' local models, many studies have proposed using differential privacy and homomorphic encryption. However, in differential privacy, excessive noise reduces model utility, while too little noise is insufficient to guarantee model security. Homomorphic encryption can effectively protect models, but it requires expensive computational and communication overhead when dealing with high-dimensional models. One of the most intuitive and simplest ways to protect models is through a one-time pad (OTP). A generated random mask is used as a one-time key to mask the model, scrambling the distribution of the masked model parameters. Based on the security of the one-time key, confidentiality can be fully guaranteed without revealing the key, effectively preventing privacy attacks against the local model. Furthermore, protecting the model involves only one addition operation, making it highly efficient compared to other protection methods. SecAgg uses pairwise masks to protect the model, ensuring that the masks of all users cancel each other out after aggregation. However, this requires extensive communication to negotiate the pairwise masks, and the aggregation time increases significantly with the number of disconnected users.

[0033] In this embodiment, an independent mask can be used to protect the model, avoiding the communication overhead caused by mask negotiation with other users. The basic idea is that the user generates a random mask locally to cover the model in order to protect the local model parameters.

[0034] Assume user u i The model is m i By randomly selecting seeds s i The independent random mask generated using the pseudo-random generator is r. i And use random masks to mask the local model parameters:

[0035]

[0036] After that, all users will Send it to the server to participate in the aggregation.

[0037] The aggregation server receives the user model Then, assume the server already knows the sum of the user's local random mask. The server can aggregate the global model m G :

[0038]

[0039] The most direct way to obtain the sum R of the random mask is by user u i Use the local random mask r i It is sent to the server through a secure channel, but in the threat model considered in this paper, the server is semi-honest, and it can be transmitted via... The user's original local model m can be calculated. i This poses a risk of privacy breaches. To address this issue, it is necessary to ensure that the server is unaware of the privacy settings of individual users. i Calculate R under the given conditions.

[0040] EC-ElGamal is an elliptic curve (EC) implementation of the ElGamal encryption algorithm, possessing additive homomorphism. EC-ElGamal's security is based on the discrete logarithm problem (ECDLP) on EC. Under the Decisional Diffie-Hellman (DDH) assumption, it is IND-CPA secure. Its additive homomorphic encryption scheme is described below:

[0041] initialization

[0042] 1. Choose a prime number p, determine the finite field GF(p), and make p public.

[0043] 2. Choose elements a, b∈GF(p), determine an elliptic curve on GF(p), determine the additive commutative group E, and make a and b public.

[0044] 3. Choose a large prime number n and determine a base point G(x, y) of order n. Make n and G(x, y) public.

[0045] 5. Randomly select an integer d (0 < d < n) as the private key sk and keep it secret. Then the public key is:

[0046] pk = skG

[0047] Encryption: (C1, C2) ← ECE.EncP m k i ,pk:

[0048] Assume message P to be sent m The user randomly selects parameter k∈Z n Calculate (C1, C2) according to the following operations:

[0049] C1=k i G, C2 = P n G+k i pk

[0050] Decryption: P m ←ECE.Dec(C2, C1, sk):

[0051] To decrypt (C1, C2), the user calculates m = C2 - skC1:

[0052] P m =P mG+k i pk-skk i G

[0053] =P m G+k i (skG)-k i skG

[0054] Additive Homomorphism: EC-ElGamal encryption exhibits additive homomorphism, assuming plaintext... The ciphertexts are respectively Add the ciphertext:

[0055]

[0056] It can be obtained by using sk decryption To obtain plaintext This requires solving the discrete logarithm problem on elliptic curves. Computational efficiency can be improved by using the Chinese Remainder Theorem (CRT) to transform a difficult ECDLP problem (i.e., a large integer problem) into solving several smaller ECDLP problems. In this embodiment, privacy-preserving aggregation using multi-party random masking is achieved based on EC-ElGamal additive homomorphism and homomorphic pseudo-random numbers.

[0057] In order to correctly calculate R without exposing r to the server i This algorithm can achieve multi-key privacy aggregation based on the homomorphism and ciphertext correlation of homomorphic EC-ElGamal. It allows users to use a public key and a random temporary key k. i This algorithm encrypts the private input, performs ciphertext computation, and ultimately allows the server to decrypt the sum of the private input using its private key. This avoids the security risks associated with key sharing, as users do not need to share keys. The basic idea is to achieve the sum of the private input and the ciphertext in a single interaction between the user and the server, converting the encryption key of the private input and ciphertext into the server S's public key. This allows the server S to decrypt R using its private key. This algorithm guarantees... The confidentiality of the private input of honest non-colluding users in cases involving a semi-honest colluding user.

[0058] Assume v i User u i To ensure privacy of input, as shown in Algorithm 1, each user first generates a public-private key pair locally. The server generates a public-private key pair sk. s , pk s Then the user sends the public key to the server, and the server calculates the global public key PK:

[0059]

[0060] The server will handle PK and pk. s Send to each user.

[0061] User u i Randomly generate a large integer k i As a temporary key, then use the global public key PK and the temporary key k i For privacy input v i Encrypt:

[0062]

[0063] Afterwards, the user will encrypt the text. Send to the aggregation server.

[0064] Server S calculates the ciphertext based on the additive homomorphism of EC-ElGamal:

[0065]

[0066] Server S will calculate the result C 1，s C 2，s Returned to the user, user u i Calculated locally:

[0067]

[0068] Then, the calculation results Send to server S, server S receives Then calculate:

[0069]

[0070] The calculation result is in The aggregation server S can use the private key sk s Decryption Want to obtain The discrete logarithm problem on elliptic curves needs to be solved, in v i The element value is small and v i At lower dimensionalities, the server is computationally feasible, but when v... i The element value is large and v i High dimensionality can lead to low aggregation efficiency.

[0071] Algorithm 1. Multi-key privacy aggregation algorithm.

[0072] Input: User u i public-private key pair sk i , pk iPrivacy input v i Aggregator server S public and private key pair sk s , pk s

[0073] Output: Sum of private inputs and V

[0074] initialization:

[0075] 1. User u i ∈U will use the public key pk i Send to aggregation server S;

[0076] 2. The server received the PK (player kill) message. i Then calculate PK and pk s Send to each user;

[0077] Phase 1:

[0078] 3. User u i In generating a random temporary key k i Use PK to encrypt the privacy input v i : and the results Send to the server;

[0079] 4. Server S receives user u i Submitted Calculate: (C) 1，s C 2，s );

[0080] 5. Calculate the results (C) 1，s C 2，s Send to the user;

[0081] Phase Two:

[0082] 6. User u i Received server calculation results (C) 1，s C 2，s Then calculate:

[0083] 7. Send the calculation results to the aggregation server;

[0084] 8. Aggregation server S receives user u i Submitted Then calculate: (C′) 1，s C′ 2，s );

[0085] 9. Aggregator server S uses private key sk s Decrypt (C′) 1，s C′ 2，sWe get: V = ECE.Dec(C′) 1，s C′ 2，s ,sk s )

[0086] Algorithm 1 ensures that the server can calculate the sum of private inputs without exposing the user's private inputs. In the case of fewer than N-1 users colluding with the server, it can be guaranteed that the server can obtain the sum of private inputs without disclosing the private inputs of any party.

[0087] Based on Algorithm 1, the user can set a random mask r i As a privacy input v i To achieve this without exposing any user's r i In this case, the server calculates R, thereby correctly calculating m. G However, this presents two problems in practical applications: 1) Users need to adjust the mask r during the training process. i Encryption is performed with the same dimensionality as the model. This incurs significant computational and communication overhead when dealing with high-dimensional and complex deep learning models. In cross-device federated learning scenarios, most clients are mobile devices, and their hardware may not meet training requirements. 2) To obtain the aggregated privacy input V, the server needs to solve the discrete logarithm problem on the elliptic curve. i Excessive dimensionality and large element values ​​will reduce aggregation efficiency.

[0088] Furthermore, before each user encrypts their own private input using a locally randomly generated temporary key and a global public key, the process includes: generating a random mask using a seed pseudo-random number generator, and encrypting the private input using the random mask. The seed pseudo-random number generator uses a pseudo-random number function with homomorphic properties.

[0089] A pseudorandom function (PRF) is a keyed function F: For a random key Under a given black-box access condition, the function F(k,·) is indistinguishable from a uniformly random function. A homomorphic pseudorandom function (HPRF) is a pseudorandom number function with homomorphic properties, which is indistinguishable for any key. And any input have: A pseudorandom generator (PRG) is a function G that can be efficiently computed. ： for The uniform s and In a uniform r, the distribution of G(s) is computationally indistinguishable from the distribution of r. Similarly, if for any G(s1, x) and G(s2, x), we have The PRG function G is then called: It is a Seed Homomorphic Pseudorandom Generator (SHPRG).

[0090] A simple secure key homomorphic PRF can be constructed within the random oracle model. Assume G is a finite cyclic group of prime order q, and H: If a hash function is modeled as a random oracle, then the constructor F can be constructed: for:

[0091] F(k, x) = k·H(x)

[0092] F(k, x) has additive homomorphism:

[0093] F(k1,x)+F(k2,x)=F(k1+k2,x)

[0094] In the stochastic oracle model, assuming that DDH holds in G, F is a safe PRF.

[0095] Based on the above HPRF, a seeded homomorphic pseudo-random generator SHPRG can be constructed, and can be represented as:

[0096] SHPRG(s, x) = s·H(x)

[0097] satisfy:

[0098] SHPRG(s1+s2,x)

[0099] =SHPRG(s1,x)+SHPRG(s2,x)

[0100] To achieve efficient and secure aggregation in federated learning, considering r i The properties of pseudo-random numbers can be utilized to improve aggregation efficiency by changing the random mask generation method. A seeded homomorphic pseudo-random number generator can be used to generate the random mask, thereby enabling the random mask r to be generated. i Aggregation converted into seed s i This aggregation avoids the computational and communication overhead of encrypting high-dimensional random vectors by users, while reducing the number of times the server needs to solve the ECDLP problem to one. Without compromising security, a CRT can be introduced to transform the difficult ECDLP problem into solving several simpler ECDLP problems, thereby improving aggregation efficiency.

[0101] Specifically, the random mask generated using a seed pseudo-random number generator can be designed to include the following:

[0102] First, a shared input sequence is constructed by concatenating the training round number and the model parameter index;

[0103] Then, based on the shared input sequence, a random mask is generated using a seed pseudo-random number generator.

[0104] When all users share a single x, for any... It satisfies additive homomorphism. Considering that when the generated random mask is unique, using the same random mask to cover all model parameters makes it easy for an adversary to reconstruct the original model parameters through an enumeration attack, given a fixed range of model parameters. Therefore, with a fixed seed, different masks can be generated by transforming the shared input sequence x to cover different model parameters. To avoid the additional communication overhead of negotiating x between users, a shared x sequence can first be constructed by concatenating the training round number and the model parameter index. Then, a random mask r can be generated based on the x sequence using SHPRG. i .

[0105] user Randomly select a seed locally Using SHPRG to generate a mask r i :

[0106] r i =SHPRG(s i )

[0107] Among them, SHPRG(s) i )=[F(s i [b||τ)], 0<b<L, where b is the index of each model parameter and L is the index of the user's local model m. i The length of τ is the current training round number, and F is:

[0108] F(s i b||τ)=s i ·H(b||τ)

[0109] H is a hash function. Based on the properties of SHPRG, we have:

[0110]

[0111] Apply Algorithm 1 to seed s i The aggregation, and finally the server calculates Then, the sum R of the random mask is calculated, avoiding the computational and communication overhead caused by encrypting the high-dimensional random mask.

[0112] Specifically, a random mask is generated using a seed pseudo-random number generator. The generation process also includes: representing the seed randomly selected by the user locally using several of its congruent numbers; generating a random mask based on the seed pseudo-random number generator; and then performing CRT encoding on the seed so as to transform the random mask aggregation into seed aggregation in the data aggregation.

[0113] To reduce server computation time, a CRT can be introduced to process large integers s. i Using its several congruences a i express:

[0114] s i ≡a1 mod p1

[0115] s i ≡a2 mod p2

[0116] …

[0117] s i ≡a n mod p n

[0118] Where p2, ..., p n Pairwise coprime and publicly known, a i <<s i Given a1, a2, ..., a n When the time is right, the unique solution s of the above equation can be calculated. i :

[0119]

[0120] in, Furthermore, based on the additive homomorphism of CRT, given two seeds s i and s j When the lists of congruences are a1, a2 and b1, b2 respectively, we have:

[0121]

[0122]

[0123] Therefore, user u i Using s i Generate r i Then, place the seed s i Perform CRT encoding: Then, Algorithm 1 is used to aggregate the results. Finally, the server decodes the aggregated results to obtain...

[0124] Based on Algorithm 1, SHPRG can be used to transform the high-dimensional mask r i The aggregation is transformed into seeds s i The aggregation, 1 = |s i |<<|r i To avoid the computational and communication overhead caused by users performing encrypted calculations on high-dimensional data, a CRT is introduced to further reduce server computation time and improve overall aggregation efficiency, achieving efficient and secure aggregation using random masks. In practical applications, to further reduce the computational overhead during training, users can calculate the mask r offline. i , as well as

[0125] The above scheme can achieve efficient and secure aggregation of random masks, thus enabling efficient privacy-preserving federated learning. However, Algorithm 1 cannot tolerate user disconnections. To achieve seed s... i Correct aggregation requires the user to receive the ciphertext aggregation result. If a user disconnects and cannot perform the calculation, the aggregation server S will be unable to correctly calculate C′. 1，s C′ 2，s This ultimately leads to the inability to aggregate correctly.

[0126] However, in cross-device federated learning application scenarios, the clients participating in training are usually resource-constrained devices, such as mobile terminals and IoT devices, which may face problems such as unstable network status and energy constraints. They may drop out of training at any time during the training process, which is common in real-world applications. To meet the requirements of this application scenario, the secure aggregation scheme needs to be able to tolerate user disconnection, that is, to ensure the correctness of the aggregation results even when a certain number of users disconnect. Therefore, in this embodiment, additional mechanisms can be added to achieve flexibility in handling user withdrawal from training.

[0127] Specifically, before federated learning training, each user divides their client private key into t shares based on a preset threshold t. Each share is secretly shared with other users to ensure that user exits during data security aggregation are tolerated. This tolerance for user exits during data security aggregation includes: if a user exits training during federated learning, the other users send their received shares to the server. Once the server receives more than t shares, it reconstructs the client private key of the user who exited training. This allows the server to obtain global parameters by aggregating and decrypting the received second ciphertext.

[0128] In (t, n)-secret sharing (SS), a secret *s* is divided into *n* parts, each part being a sub-secret held by a user. Sub-secrets held by *t* or more users can reconstruct secret *s*, while sub-secrets held by fewer than *t* users cannot reconstruct the secret and cannot provide any information about it. For a given secret *s*, the specific operation for (t, n)-secret sharing is as follows:

[0129] Initialization: Secret Holder u s From Z P Randomly select t-1 positive integers a1, ..., a2 from the given data. t-1 Simultaneously, let a0 = s. Based on the above values, select a polynomial with a highest degree of t-1: f(x). s =a0+a1x+a2x 2 +a3x 3 +…+a t-1 x t-1 modP.

[0130] Secret sharing: The secret holder randomly selects n points x1, x2, ..., xn on the polynomial f(x). n Then calculate the function values ​​f(x1), f(x2), ..., f(x) corresponding to each point. n Finally, (x1, f(x1)), (x2, f(x2)), ..., (x n f(x) n Shared as a sub-secret with other users, represented as (x i f(x) i ) s ) i∈n ←ASS.share(s, t, n).

[0131] Secret Reconstruction: Given any number of at least t sub-secrets (x i f(x) i ) s The polynomial f(x) can be determined using Lagrange interpolation. s The expression, where when x = 0, allows us to compute the constant term a0, thus obtaining the secret s, formally represented as s←ASS.recon((x i f(x) i ) s ) i∈n ,t).

[0132] Homomorphism: Shamir secret sharing exhibits additive homomorphism, meaning that for given s1 and s2, performing (t, n) secret sharing and distributing secret shares to other users, the holder of any sub-secret can locally compute the secret share. The sum of t-1 degree polynomials is still of degree t-1, given any number of no less than t subsecrets. calculate When x = 0, calculate

[0133] In this embodiment, by introducing Shamir threshold secret sharing during the pre-training initialization phase, tolerance for users exiting training at any time is achieved, enhancing the robustness of secure aggregation to meet cross-device federated learning application scenarios. At the same time, its additive homomorphism is used to reduce server computation time.

[0134] Before the federated learning training begins, user u i Private key sk is set at a threshold t. i To share in secret: (j, sk) i，j ) represents user u i Share with user u j sk i The secret share.

[0135] Assuming users may exit at any time during the aggregation process, the list of surviving users in the first stage is as follows: They all successfully sent to the server. and The list of surviving users in the second phase is as follows: They all successfully sent to the server.

[0136] Then the server calculates (C) 1，s C 2，s ) and (C′ 1，s C′ 2，s ) are respectively and Because of disconnected users, the server cannot obtain the calculations for those disconnected users. Key conversion cannot be performed without the ability to correctly calculate the key. The calculation formula can be revised, and the server calculates C′. 1，s C′ 2，s :

[0137]

[0138]

[0139] Finally, the server can calculate the ciphertext. The server uses the private key sk s Decrypt (C′) 1，s C′ 2，s )get

[0140] Based on the above process, the server needs to know for correct aggregation. Therefore, if the user... If you exit training, then other users u i Will The secret is sent to server S. After receiving more than t sub-secret shares, the server can reconstruct the secret. Based on the Shamir secret-sharing addition homomorphism, the server only needs one reconstruction to recover the sum of the offline user's private key. Therefore, the computation time does not increase significantly with the increase of the number of offline users.

[0141] Furthermore, the server knows the individual user sk i In this case, it will not affect security because user u i seeds i Encrypted by PK, unless the server knows all other users' sk. i After increasing the tolerance for users leaving training, the tolerable number of colluding users is [number missing]. In addition, some additional realistic assumptions need to be made, namely, to ensure that there is an honest user who will not disconnect during multiple rounds of aggregation.

[0142] In summary, the most preferred embodiment in this case implements privacy-preserving model aggregation based on the efficient and secure aggregation scheme of HMASA. The specific interaction process can be described as follows: Figure 2 As shown, this scheme operates between an aggregation server S and n users, where the user set is represented by... This indicates that user sets at different stages are distinguished by numerical subscripts, for example... For ease of expression, a unique identifier can be assigned to each client, such as 1, 2, ..., n. User parameters are divided by subscripts, and server parameters are represented by the subscript s. Multiple EC-E1Gamal ciphertext sets are represented by the square brackets []. Represents the relationship between congruences. An encrypted set of ciphertext. Each user has a privacy vector m of length L. i As input, each element ranges from Z. qIn this scheme, the aggregation server is responsible for message forwarding between clients and providing necessary computational services. Similar to SecAgg, it assumes that clients and the server communicate via a secure channel. Users may exit the training at any time during the aggregation process. This scheme guarantees that as long as t users survive (i.e., the server receives messages from more than t users within the waiting time), it can correctly aggregate the result. If not enough messages are received, the aggregation is terminated immediately. Based on the property of (t, n) threshold secret sharing, it can tolerate t-1 users colluding with the server. Furthermore, it is assumed that at least one honest non-colluding user remains online throughout a complete computational task. If each honest user disconnects once, other honest users will contribute the sub-secret share shared by the disconnected user. The honest user's private key `ski` will be recovered sequentially. Finally, the server and colluding users can compute... By decrypting to obtain the seed si of honest users, and inferring the users' private input, privacy is compromised. Furthermore, it can be stipulated that users who have disconnected can submit their data later, but this data will not participate in the current aggregation round. However, it can participate in the next round of aggregation, assuming the server remains online.

[0143] Furthermore, based on the above method, this embodiment of the invention also provides a data security aggregation system based on multiple homomorphic attributes for privacy protection in federated learning, comprising: local users consisting of several clients and an aggregation server connected to each local user, wherein each user generates a client public-private key pair locally, the aggregation server generates a server public-private key pair, and each client sends its own client public key to the aggregation server, the aggregation server generates a global public key by merging the client public keys, and sends the global public key and the server public key to each user;

[0144] Furthermore, in the data security aggregation process, firstly, each user uses a seed as a privacy parameter, generates a random mask using a pseudo-random number from the seed, and masks the privacy input using the random mask. The privacy parameter is then encrypted using a locally generated temporary key and a global public key, and the encrypted ciphertext and the masked privacy input are sent to the aggregation server. The aggregation server aggregates the received ciphertexts from each user based on the additive homomorphism of the encryption algorithm and returns the aggregated ciphertext to the user. Next, the user uses a temporary key, their own client private key, and the server public key to perform a transformation calculation on the aggregated ciphertext and sends the transformation result to the aggregation server. The aggregation server decrypts the transformation result using its private key to obtain the user's seed sum, generates a random mask sum using the seed sum, and obtains the privacy input sum by aggregating the masked privacy input. Finally, the global parameters for federated learning are obtained by subtracting the random mask sum from the privacy input sum.

[0145] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0146] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0147] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0148] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0149] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A data security aggregation method based on multiple homomorphic attributes for privacy protection in federated learning, characterized in that, Include: Each user generates a client public-private key pair locally, the aggregation server generates a server public-private key pair, and each client sends its own client public key to the aggregation server. The aggregation server generates a global public key by merging the client public keys, and sends the global public key and the server public key to each user. Each user uses the seed as a privacy parameter, generates a random mask using a seed pseudo-random number generator, masks the privacy input using the random mask, encrypts the privacy parameter using a locally randomly generated temporary key and a global public key, and sends the encrypted ciphertext and the masked privacy input to the aggregation server. The aggregation server aggregates the received user ciphertexts based on the additive homomorphism of the encryption algorithm and feeds back the aggregated ciphertext to the user. The seed pseudo-random number generator uses a pseudo-random number function with homomorphic properties, and the seed randomly selected by the user locally is represented by several of its congruent numbers. After generating a random mask based on the seed pseudo-random number generator, the seed is CRT encoded so that the random mask aggregation is transformed into seed aggregation in the aggregation. Users use a temporary key, their own client private key, and the server public key to perform transformation calculations on the aggregated ciphertext, and send the transformation calculation results to the aggregation server. The aggregation server uses the server private key to decrypt the transformation results to obtain the user's seed sum, uses the seed sum to generate a random mask sum, and the aggregation server obtains the privacy input sum by aggregating the masked privacy input. The global parameters of federated learning are obtained by subtracting the random mask sum from the privacy input sum.

2. The data security aggregation method based on multiple homomorphic attributes according to claim 1, characterized in that, A random mask is generated using a seed pseudo-random number generator, including: First, a shared input sequence is constructed by concatenating the training round number and the model parameter index; Then, based on the shared input sequence, a random mask is generated using a seed pseudo-random number generator.

3. The data security aggregation method based on multiple homomorphic attributes according to claim 2, characterized in that, The random mask is generated using a seed pseudo-random number generator, and the generation process is as follows: ,in, , Index each model parameter. For user local model Length, This is the current training round number. For users A seed randomly selected locally. H() is the hash function.

4. The data security aggregation method based on multiple homomorphic attributes according to claim 1, characterized in that, It also includes: Before federated learning training, each user divides their client private key into t shares based on a preset threshold t, and secretly shares each share with other users to ensure that users can withdraw from training while data is being securely aggregated.

5. The data security aggregation method based on multiple homomorphic attributes according to claim 4, characterized in that, Tolerating user exit during data security aggregation includes: if a user exits training during federated learning training, other users send their received shares to the server. After receiving more than t shares, the server reconstructs and recovers the client's private key from the user who exited training, enabling the server to obtain global parameters by aggregating and decrypting the received second ciphertext.

6. A data security aggregation system based on multiple homomorphic attributes for privacy protection in federated learning, characterized in that, The method based on claim 1 includes: a local user consisting of several clients and an aggregation server connected to each local user, wherein each user generates a client public-private key pair locally, the aggregation server generates a server public-private key pair, and each client sends its own client public key to the aggregation server, the aggregation server generates a global public key by merging the client public keys, and sends the global public key and the server public key to each user. Furthermore, in the data security aggregation process, firstly, each user uses a seed as a privacy parameter, generates a random mask using a pseudo-random number from the seed, and masks the privacy input using the random mask. The privacy parameter is then encrypted using a locally generated temporary key and a global public key, and the encrypted ciphertext and the masked privacy input are sent to the aggregation server. The aggregation server aggregates the received ciphertexts from each user based on the additive homomorphism of the encryption algorithm and returns the aggregated ciphertext to the user. Next, the user uses a temporary key, their own client private key, and the server public key to perform a transformation calculation on the aggregated ciphertext and sends the transformation result to the aggregation server. The aggregation server decrypts the transformation result using its private key to obtain the user's seed sum, generates a random mask sum using the seed sum, and obtains the privacy input sum by aggregating the masked privacy input. Finally, the global parameters for federated learning are obtained by subtracting the random mask sum from the privacy input sum.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 5.

8. A computer device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method described in any one of claims 1 to 5.

Images