A federated learning method, system, device and storage medium

Abstract

Embodiments of the present application provide a kind of federal learning method, system, equipment and storage medium, the method is when initial model is issued to participant by center server, using digital signature technology, participant is verified by second key information, only initial model can be obtained after successful verification.And under the support of trusted execution environment in participant local, it can guarantee that model is safely saved in safe and trusted storage space, and not be maliciously destroyed and stolen by any application program under rich execution environment.Further through security container technology, process level lightweight virtualization is realized, ensure that model is safely isolated in the process of training, protect privacy data and model parameter from the deliberate destruction of other application programs.Through digital signature technology, the model integrity that is trained in security container each time is ensured.The above technical solutions realize the security and credibility of training model in federal learning and guarantee the privacy of training data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of machine learning, and in particular to a federated learning method, system, device and storage medium. BACKGROUND

[0002] Traditional machine learning needs to aggregate data to a central storage point (such as a server in the cloud) before unified federated learning can be performed. In this process, the original data needs to be transferred, and as the amount of data increases, the relative cost also increases exponentially; at the same time, after the data is out of the domain, the data becomes uncontrollable, thereby causing the risk of data leakage. In addition, people's concern for user privacy and data security is also increasing. Users begin to pay more attention to whether the use of personal privacy information is permitted by the person himself. For the above reasons, the big data used in the past is facing a serious data fragmentation problem and is in a "data island" situation, which prevents the effective use of data from each participant in artificial intelligence federated learning and hinders the improvement of the effect of the algorithm model.

[0003] Therefore, a method is needed that can train a machine learning model without having to centralize all data in a central storage point. A feasible method is as follows: each institution that has a data source trains a model locally using its own data, and then the models of each institution interact with each other, and finally a global model is obtained through model aggregation. In order to ensure user privacy and data security, the process of exchanging model information between institutions will be carefully designed so that no institution can guess the privacy data content of any other institution. At the same time, when building a global model, its effect is almost the same as that of centralized training when the data sources are integrated together. The "federated learning" that is popular in the privacy computing industry is designed and developed based on this idea.

[0004] However, when data is locally federated, the following problems may occur: 1. The model is vulnerable to attacks and malicious tampering, and some important parameters are artificially destroyed, causing the overall training to collapse. 2. In the process of federated learning, the training data may involve real privacy data of users, which may be monitored or even stolen by other malicious programs after extraction. SUMMARY

[0005] The embodiments of the present application provide a federated learning method, system, device and storage medium to realize the security and credibility of the training model in federated learning and ensure the privacy of the training data.

[0006] In a first aspect, the embodiments provide a federated learning method, comprising:

[0007] The central server distributes the first encryption model and the first digital signature corresponding to the first encryption model to each participating party. The first encryption model and the first digital signature are obtained by the central server by processing the initial model according to the pre-stored first key information.

[0008] Through the participating parties, the first digital signature is verified in a trusted execution environment based on the pre-stored second key information, and after successful verification, the first encryption model is stored in the trusted execution environment. The first key information and the second key information constitute two key pairs.

[0009] Through the participating party, the first encryption model is decrypted using the second key information in the trusted execution environment to obtain the initial model, and the initial model is encrypted using the pre-generated third key information to obtain the second encryption model and the second digital signature of the second encryption model, which are then sent to the secure container of the rich execution environment of the participating party.

[0010] The participating parties verify the second digital signature within the secure container according to the pre-generated fourth key information. After successful verification, they train the decrypted initial model and send the trained local model to the central server. The third key information and the fourth key information constitute two key pairs.

[0011] The central server aggregates the local models to obtain a global model and distributes the global model to the participants so that the participants can obtain the global model.

[0012] Secondly, this embodiment provides a federated learning system, including a central server and participants, wherein the participants include a trusted execution environment and a rich execution environment;

[0013] The central server is used to distribute the first encryption model and the first digital signature corresponding to the first encryption model to each participating party. The first encryption model and the first digital signature are obtained by the central server processing the initial model according to the pre-stored first key information.

[0014] The participating party is used to verify the first digital signature in the trusted execution environment according to the pre-stored second key information, and after successful verification, store the first encryption model in the trusted execution environment. The first key information and the second key information constitute two key pairs.

[0015] The participating party is also used to decrypt the first encryption model using the second key information in the trusted execution environment to obtain the initial model, and to encrypt the initial model according to the pre-generated third key information to obtain the second encryption model and the second digital signature of the second encryption model and send them to the secure container of the rich execution environment of the participating party;

[0016] The participating party is also used to verify the second digital signature in the secure container according to the pre-generated fourth key information, and after successful verification, to train the decrypted initial model, and to send the trained local model to the central server. The third key information and the fourth key information constitute two key pairs.

[0017] The central server is also used to aggregate the local models, obtain a global model, and distribute the global model to the participants so that the participants can obtain the global model.

[0018] Thirdly, this embodiment provides an electronic device, the electronic device comprising:

[0019] At least one processor; and

[0020] A memory communicatively connected to the at least one processor; wherein,

[0021] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the federated learning method described in the first aspect embodiment.

[0022] Fourthly, this embodiment provides a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the federated learning method as described in the first aspect embodiment.

[0023] This invention provides a federated learning method, system, device, and storage medium. The method involves a central server distributing a first encryption model and its corresponding digital signature to each participating party. The first encryption model and the first digital signature are obtained by the central server processing an initial model based on pre-stored first key information. The participating parties then verify the first digital signature in a trusted execution environment using pre-stored second key information. Upon successful verification, the first encryption model is stored in the trusted execution environment. The first key information and the second key information constitute two key pairs. Finally, the participating parties decrypt the first encryption model in the trusted execution environment using the second key information. The system obtains the initial model and encrypts it according to a pre-generated third key, obtaining a second encrypted model and a second digital signature of the second encrypted model, which are then sent to a secure container in the rich execution environment of the participating party. The participating party verifies the second digital signature in the secure container according to a pre-generated fourth key, and upon successful verification, trains the decrypted initial model to obtain a trained local model, which is then sent to the central server. The third and fourth key information form two key pairs. The central server aggregates the local models to obtain a global model and distributes the global model to the participating parties, enabling them to obtain the global model. In this technical solution, when the central server distributes the initial model to the participating parties, digital signature technology is used, and the participating parties verify it using the second key information. Only after successful verification can they obtain the initial model. Furthermore, with the support of the participating party's local trusted execution environment, it can ensure that the model is securely stored in a secure and trusted storage space, preventing malicious damage and theft by any application in the rich execution environment. Furthermore, by employing secure container technology, lightweight virtualization at the process level is achieved, ensuring the model is securely isolated during training and protecting privacy data and model parameters from malicious damage by other applications. Digital signature technology ensures the integrity of the model trained within the secure container each time. This achieves secure and trustworthy model training in federated learning while guaranteeing the privacy of training data.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart illustrating a federated learning method provided in Embodiment 1 of the present invention;

[0027] Figure 2 This is a schematic diagram illustrating the principle of digital signature in the execution of a federated learning method, as provided in Embodiment 1 of the present invention.

[0028] Figure 3 This is an example diagram illustrating a rich execution environment and a trusted execution environment in the execution of a federated learning method, as provided in Embodiment 1 of the present invention.

[0029] Figure 4 This is a flowchart illustrating another federated learning method provided in Embodiment 2 of the present invention;

[0030] Figure 5 This is a schematic diagram of the structure of a federated learning system provided in Embodiment 3 of the present invention;

[0031] Figure 6 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0032] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "original," "target," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] Example 1

[0035] Figure 1 This is a flowchart illustrating a federated learning method provided in Embodiment 1 of the present invention. This method is applicable to federated learning scenarios and can be executed by a federated learning system. The federated learning system can be implemented in hardware and / or software, and the device can be configured in an electronic device.

[0036] like Figure 1 As shown, the federated learning method provided in this embodiment may specifically include the following steps:

[0037] S101. The first encryption model and the first digital signature corresponding to the first encryption model are distributed to each participating party through the central server.

[0038] In this embodiment, digital signature technology is used to ensure secure and reliable model transmission between the central server and the participating parties. A digital signature (also known as a public-key digital signature) is a string of numbers that only the sender of the information can generate and that cannot be forged by others. This string of numbers also serves as valid proof of the authenticity of the information sent by the sender. It is similar to a physical signature written on paper, but implemented using public-key cryptography techniques, and is a method for authenticating digital information. A set of digital signatures typically defines two complementary operations, one for signing and the other for verification. Digital signatures are an application of asymmetric key encryption technology and digital digest technology. For example, Figure 2 This is a schematic diagram illustrating the principle of digital signatures in the execution of a federated learning method, as provided in Embodiment 1 of the present invention. Figure 2As shown, the principle of digital signature technology can be described as including a signing process and a verification process. The signing process is as follows: the sender encrypts the original text using the receiver's public key to obtain ciphertext; the sender performs a hash algorithm on the original text to obtain a digest, and then signs the digest using the sender's private key to obtain a digital signature; the sender sends the ciphertext and its corresponding digital signature to the receiver. The verification process is as follows: the receiver decrypts the ciphertext using the receiver's private key to obtain the original text, then performs a hash algorithm on the original text to obtain digest_A; the receiver decrypts the digital signature using the sender's public key to obtain digest_B; if digest_A and digest_B are the same, the verification is successful; if digest_A and digest_B are different, the verification fails.

[0039] In this embodiment, when using digital signature technology, the central server can be the sender, the participants can be the receivers, and the initial model can be the original text for the signing and verification processes.

[0040] The central server can be considered as sending initial models to each participant so that they can train their models locally; it also receives the trained local models from each participant, aggregates these local models, and redistributes the aggregated models to each participant to update their final models. Each participant can be considered as training the received initial model locally to obtain a trained model, which is then uploaded to the central server for aggregation. The initial model can be understood as the original model to be trained.

[0041] The central server stores first key information, which includes a first public key and a second private key. The trusted execution environment stores second key information, which includes a first private key and a second public key. The first public key and the first private key constitute a first key pair, and the second public key and the second private key constitute a second key pair.

[0042] In this embodiment, the first encryption model and the first digital signature are obtained by the central server processing the initial model based on pre-stored first key information. For example, an asymmetric encryption algorithm can be used, pre-generating two key pairs. Asymmetric encryption requires two keys: a public key and a private key. The public and private keys are a pair; if data is encrypted using the public key, it can only be decrypted using the corresponding private key. Conversely, if data is encrypted using the private key, it can only be decrypted using the corresponding public key. Because encryption and decryption use different keys, it is called asymmetric encryption. For example, asymmetric encryption algorithms that can be used in this embodiment include: RSA algorithm, Digital Signature Algorithm (DSA), and Elliptic Curve Cryptography (ECC) public-key encryption algorithms based on elliptic curve mathematical theory.

[0043] The process of encrypting the initial model through a central server to obtain the first encrypted model and the first digital signature is equivalent to the signing process of the digital signature. The encrypted model is designated as the first encrypted model, and the obtained digital signature is designated as the first digital signature. The central server then distributes the first encrypted model and its corresponding first digital signature to the participating parties.

[0044] In this embodiment, if there are multiple participants training the model in this round, different key pairs need to be set and stored in different participants. This ensures that only the participant with the corresponding private key can successfully verify and obtain the initial model.

[0045] S102. Through the participating parties, the first digital signature is verified in a trusted execution environment based on the pre-stored second key information, and the first encryption model is stored in the trusted execution environment after successful verification.

[0046] The first key information and the second key information constitute two key pairs.

[0047] It's important to understand that in application scenarios where security and openness coexist, two complete execution environments are typically established simultaneously on a single device based on chip-level isolation. One environment handles business logic with high requirements for functionality and openness; this is defined as the rich execution environment. The other handles business logic with higher requirements for security and privacy; this is defined as the trusted execution environment. With both execution environments coexisting on the same device, the resources required for their operation, such as the Central Processing Unit (CPU), memory, and peripherals, are strictly isolated based on chip-level security mechanisms. The trusted execution environment has higher execution privileges. Ordinary applications or client applications in the rich execution environment and trusted applications in the trusted execution environment can interact and collaborate in real time to form a complete application.

[0048] For example, Figure 3 This is an example diagram of a rich execution environment and a trusted execution environment in the execution of a federated learning method according to Embodiment 1 of the present invention. The rich execution environment (REE) includes open applications, client applications, security agents, rich operating systems, etc.; the trusted execution environment (TEE) includes trusted applications (TA), communication services, trusted operating systems, and secure channels; the rich execution environment and the trusted execution environment are hardware isolated from each other, and the two can communicate with each other through a secure channel.

[0049] In this embodiment, the participants can verify the first digital signature within a trusted execution environment. The participants verify the first digital signature in the trusted execution environment based on pre-stored second key information; this process can be understood as the digital signature verification process. The second key information and the first key information constitute a key pair, and the second key information includes a first private key and a second public key. As one implementation, the process of verifying the first digital signature based on the second key information can be described as follows: decrypting the first encryption model based on the first private key in the second key information to obtain the model to be verified; performing a hash operation on the model to be verified to obtain a digest to be verified; decrypting the first digital signature using the second public key in the second key information to obtain a first digest; if the digest to be verified is the same as the first digest, the verification is successful; if the digest to be verified is different from the first digest, the verification fails.

[0050] In this embodiment, after successful verification, the participants will store the first encrypted model in a trusted execution environment to provide a basis for subsequent model training.

[0051] S103. Through the participating parties, in a trusted execution environment, the first encryption model is decrypted using the second key information to obtain the initial model, and the initial model is encrypted according to the pre-generated third key information to obtain the second encryption model and the second digital signature of the second encryption model, which is then sent to the secure container of the participating parties' rich execution environment.

[0052] In this embodiment, the participants decrypt the first encrypted model using the first private key in the second key information within a trusted execution environment to obtain the initial model. Considering that the model training process takes place in the participants' rich execution environment, digital signature technology is also used in this embodiment to ensure the model's security and trustworthiness during transmission from the trusted execution environment to the rich execution environment, preventing it from being stolen or tampered with.

[0053] As described above, a process in the rich execution environment can generate two temporary key pairs. One public key and one private key are stored as third key information in the trusted execution environment, and the other private key and another public key are stored as fourth key information in the rich execution environment. Then, in the trusted execution environment, the initial model is encrypted based on the third key information to obtain an encrypted model and a digital signature. In this embodiment, this encrypted model is referred to as the third encrypted model, and the digital signature is referred to as the third digital signature corresponding to the third encrypted model. This process can be considered as the signing process of the digital signature. This encryption process is similar to the process by which the central server encrypts the initial model, and will not be described again here. The third encrypted model and the third digital signature are then sent to the rich execution environment.

[0054] It's important to understand that operating systems use processes as abstractions of program execution. Processes have independent address spaces, and their execution relies on the operating system's scheduling. However, processes share resources such as the file system and function libraries, making interference between programs highly likely. This level of isolation is suitable for running different programs from a single user on the same host, where the user is responsible for ensuring resource allocation between programs. As computing hardware performance improves, the need for software isolation becomes more pronounced, leading to the emergence of various resource isolation technologies such as control groups (cgroups) and namespaces. These technologies are all operating system isolation techniques, enabling software isolation in areas such as hardware resources, file systems, networks, and process IDs. Most common container technologies are based on this mechanism. However, this isolation has significant drawbacks because different applications still run on the same operating system kernel, making it vulnerable to malicious exploits. Nevertheless, this level of isolation incurs relatively low additional resource consumption, making it suitable for applications from different users within the same organization to run on the same host.

[0055] With the advent of virtualization technology, multiple different operating systems can run on the same physical machine. The interface between the operating system and the hardware is simulated by the hypervisor. Programs running on different systems have isolated kernels, and resource visibility is also highly isolated. Even malicious users find it difficult to bypass this virtualization limitation. However, because various devices need to be simulated, the resource overhead is much greater.

[0056] Therefore, this embodiment employs a secure container, which, like a regular container, is very lightweight and consumes very little additional memory. Simultaneously, it provides a level of isolation comparable to virtualization solutions. For example, KataContainer and gVisor are technologies for implementing secure containers. Considering system resource consumption, gVisor is preferred as the chosen secure container implementation.

[0057] In this embodiment, the third encryption model and the third digital signature are sent to a secure container in a trusted execution environment. Secure container technology enables lightweight virtualization at the process level, ensuring the model is securely isolated during training and protecting privacy data and model parameters from malicious damage by other applications; it also provides faster startup performance and lower resource overhead than virtual machines.

[0058] S104. Through the participating parties, the second digital signature is verified in the secure container according to the pre-generated fourth key information. After successful verification, the initial model obtained by decryption is trained, and the trained local model is sent to the central server.

[0059] The third key information and the fourth key information constitute two key pairs.

[0060] In this embodiment, the participants verify the second digital signature using the third private key and the fourth public key from the fourth key information within a secure container. If the verification is correct, the initial model for this training is obtained, and the current round of training is ready to begin. The trained model is recorded as the local model and sent to the central server for aggregation. This verification process is equivalent to the digital signature verification process, similar to the process by which the participants verify the encrypted model issued by the central server, and will not be described in detail here.

[0061] S105. Aggregate the local models through the central server to obtain the global model and distribute the global model to the participants so that the participants can obtain the global model.

[0062] In this embodiment, after receiving the local models uploaded from various locations, the central server aggregates them to generate an updated model, denoted as the global model. The global model is then distributed to the local machines of the participating parties. This process is the same as the process of distributing local models to participating parties based on digital signature technology, and will not be described in detail here.

[0063] This invention provides a federated learning method. The method involves a central server distributing a first encryption model and its corresponding digital signature to each participating party. The central server processes the first encryption model and digital signature using pre-stored first key information to obtain an initial model. Each participating party verifies the first digital signature using pre-stored second key information in a trusted execution environment. Upon successful verification, the first encryption model is stored in the trusted execution environment, with the first and second key information forming two key pairs. In the trusted execution environment, each participating party decrypts the first encryption model using the second key information to obtain an initial model, and encrypts the initial model using pre-generated third key information to obtain a second encryption model and its second digital signature, which is then sent to a secure container within the participating party's rich execution environment. Within the secure container, each participating party verifies the second digital signature using pre-generated fourth key information. Upon successful verification, the decrypted initial model is trained, and the trained local model is sent to the central server, with the third and fourth key information forming two key pairs. The central server aggregates the local models to obtain a global model and distributes it to the participating parties, enabling them to access the global model. The above technical solution employs digital signature technology when the central server distributes the initial model to the participants. Participants verify the model using a second key, and only after successful verification can they obtain the initial model. Furthermore, with the support of a trusted execution environment on the participant's local machine, the model is securely stored in a secure and trusted storage space, preventing malicious damage or theft by any application within the rich execution environment. Further, through secure container technology, lightweight virtualization at the process level is achieved, ensuring the model is securely isolated during training and protecting privacy data and model parameters from intentional damage by other applications. Digital signature technology ensures the integrity of the model trained within the secure container each time. This achieves secure and trustworthy model training in federated learning while guaranteeing the privacy of training data.

[0064] As a first optional embodiment of the present invention, based on the above embodiments, before distributing the first encryption model and the first digital signature corresponding to the first encryption model to each participating party through the central server, the method further includes:

[0065] a1) The initial model is encrypted using the first public key in the first key information through the central server to obtain the first encrypted model.

[0066] First, two public-private key pairs are generated using an asymmetric encryption algorithm: a first key pair and a second key pair. The first key pair contains a first public key and a first private key, and the second key pair contains a second public key and a second private key. For example, the asymmetric encryption algorithm could be RSA, ECC, etc. The first public key and the second private key are pre-stored as the first key information in a central server, and the first private key and the second public key are stored as the second key information in a trusted execution environment on the local machine of each participating party.

[0067] Subsequently, the central server uses the first public key to encrypt the initial model, generating an encrypted model, which is denoted as the first encrypted model.

[0068] b1) Perform a hash operation on the initial model to generate the first digest.

[0069] Simultaneously, a hash algorithm is used to perform a hash operation on the initial model to generate a digest, which is denoted as the first digest in this embodiment.

[0070] c1) Encrypt the first digest based on the second private key in the first key information to obtain the first digital signature.

[0071] Specifically, the first digest is then encrypted using the second private key from the first key information to generate a digital signature, denoted as the first digital signature. This process can be understood as a digital signature process. In this embodiment, digital signatures are used to implement encryption technology for verifying the identity and integrity of the initial model. The digital signature ensures that the initial model is not tampered with during transmission and that its identity is not impersonated.

[0072] This first optional embodiment specifies the process of a central server signing an initial model based on digital signature technology. The digital signature technology ensures that the initial model is not tampered with during transmission and that its identity is not impersonated.

[0073] Example 2

[0074] Figure 4This is a flowchart illustrating a federated learning method provided in Embodiment 2 of the present invention. This embodiment is a further optimization of the above embodiment. In this embodiment, the following is further optimized: "The participant verifies the first digital signature in a trusted execution environment according to the pre-stored second key information, and stores the first encryption model in the trusted execution environment after successful verification." The following is further optimized: "The participant decrypts the first encryption model in the trusted execution environment using the second key information to obtain the initial model, and encrypts the initial model according to the pre-generated third key information to obtain the second encryption model and the second digital signature of the second encryption model, and sends them to the secure container of the participant's rich execution environment." The following is further optimized: "The participant verifies the second digital signature in the secure container according to the pre-generated fourth key information, and trains the decrypted initial model after successful verification to obtain the trained local model, which is then sent to the central server." The following is further optimized: "The central server aggregates the local models to obtain a global model and distributes the global model to the participants so that the participants can obtain the global model."

[0075] like Figure 4 As shown, this second embodiment provides a federated learning method, which specifically includes the following steps:

[0076] S201. The first encryption model and the first digital signature corresponding to the first encryption model are distributed to each participating party through the central server.

[0077] Specifically, the central server sends the first encryption model and the first digital signature to the model management process in the local rich execution environment of the participating party.

[0078] S202. Through the model management process of the participating party in the rich execution environment, receive the first encrypted model and the first digital signature, and send the first encrypted model and the first digital signature to the trusted execution environment.

[0079] Specifically, the model management process receives the first encrypted model and the first digital signature, and sends them to the trusted execution environment operating system of the participants in the trusted execution environment by calling the secure storage service.

[0080] S203. The first digital signature is verified based on the second key information through a secure verification process in a trusted execution environment.

[0081] In this embodiment, the participating parties initiate an internal security verification process through the Trusted Execution Environment (TEE) operating system within the TEE. This process uses the first private key and the second public key from the second key information to verify the first digital signature. This process is equivalent to the digital signature verification process.

[0082] It is important to understand that the support of a trusted execution environment ensures that the model is securely stored and protected from malicious damage and theft by any application within the rich execution environment.

[0083] S204. If the verification is successful, the first encrypted model is stored in the trusted execution environment and a model saving success message is sent to the model management process.

[0084] Specifically, if the verification is successful, the received first encrypted model is stored in the trusted execution environment, and a message is sent to the model management process to inform that the model has been saved successfully.

[0085] S205. If verification fails, a model save failure message is sent to the model management process.

[0086] Specifically, if the verification fails, it indicates that the data integrity has been compromised, and the model management process will be notified that the model saving has failed.

[0087] S206. Through the secure processing of the participants in a trusted execution environment, the first encryption model is decrypted based on the first private key in the second key information to obtain the initial model.

[0088] In this embodiment, the participants start an internal security processing process through the Trusted Execution Environment Operating System (also known as the Trusted Operating System) in the Trusted Execution Environment. The security processing process first decrypts the first encryption model using the first private key in the second key information to obtain the initial model.

[0089] It's important to understand that steps S201-S206 describe the process by which the central server signs the initial model, sending the encrypted model and digital signature to the participating party's local machine. The participating party then verifies the digital signature within a trusted execution environment. This ensures that the model is protected from malicious tampering during its distribution from the central server, and also ensures that even if the model management process is attacked by other programs, an incorrect model will not be stored in the trusted execution environment. This eliminates the possibility of an incorrect model being stored in the local secure environment from two perspectives.

[0090] S207. The initial model is encrypted using the third public key in the third key information to obtain the second encrypted model.

[0091] Specifically, the security process uses the third public key in the third key information to encrypt the initial model, obtaining the encrypted model, which is denoted as the second encrypted model.

[0092] S208. Perform a hash operation on the initial model to generate a second digest.

[0093] Specifically, the security processing uses a hash algorithm to perform a hash operation on the initial model, generating a digest denoted as the second digest.

[0094] S209. The second digest is encrypted using the fourth private key in the third key information to obtain the second digital signature.

[0095] Specifically, the security process encrypts the second digest based on the fourth private key in the third key information to obtain a digital signature, which is denoted as the second digital signature.

[0096] It is important to understand that steps S207-S209 describe the process of signing the initial model in a trusted execution environment based on digital signature technology. This ensures that the model is not stolen or altered when it is sent between the trusted execution environment and the secure container in the rich execution environment, thus guaranteeing the security and reliability of the initial model.

[0097] S210, Send the second encryption model and the second digital signature to a secure container in a rich execution environment.

[0098] In this embodiment, a secure container is generated and started in a rich execution environment, and the model training process is run within the secure container. Specifically, the second encrypted model and the second digital signature are sent into the secure container.

[0099] S211. Through the model training process, verify the second digital signature based on the fourth key information.

[0100] As described above, once the second encryption model and the second digital signature are received in the secure container, the model training process can verify the second digital signature based on the third private key and the fourth public key in the fourth key information.

[0101] This step is based on digital signature technology, and is the process by which the model training process verifies the second digital signature. This process can be described as follows: the model training process decrypts the second encryption model based on the third private key in the fourth key information to obtain the model to be verified; a hash operation is performed on the model to be verified to obtain a digest; the second digital signature is decrypted using the fourth public key in the fourth key information to obtain a second digest; if the digest to be verified is the same as the second digest, the verification is successful; if the digest to be verified is different from the second digest, the verification fails.

[0102] S212. If the verification is successful, a model training message is sent to the model management process.

[0103] Specifically, if the verification is successful, the initial model for this training is obtained, and the model training progress is informed that the current round of training is about to begin.

[0104] S213. Train the initial model through the model training process and send heartbeat keep-alive messages to the model management process at set time intervals.

[0105] In this embodiment, after the model training process starts, heartbeat keep-alive information is sent to the model management process periodically at agreed time intervals (e.g., 1ts). The heartbeat keep-alive information may include relevant information such as the current training round number and whether a graphics processing unit (GPU) is used to accelerate computation. The specific data format can be defined according to actual needs.

[0106] S214. If the model management process receives a heartbeat keep-alive message within a set time, it will send the trained local model to the model management process through the model training process.

[0107] In this embodiment, if the model management process receives the heartbeat keep-alive information on time, it indicates that the current training is normal. The model training process officially starts local training and sends keep-alive information to the model management process at certain time intervals. As long as the model management process receives this information on time, it indicates that the training is proceeding normally; otherwise, it indicates that the training is abnormal. After the model training process successfully completes training, it sends the updated local model to the model management process.

[0108] S215. Upload the local model to the central server through the model management process.

[0109] S216. The global model is obtained by aggregating the local models through the central server.

[0110] Specifically, after receiving local models uploaded from various locations through the central server, the local models are aggregated to generate an updated model, which is referred to as the global model.

[0111] S217. Through the central server, the global model is encrypted according to the pre-stored fifth key information to obtain the third encryption model and the third digital signature corresponding to the third encryption model, and then distributed to the participants.

[0112] The fifth key information includes the fifth public key and the sixth private key, and the sixth key information contains the fifth private key and the sixth public key. The fifth key information and the sixth key information constitute two key pairs, namely, the fifth public key and the fifth private key are key pairs, and the sixth public key and the sixth private key are key pairs.

[0113] The central server encrypts the global model based on the fifth key information, obtaining the encrypted model, denoted as the third encrypted model, and the corresponding digital signature, denoted as the third digital signature. This step can be understood as the signing process of digital signature technology, which is the same as the process of the central server encrypting the local model, and will not be elaborated here. Then, the third encrypted model and the third digital signature are distributed to the trusted execution environment on the local machines of the participating parties to achieve local updates.

[0114] S218. Through the participating parties, the third digital signature is verified in a trusted execution environment based on the pre-stored sixth key information, and the global model after decryption of the third encryption model is obtained after successful verification.

[0115] After receiving the third digital signature and the third encryption model, the participating party can verify the third digital signature based on the sixth key information. This step can be understood as the verification process of digital signature technology, which is the same as the process by which the participating party verifies the first encryption model. The decryption process after successful verification is also the same, and will not be elaborated here. This completes the final update of the model on the participating party's local machine.

[0116] It is clear that digital signature technology ensures the integrity of each model trained within a secure container. It also guarantees that the model updated locally after the central server aggregates the training results is complete and reliable.

[0117] The above technical solution utilizes trusted execution environment technology, digital signature technology, secure container technology, and heartbeat keep-alive mechanism to ensure the security and trustworthiness of data during local training, model updates, and storage.

[0118] As a first optional embodiment of this example, based on the above embodiment, the verification of the first digital signature based on the second key information through a secure verification process in a trusted execution environment can be optimized to the following steps:

[0119] a2) The first encryption model is decrypted based on the first private key in the second key information through a security verification process to obtain the model to be verified.

[0120] In this embodiment, an internal security verification process is initiated through the Trusted Execution Environment (TEE) operating system in a Trusted Execution Environment (TEE) environment. The first private key is used to decrypt the first encryption model, and the resulting model is denoted as the model to be verified.

[0121] b2) Perform a hash operation on the model to be verified to obtain the digest to be verified.

[0122] Specifically, the model to be verified is hashed using the same hash algorithm as in the signature process, and the resulting digest is denoted as the digest to be verified.

[0123] c2) Use the second public key from the second key information to decrypt the first digital signature and obtain the first digest.

[0124] d2) If the digest to be verified is the same as the first digest, then the verification is successful.

[0125] Specifically, the digest to be verified is compared with the first digest. If they are the same, the verification is successful.

[0126] e2) If the digest to be verified is different from the first digest, the verification fails.

[0127] Specifically, if the digest to be verified is compared with the first digest and they are different, the verification fails.

[0128] The above process can be understood as a digital signature verification process. If the verification fails, it indicates that the data integrity has been compromised, and the model saving can be considered a failure. This ensures that the model is not maliciously tampered with during its distribution from the central server, and also ensures that even if the model management process is attacked by other programs, an incorrect model will not be saved in a trusted execution environment. This eliminates the possibility of an incorrect model being saved in a local secure environment from two perspectives.

[0129] The above technical solution specifies the verification process of digital signatures. The received model is verified by the participating parties through a secure verification process under the trusted execution environment operating system, which ensures the secure distribution of the model and prevents erroneous models from being stored in the trusted execution environment.

[0130] As a second optional embodiment of this example, based on the above embodiment, after storing the first encryption model in the trusted execution environment after successful verification, the method further includes:

[0131] a3) Start a secure container in the rich execution environment and run the model training process in the secure container.

[0132] A secure container is launched within the rich execution environment, and the model training process is run within the secure container. The model training process is then used for subsequent local model training.

[0133] b3) Through the model management process in the rich execution environment, a third key pair and a fourth key pair are generated based on the generated random number and the preset encryption algorithm.

[0134] The preset encryption algorithm can be an asymmetric encryption algorithm. Meanwhile, a model management process runs within the rich execution environment. This process generates a random number and, combined with the asymmetric encryption algorithm, generates two temporary public-private key pairs, denoted as the third key pair and the fourth key pair, respectively.

[0135] c3) Through the model management process, the third public key in the third key pair and the fourth private key in the fourth key pair are sent as the third key information to the trusted execution environment, and the third private key in the third key pair and the fourth public key in the fourth key pair are sent as the fourth key information to the model training process.

[0136] In this embodiment, the model management process sends the third public key from the third key pair and the fourth private key from the fourth key pair as the third key information to the trusted execution environment for the subsequent digital signature signing process. The third private key from the third key pair and the fourth public key from the fourth key pair are sent as the fourth key information to the model training process for the subsequent digital signature verification process.

[0137] As a third optional embodiment of this embodiment, based on the above embodiment, the method can be optimized to further include: if the model training process fails to verify the second data signature or the model management process does not receive heartbeat keep-alive information within a set time, a training failure message is generated and sent to the model management process.

[0138] In this embodiment, the model training process uses the third private key and the fourth public key to verify the second digital signature. If the verification fails, it means that the model is abnormal and cannot be trained. In this case, a training failure message is generated and notified to the model management process.

[0139] Additionally, if the model management process does not receive heartbeat keep-alive information within a certain time window (e.g., 2ts) during model training, the model training process may become abnormal or crash. In this case, a training failure message is generated and notified to the model management process, so that the model management process can proceed to the next step of undoing the system resource occupation involved in this training and destroying the generated security container.

[0140] The above technical solution specifies two scenarios of training failure. Through a heartbeat protection communication mechanism between the model management process and the training process within the container, it ensures that system resources are not occupied for a long time due to training anomalies.

[0141] Furthermore, the method also includes: after uploading the local model to the central server through the model management process or after receiving training failure information, revoking the resources occupied by the model training and destroying the security container through the model management process.

[0142] In existing technologies, to accelerate training, local model training may utilize resources such as GPUs and Field Programmable Gate Arrays (FPGAs) on the system for some high-load computations. If the training process crashes or is attacked during this process, these hardware resources may be continuously preempted, preventing other system tasks from functioning properly.

[0143] Therefore, in this embodiment, after the model management process uploads the trained local model to the central server, it destroys the security container generated during training, releasing the system resources occupied by the model training. Alternatively, upon receiving a model training failure message, the model management process immediately cancels the system resource occupation involved in this training and destroys the generated security container, thereby ensuring that system resources are not occupied for an extended period due to training anomalies.

[0144] The above technical solution will promptly release system resources and destroy the generated security container when training is completed or fails, thereby ensuring that system resources are not continuously occupied due to training anomalies, thus avoiding situations where other system tasks cannot be used normally.

[0145] Example 3

[0146] Figure 5 This is a schematic diagram of a federated learning system provided in Embodiment 3 of the present invention. It is applicable to situations involving federated learning and can be implemented in hardware and / or software, integrated into an electronic device. Figure 5 As shown, the system includes: a central server 31 and participants 32, wherein the participants 32 include a trusted execution environment 321 and a rich execution environment 322;

[0147] The central server 31 is used to distribute the first encryption model and the first digital signature corresponding to the first encryption model to each participating party. The first encryption model and the first digital signature are obtained by the central server processing the initial model according to the pre-stored first key information.

[0148] Participant 32 is used to verify the first digital signature in a trusted execution environment based on the pre-stored second key information, and after successful verification, to store the first encryption model in the trusted execution environment. The first key information and the second key information constitute two key pairs.

[0149] Participant 32 is also used to decrypt the first encryption model using the second key information under the trusted execution environment 321 to obtain the initial model, and to encrypt the initial model according to the pre-generated third key information to obtain the second encryption model and the second digital signature of the second encryption model and send it to the secure container 3221 of the participant's rich execution environment 322.

[0150] Participant 32 is also used to verify the second digital signature in the secure container 3221 according to the pre-generated fourth key information, and after successful verification, to train the initial model obtained by decryption, and send the trained local model to the central server 31. The third key information and the fourth key information constitute two key pairs.

[0151] The central server 31 is also used to aggregate local models, obtain a global model, and distribute the global model to the participants so that the participants 32 can obtain the global model.

[0152] It should be noted that, Figure 5 The diagram only shows the interaction between the central server and one participant. When multiple participants are involved in model training, the central server should interact with all participants.

[0153] This invention provides a federated learning device. The above-described technical solution employs digital signature technology when the central server distributes the initial model to the participants. Participants verify the model using a second key, and only after successful verification can they obtain the initial model. Furthermore, with the support of a trusted execution environment on the participant's local machine, the model is securely stored in a secure and trusted storage space, preventing malicious damage and theft by any application within the rich execution environment. Further, through secure container technology, lightweight virtualization at the process level is achieved, ensuring the model is securely isolated during training and protecting privacy data and model parameters from intentional damage by other applications. Digital signature technology ensures the integrity of the model trained within the secure container each time. This achieves secure and trustworthy model training in federated learning while guaranteeing the privacy of training data.

[0154] Optionally, the central server stores first key information, which includes a first public key and a second private key, and the trusted execution environment stores second key information, which includes a first private key and a second public key. The first public key and the first private key constitute a first key pair, and the second public key and the second private key constitute a second key pair.

[0155] Optionally, before distributing the first encryption model and the corresponding first digital signature to each participant, the central server 31 is also used for:

[0156] The initial model is encrypted using the first public key from the first key information to obtain the first encrypted model.

[0157] Perform a hash operation on the initial model to generate a first digest;

[0158] The first digest is encrypted using the second private key from the first key information to obtain the first digital signature.

[0159] Continue to refer to Figure 5 Optionally, participant 32 includes a model management process 3222 in a rich execution environment 322, and a security verification process 3211 in a trusted execution environment.

[0160] Model management process 3222 is used to receive the first encryption model and the first digital signature, and send the first encryption model and the first digital signature to the trusted execution environment;

[0161] Security verification process 3211 is used to verify the first digital signature based on the second key information;

[0162] If the verification is successful, the first encrypted model is stored in the trusted execution environment and a model saving success message is sent to the model management process 3222.

[0163] If verification fails, a model save failure message is sent to the model management process 3222.

[0164] Optionally, security verification process 3211 is specifically used for:

[0165] The first encryption model is decrypted based on the first private key in the second key information to obtain the model to be verified.

[0166] Perform a hash operation on the model to be verified to obtain the digest to be verified;

[0167] The first digital signature is decrypted using the second public key from the second key information to obtain the first digest;

[0168] If the digest to be verified is the same as the first digest, then the verification is successful;

[0169] If the digest to be verified is different from the first digest, the verification will fail.

[0170] Optionally, after successfully verifying and storing the first cryptographic model in the trusted execution environment, participant 32 may further use it for:

[0171] In the rich execution environment 322, a secure container 3221 is started, and the model training process 32211 is run in the secure container 3221;

[0172] Model management process 3222 is used to generate a third key pair and a fourth key pair based on the generated random number and the preset encryption algorithm;

[0173] Model management process 3222 is used to send the third public key in the third key pair and the fourth private key in the fourth key pair as third key information to the trusted execution environment, and to send the third private key in the third key pair and the fourth public key in the fourth key pair as fourth key information to the model training process.

[0174] Continue to refer to Figure 5 Optionally, participant 32 includes a secure processing process 3212 within the trusted execution environment 321, for:

[0175] The first encryption model is decrypted based on the first private key in the second key information to obtain the initial model;

[0176] The initial model is encrypted using the third public key from the third key information to obtain the second encrypted model;

[0177] Perform a hash operation on the initial model to generate a second digest;

[0178] The second digest is encrypted using the fourth private key from the third key information to obtain the second digital signature.

[0179] The second encryption model and the second digital signature are sent to a secure container 3221 in a rich execution environment.

[0180] Optionally, model training process 32211 is used for:

[0181] The second digital signature is verified based on the fourth key information;

[0182] If the verification is successful, a model training message is sent to the model management process;

[0183] The initial model is trained through the model training process, and heartbeat keep-alive messages are sent to the model management process at set time intervals.

[0184] If the model management process receives a heartbeat keep-alive message within a set time, it will send the trained local model to the model management process through the model training process.

[0185] The local model is uploaded to the central server through the model management process.

[0186] Optionally, model training process 32211 is also used for:

[0187] If the verification of the second data signature fails or the model management process does not receive heartbeat keep-alive information within the set time, a training failure message is generated and sent to the model management process.

[0188] Optionally, model management process 3222 is also used for:

[0189] After uploading the local model to the central server or receiving a training failure message, undo the resources used for model training and destroy the security container.

[0190] Optionally, the central server 31 is also used to encrypt the global model according to the pre-stored fifth key information to obtain the third encryption model and the third digital signature corresponding to the third encryption model, and then distribute them to the participants;

[0191] Participant 32 is also used to verify the third digital signature based on the pre-stored sixth key information in the trusted execution environment 321, and to obtain the global model after decrypting the third encryption model after successful verification. The fifth key information and the sixth key information constitute two key pairs.

[0192] It should be noted that the security verification process and security processing process can be started by a trusted operating system.

[0193] The federated learning system provided in the embodiments of the present invention can execute the federated learning method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0194] Example 4

[0195] Figure 6 This is a schematic diagram of an electronic device according to Embodiment 4 of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0196] like Figure 6As shown, the electronic device 40 includes at least one system-on-a-chip (SOC), which includes at least one operating system domain. Each operating system domain is connected to at least one execution device, and a memory, such as a read-only memory (ROM) 42 or a random access memory (RAM) 43, is communicatively connected to at least one SOC 41. The memory stores computer programs executable by at least one SOC. The SOC 41 can perform various appropriate actions and processes based on the computer programs stored in the ROM 42 or loaded from storage unit 48 into the RAM 43. The RAM 43 can also store various programs and data required for the operation of the electronic device 40. The SOC 41, ROM 42, and RAM 43 are interconnected via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0197] Multiple components in electronic device 40 are connected to I / O interface 45, including: input unit 46, such as keyboard, mouse, etc.; output unit 47, such as various types of monitors, speakers, etc.; storage unit 48, such as disk, optical disk, etc.; and communication unit 49, such as network card, modem, wireless transceiver, etc. Communication unit 49 allows electronic device 40 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0198] SOC41 performs the various methods and processes described above, such as federated learning methods.

[0199] In some embodiments, the federated learning method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 40 via ROM 42 and / or communication unit 49. When the computer program is loaded into RAM 43 and executed by SOC 41, one or more steps of the federated learning method described above may be performed. Alternatively, in other embodiments, SOC 41 may be configured to perform the federated learning method by any other suitable means (e.g., by means of firmware).

[0200] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable SoC, which may be a dedicated or general-purpose programmable SoC, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0201] Computer programs used to implement the methods of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a System-on-a-Chip (SOC), such that when executed by the SOC, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0202] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0203] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0204] The systems and technologies described herein can be implemented in computing systems that include back-end components (e.g., as a data server), or computing systems that include first-end components (e.g., an application server), or computing systems that include front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such back-end, first-end, or front-end components. The components of the system can be interconnected via digital data communication (e.g., a communication network) of any form or medium. Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0205] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0206] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0207] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A federated learning method, characterized in that, include: The central server distributes the first encryption model and the first digital signature corresponding to the first encryption model to each participating party. The first encryption model and the first digital signature are obtained by the central server by processing the initial model according to the pre-stored first key information. Through the participating parties, the first digital signature is verified in a trusted execution environment based on the pre-stored second key information, and after successful verification, the first encryption model is stored in the trusted execution environment. The first key information and the second key information constitute two key pairs. Through the participating party, the first encryption model is decrypted using the second key information in the trusted execution environment to obtain the initial model, and the initial model is encrypted using the pre-generated third key information to obtain the second encryption model and the second digital signature of the second encryption model, which are then sent to the secure container of the rich execution environment of the participating party. The participating parties verify the second digital signature within the secure container according to the pre-generated fourth key information. After successful verification, they train the decrypted initial model and send the trained local model to the central server. The third key information and the fourth key information constitute two key pairs. The central server aggregates the local models to obtain a global model and distributes the global model to the participating parties so that the participating parties can obtain the global model. The step of verifying the first digital signature based on pre-stored second key information in a trusted execution environment through the participating parties, and storing the first encryption model in the trusted execution environment after successful verification, includes: The participating party receives the first encrypted model and the first digital signature through its model management process in the rich execution environment, and then sends the first encrypted model and the first digital signature to the trusted execution environment. The first digital signature is verified based on the second key information through a secure verification process within the trusted execution environment. If the verification is successful, the first encrypted model is stored in the trusted execution environment and a model saving success message is sent to the model management process; If verification fails, a model save failure message is sent to the model management process; The method further includes, after storing the first encryption model in the trusted execution environment upon successful verification: A secure container is launched in the rich execution environment, and a model training process is run within the secure container; wherein the model training process is used for subsequent local model training. Through the model management process in the rich execution environment, a third key pair and a fourth key pair are generated based on the generated random number and the preset encryption algorithm; Through the model management process, the third public key in the third key pair and the fourth private key in the fourth key pair are sent as third key information to the trusted execution environment, and the third private key in the third key pair and the fourth public key in the fourth key pair are sent as fourth key information to the model training process.

2. The method according to claim 1, characterized in that, The central server stores first key information, which includes a first public key and a second private key. The trusted execution environment stores second key information, which includes a first private key and a second public key. The first public key and the first private key constitute a first key pair, and the second public key and the second private key constitute a second key pair.

3. The method according to claim 2, characterized in that, Before the first encryption model and the first digital signature corresponding to the first encryption model are distributed to each participant through the central server, the process further includes: The initial model is encrypted using the first public key in the first key information through the central server to obtain the first encrypted model. Perform a hash operation on the initial model to generate a first digest; The first digest is encrypted using the second private key from the first key information to obtain the first digital signature.

4. The method according to claim 3, characterized in that, The verification of the first digital signature based on the second key information through a secure verification process in the trusted execution environment includes: The security verification process decrypts the first encryption model based on the first private key in the second key information to obtain the model to be verified. Perform a hash operation on the model to be verified to obtain a digest to be verified; The first digital signature is decrypted using the second public key from the second key information to obtain the first digest; If the digest to be verified is the same as the first digest, then the verification is successful; If the digest to be verified is different from the first digest, the verification fails.

5. The method according to claim 1, characterized in that, The step of obtaining the initial model by decrypting the first encryption model using the second key information in the trusted execution environment through the participating parties, and encrypting the initial model according to the pre-generated third key information to obtain the second encryption model and the second digital signature of the second encryption model, and sending them to the secure container of the rich execution environment, includes: The initial model is obtained by decrypting the first encryption model based on the first private key in the second key information through the secure processing of the participating parties in the trusted execution environment. The initial model is encrypted using the third public key in the third key information to obtain the second encrypted model; Perform a hash operation on the initial model to generate a second digest; The second digest is encrypted using the fourth private key in the third key information to obtain the second digital signature; The second encryption model and the second digital signature are sent to the secure container of the rich execution environment.

6. The method according to any one of claims 1, characterized in that, The process involves the participating parties verifying the second digital signature within the secure container according to pre-generated fourth key information, and after successful verification, training the decrypted initial model to obtain a trained local model, which is then uploaded to the central server. The second digital signature is verified based on the fourth key information through the model training process. If the verification is successful, a model training message is sent to the model management process; The initial model is trained through the model training process, and heartbeat keep-alive messages are sent to the model management process at set time intervals. If the model management process receives the heartbeat keep-alive information within a set time, the trained local model is sent to the model management process through the model training process. The local model is uploaded to the central server through the model management process.

7. The method according to any one of claims 6, characterized in that, Also includes: If the model training process fails to verify the second digital signature or the model management process does not receive the heartbeat keep-alive information within a set time, a training failure message is generated and sent to the model management process.

8. The method according to any one of claims 7, characterized in that, Also includes: After uploading the local model to the central server through the model management process or after receiving the training failure information, the model management process cancels the resources occupied by the model training and destroys the security container.

9. The method according to any one of claims 1, characterized in that, The step of distributing the global model to the participants so that the participants can obtain the global model includes: The central server encrypts the global model based on the pre-stored fifth key information to obtain a third encryption model and a third digital signature corresponding to the third encryption model, and then sends them to the participating parties. Through the participating parties, the third digital signature is verified in a trusted execution environment based on the pre-stored sixth key information. After successful verification, the global model after decrypting the third encryption model is obtained. The fifth key information and the sixth key information constitute two key pairs.

10. A federated learning system, characterized in that, It includes a central server and participants, the participants comprising a trusted execution environment and a rich execution environment; The central server is used to distribute the first encryption model and the first digital signature corresponding to the first encryption model to each participating party. The first encryption model and the first digital signature are obtained by the central server processing the initial model according to the pre-stored first key information. The participating party is used to verify the first digital signature in the trusted execution environment according to the pre-stored second key information, and after successful verification, store the first encryption model in the trusted execution environment, wherein the first key information and the second key information constitute two key pairs; The participating party is also used to decrypt the first encryption model using the second key information in the trusted execution environment to obtain the initial model, and to encrypt the initial model according to the pre-generated third key information to obtain the second encryption model and the second digital signature of the second encryption model and send them to the secure container of the rich execution environment of the participating party; The participating party is also used to verify the second digital signature in the secure container according to the pre-generated fourth key information, and after successful verification, to train the decrypted initial model, and to send the trained local model to the central server. The third key information and the fourth key information constitute two key pairs. The central server is also used to aggregate the local models, obtain a global model, and distribute the global model to the participants so that the participants can obtain the global model; The participants include a model management process in a rich execution environment and a security verification process in a trusted execution environment. A model management process is used to receive the first encryption model and the first digital signature, and send the first encryption model and the first digital signature to the trusted execution environment; A security verification process is used to verify the first digital signature based on the second key information; If the verification is successful, the first encrypted model is stored in the trusted execution environment and a model saving success message is sent to the model management process; If verification fails, a model save failure message is sent to the model management process; After successful verification, the participating party stores the first encryption model in the trusted execution environment and then further uses it for: A secure container is launched in a rich execution environment, and a model training process is run within the secure container; wherein the model training process is used for subsequent local model training. The model management process is used to generate a third key pair and a fourth key pair based on the generated random number and the preset encryption algorithm; The model management process is used to send the third public key in the third key pair and the fourth private key in the fourth key pair as the third key information to the trusted execution environment, and to send the third private key in the third key pair and the fourth public key in the fourth key pair as the fourth key information to the model training process.

11. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the federated learning method according to any one of claims 1-9.

12. A storage medium containing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform the federated learning method as described in any one of claims 1-9.

Images