An efficient federated learning secure aggregation method based on symmetric homomorphic encryption algorithm

Abstract

The present invention discloses an efficient federated learning security aggregation method based on a symmetric homomorphic encryption algorithm. Multiple users will encrypt local gradients with the public key of a central service, and then send the ciphertext to an aggregation server. After aggregation, the aggregation server sends the aggregated ciphertext to the central server, which decrypts the ciphertext to obtain a global gradient. The technical solution proposed by the present invention adopts a homomorphic signature scheme to verify the global model parameters to ensure the correctness of the aggregation results. It can overcome potential threats such as privacy leakage and data forgery in federated learning, ensure the security and reliability of data, and reduce computing and communication overheads.

Description

Technical Field

[0001] The present invention relates to the field of federated learning security technology, and in particular to an efficient federated learning security aggregation method based on a symmetric homomorphic encryption algorithm. Background Art

[0002] In traditional machine learning, data is usually concentrated in a centralized location for training. But in real life, a lot of data is scattered across different devices, organizations, or geographic locations, forming so-called "data islands." The emergence of federated learning provides a new solution for data cooperation between different organizations and entities. In particular, the importance of federated learning has become increasingly prominent in terms of secure sharing. Through federated learning, participants can train models without sharing sensitive data, thereby ensuring privacy and data security. This distributed learning method not only helps reduce data transmission risks, but also effectively responds to the risk of data leakage, providing data holders with a more secure and reliable data cooperation mechanism. With the increasing importance of digital information and the continuous prominence of data security issues, federated learning, as a promising new method, has shown great potential in secure sharing.

[0003] Federated Learning (FL) allows multiple devices or data sources to train models locally, and then aggregate the updates of the local models through a federated learning algorithm to update the global model. This process is carried out in multiple rounds of iterations until satisfactory model performance is achieved. Federated learning has become a popular distributed machine learning paradigm for collaborative model training among many users, which can be mobile phones or other mobile devices. It enables decentralized resource-constrained devices to participate in model training without sharing raw data. In FL, each user only periodically shares the trained local model gradients, which are aggregated by a central server to obtain a more accurate global model. In this way, FL promotes the use of sensitive datasets and alleviates data privacy issues of collecting different datasets.

[0004] At present, federated learning is widely used in various scenarios, such as smart cities and smart healthcare. However, federated learning faces various security and privacy issues in the aggregation process. First, the model gradients transmitted between users and central servers have privacy leakage issues. Research results show that attackers may restore or infer users' sensitive data by analyzing uploaded gradient information. In the training process of FL, it is urgent to protect users' gradient information. Secondly, the server may aggregate only part of the gradients on the grounds of saving computing resources, or malicious servers may tamper with or forge the aggregation results, misleading the learning results of participating users. Therefore, the verifiability of the global gradients aggregated by the central server is also an important factor in the secure aggregation of federated learning. Finally, the computational and communication efficiency in the aggregation process of federated learning is also a challenge, especially on mobile devices with limited computing and storage resources.

[0005] There are three important issues in federated learning: the first is how to protect the user's local model to prevent attackers from indirectly obtaining the user's private information by using local model parameters; the second is how to verify the correctness of the global model parameters returned by the server to prevent the server from forging aggregated results; the third is how to improve training efficiency, reduce communication overhead and computing costs, and lower the threshold for participation. Many federated learning security methods have been designed in existing technical solutions, but there is still a need for continuous optimization in terms of system communication computing costs, resource allocation, strengthening data security and reliability, and strengthening the robustness of federated learning. Summary of the invention

[0006] In order to solve the above problems, the present invention proposes an efficient federated learning security aggregation method based on symmetric homomorphic encryption algorithm, and adopts symmetric homomorphic encryption to construct a federated learning framework with privacy protection. The specific technical solution is as follows.

[0007] An efficient federated learning security aggregation method based on symmetric homomorphic encryption algorithm includes the following steps:

[0008] Step S1: System initialization, the central server CS generates the private key and public keys E(0)1 and E(0)2 of the SHE encryption algorithm, where E(.) represents the SHE encryption algorithm; the central server CS broadcasts the initial global gradient W0 to n users;

[0009] Step S2: User C i Generate new gradient W after local training update i , User C i The gradient W is queried using a homomorphic signature algorithm based on an asymmetric programmable hash function combined with BLS signature. i Sign and get signatureσ i , and communicates with the aggregation server S through the Diffie-Hellman protocolA Negotiate the key Key and calculate the key K i ; Use SHE encryption algorithm to encrypt W i +K i Encryption, and finally send the ciphertext and signature value to the aggregation server S A ;

[0010] Step S3: Aggregation Server S A Collect ciphertext gradients and signatures within a preset time interval, aggregate the collected ciphertexts to obtain the aggregated ciphertext E(W j ),in j represents the jth iteration; for signature σ i Aggregate to obtain the aggregate signature σ, and convert the aggregate ciphertext E(W j ) and the aggregate signature σ are sent to the central server CS;

[0011] Step S4: The central server CS receives the data from the aggregation server S A After sending the aggregated ciphertext, the encrypted gradient PE(W j ) is decrypted to obtain the global gradient W j , and the global gradient W j And the aggregate signature σ is sent to each user C i ;

[0012] Step S5: User C i Verify that the aggregation results returned by the server are correct.

[0013] Furthermore, the SHE encryption algorithm supports homomorphic addition and multiplication operations, and has scalar homomorphic properties. The operation processing of the SHE encryption algorithm specifically includes:

[0014] Step S11: Key generation: given security parameters (k0, k1, k2, k p ,k q ), and k0<k1<<k2<k p <<k q ; The key generation algorithm selects a k2-bit random number L and a k p A prime integer p of bits, then a set of k p Prime number of bits And calculate And the parameter N = p·q; finally output the public parameter pp = (k0, k1, k2, k p ,k q ,N) and key SK=(p,L), and set the message space M to

[0015] Step S12: Encryption; Given a message m ∈ (-2k0, 2k0] and a secret key SK, the message m can be encrypted as E(m) = (rL + m)(1 + r’p) mod N, where r and r’ are random numbers that satisfy and respectively;

[0016] Step S13: Decryption; For the ciphertext E(m) and the secret key SK, E(m) is decrypted as m’ = (E(m) mod p) mod L = (m + rL) mod L. If m < L / 2, then m > 0 and m = m’; if m > L / 2, then m < 0 and m = m’ - L.

[0017] Furthermore, the specific operations of the homomorphic signature algorithm include:

[0018] Input the asymmetric bilinear group bgp, create the BLS algorithm signature key pair (sk′, pk′) ← BLS.Gen(bgp), and select two random seeds K in the key space of the pseudorandom function F: K × {0, 1}* → Zq. Generate two sets of key pairs for APHF (sek, pek) ← H.Gen(bgp) and (sek′, pek′) ← H.Gen′(bgp), and set and hpk = (pk′, bgp, pek, pek′), and return the homomorphic signature key (hsk, hpk), where hsk is the signature private key and hpk is the verification public key. The arrow symbol ← means assigning the calculated or generated result to the corresponding variable or data structure;

[0019] Input the signature private key hsk, the message ω, the user identifier n, and the identifier Δ to generate a homomorphic signature;

[0020] Input a set of signatures Σ = {σ m}, where σ m∈U = (σ m , m, Z △ , R m , S m ), U is the user set, randomly select an m ∈ U, set σ △ = σ △,m , Z = Z m , multiply the R m and S m of each user, and get R = ∏ m∈U R m , S = ∏ m∈U S m , and return the homomorphic signature σ = (σ △ , Z, R, S);

[0021] ​Input the verification public key hpk, model parameter ω, homomorphic signature σ, user set U and identifier Δ, use the BLS signature verification algorithm to verify whether the given homomorphic signature is valid, run BLS.Verify(pk′,Δ|Z,σΔ), pass in the verification public key pk′, identifier Δ, message Z, and signature σ △ , verify σ △ Is it a valid signature for the identifiers Δ and Z? If not, stop and return False, otherwise, return True if and only if the following equation is satisfied:

[0022] e(S,Z)=(∏ m∈U H.PubEval(pek,m))·e(R,h)·(∏ m∈U H.PubEval′(pek′,l) w1 );

[0023] This equation is the specific calculation formula used to verify homomorphic signatures in the BLS signature scheme, where e(S,Z) represents a bilinear mapping function on the elliptic curve, which is used to calculate the mapping value of the signature S with respect to the message Z; e(R,h) represents a bilinear mapping function on the elliptic curve, which is used to calculate the mapping value of the random number R and the hash result h.

[0024] Further, the step S2 specifically includes:

[0025] User C i Calculate the key K i =H(Key||T i ). Among them, T i is the current time, and Key is a new key generated by encrypting the aggregation server public key with the user's private key. sk ci User C i The negotiated private key, PK SA It is the aggregation server S A 's public key;

[0026] User C i Encrypt W using the public keys E(0)1 and E(0)2 of the central server CS i +K i , PE(W i +K i )=(W i +K i )+r1·E(0)1+r2·E(0)1mod N, where i=1,2,3...., r1 and r2 are such that r1,r2∈{0,1} k1 A random number, where {0,1} k1 Represents a set of binary sequences with a length of k1 bits;

[0027] User C i Send ciphertext gradient {PE(W i +K i ),T i ,σ i} to the aggregation server S A , σ i Represents the homomorphic signature of the gradient Wi generated by user Ci.

[0028] Further, the step S3 specifically includes the following sub-steps:

[0029] Step S31: Aggregation server S A Collect the ciphertext gradient {PE(W i +K i ),T i ,h i}, verify T i The legitimacy of the gradient is discarded if it times out;

[0030] Step S32: Aggregation server S A Received from user C i The ciphertext sent, calculation K i =H(Key||T i ), PE(K i )=K i +r1·E(0)1+r2·E(0)1mod N,PE(W i )=PE(W i +K i )-PE(K i ), and obtain the encrypted gradient PE(W1), PE(W2), PE(W3)...PE(W n );

[0031] Step S33: Encrypt the gradients PE(W1), PE(W2), PE(W3)...PE(W n ) for polymerization, the gradient polymerization formula is And aggregate the signatures, the signature aggregation formula is σ i =(h △ ,i,Z i ,R i ,S i ), set σ △ =h △ , Z=Z i ,calculate Get the aggregate signature σ=(σ △ ,Z,R,S);

[0032] Step S34: Aggregation Server S A Send the aggregated encrypted gradient PE(W j ) and the aggregation signature σ to the central server CS.

[0033] Furthermore, the specific steps of step S4 include:

[0034] The central server CS receives the ciphertext sent by the aggregation server S A and then decrypts it using the key SK = (P, L) of the symmetric homomorphic algorithm. The decryption result is the aggregated gradient W j ; W' = (PE(W j ) mod P) mod L = (W + r L ) mod L. If W' < L / 2, then W > 0, W = W'; if W' > L / 2, then W < 0, W = W' – L, where L is the selected random number;

[0035] The central server CS distributes W j and the aggregation signature σ to each user C i .

[0036] Furthermore, the verification of step S5 by user C i specifically includes:

[0037] In the offline phase, use the HS.VerPre algorithm to preprocess part of the results offline; Input the asymmetric programmable hash functions H, H', verify the public key hpk, the user set U, and the message dimension L; for calculate Hm = H.PubEval(pek, m), H = {Hm}, m ∈ U; for calculate H1' = H.PubEval'(pek', l), H' = {H1'}, l ∈ L, and return hpkp = (pk', bgp, H, H'), where H.PubEval(pek, m) represents using the public evaluation algorithm PubEval in the asymmetric programmable hash function H, taking the user m as the input, and then calculating the corresponding hash value Hm. Through this process, the corresponding hash value Hm can be generated for each user m, thus preprocessing part of the results in the offline phase and preparing for the subsequent verification steps;

[0038] In the online phase, use the HS.EffVer algorithm to verify the aggregation result; HS.EffVer(hpkp, Wi, σ, U, Δ) → Bool, the HS.EffVer algorithm is the same as the verification method in the homomorphic signature algorithm, and the calculation formula is modified to:

[0039] Beneficial effects of the invention: The present invention proposes an efficient federated learning security aggregation method based on a symmetric homomorphic encryption algorithm. Multiple users will encrypt local gradients with the public key of a central service, and then send the ciphertext to the aggregation server. After aggregation, the aggregation server sends the aggregated ciphertext to the central server, which decrypts the global gradient. The aggregation server and the central server do not know the specific gradient information of the user. In addition, in order to achieve verifiability, the technical solution of the present invention adopts a homomorphic signature scheme to verify the global model parameters to ensure the correctness of the aggregation results. Through the above solution, potential threats such as privacy leakage and data forgery can be overcome in federated learning to ensure the security and reliability of data. In addition, it also has lower computing and communication overhead than existing solutions. Specific technical effects include:

[0040] Data authenticity: The present invention uses the secure encryption algorithm SHE to encrypt data to ensure that the data is protected during transmission and is not tampered with or leaked, thereby maintaining the integrity and privacy of the data. A Verify the legitimacy of messages sent by participants and check the freshness of time Ti to ensure that only legal and untampered data is accepted, thereby ensuring the integrity of data during collection and processing. Key negotiation is performed through the Diffie-Hellman protocol to ensure security and user identity during communication, reducing the risk of data being stolen or tampered with during transmission. In the decryption and distribution of aggregated gradients, the central server CS uses the key SK to decrypt and verify the aggregated gradient data to ensure the accuracy and integrity of the data, and distributes the decrypted data to each user end, ensuring the authenticity and credibility of the data.

[0041] Efficient verification: The present invention utilizes a combination of offline preprocessing and online verification to achieve an efficient verification process. In the offline preprocessing stage (HS.VerPre), the system pre-calculates and stores the public key hash value, reducing the computational burden of the online verification stage. In the online verification stage (HS.EffVer), the server uses a homomorphic signature algorithm for verification, combined with preprocessing information for efficient verification, reducing the repeated calculation part. This efficient verification process not only ensures the correctness of the aggregation results in federated learning, but also optimizes the efficiency and scalability of the verification process, provides users with a fast verification method, and significantly improves the system's performance and user experience.

[0042] Resisting man-in-the-middle attacks: The present invention starts with key generation and encryption in the initialization phase, through distributed negotiation of keys and data encryption transmission in the local training phase, to the legitimacy verification and homomorphic aggregation calculation in the server aggregation phase, as well as secure decryption and distribution in the decryption phase, and finally to the homomorphic signature algorithm verification in the verification phase. Security mechanisms against man-in-the-middle attacks are added at each step. This all-round security design ensures the integrity and privacy protection of data during secure transmission and processing, effectively prevents potential security threats and attacks, and provides a safe and reliable foundation for federated learning. The design of the entire process fully reflects the systematicity and logic, and provides comprehensive protection for user data privacy and the security of algorithm models. The comprehensive application of these security measures demonstrates the high attention paid to data security and privacy protection, and provides reliable protection for the safe operation of the entire system.

[0043] Security and verifiability: The present invention uses the DH protocol and the SHE protocol to encrypt the data to be sent, so as to resist the situation where the server is untrustworthy. It can also prevent attackers from infiltrating malicious data to reduce the quality of the data set or purposefully poisoning the data, thereby destroying the aggregation model. In addition, this solution takes into account the verifiability of the gradient after server aggregation, which can prevent the model errors caused by incomplete aggregation, custom returns, malicious forgery, etc. of the server.

[0044] High computational efficiency: This solution adopts a lightweight gradient privacy protection mode to maximize the efficiency of model updates. In the SHE solution of the present invention, each user only needs to negotiate the key with the server through the DH protocol, and the complexity is O(n), which can also be applied to federated learning systems with a large number of users. This solution only has multiplication and addition, which greatly improves efficiency.

[0045] Stability: In this scheme, the security and randomness of the key are ensured by using the SHE algorithm to generate keys and select random numbers and prime numbers in the initialization phase, providing a stable foundation for subsequent steps. In the local training phase, each user generates a new gradient after the local training update and communicates with the aggregation server S through the DH protocol. A Negotiating keys ensures the security and stability of communication. A Before collecting the ciphertext gradient, the legitimacy of the message sent by the participant and the freshness of Ti are verified to ensure that the data received by the server is accurate and valid, and also enhance the stability of the system. In the final decryption and distribution of the aggregated gradient stage, CS decrypts the received ciphertext to obtain the aggregated gradient and performs corresponding processing to ensure the integrity and accuracy of the data, thereby maintaining the stability of the system.

[0046] Correctness: The SHE algorithm supports homomorphic addition and homomorphic multiplication operations. That is, given two ciphertexts E(m1) and E(m2), there are E(m1)+E(m2)→E(m1+m2) and E(m1)·E(m2)→E(m1·m2). This scheme uses the SHE partial homomorphic encryption algorithm to encrypt the local local model training gradient. The aggregation server S A Directly using the ciphertext of the local model training gradient for global model aggregation produces the same aggregation result as using the plaintext, ensuring the correctness of the system.

[0047] Promote data sharing: The implementation of this solution can strengthen data sharing and cooperation, promote cross-organizational and cross-industry data exchange and cooperation, help promote digital transformation, promote innovation and collaborative work, and enhance intelligent development capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 is a system model architecture diagram in an embodiment of the present invention;

[0049] Figure 2 It is a schematic diagram of the verification process of the efficient federated learning security aggregation method based on the symmetric homomorphic encryption algorithm in an embodiment of the present invention;

[0050] Figure 3 It is a schematic diagram of the overall process of an efficient federated learning security aggregation method based on a symmetric homomorphic encryption algorithm in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described with reference to the accompanying drawings.

[0052] This paper proposes an efficient federated learning security aggregation method based on symmetric homomorphic encryption algorithm. The FL federated learning system involved is as follows: Figure 1 As shown, it includes three parts: Client, i ), Aggregation Server (S A ), Central Server (CS). i Maintain your own dataset, be responsible for training local models and uploading encrypted gradients, aggregation server S A It is a semi-trusted party, responsible for aggregating the valid gradients within the interval time period and sending them to CS. CS is responsible for verifying the validity of the aggregated gradients and sending them to the aggregation server S AAfter decrypting the sent ciphertext and obtaining the aggregated gradient, the gradient is then sent to each user (C) to update the model. CS is also responsible for initializing the system parameters, generating public and private keys using the Symmetric Homomorphic Encryption (SHE) algorithm, and guiding the entire training task process by evaluating the loss function of the joint training model, such as when to enter the password training phase and end the training task.

[0053] In this embodiment, the present invention can be divided into the following five parts:

[0054] (1) System initialization phase: The central server CS generates the private key of SHE and the public keys E(0)1 and E(0)2, where E(.) represents the encryption algorithm of SHE. CS broadcasts the initial global gradient W0 to n users.

[0055] (2) Local training phase: Each user C i Generate new gradient W after local training update i , User C i Use the homomorphic signature algorithm gradient W based on asymmetric programmable hash functions (APHF) combined with BLS (Boneh-Lynn-Shacham) signature i Sign and get signatureσ i , and communicate with the aggregation server S through the Diffie-Hellman (DH) protocol A Negotiate the key Key and calculate the key K i , using the SHE encryption algorithm to encrypt W i +K i Encryption, and finally send the ciphertext and signature value to the aggregation server S A .

[0056] (3) Server aggregation stage: Aggregation server S A The ciphertext gradients are collected within the time interval, and then the collected ciphertexts are aggregated to obtain the aggregated ciphertext E(W j ),in j represents the jth iteration; for signature σ i Aggregate to obtain the aggregate signature σ, and convert the aggregate ciphertext E(W j ) and the aggregate signature σ are sent to the central server CS.

[0057] (4) Decryption and sending aggregation gradient stage: CS receives the aggregation server S A After sending the ciphertext, the encrypted gradient PE(W j ) is decrypted to obtain the global gradient Wj , and the global gradient W j And the aggregate signature σ is sent to each user C i .

[0058] (5) Verification stage: Figure 2 As shown, user C i Use the HS.EffVer algorithm to verify whether the aggregation results returned by the server are correct.

[0059] The present invention discloses an efficient federated learning security aggregation method based on a symmetric homomorphic encryption algorithm:

[0060] During the system initialization phase, CS generates a key using the SHE algorithm, outputs the public parameter PP and the key SK, and uses SHE to encrypt 0 into two different ciphertexts E(0)1 and E(0)2 and then makes them public.

[0061] In the local training phase, each user C i Generate new gradient W after local training update i , and then use the homomorphic signature algorithm based on asymmetric programmable hash function (APHF) combined with BLS signature to sign the gradient W i Signature, User C i Then use the DH protocol to communicate with the aggregation server S A Negotiate the key and calculate the key K i , encrypt PE(W) with the generated public key {E(0)1,E(0)2} i +K i )=(W i +K i )+r1·E(0)1+r2·E(0)1mod N, where PE(·) refers to the public key version of the SHE encryption algorithm. The user then sends the signature together with the encryption parameters to the aggregation server.

[0062] In the server aggregation phase, the aggregation server collects PE(W) in the time interval. i +K i ), after receiving the ciphertext, because the key K i It is negotiated by the aggregation server and the user, so PE (W i +K i ) minus PE(K i ), the gradient ciphertext of each user can be obtained, and then the aggregation server aggregates all signatures and gradient ciphertexts and sends them to the central server (CS).

[0063] In the decryption and distribution of aggregated gradients phase, CS receives the aggregated gradient from the aggregation server S AThe ciphertext is then decrypted and the obtained global parameter Wj and aggregate signature σ are sent to each user C i , users can quickly verify whether the aggregation results returned by the central server are correct.

[0064] In one embodiment, an efficient federated learning security aggregation scheme based on a homomorphic algorithm is as follows: Figure 3 As shown, the specific steps include:

[0065] S1. System initialization phase: In the initialization phase, the central server (CS) generates a key using the SHE algorithm, encrypts 0 into two different ciphertexts E(0)1 and E(0)2, and makes the ciphertext public.

[0066] Detailed steps: The central server (CS) selects a random number L and a prime integer P, then selects a set of prime numbers and calculates q, N = p*q, and outputs the public parameter PP = (k0, k1, k2, k p ,k q ,N) and key SK=(P,L). Use the SHE algorithm to encrypt 0 into two different ciphertexts E(0)1 and E(0)2, and get the public keys E(0)1 and E(0)2. The SHE algorithm is a partially homomorphic encryption algorithm, which consists of three functions: key generation, data encryption and data decryption. The SHE scheme is described in detail below:

[0067] Key generationKeyGen(k0,k1,k2,k p ,k q )→(PP,SK). Given security parameters (k0,k1,k2,k p ,k q etc.), k0<k1<<k2<k p <<k q The key generation algorithm selects a k2-bit random number L and a kp-bit prime integer p. Then, it selects a set of k p Prime number of bits And calculate And N = p·q. Finally, the algorithm outputs the public parameter PP = (k0, k1, k2, k p ,k q ,N) and key SK=(p,L), and set the message space M to

[0068] Encryption Enc(SK,m)→E(m). Given a message m∈(-2k0,2k0] and a key SK, the message m can be encrypted as E(m)=(r L+m)(1+r'p)mod N, where r, r' are respectively and A random number.

[0069] Decryption Dec(SK, E(m)) → m. Given a ciphertext E(m) and a secret key SK, E(m) can be decrypted to m’ = (E(m) mod p) mod L = (m + rL) mod L. Specifically, if m < L / 2, we have m > 0 and m = m′. Otherwise, if m > L / 2, we have m < 0 and m = m′ - L.

[0070] The SHE algorithm supports homomorphic addition and multiplication operations:

[0071] Ciphertext homomorphic property: Given two ciphertexts E(m1) and E(m2):

[0072] E(m1) + E(m2) → E(m1 + m2);

[0073] E(m1)·E(m2) → E(m1·m2), in ciphertext multiplication, the maximum multiplication depth is

[0074] Scalar homomorphic property: Given a ciphertext E(m1) and a plaintext m2:

[0075] E(m1) + m2 → E(m1 + m2);

[0076] E(m1)·m2 → E(m1·m2); in scalar multiplication, m2 > 0 should be satisfied. In addition, the multiplication depth of scalar multiplication is

[0077] The public-key version of SHE: Based on the scalar homomorphic property, we can further transfer SHE to a public-key encryption algorithm by generating public keys {E(0)1, E(0)2}, where E(0)1 and E(0)2 are two different ciphertexts of 0. Then, the message m ∈ (-2k0, 2k0) can be encrypted as E(m) = m + r1·E(0)1 + r2·E(0)1 mod N, where r1 and r2 are random numbers satisfying r1, r2 ∈ {0, 1} k1 For the correctness of public-key encryption, k1 should satisfy k1 < k p -2k2.

[0078] The SHE scheme proposed in this embodiment improves lightweight homomorphic encryption to protect the sensitive information of the gradients uploaded by users, and designs a method based on SHE and Diffie-Hellman to improve the model update efficiency. In addition, since the symmetric homomorphic algorithm can perform encryption operations on ciphertexts and plaintexts.

[0079] To ensure the verifiability of the data, the user will sign the gradients obtained after local training. The homomorphic signature method adopted by the present invention includes the following algorithms:

[0080] (1) HS.Gen(bgp)→(hsk,hpk): Input the asymmetric bilinear group bgp, create the BLS algorithm signature key pair (sk′,pk′)←BLS.Gen(bgp), select two random seeds K in the pseudo-random function F:K×{0,1}*→Zq key space, Generate two sets of APHF key pairs (sek,pek)←H.Gen(bgp) and (sek′,pek′)←H.Gen′(bgp). Set and hpk=(pk′,bgp,pek,pek′), return the homomorphic signature key (hsk,hpk).

[0081] (2) HS.Sign(hsk,ω,n,Δ)→σ n : Input the signature private key hsk, message ω, user identifier n and identifier Δ, and generate a homomorphic signature, which specifically includes the following steps:

[0082] ·Use pseudo-random function to derive z←FK(Δ) and calculate Z=hz;

[0083] Bind Z to the identifier Δ and calculate σ △ ←BLS.Sign(sk′,Δ|Z);

[0084] Derivation Set R = gr and calculate

[0085]

[0086] Return the homomorphic signature σ=(σ △ ,Z,R,S).

[0087] (3) HS.Eval(Σ,U)→σ: Input a set of signatures Σ={σ m} m∈U , where σ m =(σ △ ,m,Z m ,R m ,S m ), and the user set U. Randomly select m∈U, set m∈U, set σ △ =σ △,m , Z=Z m ,calculate

[0088] S=∏ m∈U S m

[0089] Returns the homomorphic signature σ=(σ △ ,Z,R,S).

[0090] (4) HS.Verify(hpk,ω,σ,U,Δ)→Bool: Input verification public key hpk, model parameter ω, homomorphic signature σ, user set U and identifier Δ. First run BLS.Verify(pk′,Δ|Z,σ △ ), verify σ △ Is it a valid signature for identifiers Δ and Z? If not, stop and return False. Otherwise, return True if and only if the following equation is satisfied:

[0091] e(S,Z)=(∏ m∈U H.PubEval(pek,m))·e(R,h)·(∏ m∈U H.PubEval′(pek′,l) w1 )

[0092] S2, local training phase: each user C i Train the model on the local training dataset and update the model parameters W i .

[0093] Detailed steps:

[0094] (1) Each user C i Generate new gradient W after local training update i .

[0095] (2) Using the homomorphic signature algorithm based on asymmetric programmable hash function (APHF) combined with BLS signature to sign W i Sign and use the HS.Sign algorithm to obtain the homomorphic signature HS.Sign(hsk i ,W i ,n i ,Δ i )→σ i , where hsk i User C i The signature private key, n i and Δ i Is the user ID and identifier.

[0096] (2) User C i Then use the Diffie-Hellman (DH) protocol to communicate with the aggregation server S A Negotiate the key Key, the negotiated key is Key = (PKSAskc i ) mod P calculation, where skc i User C i The negotiated private key of PKSA is the aggregation server S A The public key of

[0097] (3) User C i Calculate the key K i =H(Key||T i ). Among them, T i is the current time.

[0098] (4) User C i Encrypt W using CS's public keys E(0)1 and E(0)2 i +K i , PE(W i +K i )=(W i +K i )+r1·E(0)1+r2·E(0)1mod N, where i=1,2,3...., r1 and r2 are such that r1,r2∈{0,1} k1 A random number.

[0099] (5) User C i Send {PE(W i +K i ),T i ,h i}To the aggregation server SA.

[0100] S3, server aggregation phase: The aggregation server collects the user's encrypted gradient and its signature value, aggregates them and sends them to CS.

[0101] Detailed steps:

[0102] Aggregation Server S A Collect {PE(W i +K i ),T i}, verify T i If the timeout period is exceeded, the gradient is discarded.

[0103] Aggregation Server S A Received from user C i The ciphertext sent, K i =H(Key||T i ), PE(K i )=K i +r1·E(0)1+r2·E(0)1mod N,PE(W i )=PE(W i +K i )-PE(K i ), and obtain the encrypted gradient PE(W1), PE(W2), PE(W3)...PE(W n ).

[0104] Aggregate the encrypted gradients PE(W1), PE(W2), PE(W3)... PE(W n ), and the gradient aggregation formula is And aggregate the signature σ i =(h △ , i, X i , R i , S i ). Set σ △ =h △ , Z = Z i , and calculate to obtain the aggregated signature σ=(σ △ , Z, R, S).

[0105] The aggregation server S A sends the aggregated encrypted gradient PE(W j ) and the aggregated signature σ to the CS.

[0106] S4. Decryption and distribution of the aggregated gradient phase: Decrypt the aggregated gradient to obtain the global gradient. After distributing the global gradient and the aggregated signature to each client, the client quickly verifies whether the aggregation result is correct.

[0107] Detailed steps:

[0108] (1) The CS receives the ciphertext sent by the aggregation server S A , and then decrypts it with the key SK=(P, L) of the symmetric homomorphic algorithm. The decryption result is the aggregated gradient W j . W′=(PE(W j ) mod P) mod L=(W + rL) mod L (if W′<L / 2, we have W>0, W = W′. Otherwise, if W′>L / 2, we have W<0, W = W′ - L).

[0109] (2) The CS distributes W j and the aggregated signature σ to each user Ci.

[0110] S5. Verification phase: Each user C i uses the HS.EffVer algorithm to quickly verify the aggregation result returned by the server, where the HS.EffVer algorithm will be described in detail in the following verification phase.

[0111] To achieve efficient verification, the HS.Verify algorithm can be divided into an offline phase and an online phase.

[0112] (1) In the offline phase, use the HS.VerPre algorithm to preprocess some results offline. Input asymmetric programmable hash function H, H′, verification public key hpk, user set U and message dimension L. Calculate Hm = H.PubEval(pek,m), H = {Hm}m∈U for Calculate H1′=H.PubEval′(pek′,l), H′={H1′}l∈L, and return hpkp=(pk′,bgp,H,H′).

[0113] (2) In the online stage, the HS.EffVer algorithm is used to verify the aggregation results. HS.EffVer(hpkp,Wi,σ,U,Δ)→Bool: This algorithm is the same as HS.Verify, except that the calculation formula is modified to:

[0114]

[0115] The present invention has shown and described the basic principles and main features of the present invention and the advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. An efficient federated learning security aggregation method based on symmetric homomorphic encryption algorithm, characterized in that: It includes the following steps: Step S1: System initialization. The central server CS generates the private key of the SHE encryption algorithm and the public keys E(0)1 and E(0)2, where E represents the encryption algorithm of SHE. The central server CS broadcasts the initial global gradient W0 to n users. The SHE encryption algorithm supports homomorphic addition and multiplication operations and has the scalar homomorphic property. The operation processing of the SHE encryption algorithm specifically includes: Step S11: Key generation: given security parameters (k0, k1, k2, k p , k q ), and k0 <k1<<k2<k p <<k q ; The key generation algorithm selects a k2-bit random number L and a k p A prime integer p of bits, then a set of k p Prime number of bits And calculate And parameter N = p·q; finally output common parameter pp = (k0, k1, k2, k p , k q , N) and key SK = (p, L), and set the message space M to Step S12: Encryption: Given a message m∈(-2k0, 2k0] and a key SK, the message m can be encrypted as E(m)=(r L+m)(1+r'p)mod N, where r and r' satisfy and A random number; Step S13: Decryption. For the ciphertext E(m) and the key SK, E(m) is decrypted to m' = (E(m) mod p) mod L = (m + rL) mod L. If m < L / 2, then m > 0 and m = m'; if m > L / 2, then m < 0 and m = m' - L. Step S2: User C i Generate new gradient W after local training update i , User C i The gradient W is queried using a homomorphic signature algorithm based on an asymmetric programmable hash function combined with BLS signature. i Sign and get signatureσ i , and communicate with the aggregation server S through the Diffie-Hellman protocol A Negotiate the key Key and calculate the key K i ; Use SHE encryption algorithm to encrypt W i +K i Encryption, and finally send the ciphertext and signature value to the aggregation server S A ; The specific operations of the homomorphic signature algorithm include: Input the asymmetric bilinear group bgp, create a BLS algorithm signature key pair (sk′, pk′)←BLS.Gen(bgp), and select two random seeds in the key space of the pseudo-random function F:K×{0,1}*→Zq Generate two sets of APHF key pairs (sek, pek)←H.Gen(bgp) and (sek′, pek′)←H.Gen′(bgp), set And hp k = (pk′, bgp, pek, pek′), return the homomorphic signature key (hsk, hpk), where hsk is the signature private key, hpk is the verification public key, and the arrow symbol ← indicates that the calculated or generated result is assigned to the corresponding variable or data structure; Input the signature private key hsk, the message ω, the user identifier n, and the identifier Δ to generate a homomorphic signature. Input a set of signatures ∑={σ m } m∈U , where σ m =(σ Δ , m, Z m , R m , S m ), U is the user set, randomly select a m∈U, set σ Δ =σ Δ,m , Z=Z m , multiply each user's Rm and Sm to get R = Π m∈U R m , S = Π m∈U S m , return the homomorphic signature σ=(σ Δ , Z, R, S); Input the verification public key hpk, model parameter ω, homomorphic signature σ, user set U and identifier Δ, use the BLS signature verification algorithm to verify whether the given homomorphic signature is valid, run BLS.Verify(pk′, Δ|Z, σΔ), pass in the verification public key pk′, identifier Δ, message Z, and signature σ Δ , verify σ Δ Is it a valid signature for the identifiers Δ and Z? If not, stop and return False, otherwise, return True if and only if the following equation is satisfied: e(S,Z)=(Π m∈U H.PubEval(heavy,m))·e(R,h)·(Π m∈U H.PubEval′(peck′,l) w1 ); This equation is the specific calculation formula used to verify the homomorphic signature in the BLS signature scheme, where e(S, Z) represents the bilinear mapping function on the elliptic curve, which is used to calculate the mapping value of the signature S with respect to the message Z; e(R, h) represents the bilinear mapping function on the elliptic curve, which is used to calculate the mapping value of the random number R and the hash result h. The specific content of step S2 includes: User C i Calculate the key K i =H(Key||T i ). Among them, T i is the current time, and Key is a new key generated by encrypting the aggregation server public key with the user's private key. sk ci User C i The negotiated private key, PK SA It is the aggregation server S A 's public key; User C i Encrypt W using the public keys E(0)1 and E(0)2 of the central server CS i +K i , PE(W i +K i )=(W i +K i )+r1·E(0)1+r2·E(0)1mod N, where i=1, 2, 3...., r1 and r2 are such that r1, r2∈{0, 1} k1 A random number, where {0, 1} k1 Represents a set of binary sequences with a length of k1 bits; User C i Send ciphertext gradient {PE(W i +K i ), T i , σ i } to the aggregation server S A , σ i Represents the homomorphic signature of the gradient Wi generated by user Ci; Step S3: Aggregation Server S A Collect ciphertext gradients and signatures within a preset time interval, aggregate the collected ciphertexts to obtain the aggregated ciphertext E(W j ),in j represents the jth iteration; for signature σ i Aggregate to obtain the aggregate signature σ, and convert the aggregate ciphertext E(W j ) and the aggregate signature σ are sent to the central server CS; specifically including the following sub-steps: Step S31: Aggregation server S A Collect the ciphertext gradient {PE(W i +K i ), T i ,h i }, verify T i The legitimacy of the gradient is discarded if it times out; Step S32: Aggregation server S A Received from user C i The ciphertext sent, calculation K i =H(Key||T i ), PE(K i )=K i +r1·E(0)1+r2·E(0)1mod N,PE(W i )=PE(W i +K i )-PE(K i ), and obtain the encrypted gradients PE(W1), PE(W2), PE(W3)…PE(W n ); Step S33: Encrypt the gradients PE(W1), PE(W2), PE(W3) ... PE(W n ) for polymerization, the gradient polymerization formula is And aggregate the signatures, the signature aggregation formula is σ i =(h Δ ,i,Z i , R i , S i ), set σ Δ =h Δ , Z=Z i ,calculate Get the aggregate signature σ=(σ Δ , Z, R, S); Step S34: Aggregation server S A The encrypted gradient PE (W j ) and the aggregate signature σ are sent to the central server CS; Step S4: The central server CS receives the data from the aggregation server S A After sending the aggregated ciphertext, the encrypted gradient PE(W j ) is decrypted to obtain the global gradient W j , and the global gradient W j And the aggregate signature σ is sent to each user C i ; Specifically include: The central server CS receives the ciphertext sent by the aggregation server S A and then decrypts it using the key SK = (P, L) of the symmetric homomorphic algorithm. The decryption result is the aggregated gradient W j ; W' = (PE(W j ) mod P) mod L = (W + rL) mod L. If W' < L / 2, then W > 0 and W = W'; if W' > L / 2, then W < 0 and W = W' – L, where L is the selected random number; The central server CS will W j And the aggregate signature σ is sent to each user C i ; Step S5: User C i Verify whether the aggregated result returned by the server is correct; the user C i Verification specifically includes: In the offline stage, some results are preprocessed offline using the HS.VerPre algorithm; Input asymmetric programmable hash function H, H′, verify public key hpk, user set U and message dimension L; Calculate Hm = H.PubEval(pek,m), H = {Hm}, m∈U; for Calculate H1′=H.PubEval′(pek′,l), H′={H1′}, l∈L, and return hpkp=(pk′,bgp,H,H′), where H.PubEval(pek,m) means using the public evaluation algorithm PubEval in the asymmetric programmable hash function H, taking user m as input, and then calculating the corresponding hash value Hm. Through this process, the corresponding hash value Hm can be generated for each user m, thereby preprocessing some results in the offline stage and preparing for the subsequent verification steps; In the online stage, the HS.EffVer algorithm is used to verify the aggregation result; HS.EffVer(hpkp,Wi,σ,U,Δ)→Bool. The verification method of the HS.EffVer algorithm is the same as that of the homomorphic signature algorithm. The calculation formula is modified as follows:

Images