A method and system for auditing encrypted data in federated learning based on dual blockchains

Abstract

The present invention discloses a method for auditing encrypted data of federated learning based on dual blockchains, and uses the structure of dual blockchains to audit the client gradient of federated learning, wherein the behavior blockchain is responsible for recording transaction information and adding noise to gradient ciphertext, and the audit blockchain is responsible for implementing the audit algorithm to verify the gradient set, and uses the improved national secret SM9 algorithm to homomorphically encrypt the client gradient data. The audit algorithm targets a gradient matrix, and gradually narrows the audit scope to locate the threat gradient by the method of "first overall, then row by row, and finally single gradient". The present invention uses blockchain and homomorphic encryption technology to audit gradient attacks such as poisoning attacks and free-rider attacks in the process of federated learning with high accuracy, and uses the structure of dual blockchains at the same time, optimizes the audit resource configuration, and reduces failure losses.

Description

Technical Field

[0001] The present invention relates to a federated learning encrypted data auditing method and system based on dual blockchains, which realizes data privacy protection through the dual blockchain structure and the federated learning architecture, uses the improved national secret algorithm SM9 for homomorphic encryption, and designs an audit algorithm to audit the gradient attack threat existing in the model training process, belonging to the field of artificial intelligence security. Background Art

[0002] Auditing is a systematic, independent assessment and inspection activity that aims to verify and evaluate the accuracy, compliance, and reliability of organizations, systems, processes, projects, or accounts. Auditing plays an important role in various fields and industries. It helps to ensure the accuracy and reliability of data and protect interests and assets. With the development of informatization and the era of big data, auditing has also been widely used in the field of machine learning. As a new paradigm of distributed privacy-preserving machine learning, there may be some untrusted participants in federated learning, which may attempt to interfere with or disrupt the federated learning process by providing false or damaged encrypted gradients. Auditing the encrypted gradient data in federated learning and locating the existing malicious gradients of poisoning attacks and free-rider attacks is very necessary to maintain the learning effect of the model.

[0003] However, traditional data auditing methods rely on centralized auditing agencies or third parties to verify the accuracy and legality of data and calculations. This centralized trust model may introduce a single point of failure. Once the auditing agency or third party is attacked or manipulated, the audit results may be questioned or tampered with. In addition, traditional auditing methods usually lack transparency, and the audit process and results are invisible or unverifiable to participants, which may lead to suspicion and distrust of the audit results. Moreover, traditional data auditing methods require access to original data or decrypted data for auditing, which is contrary to the local data retention characteristics of federated learning, and brings data security and privacy risks to participating members. In addition, traditional data auditing methods cannot effectively incentivize cooperation among participants in federated learning and punish improper behavior of participants, which is not conducive to model convergence.

[0004] The emergence of blockchain technology has provided new possibilities for data auditing in federated learning. Blockchain is a decentralized, tamper-proof distributed ledger that can record and verify the integrity of transactions and data. The paper "Blockchain Assisted Federated Learning for Enabling Network Edge Intelligence" uses blockchain technology to audit participating nodes, ensures the reliability of the federated learning process, and designs a matching audit mechanism to avoid privacy leakage. Homomorphic encryption technology allows computing operations on data in an encrypted state without decrypting the data itself, and also provides important support for the audit of encrypted gradients in federated learning. For example, the paper "Blockchain and homomorphic encryption based privacy-preserving model aggregation for medical images" uses homomorphic encryption and blockchain to achieve secure aggregation of privacy-sensitive models. However, in existing methods, using a single blockchain for auditing has problems such as performance limitations, high risk of failure, and low resource utilization.

[0005] The national secret algorithm, represented by the SM series of ciphers, has higher efficiency and lower power consumption than the international mainstream RSA algorithm. However, the national secret algorithm does not have homomorphic properties and does not have an advantage in privacy protection. The 2022 article "Additive Homomorphic Encryption Scheme Based on National Secret SM2 and SM9" implements the additive homomorphism of the national secret algorithm. However, this improved method has not yet been applied, and in this method, the generation of the key depends on KGC, which is not suitable for multiple encryption parties in the federation scenario and has extremely high privacy protection requirements.

[0006] Existing data auditing methods for federated learning rely on centralized auditing agencies or third parties, which may introduce single points of failure and trust issues. In addition, traditional data auditing methods require access to original data or decrypted data, which conflicts with the local nature of data retention in federated learning and increases data security and privacy risks. The auditing method that introduces blockchain has problems such as performance limitations, high risk of failure, and low resource utilization. The latest improved national secret algorithm for homomorphic encryption has not yet been put into use, and it is not easy to gain the trust of federated members by centrally generating keys. Summary of the invention

[0007] The purpose of the present invention is to provide a method for auditing federated learning data that can protect data privacy, ensure fairness and security of participants, and efficiently use resources, including a client module, a server module, a behavior blockchain module, and an audit blockchain module. The audit method is performed in a cycle in four modules according to certain steps until the model training converges. The present invention can effectively audit the gradient attack threat in federated learning, and reasonably allocates the resource configuration of the blockchain, has lower failure losses, uses a modified national secret algorithm to distribute key generation and performs homomorphic encryption, has higher cryptographic efficiency, lower power consumption, and is appropriate for distributed multi-user scenarios.

[0008] The present invention first discloses a method for auditing encrypted data of federated learning based on dual blockchains, which uses the structure of dual blockchains to audit the client gradient of federated learning, wherein the behavior blockchain is responsible for recording transaction information and adding noise to the gradient ciphertext, and the audit blockchain is responsible for implementing the audit algorithm to verify the gradient set, and using the improved SM9 algorithm to homomorphically encrypt the client gradient data. The audit algorithm targets a gradient matrix and gradually narrows the audit scope to locate the threat gradient by the method of "first overall, then row by row and column by column, and finally single gradient". The main steps of the method described in the present invention include:

[0009] Step S1: The server distributes the global model to the audit blockchain and each client, and distributes the test data set to the audit blockchain;

[0010] Step S2: The client obtains the local data gradient through training, performs homomorphic encryption using the improved national encryption SM9 algorithm, calls the smart contract to calculate the model loss on the test data set, and submits the gradient ciphertext and loss to the behavior blockchain;

[0011] Step S3: The behavior blockchain adds noise to the gradient ciphertext and records the transaction information, and transfers the ciphertext and the loss to the audit blockchain;

[0012] Step S4: Audit the blockchain aggregation gradient, audit the gradient combination and gradually narrow the scope to locate malicious data;

[0013] Step S5: The server aggregates and audits the blockchain to update the global model;

[0014] The method loops the above five steps until the global model converges and the training ends.

[0015] In step S2, for each client, the local gradient data to be encrypted is set to m, and the gradient ciphertext c = (c1, c2, c3) is obtained through the improved SM9 algorithm. The main steps include:

[0016] Step S2.1: is a modulo N multiplication group, KGC randomly generates As the encryption master private key, according to the Sharmir threshold secret sharing scheme, a t-1 degree polynomial f(x)∈Z is randomly constructed q [x]:

[0017] f(x)=msk+a1x+a2x 2 +…+a t-1 x t-1

[0018] where msk = f(0), a1, a2, ..., a t-1 ∈Z q ;

[0019] Step S2.2: Randomly select n elements x1, x2, ..., x n ∈Z q , n is the number of federation members, calculate msk i =f(x i ), and (x i ,msk i ) are distributed to the federation member clients respectively i (i=1, 2, ..., n);

[0020] Step S2.3: t of the n members share their respective key fragments msk i To restore msk:

[0021]

[0022] Step S2.4: Let G1 and G2 be additive cyclic groups of order prime number N, and P1 and P2 be their generators. Calculate the global master public key based on the recovered global master private key msk:

[0023] mpk=[msk]P1

[0024] Step S2.5: Let the decryption party, i.e. the audit blockchain, be identified as id, hid be the encryption private key generation function identifier, and KGC be in the finite field F N Calculation:

[0025] t1=H1(id||hid,N)+msk

[0026] t2=msk·t1 -1

[0027] Audit the blockchain to get the decryption private key:

[0028] sk id =[t2]P2

[0029] Step S2.6, define the cryptographic hash function:

[0030]

[0031] Calculate the element Q in the group G B =H1(id||hid,N)P1+mpk;

[0032] Step S2.7: Generate random numbers Compute the element c1=[r]Q in the group G1 B ;

[0033] Step S2.8, G T is a multiplicative cyclic group of prime order N, e is from G1×G2 to G T Bilinear pairings of , computing the group G T The element g = e(mpk, P2) in the equation, calculate w = g r ;

[0034] Step S2.9, suppose the local gradient data to be encrypted is m, its bit length mlen is set to 32 bits, klen=mlen+256, and the key generation function KDF is defined as: {0, 1} * ×klen→{0, 1} klen , calculate K = KDF(c1||w||id,klen);

[0035] Step S2.10, remove the first mlen bits of K, the remaining is K2, and then calculate c2 = g m ×w;

[0036] Step S2.11: Define the message verification code function Calculate c3 = MAC (K2, c2);

[0037] Step S2.12, obtain the gradient ciphertext c = (c1, c2, c3).

[0038] In step S3, the behavioral blockchain adds noise to the gradient ciphertext. The main steps include:

[0039] Step S3.1: A block of the behavior blockchain contains 9 gradient ciphertexts, which are mapped into a 3-order square matrix. Let the mapping gradient be denoted by C ij , the matrix row numbers are marked as i∈{1, 2, 3}, the matrix column numbers are marked as j∈{1.2.3}, and the matrix is ​​represented as C=(C ij ) 3×3 ,in: The corresponding loss is also mapped to L ij ;

[0040] Step S3.2: For each mapping gradient C ij, the behavior blockchain generates a random value n similar to the size of the gradient ciphertext ij As noise, the behavior blockchain adjusts each n ij , ensure that the noise sum of each row and column is 0, that is, and

[0041] Step S3.3: Homomorphically encrypt nij to obtain

[0042] Step S3.4, polymerization C ij With N ij get The gradient matrix with added noise is recorded as C′=(C′ ij ) 3×3 ;

[0043] Step S3.5, the behavior blockchain records the transaction information in the block and compares the noise gradient matrix C′ with the mapping loss L ij Passed to the audit blockchain.

[0044] In step S4, the blockchain aggregation gradient is audited, the audit gradient combination is combined and the scope is gradually narrowed to locate malicious data. The main steps include:

[0045] Step S4.1: Audit blockchain to calculate average loss Aggregate the gradient ciphertext with added noise. Since the improved SM9 national encryption algorithm is homomorphic, the noise is removed after aggregation:

[0046]

[0047] Step S4.2: The audit blockchain performs homomorphic decryption on the aggregate gradient ciphertext, using the audit blockchain private key sk id , computing group G T The element w′ in id ),calculate Using BSGS algorithm from The calculation results in

[0048] Step S4.3: Audit blockchain to calculate the mean of the global aggregate gradient:

[0049]

[0050] Step S4.4: Audit blockchain uses the decrypted gradient combination to update the model, evaluates the model on the public test dataset and calculates the loss, denoted as L global ;

[0051] Step S4.5: Lglobal As a benchmark, conduct a global audit and global With L avg For comparison, if |L global -L avg |<∈1,∈1>0, the error is within the allowable range and the entire set of gradients passes the audit. Otherwise, it indicates that the data quality between devices varies greatly. There may be dishonest devices that provide malicious gradients. The audit blockchain will audit gradients in units of rows and columns of the matrix.

[0052] Step S4.6: After the global audit finds that there may be malicious gradients, the noise gradient matrix C′ is aggregated in rows and columns, and the homomorphic decryption is obtained and

[0053] Step S4.7: Use the test dataset to evaluate the aggregate gradients of each row and column and Get loss and

[0054] Step S4.8: Audit by matrix rows and matrix columns and Audit and L global and L ij If the deviation Then it is determined that there is a suspicious gradient of free riding in row i, recorded as a suspicious row, if Then it is determined that column j has a suspicious gradient of free riding, recorded as a suspicious column, if Then it is determined that there is a suspicious gradient of poisoning attack in row i, which is recorded as a suspicious row. Then it is determined that column j has a suspicious gradient of poisoning attack and is recorded as a suspicious column;

[0055] Step S4.9: If the audited blockchain only finds an abnormal aggregate gradient in one row and one column, their public gradient is identified as a malicious gradient, and the device that provides the gradient is identified as a malicious device;

[0056] Step S4.10: If the audit blockchain finds multiple suspicious rows and columns, it is considered that there are multiple malicious devices. The normal gradients of non-suspicious rows and columns are removed to obtain the suspicious gradient set C′. doubt ;

[0057] Step S4.11, Requirement set C′ doubt The clients who provide the suspicious gradients interact directly with the audit blockchain and convert C′ ij Eliminate the noise and decrypt to get m ij ;

[0058] Step S4.12: Update the model using a single gradient and evaluate the model loss L′ using the test dataset ij , L′ ij With L global and L ij Compare, if L′ ij -L ij >∈2,∈2>0, then the gradient m ij is a suspicious gradient with free-riding behavior, if L′ ij -L global >∈3,∈3>0, then the gradient m ij For a suspected gradient of poisoning attack, the client providing the gradient is identified as a malicious device;

[0059] Step S4.13: If there is a malicious device, the malicious device is prohibited from participating in the training. If the matrix C′=(C′ ij ) 3×3 If the overall gradient passes the audit, the homomorphically encrypted aggregated gradient is delivered to the server for global model update.

[0060] The present invention also discloses a dual-blockchain-based federated learning encrypted data audit system, which is used to implement the dual-blockchain-based federated learning encrypted data audit method, and the system includes a client module, a behavior blockchain module, an audit blockchain module and a server module;

[0061] The client module uses the global model to train local data, obtains local data gradients, updates local models, uses the improved national encryption SM9 algorithm to homomorphically encrypt local gradients, calls smart contracts to calculate model losses on test data sets, and submits gradient ciphertexts and losses to the behavior blockchain;

[0062] The behavior blockchain module collects the encrypted gradients of the client, adds noise to the gradients, records transaction information, and sends the gradient ciphertext with noise added and the loss to the audit blockchain;

[0063] The audit blockchain module audits the blockchain to pass global model parameters to the client, aggregates local gradients sent from the behavior blockchain, eliminates noise, audits the gradient matrix, locates malicious gradients, and sends them to the server after the audit determines that the entire set of gradients is risk-free;

[0064] The server module receives the audited homomorphically encrypted gradient group, uses the aggregated gradient group to update the global model, and distributes the updated model parameters and the test data set back to the audit blockchain;

[0065] Repeat the server module, client module, behavior blockchain module, and audit blockchain module until the global model converges to obtain the final global model.

[0066] The present invention also discloses a mobile terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the dual-blockchain-based federated learning encrypted data auditing method when executing the program.

[0067] The present invention also discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the dual-blockchain-based federated learning encrypted data auditing method are implemented.

[0068] Beneficial effects of the present invention

[0069] This application meets the strong demand of users in the information age for data privacy protection, and can efficiently audit the security compliance of encrypted data for enterprises, which is of great benefit to both parties of the transaction; this method optimizes the blockchain structure and audit algorithm to ensure low resource consumption and low failure loss in the audit process, effectively reducing the audit cost; this method applies the latest improved national secret algorithm and further optimizes key generation, with higher encryption and decryption efficiency and lower efficacy, and is more in line with the distributed scenario requirements of federated learning. Specifically including:

[0070] 1) The dual blockchain structure is used to audit the encrypted gradient, which can not only realize the gradient record of privacy protection, but also realize the trusted quality audit. The dual blockchain setting of one large and one small in this structure is easy to manage and avoids the waste in the process of block generation and consensus;

[0071] 2) The designed gradient audit algorithm can quickly locate suspicious data while maximally protecting the privacy of data providers. It is efficient and safe;

[0072] 3) It can effectively reduce the threats of model inversion attacks, poisoning attacks, free-rider attacks, etc. to the federated learning client and server;

[0073] 4) The improved national encryption algorithm SM9 is innovatively applied to the auditing field, expanding the application scenarios of domestic encryption to generate distributed encryption master private keys, making the encryption process more secure and reliable, and suitable for federal scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 The figure is a flow chart of the method of the present invention.

[0075] Figure 2 Detailed flow chart of step S3 in the method of the present invention.

[0076] Figure 3 This is a detailed flow chart of step S4 in the method of the present invention. DETAILED DESCRIPTION

[0077] The present invention will be further described below in conjunction with embodiments, but the protection scope of the present invention is not limited thereto:

[0078] Example 1

[0079] This example experiments on a public dataset CelebA. The CelebA dataset is a public dataset widely used for tasks such as face recognition, face attribute analysis, and face generation. The dataset was released by a research team from the Chinese University of Hong Kong in 2015. The CelebA dataset contains 202,599 face images of well-known people on the Internet, from about 10,177 identities. Each image has 40 binary attribute labels and 5 continuous attribute labels. These attribute labels include age, gender, hairstyle, facial expression, etc. In addition, the dataset also provides the aligned face bounding box coordinates for each image.

[0080] In this embodiment, a local computer is used to simulate the client of federated learning, and the data set is evenly divided into several subsets, which are assigned to 9 computers. The global and local iterations are set to 50 and 1 respectively, and the learning rate is 0.0001. For the CelebA data set, the size of the data subset is set to 1280 and the batch size is 64. The dual blockchain design of this embodiment is based on the Hyperledger platform to improve consensus efficiency. To this end, the number of endorsement nodes of the hyperledger is set to be small, and each recognized peer can support the deployment of smart contracts. Each round of federated learning and auditing process of the present invention is as follows:

[0081] Step S1: The server distributes the global model to the audit blockchain and the client, and sends the audit test data set to the audit blockchain. In this embodiment, the test data set is an image of a data subset size randomly extracted from the CelebA data set. In this embodiment, there are 9 computers as clients, which are hereinafter referred to as device 1 to device 9;

[0082] Step S2: The client trains the model locally to obtain the local data gradient, updates the local model, and uses the improved SM9 algorithm to homomorphically encrypt the local gradient to obtain the ciphertext c = (c1, c2, c3). The client calls the smart contract to calculate the model loss on the test data set and submits the gradient ciphertext and loss to the behavior blockchain. The encryption process specifically includes:

[0083] Step S2.1: is a modulo N multiplication group, KGC randomly generates As the encryption master private key, according to the Sharmir threshold secret sharing scheme, a t-1 degree polynomial f(x)∈Z is randomly constructed q [x]:

[0084] f(x)=msk+a1x+a2x 2 +…+a t-1 x t-1

[0085] where msk = f(0), a1, a2, ..., a t-1 ∈Z q ;

[0086] Step S2.2: Randomly select n elements x1, x2, ..., x n ∈Z q , n is the number of federation members, in this embodiment n = 9, calculate msk i =f(x i ), and (x i ,msk i ) are distributed to the federation member clients respectively i (i=1, 2, ..., n);

[0087] Step S2.3: t of the n members share their respective key fragments msk i To restore msk:

[0088]

[0089] In this embodiment, six members need to share their fragments, i.e., t = 6, to recover the key;

[0090] Step S2.4: Let G1 and G2 be additive cyclic groups of order prime number N, and P1 and P2 be their generators. Calculate the global master public key based on the recovered global master private key msk:

[0091] mpk=[msk]P1

[0092] Step S2.5: Let the decryption party, i.e. the audit blockchain, be identified as id, hid be the encryption private key generation function identifier, and KGC be in the finite field F N Calculation:

[0093] t1=H1(id||hid,N)+msk

[0094] t2=msk·t1 -1

[0095] Audit the blockchain to get the decryption private key:

[0096] sk id =[t2]P2

[0097] Step S2.6, define the cryptographic hash function:

[0098]

[0099] Calculate the element Q in the group G B =H1(id||hid,N)P1+mpk;

[0100] Step S2.7: Generate random numbers Compute the element c1=[r]Q in the group G1 B ;

[0101] Step S2.8, G T is a multiplicative cyclic group of prime order N, e is from G1×G2 to G T Bilinear pairings of , computing the group G T The element g = e(mpk, P2) in the equation, calculate w = g r ;

[0102] Step S2.9, suppose the local gradient data to be encrypted is m, its bit length mlen is set to 32 bits, klen=mlen+256, and the key generation function KDF is defined as: {0, 1} * ×klen→{0, 1} klen , calculate K = KDF(c1||w||id,klen);

[0103] Step S2.10, remove the first mlen bits of K, the remaining is K2, and then calculate c2 = g m ×w;

[0104] Step S2.11: Define the message verification code function Calculate c3 = MAC (K2, c2);

[0105] Step S2.12, obtain the gradient ciphertext c = (c1, c2, c3).

[0106] In this embodiment, a smart contract is a piece of code that is honestly executed by approved peers. The code and data it manipulates are subject to external supervision. Once the conditions are triggered, the code is automatically executed to produce the operating results;

[0107] Step S3: The behavior blockchain adds noise to the received gradient ciphertext and records the transaction information in the blockchain, and transfers the noisy gradient ciphertext and the loss to the audit blockchain, specifically including:

[0108] Step S3.1: A block in the behavior blockchain contains 9 gradient ciphertexts from device 1 to device 9. These gradient ciphertexts are mapped into a 3-order square matrix. Let the mapping gradient be denoted by C ij , the matrix row numbers are marked as i∈{1, 2, 3}, the matrix column numbers are marked as j∈{1.2.3}, and the matrix is ​​represented as C=(Cij ) 3×3 ,in: The corresponding loss is also mapped to L ij ;

[0109] Step S3.2: For each mapping gradient C ij The behavior blockchain generates a random value n similar to the size of the gradient ciphertext according to the encoding rules of the improved national encryption algorithm SM9. ij As noise, the behavior blockchain adjusts each n ij , ensuring that the noise sum of each row and column is 0, that is, and

[0110] Step S3.3: for n ij Homomorphic encryption

[0111] Step S3.4, polymerization C ij With N ij get The gradient matrix with added noise is recorded as C′=(C′ ij ) 3×3 ;

[0112] Step S3.5, the behavior blockchain records the transaction information in the block and compares the noise gradient matrix C′ with the mapping loss L ij Passed to the audit blockchain.

[0113] Step S4: Audit the blockchain aggregate gradient ciphertext, eliminate noise, audit the gradient combination and gradually narrow the scope to locate malicious data, specifically including:

[0114] Step S4.1: Audit blockchain to calculate average loss Aggregate the gradient ciphertext with added noise. Since the improved SM9 national encryption algorithm is homomorphic, the noise is removed after aggregation:

[0115]

[0116] Step S4.2: The audit blockchain performs homomorphic decryption on the aggregate gradient ciphertext, using the audit blockchain private key sk id , computing group G T The element w′ in is calculated as follows: Using BSGS algorithm from The calculation results in

[0117] Step S4.3: Audit blockchain to calculate the mean of the global aggregate gradient:

[0118]

[0119] Step S4.4: Audit blockchain uses the decrypted gradient combination to update the model, evaluates the model on the public test dataset and calculates the loss, denoted as L global ;

[0120] Step S4.5: L global As a benchmark, conduct a global audit. If |L global -L avg |<∈1,∈1>0, then the error is within the allowable range and the entire set of gradients passes the audit. Otherwise, it indicates that the data quality differences between devices are large. There may be dishonest devices that provide malicious gradients. The audit blockchain will audit the gradients in units of rows and columns of the matrix. (In this embodiment, the allowable error ε1 is set to 0.05;

[0121] Step S4.6: After the global audit finds that there may be malicious gradients, the noise gradient matrix C′ is aggregated in rows and columns, and the homomorphic decryption is obtained and

[0122] Step S4.7: Use the test dataset to evaluate the aggregate gradients of each row and column and Get loss and

[0123] Step S4.8: Audit by matrix rows and matrix columns and With L global and L ij If the deviation Then it is determined that there is a suspicious gradient of free riding in row i, recorded as a suspicious row, if Then it is determined that column j has a suspicious gradient of free riding, recorded as a suspicious column, if Then it is determined that there is a suspicious gradient of poisoning attack in row i, which is recorded as a suspicious row. Then it is determined that column j has a suspicious gradient of poisoning attack, which is recorded as a suspicious column. In this embodiment, the allowed errors ε2 and ε3 are set to 0.05 respectively;

[0124] Step S4.9: If the audited blockchain only finds abnormal aggregate gradients in one row and one column, their public gradients are marked as suspicious gradients;

[0125] Step S4.10: If the audit blockchain finds multiple suspicious rows and columns, it is considered that there are multiple malicious devices. The normal gradients of non-suspicious rows and columns are removed to obtain the suspicious gradient set C′. doubt ;

[0126] Step S4.11, Requirement set C′ doubt The clients who provide the suspicious gradients interact directly with the audit blockchain and convert C′ ij Eliminate the noise and decrypt to get m ij ;

[0127] Step S4.12: Update the model using a single gradient and evaluate the model loss L′ using the test dataset ij , L′ ij With L global and L ij Compare, if L′ ij -L ij >∈2,∈2>0, then the gradient m ij is a suspicious gradient with free-riding behavior, if L′ ij -L global >∈3,∈3>0, then the gradient m ij For a gradient suspected of poisoning, the customer who provided the gradient is identified as a suspicious device;

[0128] Step S4.13: If there is a malicious device, the malicious device is prohibited from participating in the training. If the matrix C′=(C′ ij ) 3×3 If the gradients of the whole pass the audit, the homomorphically encrypted aggregated gradients are handed over to the server for global model update;

[0129] During the model training process of this embodiment, the audit blockchain needs to face two abnormal situations: one is that there is only one malicious device that has carried out poisoning or hitchhiking attacks, and the only suspicious gradient can be directly located in step S4.9; the other is that there are multiple malicious devices that have carried out attacks, and steps S4.10 to S4.12 need to be performed to determine each suspicious device;

[0130] Step S5: After the audit blockchain confirms that the gradient data is risk-free, the audit information is recorded and the aggregated gradient is sent to the server for a new round of model updates.

[0131] The above is the execution process of the present invention in this embodiment. In order to verify that the audit method of the present invention is effective, this embodiment sets device 9 as a malicious device. First, it is made to carry out a poisoning attack during the model training process, upload a large negative gradient to the server, and use the loss of the test set in the audit blockchain to audit and locate the malicious device. A total of 50 rounds were carried out. During the training process, the losses of the 1st row and the 1st column were much higher than those of other rows and columns. The audit method of the present invention can easily locate the malicious device as device 9, which provides the public gradient in the 1st row and the 1st column; then let device 9 perform a free-rider attack again, which is specifically manifested in that no local training is performed each time, and only a zero gradient is uploaded in each round. When the audit blockchain audit finds that the 3rd row and the 3rd column perform poorly between rounds 10 and 15, the audit blockchain locates device 9 as a free-riding attacker.

[0132] Example 2

[0133] In this example, MNIST is selected as the experimental data set. The MNIST data set is a classic handwritten digit recognition data set, which is composed of handwritten digit samples from the National Institute of Standards and Technology (NIST) of the United States, obtained after processing and standardization. The MNIST data set contains 60,000 training images and 10,000 test images, each of which is a 28x28 pixel grayscale image, representing handwritten samples of 10 numbers from 0 to 9. In this example, the learning rate and the number of iterations are set the same as in Example 1, and the implementation steps and environmental configuration are the same as in Example 1, but the size of the data subset is 800 and the batch size is 50. In this embodiment, device 9 is also set as a malicious device, and poisoning attacks and free-rider attacks are performed respectively. The experimental results are similar to those in Example 1. It can be found that the audit method of the present invention can also efficiently locate malicious devices on the MNIST data set.

[0134] The existing traditional auditing methods have problems such as single point failure and trust crisis, and need to access the original data, which is not suitable for federated learning; the existing blockchain auditing methods have problems such as performance limitations, high risk of failure, and low resource utilization; in addition, if these methods are combined with homomorphic encryption technology, most of them are foreign ciphers such as Paillier; and the latest proposed improved national secret algorithm that realizes homomorphic encryption has not yet been applied and relies on the centralized generation of keys by KGC, which is contrary to the privacy protection requirements of federated learning. The present invention uses blockchain and homomorphic encryption technology to audit gradient attacks such as poisoning attacks and free-rider attacks in the process of federated learning with high accuracy, and uses a dual blockchain structure to optimize the audit resource allocation and reduce failure losses. In addition, the improved national secret algorithm SM9 is innovatively used to homomorphically encrypt the local gradient of federated learning, and the global master key generation of the algorithm is improved. The key generation is changed from centralized to distributed with the participation of federated members using the shamir secret sharing method, which not only takes advantage of the higher efficiency and lower efficacy of the traditional SM9 algorithm, but also takes advantage of the homomorphic encryption feature of the improved SM9 algorithm, and also makes the key generation scenario more in line with the actual federation, more secure and reliable.

[0135] The present invention provides a method for auditing encrypted data based on federated learning of dual blockchains. There are many methods and ways to implement the technical solution. The above is only a preferred implementation of the present invention. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made, and these improvements and modifications should also be regarded as the scope of protection of the present invention. All components not specified in this embodiment can be implemented by existing technologies.

Claims

1. A method for auditing encrypted data in federated learning based on dual blockchains, characterized in that The client gradient of federated learning is audited using a dual blockchain structure, where the behavior blockchain is responsible for recording transaction information and adding noise to the gradient ciphertext, and the audit blockchain is responsible for implementing the audit algorithm to verify the gradient set and homomorphically encrypt the client gradient data. The encryption is implemented using the improved distributed key generation SM9 algorithm with additive homomorphic encryption. The audit algorithm targets a gradient matrix and gradually narrows the audit scope to locate the threat gradient by the method of "first overall, then row by row and column by column, and finally single gradient"; the method includes: Step S1: The server distributes the global model to the audit blockchain and each client, and distributes the test data set to the audit blockchain; Step S2: The client obtains the local data gradient through training, performs homomorphic encryption using the improved national encryption SM9 algorithm, calls the smart contract to calculate the model loss on the test data set, and submits the gradient ciphertext and loss to the behavior blockchain; Step S3: The behavior blockchain adds noise to the gradient ciphertext and records the transaction information, and transfers the ciphertext and the loss to the audit blockchain; Step S4: Audit the blockchain aggregation gradient, audit the gradient combination and gradually narrow the scope to locate malicious data; Step S5: The server aggregates and audits the blockchain to update the global model; The method loops the above five steps until the global model converges and the training ends.

2. The method for auditing encrypted data using federated learning based on dual blockchains according to claim 1 is characterized in that: In step S2, the local gradient is homomorphically encrypted using the improved national encryption SM9 algorithm, and the steps include: Step S2.1: is a modulo N multiplication group, and the key generation center KGC generates it randomly As the encryption master private key, according to the Sharmir threshold secret sharing scheme, a t-1 degree polynomial f(x)∈Z is randomly constructed q [x]: f(x)=msk+a1x+a2x 2 +…+a t-1 x t-1 where msk=f(0),a1,a2,…,a t-1 ∈Z q , Z q represents the ring of integers modulo q; Step S2.2: Randomly select n elements x1, x2, ..., x n ∈Z q , n is the number of federation members, calculate msk i =f(x i ), and (x i ,msk i ) are distributed to the federation member clients respectively i (i=1,2,…,n); Step S2.3: t of the n members share their respective key fragments msk i To restore msk: Step S2.4: Let G1 and G2 be additive cyclic groups of prime order N, and P1 and P2 be their generators. Calculate the global master public key mpk based on the recovered global master private key msk: mpk=[msk]P1 Step S2.5, let the identifier of the decryption party, i.e. the audit blockchain, be id, hid be the identifier of the encryption private key generation function, and define the cryptographic hash function H1: KGC in finite field F N Calculation: t1=H1(id||hid,N)+msk t2=msk·t1 -1 Wherein, t1 and t2 represent the intermediate values ​​of the key generation calculation. If t1 is equal to 0, then re-execute steps S2.1 to S2.4 to re-obtain t1, otherwise calculate t2; The audit blockchain obtains the decryption private key sk based on t2 and generator P2 id : en id =[t2]P2 Step S2.6: Calculate the element Q in group G B =H1(id||hid,N)P1+mpk; Step S2.7: Generate random numbers Compute the element c1=[r]Q in the group G1 B ; Step S2.8, G T is a multiplicative cyclic group of prime order N, e is from G1×G2 to G T Bilinear pairings of , computing the group G T The element g=e(mpk,P2) in the equation is calculated as w=g r ;w represents an output of the bilinear pair e; Step S2.9, let the local gradient data to be encrypted be m, its bit length mlen be 32 bits, klen = mlen + 256, define the key generation function KDF: {0, 1} * ×klen→{0,1} klen , calculate K = KDF (c1 || w || id, klen); where klen represents the key length; Step S2.10, remove the first mlen bits of K, the remaining is K2, and then calculate c2 = g m ×w; Step S2.11: Define the message verification code function Calculate c3 = MAC (K2, c2); Step S2.12, obtain the gradient ciphertext c = (c1, c2, c3).

3. The method for auditing encrypted data based on federated learning using dual blockchains according to claim 1 is characterized in that: In step S3, the behavior blockchain adds noise to the gradient ciphertext, and the steps include: Step S3.1: A block of the behavior blockchain contains 9 gradient ciphertexts, which are mapped into a 3-order square matrix. Let the mapping gradient be denoted by C ij , the matrix row number is marked as i∈{1,2,3}, the matrix column number is marked as j∈{1.2.3}, and the matrix is ​​represented as C=(C ij ) 3×3 ,in: The corresponding loss is also mapped to L ij ; Step S3.2: For each mapping gradient C ij , the behavior blockchain generates a random value n similar to the size of the gradient ciphertext ij As noise, the behavior blockchain adjusts each n ij , ensure that the noise sum of each row and column is 0, that is, and Step S3.3: ij Homomorphic encryption Step S3.4, polymerization C ij With N ij get The gradient matrix with added noise is recorded as C′=(C i ' j ) 3×3 ; Step S3.5, the behavior blockchain records the transaction information in the block and compares the noise gradient matrix C′ with the mapping loss L ij Passed to the audit blockchain.

4. The method for auditing encrypted data based on federated learning using dual blockchains according to claim 1 is characterized in that: In step S4, the blockchain aggregation gradient is audited, the audit gradient combination is combined and the scope is gradually narrowed to locate malicious data. The main steps include: Step S4.1: Audit blockchain to calculate average loss Aggregate the gradient ciphertext with added noise. Since the improved SM9 national encryption algorithm is homomorphic, the noise is removed after aggregation: Step S4.2: Audit blockchain performs homomorphic decryption on the aggregated gradient ciphertext, using the decryption private key sk generated in step 2 id , computing group G T The element w′ in the id ),calculate Using BSGS algorithm from The calculation results in Step S4.3: Audit blockchain to calculate the mean of the global aggregate gradient: Step S4.4: Audit blockchain uses the decrypted gradient combination to update the model, evaluates the model on the public test dataset and calculates the loss, denoted as L global ; Step S4.5: L global As a benchmark, conduct a global audit and global With L avg For comparison, if |L global -L avg |<∈1,∈1>0, the entire set of gradients passes the audit. Otherwise, it indicates that the data quality between devices varies greatly. There may be dishonest devices that provide malicious gradients. The audit blockchain will audit gradients in units of rows and columns of the matrix. Step S4.6: After the global audit finds possible malicious gradients, the aggregated noise gradient matrix C′ in the rows and columns is homomorphically decrypted to obtain the aggregated gradients of each row. Aggregate gradient with each column Step S4.7: Use the test dataset to evaluate the aggregate gradients of each row and column and Get the corresponding loss and Step S4.8: Audit by matrix rows and matrix columns and Audit and L global and L ij If the deviation Then it is determined that there is a suspicious gradient of free riding in row i, recorded as a suspicious row, if Then it is determined that column j has a suspicious gradient of free riding, recorded as a suspicious column, if Then it is determined that there is a suspicious gradient of poisoning attack in row i, which is recorded as a suspicious row. Then it is determined that column j has a suspicious gradient of poisoning attack and is recorded as a suspicious column; Among them, ∈1, ∈2, and ∈3 all represent the allowable error range, which is set manually; Step S4.9: If the audited blockchain only finds an abnormal aggregate gradient in one row and one column, their public gradient is identified as a malicious gradient, and the device that provides the gradient is identified as a malicious device; Step S4.10: If the audit blockchain finds multiple suspicious rows and columns, it is considered that there are multiple malicious devices. The normal gradients of non-suspicious rows and columns are removed to obtain the suspicious gradient set C. d ' oubt ; Step S4.11: Requirement set C d ' oubt The customers who provide the suspicious gradients interact directly with the audit blockchain and i ' j Eliminate the noise and decrypt to get m ij ; Step S4.12: Update the model using a single gradient and evaluate the model loss L′ using the test dataset ij , L′ ij With L global and L ij Compare, if L′ ij -L ij >∈2,∈2>0, then the gradient m ij is a suspicious gradient with free-riding behavior, if L′ ij -L global >∈3,∈3>0, then the gradient m ij For a suspected gradient of poisoning attack, the client providing the gradient is identified as a malicious device; Step S4.13: If there is a malicious device, the malicious device is prohibited from participating in the training. If the matrix C′=(C i ' j ) 3×3 If the overall gradient passes the audit, the homomorphically encrypted aggregated gradient is delivered to the server for global model update.

5. A federated learning encrypted data audit system based on dual blockchains, characterized in that: The system is used to implement the dual-blockchain-based federated learning encrypted data audit method described in any one of claims 1 to 4, and the system includes a client module, a behavior blockchain module, an audit blockchain module and a server module; The client module uses the global model to train local data, obtains local data gradients, updates local models, uses the improved national encryption SM9 algorithm to homomorphically encrypt local gradients, calls smart contracts to calculate model losses on test data sets, and submits gradient ciphertexts and losses to the behavior blockchain; The behavior blockchain module collects the encrypted gradients of the client, adds noise to the gradients, records transaction information, and sends the gradient ciphertext with noise added and the loss to the audit blockchain; The audit blockchain module audits the blockchain to pass global model parameters to the client, aggregates local gradients sent from the behavior blockchain, eliminates noise, audits the gradient matrix, locates malicious gradients, and sends them to the server after the audit determines that the entire set of gradients is risk-free; The server module receives the audited homomorphically encrypted gradient group, uses the aggregated gradient group to update the global model, and distributes the updated model parameters and the test data set back to the audit blockchain; Repeat the server module, client module, behavior blockchain module, and audit blockchain module until the global model converges to obtain the final global model.

6. A mobile terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the dual-blockchain-based federated learning encrypted data auditing method is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by the processor, the steps in the dual-blockchain-based federated learning encrypted data auditing method are implemented.

Images