An anonymous authentication and secure aggregation method for medical data federated learning

Abstract

The application belongs to the technical field of privacy protection, and particularly relates to an anonymous authentication and secure aggregation method for medical data federated learning, which comprises the following steps: system initialization; federated learning participant U i registration and pseudo-identity generation; key generation; model training; random vector generation; signature authentication; session key generation; secure aggregation by an aggregation server Server; through the overall system of the application, unlinkability is achieved: the security and confidentiality of the privacy of the federated learning participant in the data processing process are greatly improved; privacy protection of gradient parameters: while improving data security, the privacy of the personal information of the federated learning participant is protected; system security is improved: the possibility of an attacker obtaining sensitive information and data is effectively reduced, and the ability of the system to resist attacks is enhanced.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of privacy protection, and particularly relates to an anonymous authentication and secure aggregation method for medical data federated learning. BACKGROUND

[0002] Machine learning is to generate a machine learning model by training data, and the generated model and some input data can be used to predict the corresponding results. Current machine learning has an increasing demand for high-quality data, and needs to aggregate data distributed in different devices and different institutions. The increasing amount of data and model complexity makes it difficult for a single node to support model training. Distributed machine learning can achieve perfect matching of training speed and training accuracy by dividing training data and allocating training tasks.

[0003] With the development of big data and artificial intelligence, large-scale data is usually generated by multiple participants and stored in a geographically distributed manner. A traditional and simple method of distributed machine learning is to first collect data and store it in a central server, and then process the data. The precondition of this method is that the central server is trustworthy. However, if a large amount of data is sent from multiple devices to the central server, it will generate huge communication overhead, and the data source and authenticity of the data are difficult to guarantee, and at the same time, data loss may occur due to single point failure. This will bring significant risks to machine learning effect and decision results. In the medical scenario, privacy and security have always been the focus. The protection of medical data is crucial for maintaining patient privacy and complying with laws and regulations. However, data sharing and information exchange in the medical scenario often require cooperation between medical institutions, patients and other related parties, and the transmission of parameters in federated learning in the medical scenario also needs to ensure security and credibility. Traditional authentication methods, such as username and password, digital certificate, etc., can ensure the authenticity of identity to a certain extent, but there are some challenges in the medical scenario. First, traditional identity authentication methods may require the provision of identity information, which may involve the risk of privacy leakage. Second, the security of medical data needs to be highly protected, and traditional authentication methods may be at risk of attack or theft. SUMMARY

[0004] To solve the above technical problems, the application provides an anonymous authentication and secure aggregation method for medical data federated learning, comprising the following steps:

[0005] Step one, system initialization;

[0006] According to the trusted agency TA, the system parameters and keys are initialized, a set of secure hash functions are randomly selected, and the master public key and the master private key are generated;

[0007] Step two, federated learning participant Ui Registration and pseudo-identity generation

[0008] According to the trusted authority TA, the federated learning participant U i Randomly select a temporary private key, generate a pseudo-identity temporary public key, and send it to the trusted authority TA, the trusted authority TA verifies the validity of the pseudo-identity, and generates complete pseudo-identity information;

[0009] Step three, key generation

[0010] According to the trusted authority TA and the aggregation server Server, the pseudo-identity information and the real identity information are respectively input into the trusted authority TA and the aggregation server Server to generate a long-term key;

[0011] Step four, model training

[0012] The aggregation server Server initializes the global model to obtain global model parameters, and distributes the global model parameters to all hospital federated learning participants U i ;

[0013] Step five, random vector generation

[0014] According to the pseudo-identity information, a random vector is generated, and the locally trained global model parameters are subjected to a masking operation;

[0015] Step six, signature authentication

[0016] According to the local gradient model, signature authentication is performed, and then the signature authentication information is sent to the aggregation server Server, the aggregation server Server verifies the validity of the signature, and authenticates the federated learning participant U i ;

[0017] Step seven, session key generation

[0018] The federated learning participant U i generates a session key through the aggregation server Server according to the pseudo-identity information, which is used for encryption and decryption of global model parameter transmission;

[0019] Step eight, the aggregation server Server performs secure aggregation

[0020] According to the aggregation server Server, the global model parameter update value uploaded by the hospital is securely aggregated to obtain the federated average model parameter, and the federated average model parameter is sent to each hospital federated learning participant U i .

[0021] Preferably, the system initialization specifically includes:

[0022] A trusted authority TA gives a finite cyclic additive group G with a generator P on an elliptic curve, the order is q, and a security parameter k is given;

[0023] Step 11, the trusted authority TA randomly selects s∈Z q * As the master private key, the master public key is P pub =sP, where: Z q * Indicates a finite field, that is, a set of integers from 0 to q-1.

[0024] Step 12, the trusted authority TA selects 7 secure hash functions, wherein the output results of H1 and H2 are the same length as the real identity RID of the participant:

[0025] H1: GxG→{0,1} |RID|

[0026] H2: GxGx{0,1}*xG→{0,1} |RID|

[0027] H3:{0,1} * xG→Z q *

[0028] H4:{0,1} * xGxG→Z q *

[0029] H5:{0,1} * x{0,1} * xGxGxGx{0,1} * x{0,1} * →Z q *

[0030] H6:{0,1} * x{0,1} * xGxGxGx{0,1} * →Z q *

[0031] H7:{0,1} * x{0,1} * xG→Z q *

[0032] Where: H1 represents the first hash function, H2 represents the second hash function, H3 represents the third hash function, H4 represents the fourth hash function, H5 represents the fifth hash function, H6 represents the sixth hash function, H7 represents the seventh hash function, |RID| represents the length of the participant's real identity RID, → represents mapping, {0,1} * This represents a string of arbitrary length composed of 0s and 1s.

[0033] Step 13: Trusted Organization (TA) publishes system parameters param = {q, P, G, P} pub ,H1,H2,H3,H4,H5,H6,H7}.

[0034] Preferably, the federated learning participant U i Registration and fake identity generation specifically include:

[0035] Federal Learning Participant U i Generate partial pseudo-identities and register them with trusted institutions (TAs) as participants in federated learning. i Generate fake identities.

[0036] Preferably, the federated learning participant U i Generating and registering partial pseudo-identities specifically includes:

[0037] Step 21, Federated Learning Participant U i Randomly select temporary private key x i ∈Z q * Calculate the temporary public key as X i =x i P;

[0038] Step 22, Federated Learning Participant U i Select random number y i ∈Z q * Calculate the temporary public key Y for the fake identity i =y i P;

[0039] Step 23, Federated Learning Participant U i Calculation using real identity RID i Calculate A i =RID i ⊕H1(y i P pub ,Y i ), and the federal learning participant U i Send (RID) i ,X i ,Y i A i (Give TA to a trusted institution)

[0040] wherein Z q * denotes a finite field, a set of integers from 0 to q-1, P denotes a generator given by the trusted authority TA on an elliptic curve, H1 denotes a first hash function, P pub denotes a master public key, A i denotes a RID i .

[0041] Preferably, the trusted authority TA is a federated learning participant U i generating a pseudo identity specifically comprises:

[0042] Step 24, the trusted authority TA calculates a RID i ’ = A i ⊕H1(sY i , Y i ), verifies whether the calculated RID i ’ is equal to the real identity RID i sent, if equal, continue, the real identity RID i is not tampered with, otherwise, the registration application is rejected;

[0043] Step 25, the trusted authority TA calculates a pseudo identity PID i of the federated learning participant U i = RID i ⊕H2(sY i , Y i , PIV i , P pub );

[0044] Step 26, the federated learning participant U i complete pseudo identity is CPID i = (PID i , PIV i ), wherein PIV i is a validity period of the pseudo identity of U i , after the validity period, the federated learning participant U i needs to re-register to generate a pseudo identity, the trusted authority TA sends the CPID i to the federated learning participant U i ;

[0045] Step 27, the trusted authority TA publishes a federated learning participant U i list L = {X i , PID i , PIV i};

[0046] wherein RID irepresents the real identity calculated by the trusted authority TA, A i represents the RID i , H1 represents the first hash function, H2 represents the second hash function, Y i represents the temporary public key, s represents the master private key, PIV i represents the U i validity period of the pseudo-identity, P pub represents the master public key, X i represents the temporary private key.

[0047] Preferably, the key generation specifically comprises:

[0048] Step 31, the trusted authority TA selects a random number r i ∈Z q * , calculates U i public key as R i =r i P, the trusted authority TA calculates B i =H3(PID i ,R i ), the trusted authority TA calculates C i =H4(PID i ,sX i ,R i ), the private key is s i =r i +B i s, the trusted authority TA sends (s i ,R i ,B i ,C i ) to the federated learning participant U i ;

[0049] Step 32, the aggregation server Server selects a random number x s ∈Z q * , calculates the temporary public key X s =x s P, sends X s to the trusted authority TA, the trusted authority TA selects a random number r s ∈Z q * , calculates the aggregation server Server public key as R s =r s P, the trusted authority TA calculates B s =H3(RID s ,R s ), the trusted authority TA calculates C s =H4(RID s ,sXs ,R s ), the private key is s s =r s +B s s, the trusted authority TA sends (s s ,R s ,B s ,C s ) to the aggregation server Server;

[0050] Step 33, the federal learning participant U i calculates C i '=H4(PID i ,x i P pub ,R i ), verifies whether the calculated C i ' is equal to the sent C i , if equal, receives the key, otherwise refuses to receive, the federal learning participant U i obtains the long-term key (s i ,R i ) under PID i ;

[0051] Step 34, the aggregation server Server calculates C s '=H4(RID s ,x s P pub ,R s ), verifies whether the calculated C s ' is equal to the sent C s , if equal, receives the key, otherwise refuses to receive, the aggregation server Server obtains the long-term key (s s ,R s );

[0052] Wherein, Z q * represents a finite field, a set of integers from 0 to q-1, P represents a generator on an elliptic curve given by the trusted authority TA, H3 represents a third hash function, PID i represents the pseudo identity of U i , H4 represents a fourth hash function, s represents the master private key, X i represents the temporary private key, P pub represents the master public key, B i represents a part of the private key of U i , C i represents the signature of the public key of U i , B s represents a part of the private key of the aggregation server Server, RID srepresents the real identity of the aggregation server Server, C i represents the public key signature calculated by Ui, C s represents the public key signature of the aggregation server Server, C s represents the public key signature calculated by the aggregation server Server.

[0053] Preferably, the model training specifically comprises: the aggregation server server selects users participating in federated learning and sets a sequence index id i , discloses a user list L2 = {X i , PID i , PIV i , id i} and distributes the model to all federated learning participants U i . U i uses local data to train with the model issued by the server to obtain w i ;

[0054] Wherein, X i represents a temporary private key, PID i represents the pseudo-identity of U i , PIV i represents the validity period of the pseudo-identity of U i .

[0055] Preferably, the random vector generation specifically comprises:

[0056] The federated learning participant U i obtains the participant list L2 = {X i , PID i , PIV i , id i}, verifies whether the validity period of the user pseudo-identity is expired, and for the valid user U j , calculates the pseudo-random number to generate the seed x i of the federated learning participant U i,j PRG: x i X j , and expands this value into a random vector: p i,j = Δ i,j · PRG(x i,j ), wherein Δ i,j = 1 when i > j; Δ i,j = -1 when i < j, U i updates the model W i , and adds the random vector to W i to obtain: W i = w i + ∑ i≠jp i,j ; wherein, when i>j, Δ i,j =1; when i<j, Δ i,j =-1, U i updates the model W i After that, W i is added with a random vector to obtain: W i =w i +∑ i≠j p i,j , and X i represents a temporary private key, PID i represents a pseudo identity of U i , PIV i represents a validity period of the pseudo identity of U i , and id i represents a sequence index.

[0057] Preferably, the signature authentication specifically includes:

[0058] Step 61, the federal learning participant U i performs signature authentication on the gradient:

[0059] The federal learning participant U i selects a random number e i ∈Z q * , E i =e i P, the federal learning participant U i selects a random number f i ∈Z q * , F i =f i P, the federal learning participant U i calculates k i =H5(RID s , PID i , R i , E i , F i , T i , W i ), u i =e i +k i s i , and signs as σ i =(k i , u i , R i ), the federal learning participant Ui sends (W i , k i , u i , R i , F i , Ti ,CPID i ) to the aggregation server Server;

[0060] Step 62, the aggregation server Server verifies:

[0061] The aggregation server Server checks whether the PIV i is expired, acquires the current time stamp T now , calculates the value of |T now -T i |, if |T now -T i | < At, accepts the signature, otherwise ends the authentication. The Server calculates B i ' = H3(PID i , R i ), the aggregation server Server calculates E i ' = u i P-k i (R i +B i 'P pub ), the aggregation server Server verifies whether h i = H5(RID s , PID i , R i , E i ', F i , T i , W i ) is true, if true, continue, if not true, reject the message;

[0062] Step 63, the aggregation server Server authenticates:

[0063] The aggregation server Server selects a random number e s ∈ Z q * , E s = e s P, the aggregation server Server selects a random number f s ∈ Z q * , F s = f s P, the aggregation server Server calculates k s = H6(RID s , PID i , R s , E s , F s , T s ), u s = e s +ks s s , the aggregation server Server sends (k s ,u s ,F s ,R s ,RID s ,T s ) to the federated learning participant U i ;

[0064] Step 64, the federated learning participant U i authenticates:

[0065] The federated learning participant U i obtains the current timestamp T now , calculates the value of |T now -T s |, if |T now -T s | < Δt, it continues, otherwise, the authentication is ended, and the federated learning participant U i calculates B s '= H3(RID s ,R s ), the federated learning participant U i calculates E s '= u s P-k s (R s +B s 'P pub ), the federated learning participant U i verifies whether h i = H6(RID s ,PID i ,R s ,E s ',F s ,T s ) is true, if true, it continues;

[0066] Wherein, Z q * represents a finite field, a set of integers from 0 to q-1, P represents a generator on an elliptic curve given by the trusted authority TA, H5 represents a fifth hash function, PID i represents the pseudo identity of U i , R i represents the public key of U i , CPID i represents the complete pseudo identity of the federated learning participant U i , H3 represents a third hash function, H6 represents a sixth hash function, k i represents a partial signature, RID s represents the real identity of the aggregation server Server, Ti denotes U i the current time, the timestamp; denotes the set time difference, B i the part W calculated by the 'Server i signature, E i denotes the part W calculated by the 'Server i signature, h i denotes U i the part W calculated by the 'Server i signature.

[0067] Preferably, the session key generation specifically comprises:

[0068] Step 71, the federated learning participant U i session key generation:

[0069] sk i,s = H7(RID s , PID i , f i F s );

[0070] Step 72, the session key generation of the aggregation server Server:

[0071] sk s,i = H7(RID s , PID i , fsF i );

[0072] Wherein, H7 denotes the seventh hash function, PID i denotes the pseudo-identity of U i f i and f s denote the random numbers selected by the federated learning participant U i F s and F i denote the random numbers selected by the aggregation server Server f s and the product of P.

[0073] Advantages of the present application:

[0074] The present application provides an anonymous authentication and secure aggregation method for medical data federated learning, which adopts an anonymous authentication method in the medical field to enhance the privacy security of federated learning secure aggregation, not only can effectively protect the privacy of patients and meet the regulatory compliance requirements, but also can promote medical data sharing and cooperation and improve the security of medical information. The present application introduces a pseudo-identity with a valid period to replace the real identity for authentication, which realizes the anonymization of the identity of the federated learning participant under the premise of ensuring security;

[0075] Compared with the prior art, the present application has the following advantages and positive effects:

[0076] 1. Achieving unlinkability: The present application uses pseudo-identity with a validity period to replace real identity for authentication, effectively preventing attackers from linking different authentication entities or behaviors through existing information, thereby achieving unlinkability. This improvement greatly improves the security and confidentiality of the privacy of federal learning participants in data processing.

[0077] 2. Privacy protection of gradient parameters: The present application uses random number masking technology to shield gradient parameters, effectively preventing attackers from inferring the sender of the parameters by analyzing the model parameters. In the case of not revealing the original gradient parameters, the privacy protection of the gradient parameters is achieved, which not only improves the security of the data, but also protects the privacy of the personal information of the federal learning participants.

[0078] 3. Improve system security: The improved scheme of the present application not only effectively protects the privacy of federal learning participants, but also improves the overall security of the system. By introducing pseudo-identity with a validity period and random number masking technology, the possibility of attackers obtaining sensitive information and data is effectively reduced, and the ability of the system to resist attacks is enhanced. BRIEF DESCRIPTION OF DRAWINGS

[0079] The accompanying drawings are provided for the basic principle diagram of the present application; Figure 1

[0080] The accompanying drawings are provided for the system model diagram of the present application; Figure 2 The accompanying drawings are provided for the flowchart of the present application.

[0081] Figure 3 DETAILED DESCRIPTION

[0082] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0083] ​​​Various embodiments of the present application can exist in a range of forms, and it should be understood that the description in the form of a range is merely for the convenience and brevity, and should not be understood as a rigid limitation on the scope of the present application; therefore, it should be considered that the range described has been specifically disclosed all possible sub-ranges and single values within the range. For example, it should be considered that the range description from 1 to 6 has been specifically disclosed sub-ranges, such as from 1 to 3, from 1 to 4, from 1 to 5, from 2 to 4, from 2 to 6, from 3 to 6, etc., and single numbers within the range, such as 1, 2, 3, 4, 5, and 6, regardless of the range. In addition, whenever a numerical range is indicated in the present application, it refers to any cited number (fraction or integer) within the indicated range. Unless otherwise specifically stated, various raw materials, reagents, instruments and equipment, etc. used in the present application can be purchased on the market or can be prepared by existing equipment.

[0084] In the present application, the orientation words such as "upper" and "lower" are specific to the drawing direction in the drawings, unless otherwise stated. In addition, in the present application, the terms "include", "contain" and the like mean "include but are not limited to". In the present application, relational terms such as "first" and "second" and the like are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. In the present application, "and / or" describes the association between the associated objects, which means that there can be three relationships, for example, A and / or B can represent the cases of A alone, A and B together, and B alone. Where A and B can be singular or plural. In the present application, "one or more" means one or more, and "a plurality" means two or more. "At least one", "at least one of the following", or the like, means any combination of the items, including any combination of single or multiple items. For example, "at least one of a, b, or c", or "at least one of a, b, and c", can represent a, b, c, a-b, i.e. a and b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple.

[0085] As shown in Figures 1-3 The embodiment of the present application provides an anonymous authentication and secure aggregation method for medical data federated learning, which comprises the following steps:

[0086] Step one, system initialization;

[0087] According to the trusted agency TA, the system parameters and the key are initialized, a set of safe hash functions are randomly selected, and the main public key and the main private key are generated;

[0088] Step two, federated learning participant U iRegistration and pseudo-identity generation

[0089] According to the trusted authority TA, the federated learning participant U i Randomly select a temporary private key, generate a pseudo-identity temporary public key, and send it to the trusted authority TA, the trusted authority TA verifies the validity of the pseudo-identity, and generates complete pseudo-identity information;

[0090] Step three, key generation;

[0091] According to the trusted authority TA and the aggregation server Server, the pseudo-identity information and the real identity information are respectively input into the trusted authority TA and the aggregation server Server to generate a long-term key;

[0092] Step four, model training;

[0093] The aggregation server Server initializes the global model to obtain the global model parameters, selects users participating in federated learning and sets the sequence index, discloses the user list and distributes the global model parameters to all hospital federated learning participants U i ;

[0094] Step five, random vector generation;

[0095] According to the pseudo-identity information, a random vector is generated, and the local trained global model parameters are subjected to a masking operation;

[0096] Step six, signature authentication;

[0097] According to the local gradient model, signature authentication is performed, and then the signature authentication information is sent to the aggregation server Server, the aggregation server Server verifies the validity of the signature, and the federated learning participant U i is authenticated;

[0098] Step seven, session key generation;

[0099] The federated learning participant U i generates a session key through the aggregation server Server according to the pseudo-identity information, which is used for encryption and decryption of global model parameter transmission;

[0100] Step eight, the aggregation server Server performs secure aggregation;

[0101] According to the aggregation server Server, the global model parameter update value uploaded by the hospital is securely aggregated to obtain the federated averaged model parameters, and the federated averaged model parameters are sent to each hospital federated learning participant U i .

[0102] Specifically: the aggregation server Server performs secure aggregation, calculates the federated average model update value W i The random vectors in the above formula can be offset by addition and subtraction operations, and then the session key sk s is used to send the updated global model W to each federated learning participant U i , and return the model training for the next round of training.

[0103] As shown in Figure 3 , the system initialization specifically includes:

[0104] The trusted authority TA gives a generator P on an elliptic curve, a finite cyclic additive group G with order q, and a security parameter k;

[0105] Step 11, the trusted authority TA randomly selects s∈Z q * As the master private key, the master public key is P pub =sP, where Z q * represents a finite field, that is, a set of integers from 0 to q-1.

[0106] Step 12, the trusted authority TA selects 7 secure hash functions, wherein the output results of H1 and H2 are the same length as the real identity RID of the participant:

[0107] H1: GxG→{0,1} |RID|

[0108] H2: GxGx{0,1}*xG→{0,1} |RID|

[0109] H3: {0,1} * xG→Z q *

[0110] H4: {0,1} * xGxG→Z q *

[0111] H5: {0,1} * x{0,1} * xGxGxGx{0,1} * x{0,1} * →Z q *

[0112] H6: {0,1} * x{0,1} * xGxGxGx{0,1} * →Z q*

[0113] H7: {0,1} * x {0,1} * x G→Z q *

[0114] Wherein: H1 represents a first hash function, H2 represents a second hash function, H3 represents a third hash function, H4 represents a fourth hash function, H5 represents a fifth hash function, H6 represents a sixth hash function, H7 represents a seventh hash function, |RID| represents the length of the real identity RID of the participant, → represents mapping, {0,1} * Represents a string of any length composed of 0 and 1.

[0115] Step 13, the trusted authority TA publishes system parameters param = {q, P, G, P pub , H1, H2, H3, H4, H5, H6, H7}.

[0116] As shown in Figure 2 and Figure 3 : the federated learning participant U i registers and generates a pseudo-identity, which specifically includes:

[0117] The federated learning participant U i generates part of the pseudo-identity and registers with the trusted authority TA as the federated learning participant U i generates a pseudo-identity.

[0118] As shown in Figure 3 : the federated learning participant U i generates part of the pseudo-identity and registers, which specifically includes:

[0119] Step 21, the federated learning participant U i randomly selects a temporary private key x i ∈Z q * , and calculates the temporary public key as X i =x i P;

[0120] Step 22, the federated learning participant U i selects a random number y i ∈Z q * , and calculates the temporary public key Y i =y i P of the pseudo-identity.

[0121] Step 23, the federated learning participant U i calculates using the real identity RID i calculates Ai =RID i ⊕H1(y i P pub ,Y i ), and the federal learning participant U i Send (RID) i ,X i ,Y i A i Give the TA to a trusted institution;

[0122] Among them, Z q * Let P represent a finite field, the set of integers from 0 to q-1, P represent the generator on the given elliptic curve of the trusted institution TA, and H1 represent the first hash function. pub Represents the master public key, A i RID i The signature.

[0123] like Figure 3 As shown: The trusted institution TA generates pseudo-identities for the federated learning participant Ui, specifically including:

[0124] Step 24: Trusted Organization (TA) calculates RID. i '=A i ⊕H1(sY i ,Y i Verify the calculated RID i Is it equal to the real identity RID sent? i If they are equal, continue; real identity RID i The application must not have been tampered with; otherwise, the registration application will be rejected.

[0125] Step 25: Trusted Institution (TA) calculates the federated learning participant U. i False identity PID i =RID i ⊕H2(sY i ,Y i ,PIV i ,P pub );

[0126] Step 26, Federated Learning Participant U i The complete pseudo-identity is CPID i =(PID i ,PIV i ), where PIV i It's U i The validity period of the false identity, after which the federated learning participant U... i A new pseudo-identity needs to be generated through registration. The trusted organization (TA) sends the CPID. i For federal learning participants Ui ;

[0127] Step 27, the trusted authority TA publishes the federated learning participant U i List L = {X i , PID i , PIV i};

[0128] Wherein, RIDi' represents the real identity calculated by the trusted authority TA, Ai represents the signature of RIDi, H1 represents the first hash function, H2 represents the second hash function, Yi represents the temporary public key, s represents the master private key, PIVI represents the validity period of the pseudo identity of Ui, Ppub represents the master public key, and Xi represents the temporary private key.

[0129] As Figure 3 shown: the key generation specifically includes:

[0130] Step 31, the trusted authority TA selects a random number r i ∈Z q * , calculates the U i public key as R i =r i P, the trusted authority TA calculates B i =H3(PID i ,R i ), the trusted authority TA calculates C i =H4(PID i ,sX i ,R i ), the private key is s i =r i +B i s, and the trusted authority TA sends (s i ,R i ,B i ,C i ) to the federated learning participant U i ;

[0131] Step 32, the aggregation server Server selects a random number x s ∈Z q * , calculates the temporary public key X s =x s P, and sends X s to the trusted authority TA, the trusted authority TA selects a random number r s ∈Z q * , calculates the aggregation server Server public key as R s =r s P, the trusted authority TA calculates B s=H3(RID) s ,R s Trusted organization TA calculates C s =H4(RID) s ,sX s ,R s The private key is s s =r s +B s s, Trusted Institution TA sends (s) s ,R s B s C s (To the aggregation server Server)

[0132] Step 33, Federated Learning Participant U i Calculate C i =H4(PID) i ,x i P pub ,R i Verify the calculated C i Is it equal to the C sent? i If they are equal, the key is accepted; otherwise, it is rejected. This applies to the federated learning participant U. i Get PID i Long-term key (s) i ,R i );

[0133] Step 34: Aggregator Server calculates C s =H4(RID) s ,x s P pub ,R s Verify the calculated C s Is it equal to the C sent? s If they are equal, the key is accepted; otherwise, it is rejected, and the aggregation server (Server) obtains the long-term key (s). s ,R s );

[0134] Among them, Z q * Let P represent a finite field, the set of integers from 0 to q-1, P represent the generator on the given elliptic curve of the trusted institution TA, H3 represent the third hash function, and PID represent the third hash function. i U i The pseudo-identity, H4 represents the fourth hash function, s represents the master private key, X i P represents a temporary private key. pub B represents the master public key. i U i Part of the private key, C i Ui Signature of public key, B s Indicates a part of the private key of the aggregation server Server, RID s Indicates the real identity of the aggregation server Server, C i Indicates the public key signature calculated by Ui, C s Indicates the public key signature of the aggregation server Server, C s Indicates the public key signature calculated by the aggregation server Server.

[0135] The model training specifically includes: the aggregation server server selects users participating in federated learning and sets a sequence index id i , discloses a user list L2 = {X i , PID i , PIV i , id i} and distributes the model to all federated learning participants U i . U i uses local data to train with the model issued by the server to obtain w i ;

[0136] Wherein, Xi represents a temporary private key, PIDi represents the pseudo-identity of Ui, and PIVi represents the validity period of the pseudo-identity of Ui.

[0137] As Figure 3 shown: the random vector generation specifically includes:

[0138] The federated learning participant U i obtains the participant list L2 = {X i , PID i , PIV i , id i}, verifies whether the validity period of the pseudo-identity of the user is expired, and for the valid user U j , calculates the pseudo-random number to generate the seed x i of the federated learning participant PRG of the device U i,j , x i = x j X i,j , and expands this value into a random vector: p i,j = Δ i,j · PRG(x i,j ).

[0139] Specifically: wherein, when i > j, Δ i,j = 1; when i < j, Δ i = -1, U i updates the model w iAdd a random vector to get: W i = w i +∑ i≠j p i,j ,

[0140] and Xi represents a temporary private key, PIDi represents the pseudo identity of Ui, PIVi represents the validity period of the pseudo identity of Ui, and idi represents the sequence index.

[0141] As Figure 3 shown: the signature authentication specifically includes:

[0142] Step 61, the federal learning participant U i signs and authenticates the gradient:

[0143] The federal learning participant U i selects a random number e i ∈Z q * , E i = e i P, the federal learning participant U i selects a random number f i ∈Z q * , F i = f i P, the federal learning participant U i calculates k i = H5(RID s , PID i , R i , E i , F i , T i , W i ), u i = e i +k i s i , and signs σ i = (k i , u i , R i ), the federal learning participant U i sends (W i , k i , u i , R i , F i , T i , CPID i ) to the aggregation server Server;

[0144] Step 62, the aggregation server Server verifies:

[0145] The aggregation server Server checks PIVi whether expired, get current timestamp T now , compute |T now -T i |, if |T now -T i | < At then accept signature, otherwise end authentication. Server computes B i ' = H3(PID i , R i ), aggregate server Server computes E i ' = u i P - k i (R i + B i 'P pub ), aggregate server Server verifies h i = H5(RID s , PID i , R i , E i ', F i , T i , W i ) holds, if yes then continue, if no then reject the message;

[0146] Step 63, aggregate server Server authenticates:

[0147] aggregate server Server selects random number e s ∈ Z q * , E s = e s P, aggregate server Server selects random number f s ∈ Z q * , F s = f s P, aggregate server Server computes k s = H6(RID s , PID i , R s , E s , F s , T s ), u s = e s + k s s s , aggregate server Server sends (k s , u s , F s , R s , RID s , T s) to the federated learning participant U i ;

[0148] Step 64, the federated learning participant U i authentication:

[0149] the federated learning participant U i acquires a current timestamp T now , calculates the value of |T now -T s |, if |T now -T s | < Δt, continues, otherwise ends the authentication, and the federated learning participant U i calculates B s '= H3(RID s , R s ), the federated learning participant U i calculates E s '= u s P-k s (R s +B s 'P pub ), the federated learning participant U i verifies whether h i = H6(RID s , PID i , R s , E s ', F s , T s ) is true, if true, continues;

[0150] wherein Z q * represents a finite field, a set of integers from 0 to q-1, P represents a generator on an elliptic curve given by the trusted authority TA, H5 represents a fifth hash function, PID i represents a pseudo identity of the U i , R i represents a public key of the U i , CPID i represents a complete pseudo identity of the federated learning participant U i , H3 represents a third hash function, H6 represents a sixth hash function, k i represents a partial signature, RID s represents a real identity of the aggregation server Server, T i represents a current time calculated by the U i , a timestamp; Δt represents a set time difference, B i 'represents a partial W i signature calculated by the Server, E i 'represents a partial Wi the signature of h i represents U i the calculated part W i the signature of.

[0151] As Figure 3 shown: the session key generation specifically comprises:

[0152] Step 71, the federated learning participant U i generates a session key:

[0153] sk i,s = H7(RID s , PID i , f i F s );

[0154] Step 72, the aggregation server Server generates a session key:

[0155] sk s,i = H7(RID s , PID i , f s F i );

[0156] Wherein, H7 represents a seventh hash function, PID i represents the pseudo identity of U i , f i and f s represent the random numbers selected by the federated learning participant U i , and F s and F i represent the products of the random numbers f s selected by the aggregation server Server and P.

[0157] The above is only a specific embodiment of the present application, enabling those skilled in the art to understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined in the present application can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to these embodiments shown in the present application, but will conform to the widest scope consistent with the principles and novel features invented by the present application.

Claims

1. An anonymous authentication and secure aggregation method for medical data federated learning, characterized in that, Comprise the following steps: Step one, system initialization; According to the trusted agency TA initializes the system parameter and key, and selects a group of safe hash function randomly, and generates the main public key and main private key; Step two, federated learning participant U i Registration and pseudo-identity generation; According to the trusted authority TA, the federal learning participant U i A temporary private key is randomly selected, a pseudo-identity temporary public key is generated, and it is sent to the trusted authority TA. The trusted authority TA verifies the validity of the pseudo-identity and generates complete pseudo-identity information; Step three, key generation; According to the trusted agency TA and the aggregation server Server, the pseudo identity information and the real identity information are respectively input into the trusted agency TA and the aggregation server Server to generate the long-term key; Step four, model training; The aggregation server Server initializes the global model to obtain global model parameters, and distributes the global model parameters to all hospital federated learning participants U i ; Step five, random vector generation; According to the own pseudo identity information, the random vector is generated, and the local trained global model parameter is masked; Step six, signature authentication; According to the local gradient model, signature authentication is performed, and then signature authentication information is sent to the aggregation server Server, the aggregation server Server verifies the validity of the signature, and the federated learning participant U i authentication is performed; Step seven, session key generation; Federated learning participant U i A session key is generated by the aggregation server Server according to the pseudo-identity information, for encryption and decryption of global model parameter transmission; Step eight, the aggregation server Server carries out security aggregation; According to the aggregation server Server, the global model parameter update value uploaded by the hospital is securely aggregated to obtain federated average model parameters, and the federated average model parameters are sent to each hospital federated learning participant U using a session key i .

2. The anonymous authentication and secure aggregation method for medical data federated learning according to claim 1, characterized in that, The system initialization specifically comprises: The trusted agency TA gives the generating element P on the elliptic curve finite cyclic additive group G, the order is q, and the safe parameter k is given; Step 11, the trusted authority TA randomly selects s e Z q * As the master private key, the master public key is P pub = sP, where: Z q * denotes a finite field, i.e. the set of integers from 0 to q-1; Step 12, the trusted agency TA selects 7 safe hash functions, wherein the output results of H1 and H2 are same with the length of the real identity RID of the participant: H1: G x G -> {0,1} |RID| H2: G x G x {0,1} * x G -> {0,1} |RID| H3: {0, 1} * x G -> Z q * H4: {0, 1} * x G x G -> Z q * H5: {0,1} * x {0,1} * x G x G x G x {0,1} * x {0,1} * → Z q * H6: {0, 1} * x {0, 1} * x G x G x G x {0, 1} * → Z q * H7: {0, 1} * x {0, 1} * x G -> Z q * wherein: H1 represents a first hash function, H2 represents a second hash function, H3 represents a third hash function, H4 represents a fourth hash function, H5 represents a fifth hash function, H6 represents a sixth hash function, H7 represents a seventh hash function, denotes the length of the real identity RID of the participant, denotes a mapping, {0,1} * denotes a string of arbitrary length composed of 0, 1; Step 13, Trusted Authority TA issues system parameters param={q, P, G, P pub H1, H2, H3, H4, H5, H6, H7}.

3. The anonymous authentication and secure aggregation method for medical data federated learning according to claim 2, characterized in that, The federated learning participant U i The registration and pseudo-identity generation specifically includes: federated learning participant U i generating a partial pseudo-identity and registering and a trusted authority TA as a federated learning participant U i generating a pseudo-identity.

4. The anonymous authentication and secure aggregation method for medical data federated learning according to claim 3, characterized in that, The federated learning participant U i Generating a partial pseudonym and registering specifically comprises: Step 21, federated learning participant U i Randomly select a temporary private key x i ∈ Z q * Calculate the temporary public key as X i = x i P; Step 22, federated learning participant U i Select a random number y i ∈ Z q * Calculate the temporary public key Y of the pseudo-identity i =y i P; Step 23, federated learning participant U i Using real identity RID i Compute A i = RID i ⊕ H1(y i P pub , Y i ), and the federated learning participant U i sends (RID i , X i , Y i , A i ) to the trusted authority TA; wherein Z q * denotes a finite field, a set of integers from 0 to q-1, P denotes a generator on a given elliptic curve by a trusted authority TA, H1 denotes a first hash function, P pub denotes a master public key, A i denotes a RID i signature of the RID.

5. The anonymous authentication and secure aggregation method for medical data federated learning according to claim 4, characterized in that, The trusted authority TA is a federated learning participant U i Generating the pseudo-identity specifically includes: Step 24, the trusted agency TA calculates RID i ’ = A i ⊕H1(sY i ,Y i ), verifies whether the calculated RID i ’ is equal to the real identity RID i sent, if equal, continue, the real identity RID i is not tampered, otherwise, reject the registration application; Step 25, the trusted authority TA calculates the pseudo identity PID of the federated learning participant U i i = RID i ⊕ H2(sY i , Y i , PIV i , P pub )​ Step 26, the federal learning participant U i The complete pseudo-identity is CPID i =(PID i ,PIV i ), PIV i is the validity period of the pseudo-identity of U i , after the validity period, the federal learning participant U i needs to re-register to generate a pseudo-identity, and the trusted authority TA sends CPID i to the federal learning participant U i ; Step 27, the trusted authority TA publishes the federated learning participant U i List L = {X i , PID i , PIV i}; wherein RID i represents a real identity calculated by the trusted authority TA, A i represents a signature of the RID i , H1 represents a first hash function, H2 represents a second hash function, Y i represents a temporary public key of the pseudo identity, s represents a master private key, PIV i represents U i a validity period of the pseudo identity, P pub represents a master public key, X i represents a temporary public key.

6. The anonymous authentication and secure aggregation method for medical data federated learning according to claim 5, characterized in that, The key generation specifically comprises: Step 31, the trusted authority TA selects a random number r i ∈Z q * , calculates U i =H1(r i ) The public key is R i =r i P The trusted authority TA calculates B i =H3(PID i ,R i ) The trusted authority TA calculates C i =H4(PID i ,sX i ,R i ) The private key is s i =r i +B i s The trusted authority TA sends (s i ,R i ,B i ,C i ) to the federated learning participant U Step 32, the aggregation server Server selects a random number x s ∈Z q * , calculates a temporary public key X s =x s P, sends X s to the trusted authority TA, the trusted authority TA selects a random number r s ∈Z q * , calculates the aggregation server Server public key as R s =r s P, the trusted authority TA calculates B s =H3(RID s ,R s ), the trusted authority TA calculates C s =H4(RID s ,sX s ,R s ), the private key is s s =r s +B s s, the trusted authority TA sends (s s ,R s ,B s ,C s ) to the aggregation server Server; Step 33, Federated Learning Participant U i Calculate C i =H4(PID) i ,x i P pub ,R i Verify the calculated C i Is it equal to the C sent? i If they are equal, the key is accepted; otherwise, it is rejected. This applies to the federated learning participant U. i Get PID i Long-term key (s) i ,R i ); Step 34, the aggregation server Server computes C s ’ = H4(RID s , x s P pub , R s ), verifies that the computed C s ’ is equal to the sent C s If so, the reception key is received, otherwise the reception is refused, the aggregation server Server obtains the long-term key (s s , R s ); wherein Z q * denotes a finite field, a set of integers from 0 to q-1, P denotes a generator on a given elliptic curve by a trusted authority TA, H3 denotes a third hash function, PID i denotes a pseudo identity of U i , H4 denotes a fourth hash function, s denotes a master private key, X i denotes a temporary public key, P pub denotes a master public key, B i denotes a part of a private key of U i , C i denotes a signature of a public key of U i , B s denotes a part of a private key of an aggregation server Server, RID s denotes a real identity of the aggregation server Server, C i ’ denotes a public key signature calculated by Ui, C s denotes a public key signature of the aggregation server Server, C s ’ denotes a public key signature calculated by the aggregation server Server.

7. The anonymous authentication and secure aggregation method for medical data federated learning according to claim 6, characterized in that, The model training specifically comprises: The aggregation server server selects users participating in federated learning and sets a sequence index id i , discloses a user list L2={Xi, PIDi, PIVi, id i} and distributes the model to all federated learning participants U i ; the global model parameters are all set to zero; U i In local use local data and server issued model training to get model parameters w i ; wherein X i represents a temporary public key, PID i represents a pseudo identity of U i , PIV i represents a validity period of the pseudo identity of U i .

8. The anonymous authentication and secure aggregation method for medical data federated learning according to claim 7, characterized in that, The random vector generation specifically comprises: Federal learning participant U i Obtain participant list L2={X i ,PID i ,PIV i ,id i}, verify whether the validity period of the user pseudo identity expires, for the valid user U j Calculate the seed x i of the pseudo random number generation PRG of the federal learning participant U i , j =x i X j , expand this value into a random vector: , wherein, when , ; when , , after updating the model W i of U i , add the random vector to W i to obtain: , and X i represents a temporary public key, PID i represents the pseudo identity of U i , PIV i represents the validity period of the pseudo identity of U i , and id i represents a sequence index.

9. The anonymous authentication and secure aggregation method for medical data federated learning according to claim 8, characterized in that, The signature authentication specifically comprises: Step 61, federated learning participant U i Sign authentication on the gradient: Federal learning participant U i Select random number e i ∈Z q * , U i Calculate the parameters required for signature E i =e i P, federal learning participant U i Select random number f i ∈Z q * , U i Calculate the temporary public key F i =f i P, federal learning participant U i Calculate the parameters required for signature k i =H5(RID s ,PID i ,R i ,E i ,F i ,T i ,W i ) and u i =e i +k i s i , signature σ i =(k i ,u i ,R i ), federal learning participant U i Send (W i ,k i ,u i ,R i ,F i ,T i ,CPID i ) to the aggregation server Server; Step 62, the aggregation server Server verifies: The aggregation server Server checks PIV i whether expired, get current timestamp T now , calculate the value of |T now -T i |, if |T now -T i | < Δt, accept the signature, otherwise end the authentication, Server calculates B i '= H3(RID i , R i ), the aggregation server Server calculates E i '= u i P-k i (R i +B i 'P pub ), the aggregation server Server verifies whether h i = H5(RID s , PID i , R i , E i ', F i , T i , W i ) is true, if true, continue, if not, reject the message; Step 63, the aggregation server Server authentication: The aggregation server selects a random number e. s ∈Z q * The required parameter E for server-side authentication calculation in the aggregation server. s =e s P, the aggregation server selects a random number f. s ∈Z q * The aggregation server calculates the temporary public key F. s =f s P, the parameter k required for authentication calculation by the aggregation server. s =H6(RID s ,PID i ,R s E s ,F s ,T s ) and u s =e s +k s s s The aggregation server (K) sends (k) s ,u s ,F s ,R s RID s ,T s ) to federal learning participants U i Among them, T s Represents the current timestamp of the aggregation server; Step 64, federated learning participant U i Authentication: Federal Learning Participant U i Get the current timestamp T now Calculate |T now -T s The value of | if |T now -T s If |<Δt, continue; otherwise, end the authentication process. (Federated learning participant U) i Calculate the parameter B required for certification s =H3(RID) s , R s ), Federal Learning Participant U i Calculate the parameter E required for certification s '=u s Pk s (R s +B s 'P pub ), Federal Learning Participant U i Verify h i =H6(RID s ,PID i ,R s E s ',F s ,T s If the condition is met, proceed. wherein Z q * denotes a finite field, a set of integers from 0 to q-1, P denotes a generator on a given elliptic curve by the trusted authority TA, H5 denotes a fifth hash function, PID i denotes a pseudo-identity of U i , R i denotes a public key of U i , CPID i denotes a real identity of a federated learning participant U i , H3 denotes a third hash function, H6 denotes a sixth hash function, k i denotes a partial signature of U s , RID i denotes a real identity of an aggregation server Server i , T i denotes a current timestamp calculated by U i , Δt denotes a set time difference, B i denotes a partial W i signature calculated by Server i , h i denotes a partial W i signature calculated by U 10. The anonymous authentication and secure aggregation method for medical data federated learning according to claim 9, characterized in that, The session key generation specifically comprises: Step 71, federated learning participant U i Session key generation: sk i,s =H7(RID s ,PID i ,f i F s ); Step 72, the aggregation server Server session key generation: sk s,i =H7(RID s ,PID i ,f s F i ); wherein H7 represents a seventh hash function, PID i represents a pseudo identity of U i .

Images